Hacking 5.4.0/5.5.0 MP4 Exploit

[Mathew_Wi]

Since it was patched, there's no point in keeping this anymore. R.I.P StageFright.

- Info -
With this you can build (and in theory, run) homebrew for Wii U version 5.4.0 and 5.5.0. It is incredibly bad, and likely won't run any code for you whatsoever. Sounds good right? Yeah? Right on!

- For Developers -
We have been incredibly lazy about fixing this. However, I have a hint for you. Use the code spray code from previous HTML exploits, and embed the MP4 exploit to run code that way.

In template540 and template550, at offset 0x79 to 0x7C contains the value that is in r30 when it crashes, which is an address to a point in the ROP buffer. Essentially leave the rest of the MP4 file unchanged if you plan on doing it via HTML/JS. If you want to use another ROP gadget, then the address that is spammed at the end of the file is the gadget that we initially jump to.

- Download -
http://puu.sh/mt6LQ/45a4ab7ae8.zip (Only builds 5.5.0 payloads, edit generate_mp4.py to generate 5.4.0 payloads.)

- Credits -
zhuowei - Pointing out the bug to Marionumber1 and I.
Marionumber1 - All the fantastic ROP chain work. Plus all around masterful work. Wouldn't have been possible without him.
Mathew_Wi - Shitty initial exploitation/debugging/5.5.0 ROP Gadgets
MrRean - Helping in a way I can't quite remember.
NWPlayer123 - Something!
Hykem - I think he did something too, I can't remember, sue me.
Original Crew - comex, Relys, TheKit, and of course Mr. Chadderz himself.

- Special Thanks -
NWPlayer123 for convincing Marionumber1 to allow me to participate in the group. <3

If I forgot you, feel free to verbally abuse me on IRC or Skype.

 

[WiiFoundLove]

YAY! Thanx!

 

[JohnathanMonkey]

Since it was patched, there's no point in keeping this anymore. R.I.P StageFright.

- Info -
With this you can build (and in theory, run) homebrew for Wii U version 5.4.0 and 5.5.0. It is incredibly bad, and likely won't run any code for you whatsoever. Sounds good right? Yeah? Right on!

- For Developers -
We have been incredibly lazy about fixing this. However, I have a hint for you. Use the code spray code from previous HTML exploits, and embed the MP4 exploit to run code that way.

In template540 and template550, at offset 0x79 to 0x7C contains the value that is in r30 when it crashes, which is an address to a point in the ROP buffer. Essentially leave the rest of the MP4 file unchanged if you plan on doing it via HTML/JS. If you want to use another ROP gadget, then the address that is spammed at the end of the file is the gadget that we initially jump to.

- Download -
http://puu.sh/mt27J/b994df006e.zip

- Credits -
zhuowei - Pointing out the bug to Marionumber1 and I.
Marionumber1 - All the fantastic ROP chain work. Plus all around masterful work. Wouldn't have been possible without him.
Mathew_Wi - Shitty initial exploitation/debugging/5.5.0 ROP Gadgets
MrRean - Helping in a way I can't quite remember.
NWPlayer123 - Something!
Hykem - I think he did something too, I can't remember, sue me.
Original Crew - comex, Relys, TheKit, and of course Mr. Chadderz himself.

- Special Thanks -
NWPlayer123 for convincing Marionumber1 to allow me to participate in the group. <3

If I forgot you, feel free to verbally abuse me on IRC or Skype.

lol.jk nice touch

 

[OriginalHamster]

Hykem exploit will make it compatible with 5.5.1, kappa.

 

[Chuardo]

Someone update http://rhcafe.us.to/ then. (idk who does that)

 

[Droyd]

So will 5.5.0 users be able to install homebrew channel without using any game for the exploit to run ?

 

[soniczx123]

What power does the End-User have with this?

 

[AboodXD]

MrRean - Helping in a way I can't quite remember.
NWPlayer123 - Something!
Hykem - I think he did something too, I can't remember, sue me.

[emoji23] [emoji23] [emoji23] [emoji23]

 

[kingraa777]

So what can I do with this ?

 

[shaneod]

So will 5.5.0 users be able to install homebrew channel without using any game for the exploit to run ?

5.5.0 users can't do much with this alone. 5.4.0 users will be able to do the same as 5.3.2 users basically, but 5.5.0 users won't be able to until an IOSU or kernel exploit is released

 

[KiiWii]

This is a great release of information, thank you and all involved.

 

[NexoCube]

it'a fake

 

[JohnathanMonkey]

Could loadiine 5 come of this? Sorry if it's a stupid question and feel free to bash away! I'm a big boy and can handle it

 

[Droyd]

5.5.0 users can't do much with this alone. 5.4.0 users will be able to do the same as 5.3.2 users basically, but 5.5.0 users won't be able to until an IOSU or kernel exploit is released

Aww, I was hoping to get a homebrew channel since I can't get the games needed for triggeing the exploit, but great reveal for 5.4 users, enjoy.

 

[Mathew_Wi]

What power does the End-User have with this?

You could try it. However, chances are you won't be running code until someone else decides to fix it.

 

[oumoumad]

So you guys all abondoned this project and no one of you is planning to fix it ?

 

[MrKeplerton]

You could try it. However, chances are you won't be running code until someone else decides to fix it.

but hey, it's someting

 

[NexoCube]

Oh my god. If w fix it, we can launch kexploit from a mp4 file

 

[Mathew_Wi]

I forgot to replace build.py, I updated the download in the original post.

 

[NexoCube]

It didn't contain support for 5.5.0 ... If i compile it with the 5.4.0 format will it work in 550 ?