Homebrew Official 5.5.X ELF Loader

[NexoCube]

fuck off xD I'll start my KeyBoard Messaging

 

[NexoCube]

Oh my god, it works ! Keyborad-U with socket support. I'll now add a Wii U to Wii U support (But naturelly you need to port forward)

 

[Deleted User]

I just dumped 40MB worth of memory from my 5.5 Wii U, starting at address 0x10000000. The only problem is what should I do with it? Oh, I wish the devs would drop some hints.

 

[NexoCube]

I just dumped 40MB worth of memory from my 5.5 Wii U, starting at address 0x10000000. The only problem is what should I do with it? Oh, I wish the devs would drop some hints.

If it's a bin, just open it with HxD then if you understand a little bit hexa things you should know what to do.

 

[Deleted User]

If it's a bin, just open it with HxD then if you understand a little bit hexa things you should know what to do.

Well, I did open it, and I found a couple of things inside, but what I meant to say was how should I use that data for hacking purposes. x/

 

[NexoCube]

Well, I did open it, and I found a couple of things inside, but what I meant to say was how should I use that data for hacking purposes. x/

I don't know but what i'm doing is cool.

 

[Deleted User]

I don't know but what i'm doing is cool.

I'd be interested to see it sometime.

In other news, I have experimented with some other functions in RPC!

Listening...
Connected by  ('192.168.1.85', 3863)
>>> rpc.read32(0x10000000, 8)
[1000, 1211384096, 1936224117, 1818501230, 1869881442, 1696621420, 1700885093, 1679843941]
>>> rpc.read32(0x20000000, 16)
[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
>>> symbol('coreinit.rpl', 'OSGetThreadName')
OSGetThreadName 17050404

It all looks interesting! I wonder if I could integrate this stuff into code?

 

[NexoCube]

I'd be interested to see it sometime.

In other news, I have experimented with some other functions in RPC!

Listening...
Connected by  ('192.168.1.85', 3863)
>>> rpc.read32(0x10000000, 8)
[1000, 1211384096, 1936224117, 1818501230, 1869881442, 1696621420, 1700885093, 1679843941]
>>> rpc.read32(0x20000000, 16)
[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
>>> symbol('coreinit.rpl', 'OSGetThreadName')
OSGetThreadName 17050404

It all looks interesting! I wonder if I could integrate this stuff into code?

Yes you can ! Just add it like that :

int (*OSGetThreadName)(void *thread);       
OSDynLoad_FindExport(coreinit_handle, 0, "OSGetThreadName", &OSGetThreadName);

char name[128] = OSGetThreadName(thread);

OSFatal(name);

// Use char because if it return an int it should work

 

[Deleted User]

Yes you can ! Just add it like that :

int (*OSGetThreadName)(void *thread);      
OSDynLoad_FindExport(coreinit_handle, 0, "OSGetThreadName", &OSGetThreadName);

char name[128] = OSGetThreadName(thread);

OSFatal(name);

// Use char because if it return an int it should work

Heh, that's not what I meant, but okay. xD

 

[NexoCube]

PS: Try with 0xA0000000

It's the virtuall adress that is mapped as RW (virtual 0xA0000000 to phys 0x10000000) to Physical with the exploit

--------------------- MERGED ---------------------------

Heh, that's not what I meant, but okay. xD

What were you meaning x) ?

 

[Deleted User]

Try with 0xA0000000

Try what with 0xA0000000?

 

[NexoCube]

Try what with 0xA0000000?

mem_dump or read32

--------------------- MERGED ---------------------------

0xF5FFFFEC = coreinit (maybe you'll find something cool idk)

 

[Deleted User]

0xF5FFFFEC = coreinit (maybe you'll find something cool idk)

WAIT how the hell did you find that? Can you take me through the steps??? *puppy eyes*

 

[NexoCube]

WAIT how the hell did you find that? Can you take me through the steps??? *puppy eyes*

Core Init, it's written in coreinit.rpl (You can look through it with IDA Pro + RPL/RPX Loader plugins)
0xA0000000 - Homebrew use it to find if she is mapped (Mapped: KExploit has been performed) (Not-Mapped : Return 0 because it's not mapped so no k-exploit)

 

[Deleted User]

Core Init, it's written in coreinit.rpl (You can look through it with IDA Pro + RPL/RPX Loader plugins)
0xA0000000 - Homebrew use it to find if she is mapped (Mapped: KExploit has been performed) (Not-Mapped : Return 0 because it's not mapped so no k-exploit)

I'm still lost. x(
Can you tell me a bit more about IDA Pro and the RPL/RPX Loader Plugins?

 

[NexoCube]

I'm still lost. x(
Can you tell me a bit more about IDA Pro and the RPL/RPX Loader Plugins?

https://gbatemp.net/threads/ida-pro-wii-u-loader.382433/

Actually it looks like this when you load an rpl with the plugins

IDA Pro is paid and is hard to crack, but i cracked it sooo.

Source : One of the thread post

You can see at the right of the left tab that we can see some strat adress of functions, it's not shown here but if you scroll right you can see the adress end.
That's very useful to look into .rpl files.

In the middle you can see some PPC Code of sendto() functions.

To install the plugin just follow the instruction, load an RPL file only works/loads with 32-bit version (that works with 64-bit)

--------------------- MERGED ---------------------------

If you want i will make a tutorial xD But before i have to record what i have just made.

 

[Deleted User]

https://gbatemp.net/threads/ida-pro-wii-u-loader.382433/

Actually it looks like this when you load an rpl with the plugins

IDA Pro is paid and is hard to crack, but i cracked it sooo.

Source : One of the thread post

You can see at the right of the left tab that we can see some strat adress of functions, it's not shown here but if you scroll right you can see the adress end.
That's very useful to look into .rpl files.

In the middle you can see some PPC Code of sendto() functions.

To install the plugin just follow the instruction, load an RPL file only works/loads with 32-bit version (that works with 64-bit)

--------------------- MERGED ---------------------------

If you want i will make a tutorial xD But before i have to record what i have just made.

Wow. Well I have IDA Pro 5.0, is that alright?

 

[NexoCube]

Wow. Well I have IDA Pro 5.0, is that alright?

It says 6.1 but try. He never tested it.

--------------------- MERGED ---------------------------

It says 6.1 but try. He never tested it.

.rpl are in the Cafe SDK

That i don't have anymore... i formatted my computers due to network problem

 

[Deleted User]

It says 6.1 but try. He never tested it.

--------------------- MERGED ---------------------------


.rpl are in the Cafe SDK

That i don't have anymore... i formatted my computers due to network problem

How do I load plugins into IDA?

 

[NexoCube]

Download the attached file in the thread then go in your IDA Pro files then put it in /loaders