Homebrew Official 5.5.X ELF Loader

[Deleted User]

I hear @MrRean steals refrigerators if you ask him about 5.5.X exploits.

I just wanted to say that I have a spare fridge.

 

[NexoCube]

I hear @MrRean steals refrigerators if you ask him about 5.5.X exploits.

I just wanted to say that I have a spare fridge.

I don't know if what i have said above is right x)

 

[Deleted User]

I don't know if what i have said above is right x)

Eh, it seems about right to me...

 

[davetheshrew]

While Im sat learning c and java I cant help but say Im impressed with whats going on in this thread, hopefully Mathew wii and the others will give you a boost, you sure deserve it for furthering the wii u HB scene.

 

[NexoCube]

While Im sat learning c and java I cant help but say Im impressed with whats going on in this thread, hopefully Mathew wii and the others will give you a boost, you sure deserve it for furthering the wii u HB scene.

Thanks

Why are you learning Java ? That's not useful at all if you want dev some Homebrew

 

[Deleted User]

While Im sat learning c and java I cant help but say Im impressed with whats going on in this thread, hopefully Mathew wii and the others will give you a boost, you sure deserve it for furthering the wii u HB scene.

If you were talking to both of us, thanks from me as well!

 

[davetheshrew]

Thanks

Why are you learning Java ? That's not useful at all if you want dev some Homebrew

Im trying to learn lots of things, Im 33 and rusty, I come from the times of eprom burning and messing with dos lol

 

[Deleted User]

@NexoCube I give up... I rly do.
I just can't think of a way that I could pull this kexploit off... I mean, I have the KERN_ADDRESS_TBL address for 5.5, and a couple of other stuff, but it's just so baffling as to how I could spot another vulnerability and put all the stuff I have together to exploit it.

 

[NexoCube]

@NexoCube I give up... I rly do.
I just can't think of a way that I could pull this kexploit off... I mean, I have the KERN_ADDRESS_TBL address for 5.5, and a couple of other stuff, but it's just so baffling as to how I could spot another vulnerability and put all the stuff I have together to exploit it.

Okay, i do understand.

But we can still dev some homebrew ? With userland yes but we can still do cool things.

 

[Deleted User]

Okay, i do understand.

But we can still dev some homebrew ? With userland yes but we can still do cool things.

You know what? You're right. Screw piracy for at least a week before I'll start whining again.
I have Cemu and a crappy processor to thank for the minimal Wii U piracy at the minute.

 

[NexoCube]

You know what? You're right. Screw piracy for at least a week before I'll start whining again.
I have Cemu and a crappy processor to thank for the minimal Wii U piracy at the minute.

Can CEMU run some unsigned app ?

 

[Deleted User]

Can CEMU run some unsigned app ?

You mean like an unsigned RPX or something? (remember they don't support mp4s or htmls yet. ) because that could well be possible.

 

[NexoCube]

You mean like an unsigned RPX or something? (remember they don't support mp4s or htmls yet. ) because that could well be possible.

yes unsigned .rpx

--------------------- MERGED ---------------------------

Is there a way to create .rpx (compiler) from a code-content-meta folder?

 

[Deleted User]

Is there a way to create .rpx (compiler) from a code-content-meta folder?

Binding the three folders together??

 

[NexoCube]

Binding the three folders together??

like how ? because folder have no extension

--------------------- MERGED ---------------------------

Like making a .zip and modify the extension to .rpx ?

 

[Deleted User]

like how ? because folder have no extension

I wouldn't have thought you could put the three folders together and you get an rpx. I just thought an RPX contained nothing but code inside it. I'm all confused now...

 

[NexoCube]

I wouldn't have thought you could put the three folders together and you get an rpx. I just thought an RPX contained nothing but code inside it. I'm all confused now...

RPX are modified .elf (so it's an executable file) maybe there's a .rpx compiler in Cafe SDK (.exe)

 

[Deleted User]

RPX are modified .elf (so it's an executable file) maybe there's a .rpx compiler in Cafe SDK (.exe)

The only thing that comes to my mind is makerpl.exe

 

[NexoCube]

The only thing that comes to my mind is makerpl.exe

here it is send it pleaaaaaaaaaase

--------------------- MERGED ---------------------------

i know how it works, i hope.

 

[Onion_Knight]

Yes, I just added "OSFatal("Buffer allocated")" to be sure the problem didn't come from MEMFreeToDefaultHeap.
I found in loadiine code that 26083 kB of data can be stored between 0xBE609EFC and 0xBFF82BC0 on 5.4.0. I don't know if this works for 5.5.x... i'll give a try tonight.

@NexoCube I give up... I rly do.
I just can't think of a way that I could pull this kexploit off... I mean, I have the KERN_ADDRESS_TBL address for 5.5, and a couple of other stuff, but it's just so baffling as to how I could spot another vulnerability and put all the stuff I have together to exploit it.

success is 90% perseverence, 5% inspiration, 4% desperation, 1% luck.

Download your firmware from nus...decrypt kernel.img with expresso ancast key and openssl. slice off the 0x100 byte header, load into IDA set ROM address to 0xffe00100 and load address to 0xffe00100 or thereabouts check the mem kernel memmap for exact offset. Make sure your using PPC as your processor type. go to 0xffe00110 and start your code decompiler there. The 1st function is systemreset at that offset. go to subview...search for strings
find all strings and make sure they are at the appropriate offsets, cross refernce strings to function calls. By default IdA will try to compile to code some stuff that are string. Once you've got your kernel setup, you can start cross referencing your syscalls from coreinit.rpl to kernel.elf. Look for things that are not thread-safe, allow for cross processor sharing of memory addresses and use syscalls. Find some, get addresses, write tests.....wash, rinse, repeat. Find vulnerable functions...write rop, make kxploit, decide to keep private considering how much work it took to do all the above....enjoy your kxploit.