<!--quoteo(post=2336751:date=Oct 18 2009, 01:12 PM:name=boof222)--><div class='quotetop'>QUOTE(boof222 @ Oct 18 2009, 01:12 PM) <a href="index.php?act=findpost&pid=2336751"><{POST_SNAPBACK}></a></div><div class='quotemain'><!--quotec-->hmm maybe try through preloader try running it as installed to test if its working (and im pretty sure its the 1 called 00000001.app that has to be renamed to 0000007e and you have to make sure that they both have 8 characters in it) other than that someone more experienced will have to help you as ive helped all i can.
hope you can figure something out
EDIT: injecting the files into wads would create your system menu and installing it would force you to reinstall preloader because preloader is deleted when the system menu is reinstalled<!--QuoteEnd--></div><!--QuoteEEnd-->
Made some test and no success... Thanks for have tried to help me. <img src="style_emoticons/<#EMO_DIR#>/wink.gif" style="vertical-align:middle" emoid="
" border="0" alt="wink.gif" />
I think that one of these codes can load the system menu dol...but i don't know c++.
<!--c1--><div class='codetop'>CODE</div><div class='codemain'><!--ec1-->void launchTitleWithId(u64 titleId, char* name)
{
ÂÂÂÂÂÂÂÂ//Identify as menu
ÂÂÂÂÂÂÂÂint rest = ES_Identify((signed_blob*)menu_certs_bin, menu_certs_bin_size, (signed_blob*)menu_tmd_bin, menu_tmd_bin_size, (signed_blob*)menu_tik_bin, menu_tik_bin_size, 0);
ÂÂÂÂÂÂÂÂ
ÂÂÂÂÂÂÂÂ__ES_Close();
ÂÂÂÂÂÂÂÂ__ES_Init();ÂÂÂÂÂÂÂÂÂÂÂÂ
ÂÂÂÂÂÂÂÂ
ÂÂÂÂÂÂÂÂlaunchTitle(titleId, name, 1);ÂÂ
}<!--c2--></div><!--ec2-->
<!--c1--><div class='codetop'>CODE</div><div class='codemain'><!--ec1-->void BootMainSysMenu( void )
{
ÂÂÂÂstatic u64 TitleID ATTRIBUTE_ALIGN(32)=0x0000000100000002LL;
ÂÂÂÂstatic u32 tmd_size ATTRIBUTE_ALIGN(32);
ÂÂÂÂstatic u32 tempKeyID ATTRIBUTE_ALIGN(32);
ÂÂÂÂs32 r = 0;
ÂÂÂÂISFS_Deinitialize();
ÂÂÂÂif( ISFS_Initialize() < 0 )
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂ//printf("ISFS_Initialize() failed!\n");
ÂÂÂÂÂÂÂÂPrintFormat( 1, ((640/2)-((strlen("ISFS_Initialize() failed!"))*13/2))>>1, 208, "ISFS_Initialize() failed!" );
ÂÂÂÂÂÂÂÂsleep( 5 );
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂ//read ticket from FS
ÂÂÂÂs32 fd = ISFS_Open("/title/00000001/00000002/content/ticket", 1 );
ÂÂÂÂif( fd < 0 )
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂerror = ERROR_SYSMENU_TIKNOTFOUND;
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂ//get size
ÂÂÂÂfstats * tstatus = (fstats*)memalign( 32, sizeof( fstats ) );
ÂÂÂÂr = ISFS_GetFileStats( fd, tstatus );
ÂÂÂÂif( r < 0 )
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂISFS_Close( fd );
ÂÂÂÂÂÂÂÂerror = ERROR_SYSMENU_TIKSIZEGETFAILED;
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂ//create buffer
ÂÂÂÂchar * buf = (char*)memalign( 32, (tstatus->file_length+32)&(~31) );
ÂÂÂÂif( buf == NULL )
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂISFS_Close( fd );
ÂÂÂÂÂÂÂÂerror = ERROR_MALLOC;
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂmemset(buf, 0, (tstatus->file_length+32)&(~31) );
ÂÂÂÂ//read file
ÂÂÂÂr = ISFS_Read( fd, buf, tstatus->file_length );
ÂÂÂÂif( r < 0 )
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂfree( buf );
ÂÂÂÂÂÂÂÂISFS_Close( fd );
ÂÂÂÂÂÂÂÂerror = ERROR_SYSMENU_TIKREADFAILED;
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂISFS_Close( fd );
ÂÂÂÂr=ES_GetStoredTMDSize(TitleID, &tmd_size);
#ifdef DEBUG
ÂÂÂÂprintf("ES_GetStoredTMDSize(%llX, %08X):%d\n", TitleID, (u32)(&tmd_size), r );
ÂÂÂÂsleep(1);
#endif
ÂÂÂÂif(r<0)
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂfree( buf );
ÂÂÂÂÂÂÂÂerror = ERROR_SYSMENU_GETTMDSIZEFAILED;
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂsigned_blob *TMD = (signed_blob *)memalign( 32, (tmd_size+32)&(~31) );
ÂÂÂÂif( TMD == NULL )
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂfree( buf );
ÂÂÂÂÂÂÂÂerror = ERROR_MALLOC;
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂmemset(TMD, 0, tmd_size);
ÂÂÂÂr=ES_GetStoredTMD(TitleID, TMD, tmd_size);
#ifdef DEBUG
ÂÂÂÂprintf("ES_GetStoredTMD(%llX, %08X, %d):%d\n", TitleID, (u32)(TMD), tmd_size, r );
ÂÂÂÂsleep(1);
#endif
ÂÂÂÂif(r<0)
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂfree( TMD );
ÂÂÂÂÂÂÂÂfree( buf );
ÂÂÂÂÂÂÂÂerror = ERROR_SYSMENU_GETTMDFAILED;
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂ
ÂÂÂÂtmd *rTMD = (tmd *)(TMD+(0x140/sizeof(tmd *)));
#ifdef DEBUG
ÂÂÂÂprintf("num_contents:%08X\n", rTMD->num_contents );
#endif
ÂÂÂÂ//get main.dol filename
ÂÂÂÂu32 fileID = 0;
ÂÂÂÂfor(u32 z=0; z < rTMD->num_contents; ++z)
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂif( rTMD->contents[z].index == rTMD->boot_index )
ÂÂÂÂÂÂÂÂ{
#ifdef DEBUG
ÂÂÂÂÂÂÂÂÂÂÂÂprintf("%d:%d\n", rTMD->contents[z].index, rTMD->contents[z].cid);
#endif
ÂÂÂÂÂÂÂÂÂÂÂÂfileID = rTMD->contents[z].cid;
ÂÂÂÂÂÂÂÂÂÂÂÂbreak;
ÂÂÂÂÂÂÂÂ}
ÂÂÂÂ}
ÂÂÂÂif( fileID == 0 )
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂfree( TMD );
ÂÂÂÂÂÂÂÂfree( buf );
ÂÂÂÂÂÂÂÂerror = ERROR_SYSMENU_BOOTNOTFOUND;
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂchar * file = (char*)memalign( 32, 256 );
ÂÂÂÂif( file == NULL )
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂfree( TMD );
ÂÂÂÂÂÂÂÂfree( buf );
ÂÂÂÂÂÂÂÂerror = ERROR_MALLOC;
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂmemset(file, 0, 256 );
ÂÂÂÂsprintf( file, "/title/00000001/00000002/content/%08x.app", fileID );
#ifdef NBOOT
ÂÂÂÂfile[33] = '1'; // Booting renamed system menu so we rename character 33!
#endif
ÂÂÂÂfd = ISFS_Open( file, 1 );
#ifdef DEBUG
ÂÂÂÂprintf("IOS_Open(%s, %d):%d\n", file, 1, fd );
ÂÂÂÂsleep(1);
#endif
ÂÂÂÂif( fd < 0 )
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂfree( TMD );
ÂÂÂÂÂÂÂÂfree( buf );
ÂÂÂÂÂÂÂÂfree( file );
ÂÂÂÂÂÂÂÂISFS_Close( fd );
ÂÂÂÂÂÂÂÂerror = ERROR_SYSMENU_BOOTOPENFAILED;
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂfstats *status = (fstats *)memalign(32, sizeof( fstats ) );
ÂÂÂÂif( status == NULL )
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂfree( TMD );
ÂÂÂÂÂÂÂÂfree( buf );
ÂÂÂÂÂÂÂÂfree( file );
ÂÂÂÂÂÂÂÂISFS_Close( fd );
ÂÂÂÂÂÂÂÂerror = ERROR_MALLOC;
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂr = ISFS_GetFileStats( fd, status);
#ifdef DEBUG
ÂÂÂÂprintf("ISFS_GetFileStats(%d, %08X):%d\n", fd, status, r );
ÂÂÂÂsleep(1);
#endif
ÂÂÂÂif( fd < 0 )
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂfree( TMD );
ÂÂÂÂÂÂÂÂfree( buf );
ÂÂÂÂÂÂÂÂfree( file );
ÂÂÂÂÂÂÂÂISFS_Close( fd );
ÂÂÂÂÂÂÂÂerror = ERROR_SYSMENU_BOOTGETSTATS;
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
#ifdef DEBUG
ÂÂÂÂprintf("size:%d\n", status->file_length);
#endif
ÂÂÂÂdolhdr *hdr = (dolhdr *)memalign(32, (sizeof( dolhdr )+32)&(~31) );
ÂÂÂÂmemset( hdr, 0, (sizeof( dolhdr )+32)&(~31) );
ÂÂÂÂ
ÂÂÂÂISFS_Seek( fd, 0, SEEK_SET );
ÂÂÂÂr = ISFS_Read( fd, hdr, sizeof(dolhdr) );
#ifdef DEBUG
ÂÂÂÂprintf("ISFS_Read(%d, %08X, %d):%d\n", fd, hdr, sizeof(dolhdr), r );
ÂÂÂÂsleep(1);
#endif
ÂÂÂÂif( r < 0 )
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂif( hdr->entrypoint != 0x3400 )
ÂÂÂÂ{
#ifdef DEBUG
ÂÂÂÂÂÂÂÂprintf("BOGUS entrypoint:%08X\n", hdr->entrypoint );
ÂÂÂÂÂÂÂÂsleep(5);
#endif
ÂÂÂÂÂÂÂÂISFS_Close( fd );
ÂÂÂÂÂÂÂÂfree(hdr);
ÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂ}
ÂÂÂÂvoidÂÂÂÂ(*entrypoint)();
ÂÂÂÂint i=0;
ÂÂÂÂfor (i = 0; i < 6; i++)
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂif( hdr->sizeText
&& hdr->addressText && hdr->offsetText )
ÂÂÂÂÂÂÂÂ{
ÂÂÂÂÂÂÂÂÂÂÂÂICInvalidateRange((void*)(hdr->addressText), hdr->sizeText);
#ifdef DEBUG
ÂÂÂÂÂÂÂÂÂÂÂÂprintf("\t%08x\t\t%08x\t\t%08x\t\t\n", (hdr->offsetText), hdr->addressText, hdr->sizeText);
#endif
ÂÂÂÂÂÂÂÂÂÂÂÂif( (((hdr->addressText)&0xF0000000) != 0x80000000) || (hdr->sizeText>(10*1024*1024)) )
ÂÂÂÂÂÂÂÂÂÂÂÂ{
#ifdef DEBUG
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂprintf("BOGUS offsets!\n");
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂsleep(5);
#endif
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂÂÂÂÂÂÂÂÂ}
ÂÂÂÂÂÂÂÂÂÂÂÂISFS_Seek( fd, hdr->offsetText, SEEK_SET );
ÂÂÂÂÂÂÂÂÂÂÂÂISFS_Read( fd, (void*)(hdr->addressText), hdr->sizeText );
ÂÂÂÂÂÂÂÂÂÂÂÂDCFlushRange((void*)(hdr->addressText), hdr->sizeText);
ÂÂÂÂÂÂÂÂ}
ÂÂÂÂ}
ÂÂÂÂ// data sections
ÂÂÂÂfor (i = 0; i <= 10; i++)
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂif( hdr->sizeData && hdr->addressData && hdr->offsetData )
ÂÂÂÂÂÂÂÂ{
ÂÂÂÂÂÂÂÂÂÂÂÂICInvalidateRange((void*)(hdr->addressData), hdr->sizeData);
#ifdef DEBUG
ÂÂÂÂÂÂÂÂÂÂÂÂprintf("\t%08x\t\t%08x\t\t%08x\t\t\n", (hdr->offsetData), hdr->addressData, hdr->sizeData);
#endif
ÂÂÂÂÂÂÂÂÂÂÂÂif( (((hdr->addressData)&0xF0000000) != 0x80000000) || (hdr->sizeData>(10*1024*1024)) )
ÂÂÂÂÂÂÂÂÂÂÂÂ{
#ifdef DEBUG
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂprintf("BOGUS offsets!\n");
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂsleep(5);
#endif
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂÂÂÂÂÂÂÂÂ}
ÂÂÂÂÂÂÂÂÂÂÂÂISFS_Seek( fd, hdr->offsetData, SEEK_SET );
ÂÂÂÂÂÂÂÂÂÂÂÂISFS_Read( fd, (void*)(hdr->addressData), hdr->sizeData );
ÂÂÂÂÂÂÂÂÂÂÂÂDCFlushRange((void*)(hdr->addressData), hdr->sizeData);
ÂÂÂÂÂÂÂÂ}
ÂÂÂÂ}
ÂÂÂÂentrypoint = (void (*)())(hdr->entrypoint);
#ifdef DEBUG
ÂÂÂÂprintf("entrypoint: %08X\n", entrypoint );
ÂÂÂÂsleep(5);
#endif
ÂÂÂÂLoadHacks();
ÂÂÂÂWPAD_Shutdown();
ÂÂÂÂ__ES_Close();
ÂÂÂÂ__ES_Init();
ÂÂÂÂif( SGetSetting(SETTING_SYSTEMMENUIOS) == 0 )
ÂÂÂÂÂÂÂÂ__IOS_LaunchNewIOS(rTMD->sys_version);
ÂÂÂÂelse
ÂÂÂÂÂÂÂÂ__IOS_LaunchNewIOS(SGetSetting(SETTING_SYSTEMMENUIOS));
ÂÂÂÂ//__IOS_LaunchNewIOS(rTMD->sys_version);
ÂÂÂÂ//__IOS_LaunchNewIOS(249);
#ifdef DEBUG
ÂÂÂÂprintf("Loading IOS: %08X\n", rTMD->sys_version );
ÂÂÂÂsleep(5);
#endif
ÂÂÂÂ__IOS_InitializeSubsystems();
ÂÂÂÂr = ES_Identify( (signed_blob *)certs_bin, certs_bin_size, (signed_blob *)TMD, tmd_size, (signed_blob *)buf, tstatus->file_length, &tempKeyID);
ÂÂÂÂif( r < 0 )
ÂÂÂÂ{
ÂÂÂÂÂÂÂÂr = ES_Identify((signed_blob *)certs_bin, certs_bin_size,(signed_blob *)su_tmd, su_tmd_size,(signed_blob *)su_tik, su_tik_size, &tempKeyID);
ÂÂÂÂÂÂÂÂÂÂÂÂif( r < 0 )
ÂÂÂÂÂÂÂÂÂÂÂÂ{
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂerror=ERROR_SYSMENU_ESDIVERFIY_FAILED;
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂreturn;
ÂÂÂÂÂÂÂÂÂÂÂÂ}
ÂÂÂÂ}
#ifdef DEBUG
ÂÂÂÂprintf("ES_Identify():%d\n", r);
ÂÂÂÂsleep(5);
#endif
ÂÂÂÂ//ES_SetUID(TitleID);
ÂÂÂÂfree(TMD);
ÂÂÂÂfree( status );
ÂÂÂÂfree( tstatus );
ÂÂÂÂfree( buf );
ÂÂÂÂ*(vu32*)0x800000F8 = 0x0E7BE2C0;ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ// Bus Clock Speed
ÂÂÂÂ*(vu32*)0x800000FC = 0x2B73A840;ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ// CPU Clock Speed
#ifdef DEBUG
ÂÂÂÂprintf("Hacks:%d\n", hacks.size() );
#endif
ÂÂÂÂ//Apply patches
ÂÂÂÂfor( u32 i=0; i<hacks.size(); ++i)
ÂÂÂÂ{
#ifdef DEBUG
ÂÂÂÂÂÂÂÂprintf("i:%d state:%d version:%d\n", i, states, hacks.version);
#endif
ÂÂÂÂÂÂÂÂif( states == 1 )
ÂÂÂÂÂÂÂÂ{
ÂÂÂÂÂÂÂÂÂÂÂÂif( hacks.version != rTMD->title_version )
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂcontinue;
ÂÂÂÂÂÂÂÂÂÂÂÂfor( u32 z=0; z < hacks.value.size(); ++z )
ÂÂÂÂÂÂÂÂÂÂÂÂ{
#ifdef DEBUG
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂprintf("%08X:%08X\n", hacks.offset[z], hacks.value[z] );
#endif
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ*(vu32*)(hacks.offset[z]) = hacks.value[z];
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂDCFlushRange((void*)(hacks.offset[z]), 4);
ÂÂÂÂÂÂÂÂÂÂÂÂ}
ÂÂÂÂÂÂÂÂ}
ÂÂÂÂ}
#ifdef DEBUG
ÂÂÂÂsleep(20);
#endif
ÂÂÂÂ__io_wiisd.shutdown();
ÂÂÂÂ__STM_Close();
ÂÂÂÂ__IOS_ShutdownSubsystems();
ÂÂÂÂmtmsr(mfmsr() & ~0x8000);
ÂÂÂÂmtmsr(mfmsr() | 0x2002);
ÂÂÂÂ_unstub_start();
}<!--c2--></div><!--ec2-->