Hacking A way to rip games without network/playing?

[Elliander]

Last year when I had a little time I tried out the method for ripping games over a network connection and, well, it didn't work out too well. I was never able to get enough files from any of my games for it to work right, and I am fairly certain it's because the game has to be played through in order to rip it which leaves quite a bit to chance. This appears to still be true for RPL files as I read here.

What I am wondering is if there is any other way to rip the game discs which, time consuming or not, will definitely get all of the files for certain.

Obviously to get a 1:1 copy on a console we'd need an IOSU Exploit for that, and although I am using one to be able to play with online access while blocking updates (not that I could anyway without updating games, just using it as an added layer of protection along with router blocks to keep the console on 5.3.2) I don't recall reading about one that can get 1:1 rips being out.

What I am wondering is if anyone has accomplished 1:1 rips through some as of yet unreleased exploit (something to look forward to?) or, alternatively, if another approach could be employed.

Alternatively, if I were to purchase a WiiU replacement dvd drive (which costs less than $30 here) and attach it to a computer might there be some way to rip games that way? Obviously the connection isn't right, but would it really be that difficult to put together an adapter? Or, alternatively, connect to an Arduino board along with a USB hard drive to set up a one click game ripper? With all the WiiU key delays, it just seems like a stand alone game ripper to be used with soft mods would make more sense to push for. Obviously software is needed as well, but is there some physical reason why this won't work? Has anyone even tried?

Personally, I am more on the software side of study than hardware, and I take more biology classes than computer science in college so I don't know how much if any I could do at this time, but I am curious. I'm getting a bit more money as my business grows so it's something I would totally try if anyone had any leads though.

EDIT: Also, why can't we rip a WiiU disc in vWii mode? I know the WiiU hardware shuts down, and clearly there would be no way to play there, but obviously the DVD drive is running and it clearly has access to the USB drive in that state. What is stopping us from copying the files there? When I try to access a WiiU game in vWii mode it shows up as "Data DVD" and attempting to access from a given app says that it's in an unrecognized format and ejects it, so it sounds like we just need some app for the vWii that can recognize the formatting of a WiiU disc.

 

[7Robins]

Very interesting points and ideas here, however I think the reason dumping games only works with Dumpiine is because the hardware needs access to the data, and the only way for that to work is for the hardwar/software is have the game be read (”playing”).

I think the problem with the jerry-rigged disc drive idea is that there wouldn't be any way to allow access to the game disc, unless someone were to figure out how to read the data without the WiiU's hardware.

It might also be possible that the game discs might have some sort of encryption on them that only the WiiU has access to.

The most interesting part for me is the vWii idea, which seems almost entirely plausible.

 

[Elliander]

the hardware needs access to the data

That's what I figured as well and makes complete sense, but it seems more like a work around to not having enough access to the drive. It seems like what's going on is more of a memory hack, interpreting the files as they are loaded into memory and sending them elsewhere.

I think the problem with the jerry-rigged disc drive idea is that there wouldn't be any way to allow access to the game disc, unless someone were to figure out how to read the data without the WiiU's hardware.

That's the part I don't get. I mean, you don't need to run the files. Only copy them. Obviously you can't run a WiiU game without the WiiU hardware, but if you can read the formatting of the disc itself you should be able to copy it. I imagine some kind of protection is added to the DVD drive itself, so you might need to add some keys so vWii more can decrypt the drive keys, but that doesn't seem insurmountable especially given the progress already made.

It might also be possible that the game discs might have some sort of encryption on them that only the WiiU has access to.

Well, the Wii U keys are available now, so if that's all that's needed I don't see why the vWii can't be given the keys to use. Of course, I could be wrong on that. Maybe there's something else stopping it that I don't know.

The most interesting part for me is the vWii idea, which seems almost entirely plausible.

Thanks! ^.^ We don't need to run the game in vWii, just get the files off the WiiU. Seems to be the place that will have the most native access to the data on a disc with the least security.

 

[7Robins]

Thanks! ^.^ We don't need to run the game in vWii, just get the files off the WiiU. Seems to be the place that will have the most native

It would probably be completely possible for that function to be built into USB Loader GX's Wii game dump feature.

 

[Elliander]

Can someone who works on USB Loaders for the Wii chime in for comment on this idea? If it would work? any problems with implementation?

 

[NWPlayer123]

It's impossible to dump raw discs from PowerPC side, I'm not sure how exactly cafe2wii works but I know that there's nothing you could do to read the disc from vWii mode, it needs keys for the drive and that doesn't get passed to vWii where we can get it, otherwise we'd have had it from the beginning with the SRESET vWii hack, only gives us a few Espresso keys, 0x40 bytes

 

[Elliander]

But the vWii can access the Wii discs. What is it that stops the vWii from reading the WiiU discs? I mean, it the data encrypted or is the disc access itself encrypted?

Is the drive key unique per console? Or is it like the common keys? Why can't the vWii be given the required keys through a mod so it can look at the WiiU disc data?

EDIT: If the format of the disc is encrypted, rather than the drive connection itself, why can't the vWii be used to dump a disc image (maybe in chunks) and then, elsewhere, decrypt the formatting?

 

[Elliander]

From what I can find out, it looks like WiiU discs are technically blue ray discs, but with slight logical changes so they don't have to pay royalties. When I put a WiiU disc into my blue ray player it can't read it at all, not even for a low level partition copy. So it's not the formatting of the data, where I wouldn't care about being able to read the data as long as I can rip the disc. It's the logical structure of the the disc. That means it would either require a special driver to tell a PC how to look at it, or more likely, would require a special drive. Based on this, it wouldn't be enough to buy a WiiU drive unless there was also special software that knew how to read their disc structure, which means a machine to rip the discs - while possible, and likely inexpensive on the hardware side - would probably take a very talented team to put together. This would of course explain why the WiiU can't play Blue ray movies, since it works the other way around. Not that Nintendo wants people to use and Wii to play movies to begin with.

What I can't seem to find out is what the console needs, software wise, to be able to read the discs. Obviously the WiiU can read WiiU discs, and obviously something is missing from the vWii that allows it to read the Wii U discs. But what exactly is that something? and what stops us from taking that something and giving it to the vWii? Is it a true impossibility or just a technical challenge? and if it is an impossibility what other options might be taken?

 

[Deleted User]

From what I can find out, it looks like WiiU discs are technically blue ray discs, but with slight logical changes so they don't have to pay royalties. When I put a WiiU disc into my blue ray player it can't read it at all, not even for a low level partition copy. So it's not the formatting of the data, where I wouldn't care about being able to read the data as long as I can rip the disc. It's the logical structure of the the disc. That means it would either require a special driver to tell a PC how to look at it, or more likely, would require a special drive. Based on this, it wouldn't be enough to buy a WiiU drive unless there was also special software that knew how to read their disc structure, which means a machine to rip the discs - while possible, and likely inexpensive on the hardware side - would probably take a very talented team to put together. This would of course explain why the WiiU can't play Blue ray movies, since it works the other way around. Not that Nintendo wants people to use and Wii to play movies to begin with.

What I can't seem to find out is what the console needs, software wise, to be able to read the discs. Obviously the WiiU can read WiiU discs, and obviously something is missing from the vWii that allows it to read the Wii U discs. But what exactly is that something? and what stops us from taking that something and giving it to the vWii? Is it a true impossibility or just a technical challenge? and if it is an impossibility what other options might be taken?

The vWii is only permitted to read discs using the DVD (red) laser, while Wii U discs are read using a blu-ray (blue, obviously) laser. It would be interesting if we could exploit the IOSU processor to enable Wii U disc reading in vWii mode, though.

You don't need to play through the entire game in order to dump its data, I'm pretty sure that it just needs to be launched once, to the point where it stores save data on your console, at that point I'm pretty sure DDD works.

 

[Elliander]

The vWii is only permitted to read discs using the DVD (red) laser, while Wii U discs are read using a blu-ray (blue, obviously) laser. It would be interesting if we could exploit the IOSU processor to enable Wii U disc reading in vWii mode, though.

ahh. So it's a red laser / blue laser issue. That's very interesting. So, what is stopping someone from turning the blue laser back on in vWii? I mean, if the WiiU hardware completely shuts down it seems like a final set of instructions are sent to the vWii telling it what it can and cannot do and from there it would have no ability to regulate it. It also seems like it would be easier to turn the blue laser on in a powered device than it would be for trying to turn on wiiU features. If the location of those instructions are known wouldn't we just need to change them? The wii has been completely hacked, so it just seems like that would be the simplest approach to getting full disc backups for the Wii U that are simple to do and don't require the use of a computer. With a 1:1 backup it would probably be easier to implement backup loaders on the Wii U.

You don't need to play through the entire game in order to dump its data, I'm pretty sure that it just needs to be launched once, to the point where it stores save data on your console, at that point I'm pretty sure DDD works.

With some games maybe, but others didn't seem to load those files until certain points of the game. Also didn't seem to be a full 1:1 copy.

 

[Deleted User]

ahh. So it's a red laser / blue laser issue. That's very interesting. So, what is stopping someone from turning the blue laser back on in vWii? I mean, if the wii hardware completely shuts down it seems like a final set of instructions are sent to the vWii telling it what it can and cannot do. If the location of those instructions are known wouldn't we just need to change them? The wii has been completely hacked, so it just seems like that would be the simplest approach to getting full disc backups for the Wii U that are simple to do and don't require the use of a computer. With a 1:1 backup it would probably be easier to implement backup loaders on the Wii U.



With some games maybe, but others didn't seem to load those files until certain points of the game. Also didn't seem to be a full 1:1 copy.

I'm pretty sure that the vWii still runs within certain IOSU limitations (I could be wrong, though) and we would need an IOSU exploit in order to do this (please GBATemp, don't turn this into a ****post thread!)

DDD doesn't perform a 1:1 backup of the actual disc and produce a WUD image, it actually dumps all of the files from the disc (and its DLC, updates and save data) over the network and stores it in a folder on your PC. Cemu and Loadiine GX2 can use these.

I don't know what's going wrong with some files not being dumped, are you sure? What game are you trying to dump and what files are missing?

 

[Cyan]

All the /content/ folder is dumped at launch, but not the /code/ folder (not accessible, so its files are dumped from memory).
The rpl are only dumped from memory and therefore only when they are loaded while playing.
The cos and app xml are also not dumped, but pseudo-generated from values found in memory. only the values needed by loadiine are dumped.


ddd is not dumping the disc, but the symbolic link created by the console (or IOS? I don't know).
the "/vol/content" and "/vol/code" actually contains a mix of the original game's files (disc or eshop version) overwritten by the game update's files (physically stored in the NAND or external hdd).
There's no real access to the disc game's path or eshop game's path, or update path only. For that, it will require file system access to browse the console's content.

 

[7Robins]

Perhaps the biggest problem is that no one would really have any reason to program this, as there's already a pretty decent method to dump games, even if it has a few issues.

 

[Elliander]

Yeah, I figured it would take some kind of exploit, but since IOSU exploits for the WiiU already exists it seems like this is very doable. I'm sure I'm over simplifying things since I've never been involved in that part of the scene (I wouldn't even know where to begin, even though I take programming classes in college), but at least there's hope of a solution. Even if the DDD could be made to dump all the code it's still a very slow and imperfect option.

and yeah, definitely didn't get all the RPL files.

Perhaps the biggest problem is that no one would really have any reason to program this, as there's already a pretty decent method to dump games, even if it has a few issues.

I'd disagree there. If it's not possible to dump all the files without playing through certain points while connected through wifi, and if the user doesn't know where to stop, they may not know if or when they get all the files for their games. Also, at least for me, I prefer to rip a new game immediately and then keep it in it's sleeve to limit possible damage.

I think that whatever way is simplest and fastest for the average user is best.

Obviously this idea won't help with DLC, saved games, and games downloaded to the console. However, it seems like those items are easier to rip. Although, personally, I paid for Mario Kart 8 DLC in advance and then never got it because doing so would mean taking an update I didn't want. My only hope to actually play that DLC is to find it from somewhere else and hope that since I actually paid for it that there would be a way to use it.

My prediction is that if a wifi approach could get everything a vWii approach couldn't people would use the vWii approach for the disc backups, a backup loader would use actual image files of some kind (of a reduced size since most game discs waste space) and they would probably use DDD or something similar for getting their DLC and updates, which would be stored in it's own image file that the user could enable/disable as needed and where the user, if missing a DLC download, could use it from some other source - assuming of course there are sufficient protections to make sure they paid for it. Otherwise there would be no way to share the DLC files without promoting piracy.

I'd say the only reason to not do this would be if it would be easier to implement in Wii U mode. I doubt that is the case, but I don't know how much progress is being made on fully hacking apart the Wii U.

The "/vol/content" and "/vol/code" actually contains a mix of the original game's files (disc or eshop version) and overwritten by the game update's files (physically stored in the NAND or external hdd).
There's no real access to the disc game's path or eshop game's path, or update path only. For that, it will require file system access to browse the console's content.

That creates another reason to do this. Being able to actually see what files are on the disc are valuable in and of itself. Nintendo likely implemented forced game updates to close vulnerabilities created within games quickly, regardless of the PR problem of people not being able to play single player games offline if an update is available. (I ran into that issue a few times myself). Being able to get the actual game without the updates means that my backup will be exactly the same as your backup (since you might or might not have updates when you make the backup) and if a vulnerability is present in any given update that could help fully hack the WiiU it would be easier to find or preserve.

 

[7Robins]

I'd disagree there. If it's not possible to dump all the files without playing through certain points while connected through wifi, and if the user doesn't know where to stop, they may not know if or when they get all the files for their games. Also, at least for me, I prefer to rip a new game immediately and then keep it in it's sleeve to limit possible damage.

I think that whatever way is simplest and fastest for the average user is best.

Most games I've seen dump fine while running at the title screen. The only real inconvenience is your network speed.

There's also the point that lots of people won't bother going through the entire vWii hacking process, which requires a full retail Wii game in order to do, just to dump a game. The current dump process requires nothing but a computer and the game that you want to dump.

 

[Subtle Demise]

The warez scene has been abke to rip full wii u discs and extract the title key for years now. Unfortunately, us end users aren't really supposed to have their releases, and they are never willing to share their methods.

 

[Elliander]

Most games I've seen dump fine while running at the title screen. The only real inconvenience is your network speed.

Well, most games I've tried didn't. I don't really care about the speed so much as I want proper backups, and now that I know it creates a merged backup with updates it makes me want to see proper backups even more.

There's also the point that lots of people won't bother going through the entire vWii hacking process, which requires a full retail Wii game in order to do, just to dump a game. The current dump process requires nothing but a computer and the game that you want to dump.

I really doubt that. Most people I know want everything. If you are going to go through the trouble to get a backup loader working on the Wii U, well, why not also get wii backups? and gamecube?

The warez scene has been abke to rip full wii u discs and extract the title key for years now. Unfortunately, us end users aren't really supposed to have their releases, and they are never willing to share their methods.

Well, doesn't that imply they have some ability to actually read the discs? Rather than just some wifi stream of the loaded memory?

 

[7Robins]

I really doubt that. Most people I know want everything. If you are going to go through the trouble to get a backup loader working on the Wii U, well, why not also get wii backups? and gamecube?

Yes, but you also have to consider that a good majority of the people using it aren't like us, who look at the advantages rather than the disadvantages. Having to go through that extensive process just to copy their games is tedious, it would make more sense to just go download a copy somewhere else.

 

[NWPlayer123]

I'm pretty sure that the vWii still runs within certain IOSU limitations (I could be wrong, though) and we would need an IOSU exploit in order to do this (please GBATemp, don't turn this into a ****post thread!)

DDD doesn't perform a 1:1 backup of the actual disc and produce a WUD image, it actually dumps all of the files from the disc (and its DLC, updates and save data) over the network and stores it in a folder on your PC. Cemu and Loadiine GX2 can use these.

I don't know what's going wrong with some files not being dumped, are you sure? What game are you trying to dump and what files are missing?

I haven't looked at cafe2wii but it's put into compatibility mode and the Wii can do whatever it wants in its little sandbox that's fine, not sure if fw.img is ever unloaded

ddd uses some tricks to dump everything as its passed to the loader, MCP in IOSU still reads from eMMC and mounts everything to /vol/content and passes in XML values and code which is what the loader uses to put everything in, it doesn't send everything to the loader so it's not a "real" cos.xml or app.xml, just as close as we can get without full control

The disc dumps are just WiiKeyU that they use with a drive on a really old firmware because yes the drive key is console specific and they just use an IOSU exploit on 3.0.1 or something to get it, they have raw access and can just dump as they please with the right program

 

[Elliander]

Yes, but you also have to consider that a good majority of the people using it aren't like us, who look at the advantages rather than the disadvantages. Having to go through that extensive process just to copy their games is tedious, it would make more sense to just go download a copy somewhere else.

Well, that would be piracy. Of course, even pirates need to get it from somewhere so in a roundabout way that type of person would still benefit even if they don't go through the motions themselves. Of course, 1:1 backups would also open the doors to game modding as well which can lead to homebrew.

I haven't looked at cafe2wii but it's put into compatibility mode and the Wii can do whatever it wants in its little sandbox that's fine, not sure if fw.img is ever unloaded

So if it has full control it can turn the blue ray light on?

ddd uses some tricks to dump everything as its passed to the loader, MCP in IOSU still reads from eMMC and mounts everything to /vol/content and passes in XML values and code which is what the loader uses to put everything in, it doesn't send everything to the loader so it's not a "real" cos.xml or app.xml, just as close as we can get without full control

Yeah, that's the part that's the problem. Not having the complete file means they are going to be bugs, compatibility issues, etc. Of course, it's great that we can do this at all, but if we can have better I don't see why not.

The disc dumps are just WiiKeyU that they use with a drive on a really old firmware because yes the drive key is console specific and they just use an IOSU exploit on 3.0.1 or something to get it, they have raw access and can just dump as they please with the right program

Is the Drive Key issue the reason why they haven't released that yet?