Hacking Able to install cIOS with the system menu?

[Krestent]

In that case, I know that a superuser ticket is sometimes created in IOS0. What would happen if I installed a system menu to 00000001000000000?

 

[Jacobeian]

Try it ?

Anyway, I've looked in libogc and it seems the IPC commands used to tell IOS to launch a title is the same for IOS or System menu (or any channel). This means the difference is made in IOS because it needs at least to know where the title code should be loaded and executed. It's probably hardcoded and done based on the title ID which means that anything that looks like an IOS would be loaded in ARM memory. You don't want to do that with the system menu.

You might try to install it as its own channel (you can have hidden channel too, like dvdx) and launch it, I don't know if it would work, there might be some restrictions when the systeme menu is running, if it doesn't run unless is title id is 0000000100000002 for example. Seems too easy though.

 

[9th_Sage]

The system menu is expected to be title 0000000100000002, it's hard-coded in things all over the place.

That's what I was just thinking. Anything that messes with the system menu is coded for that, the menu itself is coded for that...this plan is getting pretty wacky.

 

[carbonyle]

using homebrew maybe, at least it would be more realistic, though I don't know what kind of protection/requirements are in those ES functions

edit: in libogc you have this neat little function WII_LaunchTitle(u64 titleID), you could try to load the system menu title installed as IOS and see what happen. The biggest risk is if the korean system menu try to write some files on your NAND when started and this ends up messing your old system configuration, preventing the original system menu to work when you reboot your console.

Be sure to have bootmii as boot2 installed otherwise I won't take that risk if I were you.

If you do this, you could have multiple System Menus installed. Reasonably pointless really, but you could modify MyMenu to install themes to a "backup" System Menu so you could test them without risk of bricking. That's about the only use for it I can think of.

or just wait for SNEEK2

 

[Krestent]

How would I go about making it a channel?