Hacking Any Region Changer- SYSCONF is jacked

[mauifrog]

4.2u Region changed Korean wii, unable to save new region settings. Failed attempt to region change to 4.2e. "saving...Unexpected error: SYSCONF_Savechanges Value: -102"
Replaced setting.txt, no help there. Can someone look at this nandBinCheck and see if you know the issue. Could it be fixed with fstoolbox? Or only nand.bin format?

Spoiler

** nandBinCheck : Wii nand info tool **
from giantpune
svn r: 104
built: May 30 2011 23:56:10
checking boot1 & 2...
Boot1 C (fixed)
found 2 copies of boot2
"blocks 1 & 2: Used for booting; Content Sha1 matches TMD; TMD officially signed; Ticket officially signed; Version 4"
"blocks 7 & 6: Backup copy; Content Sha1 matches TMD; TMD officially signed; Ticket officially signed; Version 4"
checking uid.sys...
UIDmap::Check() system menu entry is messed up: 4294967313 1
checking content.map...
checking "/shared1/00000000.app" ...
checking "/shared1/00000001.app" ...
checking "/shared1/00000002.app" ...
checking "/shared1/00000003.app" ...
checking "/shared1/00000004.app" ...
checking "/shared1/00000005.app" ...
checking "/shared1/00000006.app" ...
checking "/shared1/00000007.app" ...
checking "/shared1/00000008.app" ...
checking "/shared1/00000009.app" ...
checking "/shared1/0000000a.app" ...
checking "/shared1/0000000b.app" ...
checking "/shared1/0000000c.app" ...
checking "/shared1/0000000d.app" ...
checking "/shared1/0000000e.app" ...
checking "/shared1/0000000f.app" ...
checking "/shared1/00000010.app" ...
checking "/shared1/00000011.app" ...
checking "/shared1/00000012.app" ...
checking "/shared1/00000013.app" ...
checking "/shared1/00000014.app" ...
checking "/shared1/00000015.app" ...
checking "/shared1/00000016.app" ...
checking "/shared1/00000017.app" ...
checking "/shared1/00000018.app" ...
checking "/shared1/00000019.app" ...
checking "/shared1/0000001a.app" ...
checking "/shared1/0000001b.app" ...
checking "/shared1/0000001c.app" ...
checking "/shared1/0000001d.app" ...
checking "/shared1/0000001e.app" ...
checking "/shared1/0000001f.app" ...
checking "/shared1/00000020.app" ...
checking "/shared1/00000021.app" ...
checking "/shared1/00000022.app" ...
checking "/shared1/00000023.app" ...
checking "/shared1/00000024.app" ...
checking "/shared1/00000025.app" ...
checking "/shared1/00000026.app" ...
checking "/shared1/00000027.app" ...
checking "/shared1/00000028.app" ...
checking "/shared1/00000029.app" ...
checking "/shared1/0000002a.app" ...
checking "/shared1/0000002b.app" ...
checking "/shared1/0000002c.app" ...
checking "/shared1/0000002d.app" ...
checking "/shared1/0000002e.app" ...
checking "/shared1/0000002f.app" ...
checking "/shared1/00000030.app" ...
checking "/shared1/00000031.app" ...
checking "/shared1/00000032.app" ...
checking "/shared1/00000033.app" ...
checking "/shared1/00000034.app" ...
checking "/shared1/00000035.app" ...
checking "/shared1/00000036.app" ...
checking "/shared1/00000037.app" ...
checking "/shared1/00000038.app" ...
checking "/shared1/00000039.app" ...
checking "/shared1/0000003a.app" ...
checking "/shared1/0000003b.app" ...
checking "/shared1/0000003c.app" ...
checking "/shared1/0000003d.app" ...
checking "/shared1/0000003e.app" ...
checking "/shared1/0000003f.app" ...
checking "/shared1/00000040.app" ...
checking "/shared1/00000041.app" ...
checking "/shared1/00000042.app" ...
checking "/shared1/00000043.app" ...
checking "/shared1/00000044.app" ...
checking "/shared1/00000045.app" ...
checking "/shared1/00000046.app" ...
checking "/shared1/00000047.app" ...
checking "/shared1/00000048.app" ...
checking "/shared1/00000049.app" ...
checking "/shared1/0000004a.app" ...
checking "/shared1/0000004b.app" ...
checking "/shared1/0000004c.app" ...
checking "/shared1/0000004d.app" ...
checking "/shared1/0000004e.app" ...
checking "/shared1/0000004f.app" ...
checking "/shared1/00000050.app" ...
checking "/shared1/00000051.app" ...
checking "/shared1/00000052.app" ...
checking "/shared1/00000053.app" ...
checking "/shared1/00000054.app" ...
checking "/shared1/00000055.app" ...
checking "/shared1/00000056.app" ...
checking "/shared1/00000057.app" ...
checking "/shared1/00000058.app" ...
checking "/shared1/00000059.app" ...
checking "/shared1/0000005a.app" ...
checking "/shared1/0000005b.app" ...
checking "/shared1/0000005c.app" ...
checking "/shared1/0000005d.app" ...
checking "/shared1/0000005e.app" ...
checking "/shared1/0000005f.app" ...
checking "/shared1/00000060.app" ...
checking "/shared1/00000061.app" ...
checking "/shared1/00000062.app" ...
checking "/shared1/00000063.app" ...
checking "/shared1/00000064.app" ...
checking "/shared1/00000065.app" ...
checking "/shared1/00000066.app" ...
checking "/shared1/00000067.app" ...
checking "/shared1/00000068.app" ...
checking "/shared1/00000069.app" ...
checking "/shared1/0000006a.app" ...
checking "/shared1/0000006b.app" ...
checking "/shared1/0000006c.app" ...
checking "/shared1/0000006d.app" ...
checking "/shared1/0000006e.app" ...
checking "/shared1/0000006f.app" ...
checking "/shared1/00000070.app" ...
checking "/shared1/00000071.app" ...
checking "/shared1/00000072.app" ...
checking "/shared1/00000073.app" ...
checking "/shared1/00000074.app" ...
checking "/shared1/00000075.app" ...
found 70 titles installed
Checking 00000001-00000009 ...
ticket fakesigned
tmd fakesigned
Checking 00000001-0000000b ...
ticket fakesigned
tmd fakesigned
Checking 00000001-0000000c ...
Checking 00000001-0000000d ...
Checking 00000001-0000000e ...
Checking 00000001-0000000f ...
Checking 00000001-00000010 ...
tmd fakesigned
Checking 00000001-00000011 ...
Checking 00000001-00000014 ...
ticket fakesigned
tmd fakesigned
Checking 00000001-00000015 ...
Checking 00000001-00000016 ...
Checking 00000001-0000001c ...
Checking 00000001-0000001e ...
ticket fakesigned
tmd fakesigned
Checking 00000001-0000001f ...
Checking 00000001-00000021 ...
Checking 00000001-00000022 ...
Checking 00000001-00000023 ...
Checking 00000001-00000024 ...
ticket fakesigned
tmd fakesigned
Checking 00000001-00000025 ...
Checking 00000001-00000026 ...
Checking 00000001-00000029 ...
Checking 00000001-0000002b ...
Checking 00000001-0000002d ...
Checking 00000001-0000002e ...
Checking 00000001-00000030 ...
Checking 00000001-00000032 ...
ticket fakesigned
tmd fakesigned
Checking 00000001-00000035 ...
Checking 00000001-00000037 ...
Checking 00000001-00000038 ...
Checking 00000001-00000039 ...
Checking 00000001-0000003a ...
Checking 00000001-0000003c ...
ticket fakesigned
tmd fakesigned
Checking 00000001-0000003d ...
Checking 00000001-00000046 ...
ticket fakesigned
tmd fakesigned
Checking 00000001-00000050 ...
ticket fakesigned
tmd fakesigned
Checking 00000001-0000005a ...
ticket fakesigned
tmd fakesigned
Checking 00000001-000000de ...
Decrypted signature hash: 0000000000000000000000000000000000000000
SHA1 hash: 91037c477f257e390b74a2f65020cb491e5d29ad
ticket RSA signature isn't even close ( 4 )
Decrypted signature hash: 0000000000000000000000000000000000000000
SHA1 hash: 48900638a513496d917b6f0aa6c898a57424b816
tmd RSA signature isn't even close ( 4 )
Checking 00000001-000000df ...
Decrypted signature hash: 0000000000000000000000000000000000000000
SHA1 hash: 3873973e59211f1456f9cb64cad8fe196a57d2e0
ticket RSA signature isn't even close ( 4 )
Decrypted signature hash: 0000000000000000000000000000000000000000
SHA1 hash: def57806d64d06cf878b846383937d636018280f
tmd RSA signature isn't even close ( 4 )
Checking 00000001-000000e0 ...
Decrypted signature hash: 0000000000000000000000000000000000000000
SHA1 hash: aa41f5930624c9fef91c91abd91c7aa777863148
ticket RSA signature isn't even close ( 4 )
Decrypted signature hash: 0000000000000000000000000000000000000000
SHA1 hash: a52823b811ceb565ad9db0138430e38e7b21070b
tmd RSA signature isn't even close ( 4 )
Checking 00000001-000000ec ...
ticket fakesigned
tmd fakesigned
Checking 00000001-000000fe ...
ticket fakesigned
tmd fakesigned
found 41 bootable IOS
Checking 00000001-00000002 ...
incorrect uid/gid for "data/setting.txt"
Checking 00000001-00000004 ...
Checking 00000001-0000000a ...
Checking 00000001-00000028 ...
Checking 00000001-00000033 ...
Checking 00000001-00000034 ...
Checking 00000001-000000f9 ...
Checking 00000001-000000fa ...
Checking 00000001-00000100 ...
Checking 00000001-00000101 ...
Checking 00010001-48414445 (HADE) ...
Checking 00010001-48414a45 (HAJE) ...
Checking 00010001-48415045 (HAPE) ...
Checking 00010001-48415445 (HATE) ...
Checking 00010001-af1bf516 (....) ...
ticket fakesigned
tmd fakesigned
Checking 00010002-48414141 (HAAA) ...
Checking 00010002-48414241 (HABA) ...
Checking 00010002-48414341 (HACA) ...
Checking 00010002-48414641 (HAFA) ...
Checking 00010002-48414645 (HAFE) ...
Checking 00010002-48414650 (HAFP) ...
Checking 00010002-48414741 (HAGA) ...
Checking 00010002-48414745 (HAGE) ...
Checking 00010002-48414750 (HAGP) ...
Checking 00010002-48415941 (HAYA) ...
Checking 00010008-48414b45 (HAKE) ...
Checking 00010008-48414b50 (HAKP) ...
Checking 00010008-48414c45 (HALE) ...
Checking 00010008-48414c50 (HALP) ...
Checking for 003 error ...
Checking setting.txt stuff...
Comparing uid.sys against the filesystem...
00010000-00555050 (.UPP) has been deleted
00010000-52535045 (RSPE) has been deleted
00010004-52465045 (RFPE) has been deleted
00010004-52464e50 (RFNP) has been deleted
00010000-534d5745 (SMWE) has been deleted
00010000-52534250 (RSBP) has been deleted
00010000-52363345 (R63E) has been deleted
checking for lost clusters...
found 0 lost clusters
UNK ( 0xffff ) 11 (1044, 1045, 1046, 1047, 4bd0, 4bd1, 4bd2, 4bd3, 4bd4, 4bd5, 4bd6, 4bd7, 5303, 5304, 5305, 5306, 5307)
free 49b1
verifying ecc...
2 out of 888256 pages had incorrect ecc.
they were spread through 2 clusters in 2 blocks:
(2, 6)
0 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 497 files
0 files had bad HMAC data
checking HMAC for superclusters...
0 superClusters had bad HMAC data

Is this the same issue caused to sysconf by comex nand formater?

 

[giantpune]

looks like this little guy might have something to do with it

checking uid.sys...
UIDmap::Check() system menu entry is messed up: 4294967313 1

.....
Checking 00000001-00000002 ...
incorrect uid/gid for "data/setting.txt"

and IIRC, -102 is IOS telling you that you dont have permission to access some file. it is the uid.sys that lists what title owns what file. seems somehow the setting.txt no longer belongs to the system menu.

 

[mauifrog]

Any idea on how to fix uid.sys. The wii is functional, can replace setting.txt with replace tool but that did not help. Only thing I can think of is to use oneswananegger, or somehow fix uid.sys and replace it with fstoolbox.

 

[airline38]

Maybe you can try to use WiiMod (v2.6)

 

[stefanox]

hi giantpune,

can you tell use how we can fix the problem?

looks like this little guy might have something to do with it

checking uid.sys...
UIDmap::Check() system menu entry is messed up: 4294967313 1

.....
Checking 00000001-00000002 ...
incorrect uid/gid for "data/setting.txt"

and IIRC, -102 is IOS telling you that you dont have permission to access some file. it is the uid.sys that lists what title owns what file. seems somehow the setting.txt no longer belongs to the system menu.

 

[giantpune]

i think that by default, that file exists as read-only. so even if it does belongs to a title, it still isnt able to be edited. but that title has the ability to chmod the file and then edit it. comex's formatter creates the file with full read/write permissions, so i dont think that is the cause of the issue. there no telling what kind of stuff you did to the wii to get it in that situation.

im guessing that with all those IOS that are fakesigned, you have at least 1 that has some FS permissions patch applied. you can use that IOS to edit the file directly. and you can use that IOS to try to change the file attributes to allow editing that file with a different IOS.

 

[stefanox]

i think that by default, that file exists as read-only. so even if it does belongs to a title, it still isnt able to be edited. but that title has the ability to chmod the file and then edit it. comex's formatter creates the file with full read/write permissions, so i dont think that is the cause of the issue. there no telling what kind of stuff you did to the wii to get it in that situation.

im guessing that with all those IOS that are fakesigned, you have at least 1 that has some FS permissions patch applied. you can use that IOS to edit the file directly. and you can use that IOS to try to change the file attributes to allow editing that file with a different IOS.

hi giantpune,

i have the nand backup, if you want can you look at it, if it's possible to restore for me?


thnx

 

[SifJar]

From what Giantpune said you should be able to use one of your patched IOS to dump uid.sys from your system with FSToolbox (should be in a folder called "sys" I believe). Then open it in a hex editor. The first 12 bytes should look like this (in hex):

00 00 00 01 00 00 00 02 00 00 10 00

Then reinstall it with FSToolbox.

 

[giantpune]

that is only "normal" first entry. you cant really assume that his system menu UID is 0x1000. i say this because from that error line he posted says that the first entry in the uid.sys is for IOS17 - 0x1.

comex's nand formatter starts counting uids at 1 instead of 0x1000. so it seems like he used that formatter, and it installed first the IOS17 wad, not the system menu. if you do what you are saying, you will probably break more stuff than you will fix.

 

[SifJar]

Oh, OK I understand now. I was just looking at the WiiBrew page briefly. But I understand now that the UID counts up with each installed title, right? So how would he establish the correct UID for 1-2 on his system?

 

[giantpune]

the uid is generated before a title's folder and files are created. if you change an entry in the uid.sys, it will no longer match any of the files and folders that were created with that uid. the proper behaviour would be to change individual files to match what is in the uid.sys.

so, ISFS_SetAttributes() or whatever its called. or read the file to a buffer, delete the file, create the file with different attributes, write the data back.

 

[SifJar]

Ah, OK I understand. So he'll have to dump his uid.sys, check the UID for 1-2 then change setting.txt to have the same UID.

EDIT: Looks like its ISFS_SetAttr()

EDIT: Well I suppose he wouldn't have to dump it, just write a little app to get the correct UID and set setting.txt's UID to the same.

 

[Slimmmmmm]

I've been playing with uid.sys recently.

The wiibrew info seems a bit off, as I often see uid.sys with other entries at the start, not what wiibrew says "The first entry in the file is always Title 1-2" Other things just now are taking my time, so I've not investigated further.

 

[SifJar]

It's basically the order in which titles are installed (or run? seems vague) according to a HackMii post here: http://hackmii.com/2008/07/factory2/

And normally starts at 0x1000 and increments by one each time.

 

[Slimmmmmm]

Thanks SifJar, the info there is a great read (and the links from it).

I've no idea why the start of the file has been diff before when I've seen it, but it must be that it is not a genuine uid I'm looking at, perhaps blanked and created in some app (no idea and it was a while ago while testing some emu nand and save related things). Perhaps I'm mixing the two. From reading that article it would seem most if not all uid are the same at factory point (other than region related).

 

[SifJar]

Yeah, seems so. As GiantPune mentioned, Comex's NAND Formatter does it differently. I guess depending on how you generated the emulated NAND it could have been different. (If it was dumped from a real NAND I guess it should have been same as most, but if it was generated from scratch perhaps it'd be different. Possibly the generator in question "installs" the titles in a different order than factory)

 

[jskyboo]

So this issue is caused by comex's nand formatter? Is there any other way people run into this issue? Airline, with good intentions, recommended using Wii Mod which currently would NOT be able to solve this problem but if this is a fairly common issue I could look into adding in the fix suggested. Currently Wii Mod assumes the system menu uid is 0x1000, and giantpune you said:

you cant really assume that his system menu UID is 0x1000.

What else changes the uid? It would seem normal running of the wii and most homebrew would not cause this problem. Only a few of the more dangerous tools would be able to cause this problem. Are there many other ways to cause this problem?

 

[stefanox]

that is only "normal" first entry. you cant really assume that his system menu UID is 0x1000. i say this because from that error line he posted says that the first entry in the uid.sys is for IOS17 - 0x1.

comex's nand formatter starts counting uids at 1 instead of 0x1000. so it seems like he used that formatter, and it installed first the IOS17 wad, not the system menu. if you do what you are saying, you will probably break more stuff than you will fix.

I dont use the comex nandformater.
the only thing i use was Any Region Changer, thats it.

 

[stefanox]

When i try to restore the format nand, created with giantpunte program
bootmii give me a error,

start bootmii, choose the option restore from sd.
press A, give me the error:
Bootmii not found, its to dangerous to continuem ect. ect