Hacking Anyone know IOS ARM ASM?

[damysteryman]

Does anybody know ARM ASM code for IOS, are experienced with IDA pro (v5.2), and are experienced with IOS hacking?

Because I could really use some help. I've disassembled the DIP modules of cISO249 rev14 and rev15, and am trying to compare them, but I don't know any ARM ASM (lol, I feel like a noob).

What the goal is, is to hack back in DL disc support into rev14's DIP (without the error 001 bug that rev15 has), and maybe add some sort of trainer to the DIP that patches NSMBWii's main.dol (with the anti-piracy removal patch) before executing it.

If anyone can do such things, could you please post here or pm me, and I'll pm you my .idb files for rev14 DIP and rev15 DIP when I tried disassembling them.

 

[WiiPower]

Don't do the main.dol patch there. Rev14 is the 1st clean cIOS since rev7, please keep it that way. I already had the same idea, and had Nicksasa working on it.

46090000 is a value you should be able to find in the cIOS, while the correct value for SL is 460A0000. Replacing that value by 460B0000 gets me the rev15 issues(001 disc, green screen freeze usb) but wihout Sam & Max fix relation(i think) on SL discs. Setting it to 460A0000 as it should be correct, gets the very same results as rev14 itself, same bug in SSBB intro, but no 001 erros. I guess there's some other value used for 1st layer inside DL discs, the value i'm talking about is for SL only i think.

But with that patch i guess, rev14 would have at least not the risk of having problems with big SL discs as you can see 256KB are not accessed.

 

[Helwem]

but error 001 is only in the disc channel? could not in rev13-ios rv14 in the system ios and rev15 in the ios53?

 

[Slimmmmmm]

Sounds a great idea, wish I could help but I tried IDA for about 10 minutes before and decided it was waaaaaay to hard for me to learn (plus I couldn't find a working .dol plugin)

Reading this topic I started to think that maybe you are going to end up with the "ultimate cIOS" based off of Waninkokos cIOS and then I had some thoughts.

Why do you always choose wanins cIOS and not Hermes ?

What would make the Ultimte cIOS ? (rockband/GH, wiispeak, DL, usb2, NSMB, block IOS reload)
If you could get all these fixes within ONE cIOS it would rule big time, and we could install it to an empty slot so not needing to compromise on anything, just all gain then.

This is some complicated stuff trying to sort ALL the problems within one cIOS
Anyway, I'm sure you'll surprise us all da_letter_a as always. Good luck

Is this maybe a way to go --> http://wiibrew.org/wiki/Custom_IOS_Module_Toolkit

 

[WiiPower]

There's a working .dol plugin for IDA, but it does not work on the free version, i guess that was your problem.

 

[Slimmmmmm]

No laziness to go find the dol plugin was my problem

Also opening up IDA and looking at how complex it was, reading a little about how to use it (terminology & learning) nearly caused me to go blind. I do have a retail version of it gathering dust...till....."one day" (that I put off)

 

[Jacobeian]

It's probably easier to just ask Waninkoko for the DIP module sourcecode, then use Neimod's toolkit to build the IOS (like Waninkoko is doing)

I don't think there is such things possible as "hack back in DL disc support into rev14's DIP", you can't add unexisting features in a program by just disassembling and patching the binary, this only works for quick and limited stuff, what you need is to recompile sourcecode.

 

[WiiPower]

It's probably easier to just ask Waninkoko for the DIP module sourcecode, then use Neimod's toolkit to build the IOS (like Waninkoko is doing)

I don't think there is such things possible as "hack back in DL disc support into rev14's DIP", you can't add unexisting features in a program by just disassembling and patching the binary, this only works for quick and limited stuff, what you need is to recompile sourcecode.

At the moment it looks like i won't get the source. Some people claim to have it, but if they release something, it will be closed source again. Anyways, in rev14 there's just one or two values wrong that prevent to read the end of the 1st layer on DL discs. Waninkoko even confirmed that there's just some wrong value.

 

[Slimmmmmm]

It's probably easier to just ask Waninkoko for the DIP module sourcecode, then use Neimod's toolkit to build the IOS (like Waninkoko is doing)

I don't think there is such things possible as "hack back in DL disc support into rev14's DIP", you can't add unexisting features in a program by just disassembling and patching the binary, this only works for quick and limited stuff, what you need is to recompile sourcecode.

I'm thinking the same as you on this, hence why I posted the link to the toolkit. But I'm more thinking of looking at Hermes as he seems to like to teach people things (have you saw the zillion tutorials he's wrote)

My coding is VERY limited, and not much time to learn, but taking toolkit + Hermes seems to me the most complete and logical solution for future cIOS. Maybe then we can start to have cIOS that instead of purely updating call external modules into play and these modules can then be updated by more than just 2 people. But what do I know

 

[damysteryman]

Thanks for the infos WiiPower. I've seen that value while looking at the DIP modules. I'll try messing with it and see what happens.

I have a different idea: maybe put the value 460A0000 in rev15's DIP to fix the 001 error and to have NSMBW compatibility, at the expense of DL support in IOS53. I'll try that too.

 

[damysteryman]

I've checked rev15's DIP, and it has the correct values for both SL and DL discs. It seems to use an array which has both 460A0000 and 7ED40000, rather than just using 46090000 like rev14, so I'm not too sure why this is causing the 001 error. (possibly using the wrong value at the wrong time?)

I've changed one value in cIOS249 rev15, but I doubt it will actually change anything. If you want to test it, just tell me, and I'll pm you.

P.S. I only need one tester to see if it works, so if you don't get a response from me, it means that somebody beat you to it.

 

[retKHAAAN]

check your pm

 

[WiiPower]

Get SoftChip r101, you can switch the Sam & Max fix on/off in it, which should help a little. And about the usb issue, get NeoGamma and any other usb loader to test.