Hacking .app file format?

[externalist]

I'm trying to understand the files in a Virtual Console wad file. The one I'm looking at right now has 5 different extensions. I can figure out the other four but there are a bunch of .app files starting from 00000000.app to 00000008.app and I have absolutely no idea what their format is. I heard they contain resources for the game and all the .app files are not one single format, but different formats and only the extensions are the same and the number in the file name identifies the purpose of the file. I searched for info about these .app files but "app" is a very common abbreviation for 'application' so googling gives so may irrelevant results. I just thought someone here already knows about this stuff and could give me a little advice.

Links to info about app files or even posts on a forum would be very helpful. Thanks.

 

[SifJar]

Most .app files in IOS are U8 archives which can be extracted with any U8 tool.

In channels, 00000000.app is NAND Loader
00000001.app is the .dol file (binary)
00000002.app is the banner (U8 archive with sound.bin, banner.bin and icon.bin. The last two are themselves U8 archives.)
The rest are other files, usually U8 archives.

I think this is correct, but it might not be.

 

[A252]

Most .app files in IOS are U8 archives which can be extracted with any U8 tool.

In channels, 00000000.app is NAND Loader
00000001.app is the .dol file (binary)
00000002.app is the banner (U8 archive with sound.bin, banner.bin and icon.bin. The last two are themselves U8 archives.)
The rest are other files, usually U8 archives.

I think this is correct, but it might not be.

00000000.app is the banner and 00000002.app is the NAND loader

 

[tj_cool]

00000000.app = Banner/Icon/Sound
00000001.app = NAND loader
00000002.app = the internal dol

 

[XFlak]

thx, i can never remember what's what, i just copied and pasted this into a "wad app file legend" text file for future reference

cheers

 

[Leathl]

It can vary.. The boot index (described in the tmd, read up on wiibrew) defines which app file will be loaded first. That's the nand loader.
The nandloader and dol executable can also be combined like in the HBC.

 

[tj_cool]

It can vary.. The boot index (described in the tmd, read up on wiibrew) defines which app file will be loaded first. That's the nand loader.
The nandloader and dol executable can also be combined like in the HBC.

Thx, I was already wondering why we all said somthing different

 

[XFlak]

@ Leathl, for channels made using customize mii, do they follow the same 'legend' tj_cool posted HERE

I just want to know the most common case, so that next time I need to unpack a wad I will have a good guess at what each file is (even if it isn't 100%, its better than nothing, and probably easier than trying to locate the boot index you references earlier)

 

[externalist]

Thanks for the U8 archive tip! Now I have all the files extracted.

I have a lot of questions though.

I realized the target being analyzed was not a virtual console, so I decided to drop the target and get a real Virtual Console wad.
What questions me is that I thought wad files were in a emulator+rom+resources form, but it turned out to be a standalone game, not a game from another console. Which makes wonder, what are wad files anyway? So far I understand that they're an installer format targeted specifically for the Wii like microsoft windows installer .msi files, but where do those wad files come from in the first place? I think I read somewhere that you can download games officially from nintendo(haven't tried it out yet, I just bought my Wii), so my thought is that when you download a game from the official nintendo server through the Wii channel, it actually downloads the wad file of the game and merely installs it. The wad file could be either a game from another console, making it contain an emulator or a rom, or just a standalone game created for wii. Those wad files are created internally from Nintendo, and all the .wad game files created by the community is done by just leaving everything alone in the wad file to preserve the functionality of the emulator, and merely replacing the rom, and update banners and icons and such. And people call those a "Virtual Console" wad, and the one I was just analyzing is a "Wiiware" wad. Am I correct so far? Please correct me if I'm wrong. I'm all new to this Wii hacking scene and I'm willing to learn more so I could possibly give something back to the community.

Now after extracting everything, I had 2 files left that didn't seem to be a U8 archive. So I looked into it in a hex editor and confirmed that it was a .dol file. One of them had several names of SNES games in it so I'm assuming it's the emulator part. The other one... I just can't guess really. If my memory is correct, Wii runs one .dol file at a time, so what would be the need for 2 .dol files? What is the other one?

While writing this post, I got curious and converted the .dol file to .elf and loaded it to IDA to see if I can find some clues but the .dol file doesn't even have a proper entry point and IDA fails! The other .dol that I assumed as emulator loads fine.

So what is this other .dol? If it doesn't have an entrypoint, it won't execute so seems like garbage to me. Any advice/pointers?

 

[externalist]

Wow, at the time I was writing only 1 reply was up, I was surprised to see so many! Thanks for the support guys.

00000000.app = Banner/Icon/Sound
00000001.app = NAND loader
00000002.app = the internal dol

there are a couple more .app files, up to 00000006.app, and I'm assuming that all Virtual Console wads are like that, but seeing that 00000000.app indeed contains Banner/Icon/Sound like you said, I guess I can think that 00000001.app is indeed the NAND loader despite the fact that the internal dol is not 00000002.app, but 00000006.app. Am I right?

QUOTE(Leathl @ Feb 17 2010, 01:10 AM) It can vary.. The boot index (described in the tmd, read up on wiibrew) defines which app file will be loaded first. That's the nand loader.
The nandloader and dol executable can also be combined like in the HBC.

So if the boot index is something like 0x1 then 00000001.app will be executed?

 

[techboy]

files, up to 00000006.app
They're extra resources. In many official wads they'll contain things like graphics for the HOME menu, game ROMs and maybe the User Manual if the game has one.

So if the boot index is something like 0x1 then 00000001.app will be executed?
Yes.

QUOTE

the fact that the internal dol is not 00000002.app,

In official channels (at least the ones I've unpacked), 00000001.app was the DOL. The NAND loader is often the last (highest numbered) content.

 

[Daco]

It can vary.. The boot index (described in the tmd, read up on wiibrew) defines which app file will be loaded first. That's the nand loader.
The nandloader and dol executable can also be combined like in the HBC.

or priiloader

 

[tueidj]

The only place you're likely to find "proper" wad files is inside the update partition of a disc. Wiiware/VC games aren't downloaded in wad format, and in fact it can only very loosely be called a format at all - it's really just all the relevant files rounded up to 64-byte multiples and concatenated together.

 

[Leathl]

@ Leathl, for channels made using customize mii, do they follow the same 'legend' tj_cool posted HERE

I just want to know the most common case, so that next time I need to unpack a wad I will have a good guess at what each file is (even if it isn't 100%, its better than nothing, and probably easier than trying to locate the boot index you references earlier)

For comex nandloader, 01.app is the nandloader and 02.app the dol.
For waninkokos nandloader, 02.app is the nandloader and 01.app the dol.

 

[Daco]

For comex nandloader, 01.app is the nandloader and 02.app the dol.
For waninkokos nandloader, 02.app is the nandloader and 01.app the dol.

in that case comex' makes much more sense

 

[externalist]

The only place you're likely to find "proper" wad files is inside the update partition of a disc. Wiiware/VC games aren't downloaded in wad format, and in fact it can only very loosely be called a format at all - it's really just all the relevant files rounded up to 64-byte multiples and concatenated together.

So the Wiiware games are sold in a CD, and you dump the CD contents and extract the .wad file out of it, and the same goes for Virtual console games? Is that how it works?
Another question. What exactly is a NAND loader, what role does it play in the loading of the game? Thanks!

 

[techboy]

So the Wiiware games are sold in a CD, and you dump the CD contents and extract the .wad file out of it, and the same goes for Virtual console games? Is that how it works?

Wiiware/VC is never found on a CD (actually a DVD)...ever!

Wiiware & VC are never officially distributed in WAD format. We just pack them into a WAD to make sharing/piracy easier (otherwise each title would come as a zip file full of a TMD, Ticket, and numerous contents).

And just for reference (for n00bs, so they hopefully won't ask)...titles on NUS are stored as individual encrypted contents, plus a TMD, and optionally a ticket. We can get wads with tools like NUS Downloader only because NUSD packs those individual parts into WADs.

 

[externalist]

So the Wiiware games are sold in a CD, and you dump the CD contents and extract the .wad file out of it, and the same goes for Virtual console games? Is that how it works?

Wiiware/VC is never found on a CD (actually a DVD)...ever!

Wiiware & VC are never officially distributed in WAD format. We just pack them into a WAD to make sharing/piracy easier (otherwise each title would come as a zip file full of a TMD, Ticket, and numerous contents).

And just for reference (for n00bs, so they hopefully won't ask)...titles on NUS are stored as individual encrypted contents, plus a TMD, and optionally a ticket. We can get wads with tools like NUS Downloader only because NUSD packs those individual parts into WADs.

Thanks for the reply.

I know that people make Virtual Console games by replacing the rom file with another one and repacking the .wad but how do people make a Wiiware game wad? Extract necessary contents to run the game from the .iso and repack them into a .wad file? Can you possibly point me to a link or tutorial that explains the process? Thanks.

 

[techboy]

Thanks for the reply.

I know that people make Virtual Console games by replacing the rom file with another one and repacking the .wad but how do people make a Wiiware game wad? Extract necessary contents to run the game from the .iso and repack them into a .wad file? Can you possibly point me to a link or tutorial that explains the process? Thanks.

You got the VC part right. It's called "injection". If you look around you'll find quite a few injected VC wads.

ISO is a DVD image. Wiiware & VC are never stored in an ISO at any point, since they are never on a DVD in the first place.

Here's how a pirate VC/WW Wad is made if you're curious:

* Someone starts with a hacked wii that has cIOS installed.
* The person making the WAD purchases the game from the Wii Shop and installs it on their wii. (Yeah, someone pays for it originally!)
* They then use any number of methods to create a WAD from the files installed on the wii. One of the most common methods nowadays is to use Waninkoko's Wad Creator or Bluedump. These applications (which use cIOS) grab the TMD, Ticket, and Content from the NAND, pack it into a WAD, and save the WAD to the SD card. Other methods do exist.

* The person then puts the SD in the computer. Here, they trucha sign the WAD so it will install other people's wiis using a packer tool like wwPacker. The trucha signed WAD is the final WAD that gets released on torrents and such.

Hopefully that explains well enough where VC/WW wads come from. Every single one of them is pirate content...and exactly 0% are legal.

 

[Bumpman]

Hopefully that explains well enough where VC/WW wads come from. Every single one of them is pirate content...and exactly 0% are legal.

Except for the original one.