Hacking Boot1

[sylux92]

What makes the boot1 not able to load bootmii in boot2? What changed from the vulnerable boot1? Could bootmii be fixed to work on these? Sorry if this has been asked before, I searched but didn't really find anything helpful.

 

[nabster92]

Nintendo fixed the hole that made boot1 vulnerable in newer Wii's, and boot1 is a one time programmed thing that can't be changed so it can't be fixed (as far as we know now).

One thing I'm not sure about though is if everyone's Wii that can't install boot2 bootmii at the moment really doesn't have a vulnerable boot1. Is it possible that with all the extensive checking Team Twiizers went through to avoid bricking people it blocked more installs than possibly necessary? A friend of mine told me it wouldn't let him install to boot2 on his launch Wii, which struck me as a bit odd. So maybe it would be possible to at least extend compatibility to a limited amount of users that may not actually have a fixed boot1, but maybe something else that the current beta version didn't want to risk attempting an install with?

 

[trumpet-205]

Boot1 is read only. So bootmii cannot modify it no matter what.

You can't install at launch Wii probably because it has been soft-modded extensively. Hackmii does run sanity check.

 

[FenrirWolf]

To clarify, boot1 can technically be overwritten on any Wii. The problem is that its SHA-1 hash is read-only, so after loading boot0 the Wii would brick after it saw that the signatures didn't match since there's no way to fakesign the boot1 install. So yeah, the moral of the story is don't try overwriting boot1.

 

[MicShadow]

The trucha signing bug has been fixed in boot1 now. It had it in before, which is read only, which is prettyy stupid for nintendo.

Thats why new systems will not be able to use boot2 for custom software. Unless theres another signing bug lol

 

[WiiPower]

Added the answer to the question to my FAQ:
http://gbatemp.net/index.php?showtopic=155844