Hacking BootMii

[FOUNTAINEER]

So once i have TH and bootmii installed with 3.4 backed up. what is the point of updating to 4.0 with wininkoko downgrade?

if i have 3.4u backed up with bootmii and i update to 4.0 through nintendo will i be able to restore to 3.4 using my backup? i guess the first question is whether official 4.0 will uninstall bootmii?

Yes you can restore your 3.4 firmware that way. Installing 4.0 will not overwrite bootmii.
for restoring the backup, you should have installed bootmii as boot2. that's the safest.

 

[kedest]

So once i have TH and bootmii installed with 3.4 backed up. what is the point of updating to 4.0 with wininkoko downgrade?

if i have 3.4u backed up with bootmii and i update to 4.0 through nintendo will i be able to restore to 3.4 using my backup? i guess the first question is whether official 4.0 will uninstall bootmii?

Yes you can restore your 3.4 firmware that way. Installing 4.0 will not overwrite bootmii.
for restoring the backup, you should have installed bootmii as boot2. that's the safest.

waninkoko's updater lets more of the hacking stuff untouched. but to be honest, i really don't know the exact details
there were some reports of that updater crashing/locking during installation, resulting in a bricked wii. But with a bootmii backup, you should be able to restore that.
I didn't encounter such a problem though, I've succesfully updated to 4.0 using waninkoko's application yesterday

 

[nIxx]

Anyways, I'm going to attempt to flash my Wii with a NAND dump from a fellow friend's system within the next few days. I'll thoroughly test it out and post the results when I get around to it.

I don't think you can do that, I thought I saw somebody ask about this somewhere (I can't find it atm) and someone else replied and said that it would brick the wii because of the signing stuff in NAND

(pulls himself away from work... dammit)

Even with a boot2 installation? I thought that the boot2 installation gave you virtually the same capabilities for backup/restore as that of the infectus chip sans soldering?

Well in any case, I'll do some research and test the waters before I dive in. Lemme know if you find that post.

@FenrirWolf - That sounds logical. But I still want to get my hands on another NAND dump for research purposes.

Happy bricking

.
Yeah you will definatly brick your Wii every Wii has a unique ID (like the PSP) that is used with the signing.
So if the dump is not from your Wii it will not work but most likely Team Tweezer have anyway added a check for the ID and don´t even let you install it.

 

[rommy667]

em i installed it as boot 2 but their is nothing happening when i reboot the wii how do u get it to boot bootmii lol????

 

[nIxx]

Prepare SD Card !?

 

[kedest]

em i installed it as boot 2 but their is nothing happening when i reboot the wii how do u get it to boot bootmii lol????

the bootmii file structure has to on sd.
otherwise, bootmii menu will skip and system menu will be booted directly

 

[rommy667]

Their is a file structure on the sd card in a bootmii folder do i have to change the ini to tell it boot bootmii? if so what do i change the sysmenu to? thanks for the help

 

[Jacobeian]

no, it goes to bootmii by default when the wii is powered

the ini file let you configure the video signal (NTSC,PAL60 or PAL50) as well as the autoboot method (directly launch either the HBC or the original system Menu, without user input)
If you don't want to use the autoboot feature, you just comment this line (it is commented by default)

 

[FenrirWolf]

The HBC is upgraded to add BootMii to the menu when you press HOME.

Only for users who have installed BootMii as an Ios.

Hmmm... Currently, I'm using the boot2 with "AUTOBOOT=xxx" method. For those of us using this method without installing the IOS... It would be nice to have a link in HBC that would reboot the Wii into BootMii without autobooting.

What do you guys think?? I think I'll put this suggestion on the BootMii forum too.

Just install the IOS. That way you have the best of both worlds.

 

[FGOD]

anybody has any idea on how to get the sd card be read on pc after the format/backup with the bootmii nand dumper? i cannot back it up to pc as the sd card cannot be read on pc :s

That's odd. Does the SD partition appear in Disk Management? (start -> run -> compmgmt.msc -> disk management)
Also try to access it with a Linux LiveCD (e.g. Knoppix).

thanks, i'll try both the options, and report back tomorrow (i'm going to bed now...)

it is indeed a very odd issue... in windows he keeps on asking to format the sd card when i try to read it after the nand dump... tried formatting to fat and fat32 in windows and doing a dump afterwards... never had any problems with the card :s

for some strange reason i did the backup today, formatted my sd with bootmii, did the backup, put the sd in the card reader and today it did read the card :s same card same setup :s but thanks anyway for the help

Same thing happened to me. First, I made a backup of my 3.2 system. I copied that succesfully to my computer.
Then I updated my wii to 4.0 and again made a backup of that. But this time, the computer refused to read the card and claimed it was unformatted. But when I put the card back in the wii and used the sd browsing feature of bootmii, it could read the card just fine. So I then i made the backup again in bootmii and tried copying it again to computer. And this time it worked.
So it's defenitely a bug somewhere. Perhaps bootmii doesn't unmount the card properly or something like that.

Most likely... I wouldn't know what else could be the problem.

 

[fogbank]

i read the limitations to ios vs boot2. not super clear whether it's something that they will be able to change in the future or the limitation is permanent to those with newer wiis?

It's hardware. So you're good to go on the boot2 method. I installed it on my 4.0 system (bought in early 07) without a hitch.

No it's not hardware. It is a new boot1 that does not have the fakesigning bug so you cannot install a modified boot2. Both boot1 and boot2 are software. Boot1 is factory programmed and cannot be modified because its hash is stored in OTP (one time programming).

In other words boot1 is technically overwritable (it's on the NAND) but cannot feasibly be modified because its hash would then not match the hash stored in the OTP rom area.

 

[ecw]

i read the limitations to ios vs boot2. not super clear whether it's something that they will be able to change in the future or the limitation is permanent to those with newer wiis?

It's hardware. So you're good to go on the boot2 method. I installed it on my 4.0 system (bought in early 07) without a hitch.

No it's not hardware. It is a new boot1 that does not have the fakesigning bug so you cannot install a modified boot2. Both boot1 and boot2 are software. Boot1 is factory programmed and cannot be modified because its hash is stored in OTP (one time programming).

In other words boot1 is technically overwritable (it's on the NAND) but cannot feasibly be modified because its hash would then not match the hash stored in the OTP rom area.

So if you could make the OTP "think" the hash is correct, we would be ok? Kind of like tricking Microsofts WGA into thinking you have a valid key. Possible?

 

[Det1re]

Installed as IOS (no boot2 for me...):
Successfully backuped the nand to a 1GB SDCard (Transcend).

For those wondering how much does it take : 600MB!

WTF? Mine's 528MB...are you shure yours isn't corrupted or something like that? Never heard of such a big backup...well, if it works, then it's good for you...

It probably depends on how much it's filled. His is probably filled to the brim with saves, channels, wiiware etc.

This has nothing to do with the actual size of the dump. If the NAND has free blocks, the nand.bin will get zeros for this places. So the size of the dump should be equal for pretty much everyone.

 

[WiiBlaster]

Installed as IOS (no boot2 for me...):
Successfully backuped the nand to a 1GB SDCard (Transcend).

For those wondering how much does it take : 600MB!

WTF? Mine's 528MB...are you shure yours isn't corrupted or something like that? Never heard of such a big backup...well, if it works, then it's good for you...

It probably depends on how much it's filled. His is probably filled to the brim with saves, channels, wiiware etc.

This has nothing to do with the actual size of the dump. If the NAND has free blocks, the nand.bin will get zeros for this places. So the size of the dump should be equal for pretty much everyone.

Hea i have a few wiis and they all have the same exact size nand dump, anyways sense i had bootmii installed has boot2 thought i'd play around with it, Something funny i found which i should have guessed it would do, Was patching the system menu to use the bootmii IOS254 does make bootmii startup on boot (I know it doesn't help for protection), for wii's that has the newer boot1 but, it puts bootmii into a Loop you can never get to the system menu, I knew it would do this anyways, but thought it was funny,

but what it does mean is that someone could make a special IOS just for the system menu but it would take alot of work, so people with the newer boot1 could atleast get bootmii on startup, But it still doesn't really help for anything just playing around with it

 

[fogbank]

So if you could make the OTP "think" the hash is correct, we would be ok? Kind of like tricking Microsofts WGA into thinking you have a valid key. Possible?

Pretty much impossible. Besides it would actually involve making boot0 think that the boot1 hash is correct, even though it doesn't match the hash stored in OTP.

 

[Patryc]

no, it goes to bootmii by default when the wii is powered

the ini file let you configure the video signal (NTSC,PAL60 or PAL50) as well as the autoboot method (directly launch either the HBC or the original system Menu, without user input)
If you don't want to use the autoboot feature, you just comment this line (it is commented by default)

Strange... my system always goes to the system menu by default (no card in slot)

 

[kedest]

no, it goes to bootmii by default when the wii is powered

the ini file let you configure the video signal (NTSC,PAL60 or PAL50) as well as the autoboot method (directly launch either the HBC or the original system Menu, without user input)
If you don't want to use the autoboot feature, you just comment this line (it is commented by default)

Strange... my system always goes to the system menu by default (no card in slot)

the bootmii menu will only load if there is a sd card with the \bootmii\ directory on it

 

[tenpmetabg]

again, don't expect everyone to have the patience about reading a ton of text like you, some of us can't do that and don't intend on wasting out rime to do it either.

Agree : If only they have read the (short) README file include, they even wouldn't have to come here to ask.

... Stupid they remain : they finally "wasted" time

 

[jesterscourt]

no, it goes to bootmii by default when the wii is powered

the ini file let you configure the video signal (NTSC,PAL60 or PAL50) as well as the autoboot method (directly launch either the HBC or the original system Menu, without user input)
If you don't want to use the autoboot feature, you just comment this line (it is commented by default)

Strange... my system always goes to the system menu by default (no card in slot)

the bootmii menu will only load if there is a sd card with the \bootmii\ directory on it

Correct, however I directly copied my BootMii directory and assorted files over to another SDHC 8 gb card that I had from before, and it bypassed BootMii altogether. Put in the original "BootMii" SD, and it went to the BootMii menu. I even changed the ini to go to HBC, and still, straight to system menu with the 8 gb card. Is it the card?

 

[Det1re]

Correct, however I directly copied my BootMii directory and assorted files over to another SDHC 8 gb card that I had from before, and it bypassed BootMii altogether. Put in the original "BootMii" SD, and it went to the BootMii menu. I even changed the ini to go to HBC, and still, straight to system menu with the 8 gb card. Is it the card?

It might be the SDHC driver. Try an 2GB-Card.