Hacking Can we write a new boot2?

[Keylogger]

Hi,
Sorry for my bad english

I can't install bootmii on my Wii. I have an incompatible boot2.

I saw the file "boot2-64-v2.wad" in some ISO
If I install this file using wad Manager, will it brick my wii or does it will write a new boot2 compatible with bootmii?

Thanks

 

[Vidboy10]

We would need alot of Hardcore hackers to do that.

 

[WiiPower]

Sorry, but it's boot1 that loads boot2. And BootMii is installed as boot2.

boot1 is fixed in all new Wiis, and boot1 is on a read-only part of the nand. After the Wii is produced, the boot1 can never ever be changed again. This means, nintendo can't update boot1 to block BootMii with future updates, but this also means, that already patched Wiis can never install BootMii as boot2.

 

[schnitzelbrain]

Sorry, but it's boot1 that loads boot2. And BootMii is installed as boot2.

boot1 is fixed in all new Wiis, and boot1 is on a read-only part of the nand. After the Wii is produced, the boot1 can never ever be changed again. This means, nintendo can't update boot1 to block BootMii with future updates, but this also means, that already patched Wiis can never install BootMii as boot2.

to be correct, the boot1 is not read only but the hash for boot1 is. Its to tell the system that boot1 is valid. This hash is stored in a one time programable area at manufacture.

So
Boot0 -> one time programed at manufacture
Boot1 -> reprogram possible BUT the hash is stored permaned, so no reprogramming possible at last.
Boot2 -> reprogram possible. But valid only with bugged Boot1 due to a compare bug of the validation of Boot2. This Bug let the Boot1 think the Boot2 is valid.

 

[Screemer]

Sorry, but it's boot1 that loads boot2. And BootMii is installed as boot2.

boot1 is fixed in all new Wiis, and boot1 is on a read-only part of the nand. After the Wii is produced, the boot1 can never ever be changed again. This means, nintendo can't update boot1 to block BootMii with future updates, but this also means, that already patched Wiis can never install BootMii as boot2.

not completely correct. boot1 is writable too but it's sha1 hash is stored in a unwritable rom in starlet.

€dit: maybe i shouldn't leave my taps open for an hour.

 

[bushing]

We would need alot of Hardcore hackers to do that.

> 9000 Hardcore hackers?

 

[gunslinger]

actually BOOT2.etc.etc.WAD *is* the boot2, isn't it? How can i disassemble and analyzse those boot files (and how to get them?) in IDA?

 

[Apekop]

Im not a programmer but if this is a question of getting a lot of pc power, I'll run a program.

 

[OSW]

Keylogger - do not try to overwrite your boot2 with wad manager. It won't help you at all.

I'll close this thread so it doesnt go off the rails.