Gaming Can you hack the Wii Mini?

Superman321

Well-Known Member
Newcomer
Joined
May 26, 2018
Messages
78
Trophies
0
XP
369
Country
Germany
i found this on reddit:

"The amount of idiocy in these comments is appalling.

  1. The Wii Mini has no SD Card slot. Therefore you can't do anything homebrew related with it.

  2. The Wii Mini has no internet. Therefore Flashhax is impossible.

  3. You can technically actually get homebrew access by modifying the nand and injecting the Homebrew Channel, but that requires soldering to the board to back up the nand. I have also not found a tutorial for this anywhere."
 

Trash_Bandatcoot

Your Local Random Internet Geek
Member
Joined
Jul 14, 2018
Messages
1,193
Trophies
1
XP
3,896
Country
Netherlands
Unfortunatly, no(t yet).
Maybe something like a disc swap exploit may work, or maybe an exploit via USB, but without an SD card slot or internet connections, there is then for now no exploits.

Also,
i found this on reddit: You can technically actually get homebrew access by modifying the nand and injecting the Homebrew Channel, but that requires soldering to the board to back up the nand. I have also not found a tutorial for this anywhere."
You mean a hardmod? (also hey superman321 i hope you regonice me from discord)
 

Superman321

Well-Known Member
Newcomer
Joined
May 26, 2018
Messages
78
Trophies
0
XP
369
Country
Germany
Unfortunatly, no(t yet).
Maybe something like a disc swap exploit may work, or maybe an exploit via USB, but without an SD card slot or internet connections, there is then for now no exploits.

Also,

You mean a hardmod? (also hey superman321 i hope you regonice me from discord)

Yeah i think so
 

contezero

Well-Known Member
Member
Joined
Jul 25, 2016
Messages
214
Trophies
0
Age
47
XP
1,657
Country
Italy
No hack at the moment. Modding the nand is impossibile, even with an hardware flasher because the nand is encrypted and we need the unique per console key. To extract it we need homebrew and to have homebrew we need and entrypoint. In the classic wiis the entrypoint was a file moved from sd card to the nand, using the wii memory management utility. This utility was modified and is not able to access anymore the sd card (that is also not present but can be added, probably). Another entrypoint was a file read directly from the sd card; same problem because it seems that the access to sd was removed from the system. Another entrypoint was the browser, that is not present on the wii mini.

From what I read about that topic it should be possibile to connect an ODE, like WODE or WKF or to swap the drive, rewiring the connector, with a slot in drive able to read burned disks. That way wii backups (region locked) could be loaded but not homebrews.
 

Ryccardo

watching Thames TV from London
Member
Joined
Feb 13, 2015
Messages
7,406
Trophies
0
Age
27
Location
Imola
XP
6,384
Country
Italy
Another entrypoint was a file read directly from the sd card; same problem because it seems that the access to sd was removed from the system
It is likely vulnerable to Wilbrand/letterbomb (a better guess could be made by playing a game that saves a picture to the message board, entering the photo channel - if it has one - and duplicating it 250 times or so to fill it up, and seeing if it asks to "insert an SD" to export the messages) - but you would likely need to desolder the CPU and put a custom board in the middle to access the SD pins...

---

And the nand key could be bruteforceable (assuming boot1 is unchanged from the newest regular models, and the encryption type is suitable for a known plaintext attack) - but yeah, ultimately it will be more about bragging rights than a practical effort (especially given how the "mini" is more expensive than regular models and, after accounting for the fact it's a toploader, actually needs more space!!)
 
Last edited by Ryccardo,

contezero

Well-Known Member
Member
Joined
Jul 25, 2016
Messages
214
Trophies
0
Age
47
XP
1,657
Country
Italy
It is likely vulnerable to Wilbrand/letterbomb (a better guess could be made by playing a game that saves a picture to the message board, entering the photo channel - if it has one - and duplicating it 250 times or so to fill it up, and seeing if it asks to "insert an SD" to export the messages) - but you would likely need to desolder the CPU and put a custom board in the middle to access the SD pins...

---

And the nand key could be bruteforceable (assuming boot1 is unchanged from the newest regular models, and the encryption type is suitable for a known plaintext attack) - but yeah, ultimately it will be more about bragging rights than a practical effort (especially given how the "mini" is more expensive than regular models and, after accounting for the fact it's a toploader, actually needs more space!!)

You do not need to remove the cpu to access sd card pins. All pins of the peripherals (gamecube controllers, gamecube memory cards, sd card, wifi card and even component out) are accessibile. The only one missing is the second usb port (you need to connect a wire under the cpu). Did you had a look to the delaminated wii images you can found on modding sistes? It's almost like having the schematics and you can guess where the pins are. The wii mini motherboard was redesigned but the surrouding of the cpu/gpu are almost the same. Wilbrand/letterbomb needs access to sd card. Filling the internal memory could be an idea. Worst case scenario the system doesn't recognize the sd card.
 

Technocxt1394

Active Member
Newcomer
Joined
Dec 19, 2018
Messages
30
Trophies
0
Location
Swinging on the Hills Hoist
XP
58
Country
Australia
Quite interesting guys! Im quite interested in original Wii stuff but this is pretty similar. Keep up the great work all!

--------------------- MERGED ---------------------------

Also, if any of you need nand keys or anything for the wii mini I'd be happy to dump the files for Y'all
 

Ryccardo

watching Thames TV from London
Member
Joined
Feb 13, 2015
Messages
7,406
Trophies
0
Age
27
Location
Imola
XP
6,384
Country
Italy

contezero

Well-Known Member
Member
Joined
Jul 25, 2016
Messages
214
Trophies
0
Age
47
XP
1,657
Country
Italy
Haven't found annotated photos of the Mini, just (and with some difficulty) of the optical drive connector - and of someone thinking an IOS with the version number changed remains signed: https://bitbuilt.net/forums/index.php?threads/wii-mini-hacking.1871/

Yeah, I am following those threads, also the discord channel but nothing surfaced. It's unclear if really some people tried and failed or didn't tried at all. What we are missing is a detailed description of all the possible attacks and how they failed. A "failure report" would be helpful for people trying in the future so they won't have to reinvent the wheel. I have two wii minis and two Wode to test and also a bunch of normal wiis non working if I need some spare parts. I just need some time to play with them.

From what I've learned we have two paths to follow: the traditional one, executing some homebrew and retrieve the keys and one useful only for wii mini: try to force a system recovery and install a full system with all we need to use the traditional way.

A third, unpractical, hypothesis is an hardware attack, bruteforcing the keys and dumping/writing the nand with a flasher or sniffing/dumping the ram when the wii starts.
 

leseratte

Wiimmfi Team
Member
Joined
Jun 2, 2012
Messages
440
Trophies
0
XP
1,635
Country
Germany
Interesting theory. Has anyone tested that in more detail? Is it true, that 1. the Wii doesn't verify the whole UPDATE partition, only single files, and 2. you can modify a title's TMD without breaking any signature for the WAD?
 
  • Like
Reactions: Technocxt1394

Technocxt1394

Active Member
Newcomer
Joined
Dec 19, 2018
Messages
30
Trophies
0
Location
Swinging on the Hills Hoist
XP
58
Country
Australia
Interesting theory. Has anyone tested that in more detail? Is it true, that 1. the Wii doesn't verify the whole UPDATE partition, only single files, and 2. you can modify a title's TMD without breaking any signature for the WAD?
I think the update partition gets checked in staged though don't quote me on it
 

leseratte

Wiimmfi Team
Member
Joined
Jun 2, 2012
Messages
440
Trophies
0
XP
1,635
Country
Germany
That would be something one can test with a normal Wii with modchip, right? it doesn't have to be a Mini to test that theory.

Grab SSBB, replace IOS36v{whatever} with IOS36v65535, burn to disc, put in Wii, see if it installs.
 
  • Like
Reactions: Technocxt1394

contezero

Well-Known Member
Member
Joined
Jul 25, 2016
Messages
214
Trophies
0
Age
47
XP
1,657
Country
Italy
That would be something one can test with a normal Wii with modchip, right? it doesn't have to be a Mini to test that theory.

Grab SSBB, replace IOS36v{whatever} with IOS36v65535, burn to disc, put in Wii, see if it installs.

A normal wii without any mods but with a chipped drive or with a Wode/WKF/Flatmii or similar device.
 

leseratte

Wiimmfi Team
Member
Joined
Jun 2, 2012
Messages
440
Trophies
0
XP
1,635
Country
Germany
No, because we want to check what a chipped, non-modded Wii (mini) would do. A modded Wii would obviously accept fakesigned / non-valid update partitions.
 
  • Like
Reactions: contezero
General chit-chat
Help Users
  • No one is chatting at the moment.
    Psionic Roshambo @ Psionic Roshambo: https://www.reddit.com/r/puns/comments/wqcefg/it_might_work_for_heart_burn/?utm_medium=android_ap... +1