Hacking Casper by giantpune

[giantpune]

are there any linux tools that allow you to upload to the usbgecko flash? the most ive messed with it is just reading and writing to the /dev/ttyUSB0 for sending data like wiiload does. and the only windows tool remember seeing that let you upload to the flash was an old client from nuke back in 2008-ish.

 

[stfour]

If i'm not wrong the flash can be programmed only from wii side.

 

[tueidj]

I don't know, but how do you expect to write some working code if you don't know what it does or is suposed to do?

That's exactly how letterbomb was made; from scratch, not based on work created by anyone else.

are there any linux tools that allow you to upload to the usbgecko flash? the most ive messed with it is just reading and writing to the /dev/ttyUSB0 for sending data like wiiload does. and the only windows tool remember seeing that let you upload to the flash was an old client from nuke back in 2008-ish.

I haven't seen any method to access the flash from a PC. Support for accessing it via libogc was half-added but I forgot to submit the erase routines so writes keep stacking over each other. This is the missing stuff: http://pastie.org/pa...w6aflz21zuy3uva
Use usb_flasherasechip before starting to write unless there's some stuff somewhere that you want to keep, otherwise you have to keep track of which sectors are being written and erase them individually before they're touched (or if you're paranoid about wear, you can skip erasing when the target sector is all 0xFFs).
Geckoloader has functional code to write a .dol to the gecko's flash if you want a working example.

 

[leic7]

That's exactly how letterbomb was made; from scratch, not based on work created by anyone else.

Oh please. We're not living in a vacuum. Very few things we create today are actually created from scratch without relying on the work done by other people, i.e. we learn from other people and we owe every bit of our prior knowledge to them. Remember "standing on the shoulders of giants"? Nothing wrong with making something based on other people's work... that's pretty much how our species has progressed this far. I bet it's how letterbomb was made as well.

And I think the reason some people appreciate giantpune's work a lot is because they have had positive experiences with the previous tools by him, so their glowing encouragement towards the coder here is totally understandable. What I find hard to understand is why anyone would have an issue with that - a harmless exchange that doesn't concern them at all.

 

[DeadlyFoez]

reply to deleted post

 

[tueidj]

Oh please. We're not living in a vacuum. Very few things we create today are actually created from scratch without relying on the work done by other people, i.e. we learn from other people and we owe every bit of our prior knowledge to them. Remember "standing on the shoulders of giants"? Nothing wrong with making something based on other people's work... that's pretty much how our species has progressed this far. I bet it's how letterbomb was made as well.

I hope you're not a big gambler, because you just lost that bet. I'm not simply speculating the circumstances of how letterbomb was created - I was heavily involved in the process.
Regardless, what would you propose it was created from? There was no other example of the exploit publically released. Even if there had been, your train of thought would lead to it being based on yet another POC. So where would the original exploit come from? Do these pieces of code just create themselves and escape onto the internet for some lucky person to find?
Of course not. They're originally discovered and created by people who know how to make such things, then copied by others.

 

[obcd]

There is no reason to be worried. Soon the Wii-U will come out and it will give a new challenge for people looking for exploits.
To my knowledge, the letter bomb idea came from giantpune. While he was trying to get some fund raising for it, TT released it.

I know there is a long road between an idea and a usefull piece of software coming out of it.

But, while you don't think Casper is a great piece of work, because the idea isn't coming from Pune, you do find Letterbomb a great piece of work,
altough the idea wasn't coming from TT either In my language, they they call it measuring with 2 different measures and weights.

Don't get me wrong, in my opinion, they are both great pieces of work.

Besides, I can even call Casper my idea. When we launched neek2o, I had an irc chat with Pune where we discussed the option to launch neek2o with an exploit so it could run without modding the wii nand. He said he believed it could be done, but he didn't found it worth the trouble to use an exploit for that.
I don't really think I need credits for that, and I had not a clue how to start realising that. That's probably why I respect it even more.

I just hope the inventor of the "for next loop" doesn't show up and claims his idea was used somewhere in the creation of Casper.

If someone would hae been able to take a patent on the wheel, we would probably all have stone wheels on our cars.

 

[Hyro-Sama]

So in Noob/layman's terms, what does this exactly do and how is it benefical to me?

 

[JoostinOnline]

Besides, I can even call Casper my idea. When we launched neek2o, I had an irc chat with Pune where we discussed the option to launch neek2o with an exploit so it could run without modding the wii nand. He said he believed it could be done, but he didn't found it worth the trouble to use an exploit for that.

And then you told me about it via PM, so I call credit too!

 

[obcd]

It can be launched with a game exploit, the banner bomb or letter bomb. (depending upon your system menu)
It can launch mini from the sd card.

If you have a good working modded wii with the Homebrew Channel on it, it's of no use to you.

If you want to demonstrate the possibilities of a modded wii on an unmodded friend's wii, than you can use it.
It can launch the neek environment, and it hardly leaves any traces to the wii nand, so Ninty won't know you ever used it.

So, you can take your sd card and harddisk to a friend, and play all your stuff, without the risk to brick his unmodded wii.

 

[obcd]

@[member='JoostinOnline']

Damn, I thought you forgot about it. (It happens)

 

[tueidj]

But, while you don't think Casper is a great piece of work, because the idea isn't coming from Pune, you do find Letterbomb a great piece of work,
altough the idea wasn't coming from TT either In my language, they they call it measuring with 2 different measures and weights.

Besides, I can even call Casper my idea. When we launched neek2o, I had an irc chat with Pune where we discussed the option to launch neek2o with an exploit so it could run without modding the wii nand. He said he believed it could be done, but he didn't found it worth the trouble to use an exploit for that.
I don't really think I need credits for that, and I had not a clue how to start realising that. That's probably why I respect it even more.

You're still mixing up ideas with actual code. Letterbomb was created from nothing, while casper on the other hand... according to you, pune apparently didn't think it was worth creating an exploit for...

23:24 but god dammit. even with my jump plugin and karakoto's, my ida still doesnt get the switches in your riivolution

03:28 muahahaha. all your haxx are belong to me now
03:31 i have to say, this one is infinitely cooler than the hackmii exploit

... so instead he "borrowed" somebody else's. Does that make it less of an achievement? Compared to finding an IOS exploit on his own, yes.

TL;DR: Ideas are just talk, usable code is what matters.

 

[obcd]

Isn't it better that way.
If Ninty decides to close the exploit hole, it will hopefully only close the one that is used.
If multiple exploits are used for different programs, they might close them all...
It's a bit like the way you hand out code....

As you say yourself, usable code is what matters. What Casper does is an achievement.
Finding his own ios exploit would be a bigger one, but franckly, who knows and cares about the difference?

 

[JoostinOnline]

Before this goes any further and leads to a bunch of deleted posts, let's just drop it and discuss Casper.

 

[raulpica]

Enough off-topic. All the future OT posts will be deleted. This thread is about Casper, and Casper only.

 

[DeadlyFoez]

Casper update.

v0.2
a few changes suggested by tueidj
accept parameters via argv. supported are:
"--iosV=" specify ios version. 8-bit dec number is allowed.
"--iosR=" pass an ios revision to set for loaded module. 16-bit dec or hex with the prefix "0x" is allowed
"--app=" specify a file to be read from the SD card. it should start with "sd:/".
"--geckoChannel=" load from USB gecko flash. this is the gecko slot to use: 0 or 1.
"--geckoOffset=" offset in the usb gecko flash to read the binary. format is the same as the twilight hack a u32 is read from that offset which is the size, and the rest of the data follows. 32-bit numbers in dec, or hex with a 0x prefix are allowed.
If loading the SD path fails, then try to load from USB gecko flash at 0x20000 in slot 1 then slot 0
default to passing IOS 254 v0xff01 to module so if it loading is ceilingcat, it will skip the autoboot
Here's a few examples of the args in action:
# use all default settings:
wiiload ./casper.elf

# use armboot.bin from the bootmii folder:
wiiload ./casper.elf --app=sd:/bootmii/armboot.bin

# read from USB gecko flash in slot 1 from offset 0x30000 and set flags as IOS12 v13398
wiiload ./casper.elf --iosV=12 --iosR=0x3456 --geckoChannel=1 --geckoOffset=0x30000

Casper v0.2

 

[obcd]

If you launch it using an exploit, how can you benefit from the arguments?
I thought the exploits only launched the elf in the root of the sd card without arguments?

 

[SifJar]

If you launch it using an exploit, how can you benefit from the arguments?
I thought the exploits only launched the elf in the root of the sd card without arguments?

If you're launching it from an exploit, you probably don't need arguments. I think they're generally more useful via wiiload, for testing stuff, or from HBC to skip autoboot or whatever (e.g. you have BootMii/boot2, set to autoboot System Menu, so use casper via HBC or postLoader etc. to boot the BootMii GUI). Although some exploits are open source so could probably be modified to pass arguments if you really, really wanted to.

 

[JoostinOnline]

Does this also work through meta.xml arguments?

 

[SifJar]

Yes.