Hacking Contenthax - a Vulnerability in Wii U File System Verification

[ManuelKoegler]

So contenthax let us modify a installed game in our console without break the signature.
Haxchi is a secondary userland exploit for the DS virtual console.
Coldboothax isnt a exploit, is just modify a file to boot in a game/app instead the home menu, in this case a haxchi.
Is this OK? (sorry if my english is bad).

Coldboothax may not be an exploit so much as it's an oversight, seeing as this would be a permanent modification in the system files technically before code execution takes place.


Sent from my iPhone using Tapatalk

 

[dkabot]

So contenthax let us modify a installed game in our console without break the signature.
Haxchi is a secondary userland exploit for the DS virtual console.
Coldboothax isnt a exploit, is just modify a file to boot in a game/app instead the home menu, in this case a haxchi.
Is this OK? (sorry if my english is bad).

Yes, that's more-or-less correct.
Haxchi gives us (relatively) quick execution inside DS VC, though it's made per-game.
You can use this, on its own, with little risk as all you're touching is the game.

Coldbootxhax is Nintendo Security(TM) at work; we can tell the console to boot into whatever we want.
This is naturally _very_ dangerous to do, and can render a WiiU unusable, but allows for something similar to menuhax paired with an exploited game.

 

[loler55]

just got done porting over smeas original to the pal version of brain age

Also pushed it up to a fork on github so you can see what all had to be changed.

danke sehr thanks allot

and thx nint thats for free

 

[VinsCool]

Yellows8 added informations regarding contenthax for N64 Virtual Console games!

N64 VC contenthax
Present in system versions: N/A

Publicly exploited: No

Discovered by: yellows8 (Early 2016)

The Wii U N64 VC emulator title("VESSEL") has two known vulns which can be attacked via contenthax. These vulns were tested on hardware, but actual exploitation wasn't tested.

Note that this title can only write to codegen(JIT) via using OSCodegenCopy(), unlike other titles.

Currently this is the only known VC platform(N64) which is affected by any of these VESSEL vulns(not all platforms were checked for this).

The .ini loading occurs much earlier during title boot than the font loading. These vulns(or at least the .ini one) trigger while the system is still displaying the application spash-screen(from the title's meta/ directory).

• Stack buffer overflow when handling BMFont "pages". The entire block is copied to stack using just the size, without checking the size. The loaded data is not checked either, other than converting uppercase to lowercase('A'..'Z' to 'a'..'z'). This string is used with sprintf + PNG texture loading afterwards.
• Heap buffer overflow during .ini parsing with field-data string starting with '"'. The allocated heap buffer is 0x100-bytes, but the size is not checked when copying the value string into this buffer. During copying/etc this string content is not checked/modified, besides checking for the end of the string with '"'. For example: HAX = "LONGSTRINGHERE"

Source https://wiiubrew.org/w/index.php?title=Exploits

 

[joacosur15]

Yellows8 added informations regarding contenthax for N64 Virtual Console games!

N64 VC contenthax
Present in system versions: N/A

Publicly exploited: No

Discovered by: yellows8 (Early 2016)

The Wii U N64 VC emulator title("VESSEL") has two known vulns which can be attacked via contenthax. These vulns were tested on hardware, but actual exploitation wasn't tested.

Note that this title can only write to codegen(JIT) via using OSCodegenCopy(), unlike other titles.

Currently this is the only known VC platform(N64) which is affected by any of these VESSEL vulns(not all platforms were checked for this).

The .ini loading occurs much earlier during title boot than the font loading. These vulns(or at least the .ini one) trigger while the system is still displaying the application spash-screen(from the title's meta/ directory).

• Stack buffer overflow when handling BMFont "pages". The entire block is copied to stack using just the size, without checking the size. The loaded data is not checked either, other than converting uppercase to lowercase('A'..'Z' to 'a'..'z'). This string is used with sprintf + PNG texture loading afterwards.
• Heap buffer overflow during .ini parsing with field-data string starting with '"'. The allocated heap buffer is 0x100-bytes, but the size is not checked when copying the value string into this buffer. During copying/etc this string content is not checked/modified, besides checking for the end of the string with '"'. For example: HAX = "LONGSTRINGHERE"

Source https://wiiubrew.org/w/index.php?title=Exploits

Seems its a more fast hax for coldboot use, remember the smea video showing the iosu coldboot? I didnt see he are using the ds virtual console to archive it. Maybe that is the answer?

 

[Antonio Ricardo]

Yellows8 added informations regarding contenthax for N64 Virtual Console games!

N64 VC contenthax
Present in system versions: N/A

Publicly exploited: No

Discovered by: yellows8 (Early 2016)

The Wii U N64 VC emulator title("VESSEL") has two known vulns which can be attacked via contenthax. These vulns were tested on hardware, but actual exploitation wasn't tested.

Note that this title can only write to codegen(JIT) via using OSCodegenCopy(), unlike other titles.

Currently this is the only known VC platform(N64) which is affected by any of these VESSEL vulns(not all platforms were checked for this).

The .ini loading occurs much earlier during title boot than the font loading. These vulns(or at least the .ini one) trigger while the system is still displaying the application spash-screen(from the title's meta/ directory).

• Stack buffer overflow when handling BMFont "pages". The entire block is copied to stack using just the size, without checking the size. The loaded data is not checked either, other than converting uppercase to lowercase('A'..'Z' to 'a'..'z'). This string is used with sprintf + PNG texture loading afterwards.
• Heap buffer overflow during .ini parsing with field-data string starting with '"'. The allocated heap buffer is 0x100-bytes, but the size is not checked when copying the value string into this buffer. During copying/etc this string content is not checked/modified, besides checking for the end of the string with '"'. For example: HAX = "LONGSTRINGHERE"

Source https://wiiubrew.org/w/index.php?title=Exploits

People need to wait before buy some Nds games. lol

 

[Billy Acuña]

The name of the thread should be renamed as "Contenthax" since is not limited to a DS VC game exploit anymore.

 

[nexusmtz]

The name of the thread should be renamed as "Contenthax" since is not limited to a DS VC game exploit anymore.

No thank you. Do you think we need another 300 page thread where everyone talks about whatever they feel like that has anything to do with changing a file in a title? It's bad enough already in a thread that's supposed to be talking about one specific content hack. I would much rather watch threads for 10 different content hacks than have to wade through a single thread that jumps all around. At least then I could unwatch if I'm not interested in some of the implementations.

 

[jesus96]

No thank you. Do you think we need another 300 page thread where everyone talks about whatever they feel like that has anything to do with changing a file in a title? It's bad enough already in a thread that's supposed to be talking about one specific content hack. I would much rather watch threads for 10 different content hacks than have to wade through a single thread that jumps all around. At least then I could unwatch if I'm not interested in some of the implementations.

:^)

 

[Peninsula]

:^)

Except the thread title is wrong now. Contenthax is an exploit for more than just DS VC

 

[VinsCool]

Except the thread title is wrong now. Contenthax is an exploit for more than just DS VC

Yes I know, I requested the thread rename to "Contenthax" but this is what we got :')

 

[nexusmtz]

:^)

Thanks. I had almost missed seeing the change in the notification email, the notification drop-down, the address bar, and the tab title. The malformed oval really made the difference between being aware of it and missing it completely. I guess everyone has to contribute to the best of their ability. Keep up the good work.

 

[belisleian]

Will this be release soon

 

[ShadowOne333]

Oh wait what?
Now the N64 VC is vulnerable too?
That's pretty neat, has there been any mention as to what games are compatible with said vuln? Or is it all N64 VC?

 

[VinsCool]

Oh wait what?
Now the N64 VC is vulnerable too?
That's pretty neat, has there been any mention as to what games are compatible with said vuln? Or is it all N64 VC?

Most likely all N64 VCs, according to the Wiiubrew page. So if anyone is willing to set up a rednand, and modify the ini files, they are free to try to make the program crash I guess hahaha

 

[ShadowOne333]

Most likely all N64 VCs, according to the Wiiubrew page. So if anyone is willing to set up a rednand, and modify the ini files, they are free to try to make the program crash I guess hahaha

Oh well, I do have Donkey Kong 64 purchased, so it might be a very well thought purchase to setup rednand down the road.

 

[VinsCool]

Oh well, I do have Donkey Kong 64 purchased, so it might be a very well thought purchase to setup rednand down the road.

I don't know if anyone attempted to exploit the n64 yet. I know fix94 ported haxchi to eur Brain Age, but that's all I know for now. (I need to catch up with IRC today hahha)

 

[KevinX8]

Is there a reason why the OP gives the wrong title ID? It's refering to "Kirby Squeak Squad" which thosen't make any sense to me, Can I just replace with the title ID that is correct and it will work fine?

 

[VinsCool]

Is there a reason why the OP gives the wrong title ID? It's refering to "Kirby Squeak Squad" which thosen't make any sense to me, Can I just replace with the title ID that is correct and it will work fine?

It was originally made for Kirby. Fix94 managed to port it by changing the memory adresses.

(Edit) updated op about haxchi to clarify about Kirby

 

[KevinX8]

It was originally made for Kirby. Fix94 managed to port it by changing the memory adresses.

ah ok its just that the video in the OP is refering to Brain Age so I thought it was strange that the instructions said to use the Title ID of kirby, maybe you should change or specify that its for kirby?