Hacking Convert RVT-R (Debug) Save for normal Wii

[Emil007]

Hi

Since i'm usally playing Review-Copies of many Games on my RVT-R-Unit i wonder if a can convert the saves to use them on my normal Wii since i will probably not own the RVT-Unit forever and don't want to play every game through more than 2 times (and still want to keep my progress)

The Review-Games are usally final and in the same region then my retail games (PAL) and i don't have any idea how much has been done in reversing RVT-R-Stuff (but i think i saw some pictures of guys using debug-software), but maybe its possible with resigning the save?

Thanks in advance for your help...

 

[damysteryman]

How different is the RVT-Unit Wii?

Can it still run like a regular Wii, with the RVT Disc Drive being the only difference, or is it completely different compared to a regular Wii?

Can you run homebrew on it?

If it can run homebrew, you may want to try using Savegame Manager GX.

Keep in mind that both Wiis will need cIOS249 installed, and the regular Wii will need to have played the regular version of the game that the savegame is from at least once in order for your save to copy to it (after it's extracted from your RVT Wii of course).

 

[Emil007]

I dont think its a good idea to install cios on the unit, and since i can't start a normal wii game i dont think it will work either...
as far is a know uses the RVT-Unit a completly different keyset for encryption

 

[mousex]

123

 

[Deleted-171178]

Try doing a NAND dump with Bootmii IOS.

 

[cwstjdenobs]

Bannerbomb + modded savegame manager to take out the IOS reload should work.

 

[Emil007]

Erm, i can normally copy the saves to a sd card like on any wii, so there is no point in dumping the savegames (or does the savegajme manager dump them unencrypted?)

there is a normal wii menu avaliable, just with some debug stuff in it

 

[SifJar]

Erm, i can normally copy the saves to a sd card like on any wii, so there is no point in dumping the savegames (or does the savegajme manager dump them unencrypted?)

there is a normal wii menu avaliable, just with some debug stuff in it

have you tried copying them from the SD to your regular wii? Just a thought...

 

[cwstjdenobs]

Erm, i can normally copy the saves to a sd card like on any wii, so there is no point in dumping the savegames (or does the savegajme manager dump them unencrypted?)

Yep.

Sorry, but have you actually tried to copy a save to your retail Wii from the SD?

EDIT: Beat me to it SifJar

 

[9th_Sage]

Can they be decrypted by FE100 once you get them onto your SD card? Maybe you can rencrypt them after that, if they can be decrypted. I'm not sure if the dev units would have their own key or not (maybe you'd get that key if you generated it via the save file with FE100's keygrabber...I have no idea).

 

[cwstjdenobs]

If dev units use a different SD key as well as common key then it won't work. I know crediar has the dev units common key so it would surprise if he didn't have the SD key, but I don't know if it/they are available on the web. Do dev units use special IOSs and sysmenus?

 

[9th_Sage]

If dev units use a different SD key as well as common key then it won't work. I know crediar has the dev units common key so it would surprise if he didn't have the SD key, but I don't know if it/they are available on the web. Do dev units use special IOSs and sysmenus?

Yeah, I guess it probably wouldn't work if the key is entirely different.

 

[WiiCrazy]

You need at least,

SD key
SD IV
MD5 blanker

for that system...

here is an excerpt from bushing's blog post about keys...

SD key (ab......): This is another shared secret — also stored on the Hollywood, but also found plenty of other places, including inside the firmware images. This key is used by the System Menu (1-2) to encrypt anything before writing it out to the SD card, and it’s used by 1-2 to decrypt anything read from the SD card. This is done mainly for the purpose of obfuscation, to keep people from examining savegames. It’s worth noting that all Wii games save their data to the internal NAND — no game supports loading or saving data directly to SD. This frees game writers from the requirement of handling this step themselves; they just write the savegame data, unencrypted and unsigned, to their title-data directory inside the NAND filesystem; the system menu then handles everything else. (The real reason for this is probably that it allowed Nintendo to make a system where they didn’t have to expose the details of this encryption — or any encryption — to their licensed game developers.) This key is also stored in OTP, and in several places in IOS (for no apparent reason). If you’re using Segher’s tools, you may also be interested in the SD IV (21......) and the MD5 blanker (0e.......), both of which are stored inside the 1-2 binary

So if those games contain a different build of system menu and or ios then once you got the common key for that system you can obtain all the keys to decrypt savegames in case games for that system contains update partitions.

If they didn't removed storing of keys in the 1-2 binary and ios that is...

 

[giantpune]

i would try to just dump the saves with the system menu and install them on a normal wii. if that doesnt work, you can cross your fingers and hope that you still have a old IOS36 or 35 (v1040 ish). with an old IOS36 bannerbomb -> ftpii will let you read all the saves and dump them. old IOS35 will let you dump the nand with the fs dumper on sneek's googlecode page.

 

[WiiCrazy]

for bannerbomb to work one need to be able to encrypt the content he puts in the sd card... for that you need the sd key and the other stuff I mentioned above...

That's the case too with smash stack exploit...

Again the same for twilight hack...

The only exception could be a non existent photo channel or similar exploit that can work through plain unencrypted files...

 

[cwstjdenobs]

I'm certain I've read that bannerbomb works on dev wii's. I think it was in that "dev channels coming soon" thread, so I'm guessing the SD key is the same and that only the common key is different so Ninty don't have to share their private key with EA et al.

 

[WiiCrazy]

common key has no role in savegame (data.bin) decryption/encryption, if keys used in savegame decryption/encryption are same then presumably transferring the savefile through menu should work... but then either OP is too noob to figure this out or not clear enough and maybe he wants this for an online game where copying to sd is not possible...

 

[giantpune]

try pussieloader then.

 

[Wack0]

Yes. I wonder if the hardcoded common key in rvt-r IOS is the same as the RVT-R common key ?

So the devkit "RVT-R" Wii comes up again. And all i can say is..
waaa, run ftpii and dump the nand and give it to me... and dump the system menu discs too... i want a devkit wii via sneek...

Hehe, noob/craving moment out the way.

 

[Riley]

I'm certain I've read that bannerbomb works on dev wii's. I think it was in that "dev channels coming soon" thread, so I'm guessing the SD key is the same and that only the common key is different so Ninty don't have to share their private key with EA et al.

Did the dev channels ever get released ?