Hacking Creating discs that work on unmodded Wiis

[CambridgeGuy]

I was wondering about how one would create a disc that will work on an unmodified Wii console. Clearly Datel have managed this with their Freeloader; the question is: how?

What is the difference between a burned Freeloader, and a genuine one from Datel? Well, the most obvious thing about the Freeloader disc are those little circles that are at the centre of the underside of the disc... Do these trick the Wii into thinking the disc is a real Wii disc. If so, then could we add our own little circular notches to discs to make discs that will work on an unmodified console?

Or is there actually a small amount of data written to the disc in a region that is just not there on a DVD-R?

What does gbatemp think? Is this at all possible?

 

[Shuny]

Datel discs are pressed, your disc is burnt.

You won't get a working disc with a burner with an unmodded Wii.

 

[PikaPika]

about this, my friends grandpa works for GE or something, and I think he owns an industrail disc press. Is there any way I could use that to burn working Wii backups on an unmodded Wii?

 

[CambridgeGuy]

Datel discs are pressed, your disc is burnt.

You won't get a working disc with a burner with an unmodded Wii.

Indeed I won't. What I'm trying to figure out is: What exactly is it that the pressed discs have that our DVD-R discs lack?

 

[kedest]

What I'm curious about is how Datel can get their freeloader to run on un-modded wii's. So the drive recognizes it as a real disc instead of a burned disc, but that's only the first step. Freeloader isn't an official product. How can Datel get their code to run and get it signed? I don't think they have a wii developer kit, since only official developers get those.
Are they perhaps using a secret exploit they discovered?

 

[Kyusuke]

I may be wrong, but it would be the same way as pressing PS1, PS2, GC etc.... action replay or such unofficial discs.

If I remember reading about Swap Magic disc and how they're made. Basically, they used previously burnt game discs and press in their own data. Therefore, the sector that verifies whether the disc is authentic or not is still there but with the new data pressed in.

That's how it should work for Wii as well, it isn't any secret exploit, just a known trick used for a long time.

 

[superrob]

What I'm curious about is how Datel can get their freeloader to run on un-modded wii's. So the drive recognizes it as a real disc instead of a burned disc, but that's only the first step. Freeloader isn't an official product. How can Datel get their code to run and get it signed? I don't think they have a wii developer kit, since only official developers get those.
Are they perhaps using a secret exploit they discovered?

Truacha signer

And they press the disc.
The drivechip checks if the disc is burned if yes disallow the disc.


And pressing discs requires a very very expensive machine.

 

[FAST6191]

Before this gets massively off track it is pressed versus normal. Writers are made so as not to be able to pass as official disks for precisely these reasons (although some of the more industrious among us can abuse some things in this area).

There was a thread a few months back on the subject but it got lost (read I am hungry so I am not going to dig for it) with the release of the trucha signer and all the other stuff from the last few weeks.

 

[ProdigySim]

Burnable discs aren't "made" to identify as burnable.
Well, not all of them, anyway. DVD-Rs have a pre-written header that declares them as DVD-R discs, but bitsetting allows you to make DVD+Rs identify as DVD-ROMs, because they have no pre-written header.

What makes Wii Pressed discs work and burned discs is the securty information written on the inner ring on a physical section that can't be written to on burnable discs, but can be read from if your drive is set up to do so, like the Wii disc drive.

There's more information on this stuff on wikipedia and other places. It's pretty similar to the Security Sector for the Xbox/360 discs. You can read about that, too, to learn about the concept.

 

[HaTaX]

The reason burnt media doesn't work in an un-modded wii is because of the BCA (Burst cutting area, or bar code area). It is a barcode that is pressed onto the disc when made that is not present on blank media.

Here's a little more info on it from this page:
http://www.patentstorm.us/patents/6921336-description.html

Disk reader 83 reads digital information from plastic optical disks such as disk 43 in which the digital information is molded and burned. Disk reader 83 reads this digital information from two areas of disk 43: from area 81 and from area 80. In area 81 the digital information is represented as a long spiral track or tracks 82 of microscopic pits that are molded into each disk by a disk manufacturer. Digital information in area 81 includes video game programs and data. Area 80, known as the burst cutting area (BCA), typically consists of a circular series of variable-width bar codes that are burned, melted, or heated by a medium power laser beam into each disk after they are molded by the manufacturer. This heating process permanently alters reflectivity of bar-shaped areas of a reflective layer in the disk. The word "burned" will be used herein to encompass the various methods for placing a substantially unique bar code (for each game product) onto each disk, even though the reflective layer is usually not burned through but merely darkened. More than a hundred patents have been issued for optical disks, BCA, and related technology, such U.S. Pat. No. 6,081,785.

 

[CambridgeGuy]

Thanks for the replies everyone

Maybe I'm focusing on something that's actually totally irrelevant but... just out of sheer curiosity...
What are those little circular notches on the underside of the Freeloader disc. Are they there to try to emulate the burst cutting area of a genuine Wii disc... or are they just a strange quirk of how that particular disc is manufactured.

The reason I ask is because that would be a lot easier to replicate than a particular bardcode.

 

[paul1991]

We went over this in another thread.

It is all about structure! I will find my post and report back.

EDIT:
Found it!

DVD-ROM:

4bytes 2bytes 6bytes 2048bytes 4bytes
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
| ID | IED | CPR_MAI | User Data Frame | EDC |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
^ | 2048bytes cipher stream |
^ - - - - - - - - - - - - - -
scrambling
seed index

Gamecube/WII Optical Disc:

4bytes 2bytes 2048bytes 6bytes 4bytes
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
| ID | IED | User Data Frame | unknown | EDC |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
| 2048bytes cipher stream |

You would need special discs that have this modified file system.

Edit2:
http://gbatemp.net/index.php?showtopic=71462&hl=

 

[arctic_flame]

We went over this in another thread.

It is all about structure! I will find my post and report back.

EDIT:
Found it!

DVD-ROM:

4bytes 2bytes 6bytes 2048bytes 4bytes
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
| ID | IED | CPR_MAI | User Data Frame | EDC |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
^ | 2048bytes cipher stream |
^ - - - - - - - - - - - - - -
scrambling
seed index

Gamecube/WII Optical Disc:

4bytes 2bytes 2048bytes 6bytes 4bytes
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
| ID | IED | User Data Frame | unknown | EDC |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
| 2048bytes cipher stream |

You would need special discs that have this modified file system.

Edit2:
http://gbatemp.net/index.php?showtopic=71462&hl=

That's nothing to do with it. Filesystem structure is irrelavant. You don't even know what that means. (I'm sure I said this in the last thread)