Decrypt NAND Dump

[Larsos099]

Does anyone know how to decrypt a nand dump, I'd like to retrieve the loaded Network Config, since the Wii U Menu itself is bricked and I need internet access to unbrick it. I've tried to code a Homebrew app that opens the System Settings app but it doesnt work, I've tried to code something that changes the Network configs, in the DevkitPro Wii U Toolchain there is no API that does that, just something that connects to existing Network configs
nn::a c::Connect() (I need the space or it turns into an emoji)
Since his SSID and Password changed I cant connect to existing and he doesnt remember what it was.
And there also is no function that retrieves the details of the existing Network Config, like SSID and Password.
Now I wanna try NAND Dumping and decrypting the Dump and viewing the network config file to see it, if possible

Thanks

 

[V10lator]

I've tried to code something that changes the Network configs, in the DevkitPro Wii U Toolchain there is no API that does that

There is:
https://github.com/devkitPro/wut/blob/master/include/nn/ac/ac_cpp.h#L242.L244
https://github.com/devkitPro/wut/blob/master/include/nn/ac/ac_cpp.h#L30-L34
https://github.com/devkitPro/wut/blob/master/include/nn/ac/ac_cpp.h#L4
https://github.com/devkitPro/wut/blob/master/include/nsysnet/netconfig.h#L211-L223
https://github.com/devkitPro/wut/blob/master/include/nsysnet/netconfig.h#L164-L192

And there also is no function that retrieves the details of the existing Network Config, like SSID and Password.

There you go: https://github.com/devkitPro/wut/blob/master/include/nn/ac/ac_cpp.h#L230-L232

Now I wanna try NAND Dumping and decrypting the Dump and viewing the network config file to see it, if possible

You like to overcomplicate thinks it seems but there you go: https://github.com/koolkdev/wfs-tools?tab=readme-ov-file#wfs-extract

At that point I just need to ask why not use some recovery method like the recovery menu which can load network configs on the fly, access all storages (wupserver) and even could reinstall apps like the bricked Wii U Menu with ease?

 

[SDIO]

If you are sure you messed up only the Menu, you can just reinstall it with the wupinstaller. For that use tiramisu and launch the homebrew launcher directly instead of the menu.
But reinstalling the menu, will remove the payloadloader coldboot, so that better fixes the problem.
If you are unsure you could also instal ISFShax before, just to be safe.

 

[Larsos099]

If you are sure you messed up only the Menu, you can just reinstall it with the wupinstaller. For that use tiramisu and launch the homebrew launcher directly instead of the menu.
But reinstalling the menu, will remove the payloadloader coldboot, so that better fixes the problem.
If you are unsure you could also instal ISFShax before, just to be safe.

I cant find any wup of the system menu and if i download it with jnusdownloader, pack it with nuspacker and try to install it fails too

 

[SDIO]

Use the -dlEncrypted flag with JNUS.

Also the network config is on the SLC, not the mlc. You can extract it with this: https://github.com/koolkdev/wiiu-nandextract
But I don't think that is necessary

 

[Larsos099]

i just cant get anything to work right now

Post automatically merged: Nov 15, 2024

At that point I just need to ask why not use some recovery method like the recovery menu which can load network configs on the fly, access all storages (wupserver) and even could reinstall apps like the bricked Wii U Menu with ease?

Well we have bought a pico pico and did the recovery menu, wupserver doesnt work because of internet, load network.cfg doesnt work either??
(network.cfg:
type=eth
)
I

If you are sure you messed up only the Menu, you can just reinstall it with the wupinstaller. For that use tiramisu and launch the homebrew launcher directly instead of the menu.

like I said no wup works

and i tried my best with this code, if anyone knows why it wont work (well the ssid show works but not the password??
main.cpp:

NetConfCfg cfg; nn::ac::ReadConfig(1, &cfg); NetConfWifiConfig wcfg; wcfg = cfg.wifi; NetConfWifiConfigData dwcfg = wcfg.config; // Copy the SSID strcpy(ssid, (const char*)dwcfg.ssid); size_t aes_key_size = sizeof(dwcfg.privacy.aes_key); memcpy(pwd, dwcfg.privacy.aes_key, aes_key_size); // Display SSID text OSScreenClearBufferEx(SCREEN_DRC, 0x0000FF); OSScreenPutFontEx(SCREEN_DRC, 0, 2, ssid); OSScreenPutFontEx(SCREEN_TV, 0, 2, ssid); OSScreenPutFontEx(SCREEN_DRC, 0, 3, pwd); OSScreenPutFontEx(SCREEN_TV, 0, 3, pwd); OSScreenFlipBuffersEx(SCREEN_DRC); OSScreenFlipBuffersEx(SCREEN_TV);

I dont know if thats the right way to retrieve it or something but it doesnt work.

There is:
https://github.com/devkitPro/wut/blob/master/include/nn/ac/ac_cpp.h#L242.L244
https://github.com/devkitPro/wut/blob/master/include/nn/ac/ac_cpp.h#L30-L34
https://github.com/devkitPro/wut/blob/master/include/nn/ac/ac_cpp.h#L4
https://github.com/devkitPro/wut/blob/master/include/nsysnet/netconfig.h#L211-L223
https://github.com/devkitPro/wut/blob/master/include/nsysnet/netconfig.h#L164-L192

The files are literally different, i installed with dkp-pacman on MacOS,
when I cloned the repo and replaced the whole include folder, all those functions were there, idk why this happens tho
There were just these functions in nn::ac, as seen in WiiUBrew

(sorry i didnt explain sooner i just didnt have the five posts and it always flagged my messages.

Thanks

 

[V10lator]

(network.cfg:
type=eth
)

Do you have a LAN adapter compatible with the Wii U? If so try it at another USB port maybe (and double check it's really the correct chipset). Else try making a config for WLAN.

the ssid show works but not the password?

The sizeof() gives the size of the array in the struct (0x40), not the size of the password. The size is stored here: https://github.com/devkitPro/wut/blob/master/include/nsysnet/netconfig.h#L167

Also the password might not be a string but hex or something.

Anyway, what SDIO told makes more sense and is more simple: Get the Wii U menu from the NUS. Make sure to download it encrypted, downloading decrypted and repacking won't work. Then boot straigt into the homebrew launcher and reinstall the Wii U menu from there.

Also installing ISFSHax before trying any more things is a really good advice. I would highly recommend that, too.

//EDIT: Oh and the DKP pacman repo might simply be out of date. Try with docker ( https://hub.docker.com/r/devkitpro/devkitppc/tags ).

 

[SDIO]

like I said no wup works

no, you said your wup that you made with nus packer doesn't work.

 

[Larsos099]

Do you have a LAN adapter compatible with the Wii U? If so try it at another USB port maybe (and double check it's really the correct chipset). Else try making a config for WLAN.

yup, tried every front and back usb port, and it works with the other Wii U, so its Wii U compatible. its from ugreen

The sizeof() gives the size of the array in the struct (0x40), not the size of the password. The size is stored here: https://github.com/devkitPro/wut/blob/master/include/nsysnet/netconfig.h#L167

yup! i was a little dumb there but I noticed myself and corrected myself too:

nn::ac::ReadConfig(confId, &cfg);
strcpy(ssid, cfg.wifi.config.ssid);
memcpy(pwd, (char*)cfg.wifi.config.privacy.aes_key, cfg.wifi.config.privacy.aes_key_len);
OSScreenPutFontEx(SCREEN_TV, 0, 2, "Config: ");
OSScreenPutFontEx(SCREEN_TV, 0, 3, ssid);
OSScreenPutFontEx(SCREEN_TV, 0, 4, pwd);
OSScreenFlipBuffersEx(SCREEN_TV);

My friend hasnt had any chance to test it on hardware right now so I dont know if it works in practice.
Cemu as well as Decaf Emu just crash when loading the rpx, i dont know why.
Anyways if yall wanna correct my code its on github
https://github.com/Larsos099/ylmztool

Thanks for all the help of you guys!

Post automatically merged: Nov 16, 2024

At that point I just need to ask why not use some recovery method like the recovery menu which can load network configs on the fly, access all storages (wupserver) and even could reinstall apps like the bricked Wii U Menu with ease?

I googled the error of the recovery menu and it means that the SD Card cant be read for some reason??

OSScreenPutFontEx(SCREEN_DRC, 0, 5, "running write"); OSScreenFlipBuffersEx(SCREEN_DRC); OSScreenPutFontEx(SCREEN_TV, 0, 1, "ylmztool - alternate write"); OSScreenFlipBuffersEx(SCREEN_TV); netconf_get_running(&cfg); memcpy(alternate.wifi.config.ssid, "Emrerrrrr", cfg.wifi.config.ssidlength); memcpy(alternate.wifi.config.privacy.aes_key, "Emre2016().?z", alternate.wifi.config.privacy.aes_key_len); alternate.proxy.use_proxy = cfg.proxy.use_proxy; nn::ac::WriteConfig(2, &alternate); netconf_set_running(&alternate); NetConfCfg c; nn::ac::ReadConfig(2, &c); OSScreenClearBufferEx(SCREEN_DRC, 0x000000); OSScreenClearBufferEx(SCREEN_TV, 0x000000); OSScreenPutFontEx(SCREEN_TV, 0, 1, "ylmztool - alternate write"); OSScreenPutFontEx(SCREEN_TV, 0, 2, c.wifi.config.ssid); OSScreenClearBufferEx(SCREEN_DRC, 0x00FF0000); OSScreenFlipBuffersEx(SCREEN_DRC); OSScreenFlipBuffersEx(SCREEN_TV);

if i write this and display it again it displays the old ssid not the new one