Hacking Decrypting Wii VC nfs files

[JaGoTu10]

Hi guys,
if you've been wondering, how to decrypt the nfs files in Wii VC's /content/, here's the answer:

The key is just stored in /code/htk.bin. Just like that. It's not encrypted in any way, it just sits there. So, just strip away the EGGS-SGGE header, join all the files together, and use a command like this:

openssl enc -d -aes-128-cbc -K "[key]" -iv 0 -nopad -in hif.nfs -out hif.nfs.dec

The resulting file seems to be just a regular Wii iso.

 

[ShadowOne333]

Hi guys,
if you've been wondering, how to decrypt the nfs files in Wii VC's /content/, here's the answer:

The key is just stored in /code/htk.bin. Just like that. It's not encrypted in any way, it just sits there. So, just strip away the EGGS-SGGE header, join all the files together, and use a command like this:

openssl enc -d -aes-128-cbc -K "[key]" -iv 0 -nopad -in hif.nfs -out hif.nfs.dec

The resulting file seems to be just a regular Wii iso.

Why not post this on the "Injecting Wii VC" thread too?

 

[JaGoTu10]

Why not post this on the "Injecting Wii VC" thread too?

So it is more easily searchable, I guess.

Also, this doesn't automatically mean injecting. There could still be some hashing done so you just can't put inside your own iso

 

[xtheman]

@JaGoTu10 Would their be an advantage of decrypting these and running them on a wii or something?

 

[JaGoTu10]

@JaGoTu10 Would their be an advantage of decrypting these and running them on a wii or something?

No idea. Somebody should compare them with the regular Wii disc dumps.

 

[AboodXD]

Also, this doesn't automatically mean injecting. There could still be some hashing done so you just can't put inside your own iso

If nfs is in content folder and the key in code folder is untouched, that means it is injectable.
Edit: But hey, that's just a theory. A Wii U THEORY!

The Wii U doesn't check the content folder AT ALL! This is what contenthax is all about.

--------------------- MERGED ---------------------------

No idea. Somebody should compare them with the regular Wii disc dumps.

They should be identical to a 1:1 ISO rip.

 

[JaGoTu10]

If nfs is in content folder and the key in code folder is untouched, that means it is injectable.

The Wii U doesn't check the content folder AT ALL! This is what contenthax is all about.

--------------------- MERGED ---------------------------


They should be identical to a 1:1 ISO rip.

Normally it doesn't. However, can you then explain what the rvlt.tik and rvlt.tmd in the code folder are for?

 

[xtheman]

If nfs is in content folder and the key in code folder is untouched, that means it is injectable.

The Wii U doesn't check the content folder AT ALL! This is what contenthax is all about.

Would be pointless to worry about not editing code folder. Pretty much everyone who wants this uses cfw.

 

[moops44]

If nfs is in content folder and the key in code folder is untouched, that means it is injectable.

The Wii U doesn't check the content folder AT ALL! This is what contenthax is all about.

--------------------- MERGED ---------------------------


They should be identical to a 1:1 ISO rip.

i cant import or export any NFS files while use ftp
always get error

 

[AboodXD]

Normally it doesn't. However, can you then explain what the rvlt.tik and rvlt.tmd in the code folder are for?

They are used for installing the title on the Wii U system.
tik is to used to validate that you have purchased the title. (Except if it's free, the tik comes anyway)

 

[moops44]

After i found out the i must just change in the meta the drc to a other value
what i told in irc to fix94
i tried to inject other game into xenoblade and it in my case kirby , and all i got is blackscreen/freeze etc

 

[AboodXD]

i cant import or export any NFS files while use ftp
always get error

IDK...
Ask @dimok.

--------------------- MERGED ---------------------------

After i found out the i must just change in the meta drc to a other value
what i told in irc to fix94

Hmm?

 

[victormr21]

I was finding some files in a Wii U game/app and i found some "not popular" file types, someone knows how to decrypt they @AboodXD ?

• .ptcl
• .genvb
• .baglmf
• .arc (i think i can decrypt they like an .sarc file)
• .bflan
• .bflyt
• .bflim
• .bffnt (i only can open .ttf files in windows, but no this)
• .sharcfb
• .bgmsconf
• .ffsd
• .dsp

I think they are very strange and "exclusive"
Bye!

 

[xtheman]

i cant import or export any NFS files while use ftp
always get error

Use wupclient.

 

[JaGoTu10]

They are used for installing the title on the Wii U system.
tik is to used to validate that you have purchased the title. (Except if it's free, the tik comes anyway)

I don't think that's what these are. Remember, this isn't launched like any other title. It's launched using the CMPT library. MCP does a lot of extra checking for that. For example, the fw.img check fails on the latest iosuhax if you modify the file. Nothing we couldn't patch with iosuhax, but since there was not a lot of research into HAI, it probably isn't patched yet.

I'm not stopping you from injecting random shit into the folder, I mean, go ahead and explore Just a warning that it might not work even though you create the hfs correctly.

 

[AboodXD]

I was finding some files in a Wii U game/app and i found some "not popular" file types, someone knows how to decrypt they @AboodXD ?

• .ptcl
• .genvb
• .baglmf
• .arc (i think i can decrypt they like an .sarc file)
• .bflan
• .bflyt
• .bflim
• .bffnt (i only can open .ttf files in windows, but no this)
• .sharcfb
• .bgmsconf
• .ffsd
• .dsp

I think they are very strange and "exclusive"
Bye!

dsp is the same format as BFSTM, BRSTM, BCSTM, etc.
You can convert it to wav with DSPTool.

ARC is the same as SARC.

bflim files are for Layout textures, bflan and bflyt are for layouts settings and such.
There's a link to BFLIM Extractor in my signature (It doesn't work with all files), BenZinU can handle bflan and bflyt.

bffnt is used for fonts, this tool can convert them to GTX. (Use TexConv2 to convert GTX to DDS)

I recognize the other formats, but I can't remember what they are used for/how to handle them.

--------------------- MERGED ---------------------------

I don't think that's what these are. Remember, this isn't launched like any other title. It's launched using the CMPT library. MCP does a lot of extra checking for that. For example, the fw.img check fails on the latest iosuhax if you modify the file. Nothing we couldn't patch with iosuhax, but since there was not a lot of research into HAI, it probably isn't patched yet.

I'm not stopping you from injecting random shit into the folder, I mean, go ahead and explore Just a warning that it might not work even though you create the hfs correctly.

Meh, I don't feel like digging too much into this.
I was just judging according to my knowledge.

 

[VinsCool]

Is the reverted process possible as well?
To convert a game to nfs files?

 

[AboodXD]

IIRC Ya.

 

[victormr21]

dsp is the same format as BFSTM, BRSTM, BCSTM, etc.
You can convert it to wav with DSPTool.

ARC is the same as SARC.

bflim files are for Layout textures, bflan and bflyt are for layouts settings and such.
There's a link to BFLIM Extractor in my signature (It doesn't work with all files), BenZinU can handle bflan and bflyt.

bffnt is used for fonts, this tool can convert them to GTX. (Use TexConv2 to convert GTX to DDS)

I recognize the other formats, but I can't remember what they are used for/how to handle them.

--------------------- MERGED ---------------------------


Meh, I don't feel like digging too much into this.
I was just judging according to my knowledge.

Thanks you so much Abood! I saw BFLIM Extractor in your signature this morning! But I tried to found a blim file in any game and i didnt see it so i don't downloaded it... Some questions:
1 The BFFNT to GTX tool, Can I write it in a .bat, python file...?
2 I don't see DSPTool, there are some links in Google but i will download everything and not the program

Spoiler

A virus xD

Bye!

 

[AboodXD]

Thanks you so much Abood! I saw BFLIM Extractor in your signature this morning! But I tried to found a blim file in any game and i didnt see it so i don't downloaded it... Some questions:
1 The BFFNT to GTX tool, Can I write it in a .bat, python file...?
2 I don't see DSPTool, there are some links in Google but i will download everything and not the program

Spoiler

A virus xD

Bye!

1. BMS is easy to use, I don't see the point in re-writing in Python or Batch.
2. You can find it in the Wii U SDK.