Hacking Decrypting Wii VC nfs files

victormr21

Well-Known Member
Member
Joined
Dec 29, 2015
Messages
565
Trophies
0
XP
498
Country
Guys, the code isnt finished anyway. It just combines the nfs files, removes EGGS header, decrypts and moves around some stuff. The result is NOT a usable iso file, since the partition table points to the wrong place and the game partition is decrypted. All iso loaders expect encrypted game partitions.
your program does the @Falo instructions and he got a valid iso no?
 

sabykos

Well-Known Member
Member
Joined
Jun 10, 2013
Messages
283
Trophies
1
Age
36
XP
729
Country
Gambia, The
your program does the @Falo instructions and he got a valid iso no?
Yeah, you need to remove the backslashes in lines 199 and 200. Then it does all of his instructions besides encrytping the game partition. But I dont know if I did everything right, because I cant test it.
 

victormr21

Well-Known Member
Member
Joined
Dec 29, 2015
Messages
565
Trophies
0
XP
498
Country
Yeah, you need to remove the backslashes in lines 199 and 200. Then it does all of his instructions besides encrytping the game partition. But I dont know if I did everything right, because I cant test it.
i can test but i couldnt compile your program, im newbie in compile things, but in other things no xD
 

victormr21

Well-Known Member
Member
Joined
Dec 29, 2015
Messages
565
Trophies
0
XP
498
Country
@AboodXD ? We need you! xD.
I was searching data in an original SSBB iso and a VC Wii SMG iso, and i found the address/offset of each partition, but in wiibrew says:

Start Size Description
0x40000 4 Total partitions in the disc
0x40004 4 Partition info table offset, Address is (value << 2)
I got an adress (01234567) but now? i added 2, i subtrated 2... and nothing
Also the web says, the first partition is for updates and the 2nd for the game (we need this) but SMG only have one partition so...
And the master key is the key you use to restore Parental Control?
Bye!
 

JohnathanMonkey

Well-Known Member
Member
Joined
Apr 26, 2013
Messages
633
Trophies
1
Age
36
XP
744
Country
United States
I can't wait for this to happen!! You guys are doing great! You are so close, please don't give up on this. I just wish I knew enough about this to help you guys out.
 
  • Like
Reactions: zeldaism

AboodXD

I hack NSMB games, and other shiz.
Member
Joined
Oct 11, 2014
Messages
2,880
Trophies
1
Location
Not under a rock.
XP
2,921
Country
United Arab Emirates
@AboodXD ? We need you! xD.
I was searching data in an original SSBB iso and a VC Wii SMG iso, and i found the address/offset of each partition, but in wiibrew says:

Start Size Description
0x40000 4 Total partitions in the disc
0x40004 4 Partition info table offset, Address is (value << 2)
I got an adress (01234567) but now? i added 2, i subtrated 2... and nothing
Also the web says, the first partition is for updates and the 2nd for the game (we need this) but SMG only have one partition so...
And the master key is the key you use to restore Parental Control?
Bye!
Hmm, some games only have one partition, like NSMBW.
IIRC SMG2 has two partitions?
I'll look more into this when I come back from my holiday.

IIRC there're multiple master keys, the common key is the one you want to use here, I'm certain.
 

victormr21

Well-Known Member
Member
Joined
Dec 29, 2015
Messages
565
Trophies
0
XP
498
Country
Finally i found the partition offset, but now there is another problem, the web says:
"To get the title key decrypt the 16 bytes at offset 0x1bf with the Common Key using the Title ID (offset 0x1dc) as the initialization vector (the last 8 bytes of the IV should be zero)." I have the encrypted title key (offset 0x1bf) i think i have the common key, i saw it in the iso, in google doesn't appeare, i have the title id, but i don't know how to decrypt a key with other.
@sabykos i think i have the solution for your question to finish your nfs2iso program, idk why i can't send you a PM, so talk with me in private and i will talk you
Bye!
 

sabykos

Well-Known Member
Member
Joined
Jun 10, 2013
Messages
283
Trophies
1
Age
36
XP
729
Country
Gambia, The
I don't know how i decrypted the NFS files, I did it with the nfs2iso by Sabykos, I don't know how the program did it...
Bye and Happy Christmas!
You should be able to decrypt the key by pasting it into a file key.bin (via hexeditor) and running
Code:
openssl enc -d -aes-128-cbc -K "CommonKey"-iv 0-nopad -in key.bin -out key_dec.bin
No guarantee though, I'm basing this on the fact that AboodXD said it can be decryted the same way as the nfs files.
 

GerbilSoft

Well-Known Member
Member
Joined
Mar 8, 2012
Messages
2,395
Trophies
2
Age
34
XP
4,255
Country
United States
However it places the game partition at 0x50000 and not at 0xF800000. This seems to be the normal location for it (at least for SMG2). If you want that data in 0xF800000, remove the commentary in lines 199 and 200. For anything further, I need your help @Falo . Any hint how I encrypt/decrypt the game partition? I want to recreate what you have described in your post before I try to revert it. Would be nice, if you could give some hints. :)
0x50000 would be the first partition on the disc, which is usually an update partition. I'd assume Wii VC doesn't have an update partition.

0xF800000 would be the location of the game partition on most discs due to the update partition.

Start Size Description
0x40000 4 Total partitions in the disc
0x40004 4 Partition info table offset, Address is (value << 2)
I got an adress (01234567) but now? i added 2, i subtrated 2... and nothing
That's a left shift by 2 bits, which is equivalent to a multiply by 4.

The title key is encrypted using the Wii common key, which has nothing to do with parental controls. (I don't think it can be posted here, but it's available on hackmii.com)
 
Last edited by GerbilSoft,

AboodXD

I hack NSMB games, and other shiz.
Member
Joined
Oct 11, 2014
Messages
2,880
Trophies
1
Location
Not under a rock.
XP
2,921
Country
United Arab Emirates
You should be able to decrypt the key by pasting it into a file key.bin (via hexeditor) and running
Code:
openssl enc -d -aes-128-cbc -K "CommonKey"-iv 0-nopad -in key.bin -out key_dec.bin
No guarantee though, I'm basing this on the fact that AboodXD said it can be decryted the same way as the nfs files.
Except the iv is the title ID, and not 0.
 
D

Deleted User

Guest
I'll be surprised if they're 1:1 dumps; why would they put Wii update partitions in the vWii? :P
(MKW and Wii Fit (Plus) both have 3 partitions on ISO fwiw)
 

AboodXD

I hack NSMB games, and other shiz.
Member
Joined
Oct 11, 2014
Messages
2,880
Trophies
1
Location
Not under a rock.
XP
2,921
Country
United Arab Emirates
The title key is encrypted using the Wii common key, which has nothing to do with parental controls. (I don't think it can be posted here, but it's available on hackmii.com)
Isn't that what I said? XD
Dump your Wii U's OTP using OTP2SD, the Wii common key is located at byte 0x14.
 
  • Like
Reactions: Deleted User

victormr21

Well-Known Member
Member
Joined
Dec 29, 2015
Messages
565
Trophies
0
XP
498
Country
@AboodXD I said it because like Sabykos said:
"Partition data is encrypted using a key, which can be obtained from the partition header and the master key"
I searched a bit in Google, and the master key is for unlock Parental Control, I didn't find more utilities because Google doesn't show the keys like the Wii U keys.
So Can you help us when you will finish your holidays?
Bye!
 

AboodXD

I hack NSMB games, and other shiz.
Member
Joined
Oct 11, 2014
Messages
2,880
Trophies
1
Location
Not under a rock.
XP
2,921
Country
United Arab Emirates
Again, the master key you want is the common key, you have to find it yourself.
Here's how you decrypt the partition:
Put the encrypted title key in a file using a hex editor and name it titlekey.bin, enter the following:
Code:
openssl enc -d -aes-128-cbc -K "common key" -iv "first 8 bytes of the title ID followed by 8 bytes of 0" -nopad -in titlekey.bin -out titlekey_dec.bin

After that you open titlekey_dec.bin using a hex editor, you'll find the decrypted title key there.

Then decrypt the partition. (Hint: decrypt every cluster then stack them together)

(Not tested, but should work)

---------------------------------------------------------------

"which can be obtained from the partition header"
How did I forget about this? :P
 
Last edited by AboodXD,
  • Like
Reactions: victormr21

victormr21

Well-Known Member
Member
Joined
Dec 29, 2015
Messages
565
Trophies
0
XP
498
Country
Again, the master key you want is the common key, you have to find it yourself.
Here's how you decrypt the partition:
Put the encrypted title key in a file using a hex editor and name it titlekey.bin, enter the following:
Code:
openssl enc -d -aes-128-cbc -K "common key" -iv "first 8 bytes of the title ID followed by 8 bytes of 0" -nopad -in titlekey.bin -out titlekey_dec.bin

After that you open titlekey_dec.bin using a hex editor, you'll find the decrypted title key there.

Then decrypt the partition. (Hint: decrypt every cluster then stack them together)

(Not tested, but should work)

---------------------------------------------------------------

"which can be obtained from the partition header"
How did I forget about this? :P
Thanks you so much Abood! I know i asked stupid things and sorry
So now, @sabykos can finish his program, adding the decrypted title key to decrypt/encrypt de game partition no?
Please if this is correct, read this Sabykos
Bye and Happy Christmas!
 

sabykos

Well-Known Member
Member
Joined
Jun 10, 2013
Messages
283
Trophies
1
Age
36
XP
729
Country
Gambia, The
http://pastebin.com/Qyni2xSX

Stilll doesnt work. Do I need to use vWii Common key or Wii Common Key? I tried both and both do not work. THis program actually should do exactly what @Falo described except changing the isencrypted bit to yes, cause I have no idea where this bit is in the TMD. Anyway I also might have fucked up the encryption. I only changed one line in Falos aes_128_cbc_dec to construct aes_128_cbc_enc. Does AES use the same initialization vector for encryption and decryption?
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Veho @ Veho: Imagine putting your butt near it :tpi: