Hacking Decrypting Wii VC nfs files

[JaceCearK1]

- add eggs header, seems to be the same for all.

Just wanna point out that it's not the same for every game, as I mentioned before.

 

[Pachee]

Amazing work! So all that is left now is the EGGS header.

 

[sabykos]

NFS Encryption:
0x10000 - ??? = unknown data, not present in wii isos's

This might be a problem for the reverse way. :/

 

[CeeDee]

I tested this with "Kirby's Return to Dream Land" Wii VC iso and successfully converted it to a working wii iso.
But i don't have a WiiU to test the opposite.

If you want, I could test.

 

[flzmx]

I tested this with "Kirby's Return to Dream Land" Wii VC iso and successfully converted it to a working wii iso.
But i don't have a WiiU to test the opposite.

Would love to test. You can try to convert a WAD to a iso and encrypt it there if you don't want to include copyrighted stuff. There's an open source Homebrew Channel now. It works.

 

[sabykos]

Well, it seems nobody is really interested in writing an injecting tool, so it seems we need to do this ourselves. Fortunately we have this code:
http://gbatemp.net/threads/decrypting-wii-vc-nfs-files.452426/page-4#post-6925260
This is for decrypting the nfs files. It does not rearrange partition table and so on as described in this post:
http://gbatemp.net/threads/decrypting-wii-vc-nfs-files.452426/page-4#post-6925186
So first step would be: compile the C# code, run it with the a game, the key from htk.bin and IV=0. Then try to write an encryption code (just reverse the process of the known code) and test it on the decrypted nfs to check, if you get the old nfs back. If this is done, the only thing that remains, is to rearrange our wbfs files, what can be done with a hex editor (tedious, but possible). I try to find some time in the coming weeks, but unfortunately I'm busy with my mster thesis, so... yeah.

 

[sabykos]

OK, I'll give it a shot on Thursday. Actually it should be quite easy. :/ I definitively need help with the header though.

 

[W hat]

Are the extracted ISOs 4.38 GB? Or are they smaller (except Metroid Prime Trilogy). As for why someone would want to extract these discs, (1) collecting / comparing with real discs (2) Metroid Prime Trilogy is around half the price on the VC as it is used.

 

[flzmx]

Are the extracted ISOs 4.38 GB? Or are they smaller (except Metroid Prime Trilogy).

They would be the same size as the dumped ISOs from a Wii.

As for why someone would want to extract these discs, (1) collecting / comparing with real discs (2) Metroid Prime Trilogy is around half the price on the VC as it is used.

1. yes, but not really collecting

2. even if Metroid Prime Trilogy would be extracted, you would still need a place to play it on (like Dolphin). The Wii U\Wii\vWii can't play burned ISOs.

The real purpose is to eventually reverse engineer the decryption to encrypt their own files, like Nintendont or The Homebrew Channel, and play them with Gamepad support.

 

[CuriousTommy]

2. even if Metroid Prime Trilogy would be extracted, you would still need a place to play it on (like Dolphin). The Wii U\Wii\vWii can't play burned ISOs.

USB backup loaders are definitely a thing for the Wii.

 

[Irastris]

USB backup loaders are definitely a thing for the Wii.

We know. Notice that he said "burned ISOs".

 

[flzmx]

USB backup loaders are definitely a thing for the Wii.

yeah, but
USB Loader GX and some loaders actually support dumping ISOs in software.

 

[AboodXD]

Well, it seems nobody is really interested in writing an injecting tool, so it seems we need to do this ourselves. Fortunately we have this code:
http://gbatemp.net/threads/decrypting-wii-vc-nfs-files.452426/page-4#post-6925260
This is for decrypting the nfs files. It does not rearrange partition table and so on as described in this post:
http://gbatemp.net/threads/decrypting-wii-vc-nfs-files.452426/page-4#post-6925186
So first step would be: compile the C# code, run it with the a game, the key from htk.bin and IV=0. Then try to write an encryption code (just reverse the process of the known code) and test it on the decrypted nfs to check, if you get the old nfs back. If this is done, the only thing that remains, is to rearrange our wbfs files, what can be done with a hex editor (tedious, but possible). I try to find some time in the coming weeks, but unfortunately I'm busy with my mster thesis, so... yeah.

I can write a user-friendly tool in Python, but first I want someone to dig deeper into that tik file in code folder, it definitely has a purpose as it shouldn't be there...

 

[AboodXD]

Can someone provide me a rvl.tik file?

 

[gl1mml1ng]

Well, it seems nobody is really interested in writing an injecting tool, so it seems we need to do this ourselves. Fortunately we have this code:
http://gbatemp.net/threads/decrypting-wii-vc-nfs-files.452426/page-4#post-6925260
This is for decrypting the nfs files. It does not rearrange partition table and so on as described in this post:
http://gbatemp.net/threads/decrypting-wii-vc-nfs-files.452426/page-4#post-6925186
So first step would be: compile the C# code, run it with the a game, the key from htk.bin and IV=0. Then try to write an encryption code (just reverse the process of the known code) and test it on the decrypted nfs to check, if you get the old nfs back. If this is done, the only thing that remains, is to rearrange our wbfs files, what can be done with a hex editor (tedious, but possible). I try to find some time in the coming weeks, but unfortunately I'm busy with my mster thesis, so... yeah.

Maybe @Wiimm is interested in helping with this stuff. He is the developer of Wiimms ISO Tools for manipulating Wii and GC ISOs.

 

[Pokezuculento]

I founded this

 

[flzmx]

Can someone provide me a rvl.tik file?

If you have a valid .TIK, then just use JNUS Downloader.

I founded this

I found that too. but I really don't know how to compile it or use it in general, I just wanted it for woominstaller_gx2

 

[Hiccup]

If you have a valid .TIK, then just use JNUS Downloader.

tik or title key.

 

[victormr21]

I founded this

In the SDK there are similar tools for pack games in loadiine format to installable, other to make a .wumad, a .wud.... I think this is to make a legit title.fst, this file is in the code folder when you install a game, and I think this is the file that makes possible to see what game are you playing, the name, icon... If you go to friend list you can see System Config Tool but if you are using HBC it doesn't appear to others players. I will try it!
Bye!

 

[Pachee]

I founded this

Nice find there.

typedef struct fst_header {
  char magic[3];
  u8 version;
  u8 header_size[4];
  u8 num_sections[4];
  u8 hash_disabled;
  u8 padding[0x13]; } fst_header;
typedef struct fst_section_entry {  //secondary header
  u8 f_addr[4];
  u8 f_len[4];
  u8 owner_id[8]; //actually it is the title id
  u8 group_id[4];
  u8 hash_mode;
  u8 padding[0xB]; } fst_section_entry;

http://wiiubrew.org/wiki/FST#Secondary_header Needs an update now.