Hacking Decrypting Wii VC nfs files

victormr21 · Dec 25, 2016

sabykos said:
http://pastebin.com/Qyni2xSX

Stilll doesnt work. Do I need to use vWii Common key or Wii Common Key? I tried both and both do not work. THis program actually should do exactly what @Falo described except changing the isencrypted bit to yes, cause I have no idea where this bit is in the TMD. Anyway I also might have fucked up the encryption. I only changed one line in Falos aes_128_cbc_dec to construct aes_128_cbc_enc. Does AES use the same initialization vector for encryption and decryption?

Well, the normal iso uses Wii CK to encrypt it, but for see what key is used, we need a complete nfs2iso program, so this is a loop...
An example: to get the title key in an iso, we need:
The encrypted title key, IV (TitleID and 8 zeros and the Wii Common Key
The IV will be the same if you are decrypting or encrypting...
Let's see if @Falo can help us, he did it successfully...

And my help for this, use Wii scrubber, it says if the partition is good without Dolphin or a Wii, and says all data from each partition, with this you can find the ticket position and with this the common key, the title ID and the encrypted title key
Bye and Happy Christmas!
EDIT: And then like Abood said, to decrypt a partition use the decrypted title key and decrypt every cluster and then stack then, with this you can decrypt the partition and complete the Dali's instructions

AboodXD · Dec 25, 2016

I already have a tool in Python(2.7) to decrypt the partitions, I just need to port nfs2iso to Python.

victormr21 · Dec 25, 2016

AboodXD said:
I already have a tool in Python(2.7) to decrypt the partitions, I just need to port nfs2iso to Python.

Wow, you are awesome! If you/we/he combines the nfs2iso with the script to decrypt partitions, it will be practically done...
If you need help and I can help you, say it to me!
Bye and Happy Christmas!

MisterTea · Dec 25, 2016

AboodXD said:
I already have a tool in Python(2.7) to decrypt the partitions, I just need to port nfs2iso to Python.

Can you show me your implementation for decrypting the reassembled file itself ? I always end up with the wrong data ...

AboodXD · Dec 25, 2016

MisterTea said:
Can you show me your implementation for decrypting the reassembled file itself ? I always end up with the wrong data ...

Similar to this:
blog.delroth.net/2011/06/reading-wii-discs-with-python

sabykos · Dec 25, 2016

AboodXD said:
Similar to this:
blog.delroth.net/2011/06/reading-wii-discs-with-python

Thanks for the link!

I managed to extract Super Mario Galaxy 2 with my program:
http://pastebin.com/q06ZpNbK

Note that this code is very unclean. I possibly encrypt more than I need to, because I dont know where the game partition ends.

victormr21 · Dec 25, 2016

sabykos said:
Thanks for the link!

I managed to extract Super Mario Galaxy 2 with my program:
http://pastebin.com/q06ZpNbK

Note that this code is very unclean. I possibly encrypt more than I need to, because I dont know where the game partition ends.

Good! So Is this a 3.0 version of nfs2iso?
EDIT: When it is decrypted, the partition data goes from 0x00000000 to 0x00002440.
When it's encrypted it goes from 0x00000000 to 0x000003FF
So the partition size is 0x000203FF (20000 until the partition data and the size of the encrypted partition data (3FF))
You can see this info and more here: http://wiibrew.org/wiki/Wii_Disc
Bye and Happy Christmas!

AboodXD · Dec 25, 2016

Congratulations on getting a partially working tool, go to that page above for more information about Wii partitions, after you finish your tool, you should make a new thread, don't forget about crediting people who gave you information, I'm not saying only me, but also other people too.

If you still need help, I'll try my best. (I don't think you need my help anymore)
If you can't clean up your code before making the thread, I can take the trouble of porting to Python 3.5 and then do the cleaning.

Bye, happy holidays.

victormr21 · Dec 25, 2016

@sabykos
I have tried to compile your latest program version but I got this error:
nfs2iso.c(14,49): error CS0103: The name 'EBE... (the wii common key)' doesn't exist in the current context
Any idea?
Bye and Happy Christmas!

sabykos · Dec 26, 2016

OK, I reversed the process (well, at least without EGGS hesder generating). I took my generated, working SMG2 iso and turned it back into nts, added the old EGGS header manually and... it doesnt work. My generated nfs differs from the original at two points:

the mysterious bytes at 0x10000 and

0x48000 bytes that contain of the same 0x10 bytes over and over at the end

One of those make the game fail. Maybe the EGGS header contains some size information and the missing 0x48000 bytes let it fail. I could fill it up with junk and take a look. Otherwise I have to compare it with other VC games and try to find a pattern.

Billy Acuña · Dec 26, 2016

sabykos said:
OK, I reversed the process (well, at least without EGGS hesder generating). I took my generated, working SMG2 iso and turned it back into nts, added the old EGGS header manually and... it doesnt work. My generated nfs differs from the original at two points:

the mysterious bytes at 0x10000 and

0x48000 bytes that contain of the same 0x10 bytes over and over at the end

One of those make the game fail. Maybe the EGGS header contains some size information and the missing 0x48000 bytes let it fail. I could fill it up with junk and take a look. Otherwise I have to compare it with other VC games and try to find a pattern.

Nice RE's info, pretty sure that will be useful to archive Wii VC injection

emuman100 · Dec 26, 2016

This is excellent work! I was looking for a tool to convert nfs to a Wii iso or wbfs. Is it possible convert it to an iso with an encrypted game partition and no update partition?

victormr21 · Dec 26, 2016

sabykos said:
OK, I reversed the process (well, at least without EGGS hesder generating). I took my generated, working SMG2 iso and turned it back into nts, added the old EGGS header manually and... it doesnt work. My generated nfs differs from the original at two points:

the mysterious bytes at 0x10000 and

0x48000 bytes that contain of the same 0x10 bytes over and over at the end

One of those make the game fail. Maybe the EGGS header contains some size information and the missing 0x48000 bytes let it fail. I could fill it up with junk and take a look. Otherwise I have to compare it with other VC games and try to find a pattern.

Wow! Thanks you for talk your advances in the project.
I have the original SMG Pal iso and the VC SMG NTSC. I can help you if you want.
Other things, in my last message I said the partition and partition data size, and use Wiiscruber to see the begin and the end of each partition, its a bit usefull
Bye!

MisterTea · Dec 26, 2016

AboodXD said:
Similar to this:
blog.delroth.net/2011/06/reading-wii-discs-with-python

I already read this page, can't you paste the code you use for the nfs decryption ???

AboodXD · Dec 26, 2016

MisterTea said:
I already read this page, can't you paste the code you use for the nfs decryption ???

I currently have no code to decrypt nfs files.

sabykos · Dec 26, 2016

sabykos said:
OK, I reversed the process (well, at least without EGGS hesder generating). I took my generated, working SMG2 iso and turned it back into nts, added the old EGGS header manually and... it doesnt work. My generated nfs differs from the original at two points:

the mysterious bytes at 0x10000 and

0x48000 bytes that contain of the same 0x10 bytes over and over at the end

One of those make the game fail. Maybe the EGGS header contains some size information and the missing 0x48000 bytes let it fail. I could fill it up with junk and take a look. Otherwise I have to compare it with other VC games and try to find a pattern.

Short heads up:
The mystrious byte at 0x1000F seems to be always 0x09. Well at least it is 0x09 for two games. XD I didnt have the time to check more.
The 0x48000 bytes that contain the same 0x10 bytes over and over at the end are actually 0x47E00 bytes. And I checked the decrypted file. In the encrypted file there are only 0x47E00 bytes of zeros at the end. So... only mystery solved and one mystery maybe solved... Actually only the EGGS header is left, but thats a tough one.

victormr21 · Dec 26, 2016

sabykos said:
Short heads up:
The mystrious byte at 0x1000F seems to be always 0x09. Well at least it is 0x09 for two games. XD I didnt have the time to check more.
The 0x48000 bytes that contain the same 0x10 bytes over and over at the end are actually 0x47E00 bytes. And I checked the decrypted file. In the encrypted file there are only 0x47E00 bytes of zeros at the end. So... only mystery solved and one mystery maybe solved... Actually only the EGGS header is left, but thats a tough one.

0x1000F respect the iso begin or the partition begin?
It's for test and help you
Bye and thanks!

MisterTea · Dec 26, 2016

Again, I have mapped most parts of the nfs file, if you want to RE the header or whatever, share some ideas ...

I am more interested in converting wii iso to the wiiu format.

I am working on a tool in python to automate all the wiiu>wii or wii>wiiu stuff but I always end up with gibling with my AES implementation (Pycrypto)

JaceCearK1 · Dec 26, 2016

MisterTea said:
Again, I have mapped most parts of the nfs file, if you want to RE the header or whatever, share some ideas ...

I am more interested in converting wii iso to the wiiu format.

I am working on a tool in python to automate all the wiiu>wii or wii>wiiu stuff but I always end up with gibling with my AES implementation (Pycrypto)

When En-/Decrypting the .nfs files the important thing is, that after decrypting each sector (0x8000 bytes) the -iv value of openssl needs to be set to 0 again for it to work correctly; if that's any help to you!

MisterTea · Dec 26, 2016

JaceCearK1 said:
When En-/Decrypting the .nfs files the important thing is, that after decrypting each sector (0x8000 bytes) the -iv value of openssl needs to be set to 0 again for it to work correctly; if that's any help to you!

Thank's but I am not using openssl, the point is not to depend on it.
The sector size doesn't matter as long as it's a multiple of 16.

Here is my code regarding the decryption...
Nothing fancy

Code:

def decrypt_file(key, in_filename, out_filename, chunksize=8000):

      with open(in_filename, 'rb') as infile:
              iv = b'0000000000000000'
              decryptor = AES.new(key, AES.MODE_CBC, iv)
              with open(out_filename, 'wb') as outfile:
                  print('Decrypting nfs file')
                  while True:
                        chunk = infile.read(chunksize)
                        if len(chunk) == 0:
                               print('File successfully decrypted')
                               break
                        outfile.write(decryptor.decrypt(chunk))

Hacking Decrypting Wii VC nfs files

Well-Known Member

I hack NSMB games, and other shiz.

Well-Known Member

Well-Known Member

I hack NSMB games, and other shiz.

Well-Known Member

Well-Known Member

I hack NSMB games, and other shiz.

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

I hack NSMB games, and other shiz.

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Similar threads

Popular threads in this forum