[Dev] Wii U File System

Discussion in 'Wii U - Hacking & Backup Loaders' started by PhusionDev, Dec 27, 2016.

  1. PhusionDev
    OP

    PhusionDev Member

    Newcomer
    12
    10
    Dec 27, 2016
    United States
    First of all, I know that there is no PC software currently that lets us have access to the Wii U Filesystem, but instead I'd like to dive into some development of my own but am completely new to the 3DS/Wii/WiiU dev scene. With that being said, I'd like to ask some of the developers that frequent this site where (which files) I should begin looking at for information regarding how certain wiiu homebrew applications (wupinstaller, libwiiu, etc) access the file system.

    Part B: I know that the filesystem itself is encrypted, but if we can access it (encrypted/decrypted) on the WiiU itself, would it possible to decrypt it using a key from within windows/mac/linux?

    Anyways I am a complete noob to this dev scene like I said so this may look ridiculous to the more experienced developers and users on this site.

    I appreciate all the hard work everybody has done to make this possible, and I'm loving wupinstaller y-mod, but I wish there was an easier way to install titles other than sucking the lifeblood from my SDCards. Thanks for your time and responses. <3

    Also for clarification sakes: I am mostly interested in accessing Wii U formatted External Drives, and not the System Memory.
     
    Last edited by PhusionDev, Dec 27, 2016


  2. proflayton123

    proflayton123 Undeclared Shitposter 2.1

    Member
    5,705
    2,109
    Jan 11, 2016
    Japan
    日本
    Well, there is wiiubrew
     
    PhusionDev likes this.
  3. PhusionDev
    OP

    PhusionDev Member

    Newcomer
    12
    10
    Dec 27, 2016
    United States
  4. EstPC13

    EstPC13 GBAtemp Fan

    Member
    415
    143
    Jan 3, 2016
    In your mind
    I love the Spirit, USB FST Decryption is the one thing that separates us from a completely open Wii U. I'm not a coder myself, but if you have a problem with an app, feel free to hit me up!
     
  5. CreeperMario

    CreeperMario GBAtemp Advanced Fan

    Member
    616
    364
    Jun 18, 2016
    Australia
    OSv10 v15702
    If you're looking for filesystem examples, I would take a look at FTPiiU Everywhere and the Haxchi installer, those invoke the IOSU exploit to mount and read the NAND and USB file systems.

    It would indeed be possible to decrypt the Wii U's filesystem on a PC, there are keys in the Wii U's OTP and SEEPROM that handle the encryption of the USB drive. The OTP and SEEPROM can be dumped from your console, see the Homebrew App Store for the apps that allow you to do this.
     
    PhusionDev likes this.
  6. PhusionDev
    OP

    PhusionDev Member

    Newcomer
    12
    10
    Dec 27, 2016
    United States
    Thanks a ton for this information! I greatly appreciate it :)
     
  7. QuarkTheAwesome

    QuarkTheAwesome Working for Hugs

    Member
    785
    1,921
    Apr 19, 2015
    Australia
    Stuck in the PowerPC
    The filesystem stuff (on Wii U-formatted drives) is all handled by the IOSU totally transparently to homebrew and the console in general. We tell it "get this file" and it comes back with the file; already decrypted and ready for use. What this means is that you probably won't see any low-level filesystem tomfoolery in homebrew apps; just FS functions.
    In order to get down to the nitty-gritty, you'll need to start thinking about what the IOSU does behind the scenes. Here's what I can tell you off the top of my head:
    • Wii U filesystems are encrypted with keys from the SEEPROM and OTP.
    • @NWPlayer123 was able to decrypt a Wii U formatted USB, however she couldn't interpret the data because...
    • Even once decrypted; the console uses a totally proprietary filesystem. It's not FAT or anything like that.
    • That said, NWPlayer also screencapped a hex dump of a decrypted USB and it seemed to me that you could figure it out with a bit of work - readable filenames etc.
    • The IOSU's code is available in an IDA database. This means a dedicated person who reads ARM Assembly or some seriously messed-up C could figure out the filesystem format that way, too.
    • Nintendo doesn't know how partition tables work. Here be dragons.
    Anyway, I hope some of that information can help in your quest to bring Wii U filesystems to the PC.

    (Also, thanks for reminding me of that tutorial - better finish that. I'm actually really curious to see what code you'd come up with after learning through that)
     
  8. PhusionDev
    OP

    PhusionDev Member

    Newcomer
    12
    10
    Dec 27, 2016
    United States
    Hello there, thank you for the response and the guide/information in the guide. After reading through the first few chapters I was able to understand how the file system was accessed and indeed I started to realize that everything FS related was transparent and we'd have to reverse what IOSU does behind the scenes. However the information regarding NWPlayer having a decrypted dump is a pretty big step, and I think with a bit of work like you said it could be understood. To understand the filesystem, we'd likely have to get a decrypted dump, run a command on the wii U and get another dump immediately following the command to see what changes take place.

    Anyways this may all be futile, but regardless I'd like to learn more about the Wii U and programming for it and breaking it down. Thanks all for your input!

    With taking dumps of WiiU formatted USB drives, and running through comparison dumps after running commands it would obviously be much more manageable with a smaller drive. I'm going to dig around for a 512MB or smaller (not sure what the smallest allowed is). Do you happen to know how @NWPlayer123 got this dump? Was it software or some modified hardware?
     
    Last edited by PhusionDev, Dec 28, 2016
    QuarkTheAwesome likes this.
  9. PhusionDev
    OP

    PhusionDev Member

    Newcomer
    12
    10
    Dec 27, 2016
    United States
    Also I love your guide @QuarkTheAwesome (so far)! It has been very helpful in beginning to understand Wii U development. Thanks for the time and effort you have put into it, and if you ever feel like continuing on with it, I would surely appreciate it and I'm sure other new adventurers would as well :)
     
    QuarkTheAwesome and KiiWii like this.
  10. NWPlayer123

    NWPlayer123 GBAtemp Addict

    Member
    2,629
    6,226
    Feb 17, 2012
    United States
    The Everfree Forest
    Nah, just Windows program to dump the raw data, someone suggested dd but that's a linux tool and gave me problems, just used HxD with admin to view the drive and save it as a file
     
  11. PhusionDev
    OP

    PhusionDev Member

    Newcomer
    12
    10
    Dec 27, 2016
    United States
    I was thinking about doing this myself. Was your dump of the drive encrypted or decrypted? I assume it was encrypted unless you managed to decrypt it using the wiiu OTP/SEEPROM keys?
     
  12. NWPlayer123

    NWPlayer123 GBAtemp Addict

    Member
    2,629
    6,226
    Feb 17, 2012
    United States
    The Everfree Forest
    Yes, it's encrypted on the drive and then I used the OTP encrypted seed to decrypt it with OpenSSL just like the Wii U does and then that's what you nerds saw was the raw FS, can tell cause it's mostly zeroes like everything else
    oh, and the block size I think was 0x200
     
    Garou and I pwned U! like this.
  13. PhusionDev
    OP

    PhusionDev Member

    Newcomer
    12
    10
    Dec 27, 2016
    United States
    Thanks for this information, I will mess around with my USB raw dump and my OTP key!
     
    I pwned U! and QuarkTheAwesome like this.
  14. PhusionDev
    OP

    PhusionDev Member

    Newcomer
    12
    10
    Dec 27, 2016
    United States
    @NWPlayer123 was the data encrypted using AES-128? I have my dumped drive and I'm trying to decrypt it using openssl like you mentioned but I'm getting "bad magic number" Please forgive my noobiness here, but I feel like I'm getting steps closer to eventually making sense of this :)
     
  15. Mr Objection

    Mr Objection GBAtemp Fan

    Member
    320
    148
    Jul 10, 2016
    Argentina
    If this happens, it will be wonderful
     
    PhusionDev likes this.
  16. PhusionDev
    OP

    PhusionDev Member

    Newcomer
    12
    10
    Dec 27, 2016
    United States
  17. piratesephiroth

    piratesephiroth I wish I could read

    Member
    3,000
    1,614
    Sep 5, 2013
    Brazil
    Unfortunately right now we can only mount it read-only.
    It will be great once we can actually modify the data directly, like moving files from the SD card to USB. All the current tools (ftpiiu and the mega slow wupclient) use the network and the PC as middle man instead of moving the files directly.

    I wonder why no one has made a native file explorer for the Wii U yet.
     
    Last edited by piratesephiroth, Dec 31, 2016
  18. PhusionDev
    OP

    PhusionDev Member

    Newcomer
    12
    10
    Dec 27, 2016
    United States
    The Wii U file system is encrypted, and even once it's decrypted, we don't know how the file system actually works (on a low level bit-by-bit). Currently I am looking for patterns and anything peculiar to try and unravel the mysteries of the Wii U File System.

    Then once we understand the file system, we still need to reverse engineer the way that the Wii U installs the titles onto the hard drive (including signing of the tickets) or instead develop a custom firmware or homebrew application that can load the titles in a non-standard way.

    Also: I think that somebody has developed a file explorer (Wii U Homebrew) application. Which I plan to find/use to compare to my bit level decrypted dump, but as far as PC applications are concerned: we don't understand the file system that the Wii U formats the drives to yet. On the Wii U homebrew, we call functions that are exposed/hijacked from the Wii U itself to see the file system. So while we can call functions that nintendo wrote, we don't understand what they are doing exactly.

    — Posts automatically merged - Please don't double post! —

    Currently I am mulling over the data on a freshly zero'd and freshly formatted (by the wii u) USB stick. I'm finding interesting patterns of data, but nothing conclusive yet. The data that I have to work with has exposed xml files pertaining to the users on my Wii U, and I am going to try and understand how this data gets arranged/placed as a starting point. I plan to also install a small title onto the usb stick and immediately after dump the drive and decrypt it; seeing which changes take place to the data on the drive as a comparison.
     
    Last edited by PhusionDev, Dec 31, 2016
  19. piratesephiroth

    piratesephiroth I wish I could read

    Member
    3,000
    1,614
    Sep 5, 2013
    Brazil
    Yeah, I know that it's not an easy task to figure out the file system.That's the reason a native wii u file browser would be better.
    We could just put our modified files on the SD and then transfer to the USB device directly.
     
  20. PhusionDev
    OP

    PhusionDev Member

    Newcomer
    12
    10
    Dec 27, 2016
    United States
    even with the file browser though.. we still don't know how the wii u signs and installs the titles