Hacking [discussion] Why 5.5.x is ready for its Kexploit

D

Deleted User

Guest
we're going off topic again stop people

--------------------- MERGED ---------------------------

hykems twitter is private on my end
 
  • Like
Reactions: FlappyFalco

kaotik2k

Well-Known Member
Newcomer
Joined
Jan 17, 2016
Messages
49
Trophies
0
Age
38
XP
133
Country
Firstly great thread, its nice to see people wanting the develop on WIIU and you make some very good points.

I understand why the exploits are held back until patched or real reason for them needing to be released. One thing that really confuses me though is this..

IOSU is supposed to give us everything, so no need for a kernel exploit. So if IOSU is so special why are they not holding IOSU back until that's patched and just releasing one of the kernel exploits instead ?

What I mean is once IOSU is released it will be patched so game over. I just don't understand why IOSU being the most important of the exploits is being rushed to release and the kernel exploits being held back, surely it should be the other way around?

IOSU access would mean that we can have emunand like the 3ds has.
So the sysnand would stay at a valuable firmware version and we can upgrade the emunand to the latest version.

I understand that but what I mean is this. If IOSU is released now and then patched by Nintendo in say 5.5.6 then only consoles 5.5 and below are vulnerable. If they hold IOSU back it might never get patched by Nintendo and releasing it at a much later date will mean more consoles can use it and more importantly on much later firmware.

From my understanding the kernel exploits don't give us full access so it baffles me why they are deemed more important to protect than IOSU.
 
Last edited by kaotik2k,

steelseth

Well-Known Member
Member
Joined
Jan 25, 2016
Messages
180
Trophies
0
Age
42
XP
773
Country
Cyprus
Firstly great thread, its nice to see people wanting the develop on WIIU and you make some very good points.

I understand why the exploits are held back until patched or real reason for them needing to be released. One thing that really confuses me though is this..

IOSU is supposed to give us everything, so no need for a kernel exploit. So if IOSU is so special why are they not holding IOSU back until that's patched and just releasing one of the kernel exploits instead ?

What I mean is once IOSU is released it will be patched so game over. I just don't understand why IOSU being the most important of the exploits is being rushed to release and the kernel exploits being held back, surely it should be the other way around?
IOSU access would mean that we can have emunand like the 3ds has.
So the sysnand would stay at a valuable firmware version and we can upgrade the emunand to the latest version.
 
Joined
Apr 19, 2015
Messages
1,023
Trophies
1
Location
Stuck in the PowerPC
Website
heyquark.com
XP
3,909
Country
Australia
IOSU is supposed to give us everything, so no need for a kernel exploit.
As far as I know you'll need kernel access to apply an IOSU exploit (Hykem's exploit being the exception)

Honestly, while I do agree that a kernel exploit would be awesome and incredibly beneficial for the community at large, we all know that it isn't going to be released. The conditions for the release of all the ones we've heard of so far will likely never be met (short of emailing them to Nintendo so they can patch them out - hey.....) I think that userspace hasn't really been properly explored and there is a lot of potential there - even if just to pass the bar exam to get the secret kernel sauce.

Here's an idea: Give some trusted devs the kernel exploit for 5.5. From there, they can better reverse-engineer more methods and whatnot so that the rest of us in userspace can make better use of the hardware. Once we have an active homebrewing community (and by extension, more devs), it's only a matter of time before another kexploit is found and away we go. Even if one isn't found we'd probably get a whole bunch of cool stuff out of it anyway.

I dunno. Make of it what you will.
 

koziakauzu

Well-Known Member
Newcomer
Joined
Sep 18, 2010
Messages
73
Trophies
0
XP
621
Country
Hong Kong
may be a noob question but how would nintendo patch the exploit without it being released?
They want to be sure that the update from Nintendo blocks the exploit so most will update and get fucked. And then release it. What's the logic? I don't know.
 

toastytwo

Well-Known Member
Newcomer
Joined
Apr 3, 2015
Messages
75
Trophies
0
Age
42
XP
443
Country
Gambia, The
They want to be sure that the update from Nintendo blocks the exploit so most will update and get fucked. And then release it. What's the logic? I don't know.
To be very careful about updates when an exploit is pending should be normal!
I'm sure Hykem will inform us if a newer FW is blocking his exploit or not...
 

dimok

Well-Known Member
Member
Joined
Jan 11, 2009
Messages
728
Trophies
3
XP
2,635
Country
United States
I've got all the development tools I need by going through the official documents for the official libraries. Problem is, I can't use the sound library, for one example, with just user space, unless I am really doing something wrong, which I don't think so. Getting a handle to sndcore2 results in a mess, and getting a handle to sndcore works, but any attempt to use the library results in a lockup. I could try to use "legal" libraries, but hell, Loadiine GX2 all but copy/pastes the official header files in their source, so ...
You really do not understand the source code and the purpose of it in loadiine gx2. You just said you use official libraries and documents and that loadiine gx2 is all but copy/paste of official headers in one post... Did you even look into libwiiu? Do you really think that the examples there work or are any different? Hilarious. Especially since what you and all the other "homebrews" out there do currently is nothing different....but lets not go that way. Though I am really interessted in what you think is "legal" libraries you say in your post and what you think you can achieve with those.

The point is those "dynamic_libs" are a hardware accesses. You have to go through them to do anything with the wiiu hardware unless you do have access to the hardware registers and do know how to work with them (I would know how to work with many of the wiiu hardware registers and how to implement the necessary layers above them such as the EHCI driver but its a shitload of work and some require a lot of reversing). Though the hardware registers are only accessible through the IOSU.

Well that is what loadiine gx2 does with the rpl libraries, only the hardware access which can not be done in any other way currently. The rest around that, how and in what order the funtions from the rpl are used and what needs to be processed in what way, e.g. converting sounds to correct format or textures to the GX2 usable format, now that is what loadiine gx2 was all about for me. Do you think those several thousand lines of code and the use of several open libraries such as libfreetype, libpng or libmad are just overhead? The dynamic rpl functions are just a small fraction of the code. Loadiine gx2 was to show other developers how to use the available dynamic rpl library resources and all that needs to be done around them to get some proper results (which is a lot more than you might think). It is there so developers dont have to look into the "official documents" to understand the way the hardware access works. Well it seems its not taken as it was intended to i guess, seeing how you are trying to figure things out from the documents yourself from scretch instead of using the already working sources in loadiine gx2. Maybe I should have started with a different application than a loader and people would look different onto it. Since the sources are not used and not appreciated I guess there is no point in releasing any sources to the public then :(.

Anyway I can tell you why you cant get the sound library to run. You are trying to access it inside the browser exploit environment on your 5.5 exploit in which it is already acquired and in use by the browser application. What you do is jump into an already running and working environment with almost all resources such as the heap memory already in use and try to put things on top of it. You wont get very far with that. This is the reason you fail, assuming you do everything else correct with the rpl functions. It is not that you cant access the library through user space, afterall its a user space library, it is that you do not have enough resources left to do that or because you disturb a running environment. That is why you need the kernel exploit or at least write access to the coreinit library memory region, to actually hook yourself in a better position where the application you hook is still "fresh" and the resources are still usable.

Sorry to go so far off topic (in a way it is adding to the topic because it shows what is possible with the user exploit in a browser and what is not and requires more access rights) but this really annoys me to see something like that come from a developer who should really know better and be able to read and understand source code and the work behind it. If it is really like that and the developers just bark at each other instead of working together then there is no hope for this scene anymore and I dont wanna waste any more of my time into it in that case. I hope I am wrong on that one..
 

eliboa

Well-Known Member
Member
Joined
Jan 13, 2016
Messages
157
Trophies
0
XP
1,257
Country
France
The dynamic rpl functions are just a small fraction of the code. Loadiine gx2 was to show other developers how to use the available dynamic rpl library resources and all that needs to be done around them to get some proper results (which is a lot more than you might think). It is there so developers dont have to look into the "official documents" to understand the way the hardware access works. Well it seems its not taken as it was intended to i guess, seeing how you are trying to figure things out from the documents yourself from scretch instead of using the already working sources in loadiine gx2. Maybe I should have started with a different application than a loader and people would look different onto it. Since the sources are not used and not appreciated I guess there is no point in releasing any sources to the public then :(.
You did an amazing job on Loadiine GX2 ! I spent hours trying to understand your code and eventually i managed to make a working code (just to display an image on TV screen :P). Now i'm looking into your code again because deallocating all my shaders pointers causes problems when i want to set a new shader. I'll try your solution to deallocate asynchronously (using mutex and a new thread).
Just know that your work is a huge help for other developpers ;)
 
Last edited by eliboa,
  • Like
Reactions: dimok and vgmoose

CableLeecher

640K ought to be enough for anyone
Member
Joined
Feb 15, 2016
Messages
158
Trophies
0
Age
47
Location
EARTH | SOL-SYSTEM | SECTOR 001 | ALPHA QUADRANT
XP
221
Country
Gambia, The
So im guessing 5.5 STILL isnt out

np, i am patient i can wait till summer, then ill lose my mind

Unnecessary post... If you would really be patient, there wouldn't be the need to post about it...
I really understand why the devs are pissed and are leaving the sinking (GBAtemp)ship
 
  • Like
Reactions: ajd4096

thekarter104

Well-Known Member
Member
Joined
Mar 28, 2013
Messages
1,986
Trophies
1
XP
3,011
Country
United States
Top KEKSploit.

[discussion] Why 5.5.x is not ready for its Kexploit

- MyNintendo new FW update isn't out yet (inb4 Nintendo delays that).
- Because silly new topics about IOSU and whatnot by trolls/impationt people.
- Because soon, all dev Twitters will be hidden just like Hykem did.
- GBATemp.
- Unknown reason 1
- Unknown reason 2
 

vgmoose

Well-Known Member
OP
Member
Joined
Jan 31, 2016
Messages
360
Trophies
1
Website
github.com
XP
3,067
Country
United States
Sorry to go so far off topic (in a way it is adding to the topic because it shows what is possible with the user exploit in a browser and what is not and requires more access rights) but this really annoys me to see something like that come from a developer who should really know better and be able to read and understand source code and the work behind it. If it is really like that and the developers just bark at each other instead of working together then there is no hope for this scene anymore and I dont wanna waste any more of my time into it in that case. I hope I am wrong on that one..
Thank you for this post, and yes I think you are wrong on that one :) Also thanks again for the help with getting my game to run in Homebrew Launcher.

However, I do sympathize with @brienj, but it seems he's misplacing his frustration by directing it at you. The issue here is the fragmentation between people on 5.5 and those on lower firmwares. There's not really a clear target to release that frustration at, it's just sort of emerging from the state of things. I'm sure he wants more than anything to be able to run HBL and port his apps there as well.

I'd also like to apologize to @Marionumber1 if he feels like the original post / this thread paints him in a bad light. I appreciate his contributions and wouldn't even be involved if not for libwiiu. I also enjoy his detailed writeup+explanation of the OSDriver kernel exploit.

The last thing I wanna do is appear to be barking at other developers :(
 
Last edited by vgmoose,

oumoumad

Well-Known Member
Member
Joined
Apr 20, 2015
Messages
798
Trophies
0
Age
31
XP
890
Country
France
nice post @dimok . maybe 12 year old @brienj finally gets his head around it and either leaves forever,or actually starts reading up... most of the naysayers are young and clueless,but also wellmeaning somehow. i guess that excuses some of the shitposting. btw.. : does androids dream of electric sheep?grownups know that answer....

brienj isn't really one of those "12yo trolls" he's a homebrew developper and a very good asset to have in theWii U homebrew scene, but he did act a bit unprofessional the way he expressed himself, I hope he can continue contributing in the scene and focus more on working together with other developpers instead of acting this way in public. So no we don't want him to leave forever ^^.
 
Last edited by oumoumad,

fukseliten

Well-Known Member
Member
Joined
Apr 19, 2008
Messages
134
Trophies
0
XP
219
Country
Norway
brienj isn't really one of those "12yo trolls" he's a homebrew developper and a very good asset to have in theWii U homebrew scene, but he did act a bit unprofessional the way he expressed himself, I hope he can continue contributing in the scene and focus more on working together with other developpers instead of acting this way in public. So no we don't want him to leave forever ^^.

you are absolutely correct for pointing that out to me ,so i removed my midmorning grumpyness from the post...
 
Last edited by fukseliten,

brienj

Trying to avoid getting cancer
Member
Joined
Jan 3, 2016
Messages
1,232
Trophies
0
Website
twitter.com
XP
2,142
Country
United States
You really do not understand the source code and the purpose of it in loadiine gx2. You just said you use official libraries and documents and that loadiine gx2 is all but copy/paste of official headers in one post... Did you even look into libwiiu? Do you really think that the examples there work or are any different? Hilarious. Especially since what you and all the other "homebrews" out there do currently is nothing different....but lets not go that way. Though I am really interessted in what you think is "legal" libraries you say in your post and what you think you can achieve with those.

The point is those "dynamic_libs" are a hardware accesses. You have to go through them to do anything with the wiiu hardware unless you do have access to the hardware registers and do know how to work with them (I would know how to work with many of the wiiu hardware registers and how to implement the necessary layers above them such as the EHCI driver but its a shitload of work and some require a lot of reversing). Though the hardware registers are only accessible through the IOSU.

Well that is what loadiine gx2 does with the rpl libraries, only the hardware access which can not be done in any other way currently. The rest around that, how and in what order the funtions from the rpl are used and what needs to be processed in what way, e.g. converting sounds to correct format or textures to the GX2 usable format, now that is what loadiine gx2 was all about for me. Do you think those several thousand lines of code and the use of several open libraries such as libfreetype, libpng or libmad are just overhead? The dynamic rpl functions are just a small fraction of the code. Loadiine gx2 was to show other developers how to use the available dynamic rpl library resources and all that needs to be done around them to get some proper results (which is a lot more than you might think). It is there so developers dont have to look into the "official documents" to understand the way the hardware access works. Well it seems its not taken as it was intended to i guess, seeing how you are trying to figure things out from the documents yourself from scretch instead of using the already working sources in loadiine gx2. Maybe I should have started with a different application than a loader and people would look different onto it. Since the sources are not used and not appreciated I guess there is no point in releasing any sources to the public then :(.

Anyway I can tell you why you cant get the sound library to run. You are trying to access it inside the browser exploit environment on your 5.5 exploit in which it is already acquired and in use by the browser application. What you do is jump into an already running and working environment with almost all resources such as the heap memory already in use and try to put things on top of it. You wont get very far with that. This is the reason you fail, assuming you do everything else correct with the rpl functions. It is not that you cant access the library through user space, afterall its a user space library, it is that you do not have enough resources left to do that or because you disturb a running environment. That is why you need the kernel exploit or at least write access to the coreinit library memory region, to actually hook yourself in a better position where the application you hook is still "fresh" and the resources are still usable.

Sorry to go so far off topic (in a way it is adding to the topic because it shows what is possible with the user exploit in a browser and what is not and requires more access rights) but this really annoys me to see something like that come from a developer who should really know better and be able to read and understand source code and the work behind it. If it is really like that and the developers just bark at each other instead of working together then there is no hope for this scene anymore and I dont wanna waste any more of my time into it in that case. I hope I am wrong on that one..
@dimok I think what I said, was interpreted incorrectly, and it was in no way any sort of attack against you. What you did is very brilliant. I was just saying that the functions used through the official rpls would be very difficult to reverse every one of them without using the SDK documentation as a reference, and there is only a small sample of all of them on wiiubrew.org. There I go again, by using "small", someone will bend my words that I am saying that there isn't anything documented on there, but if you did it without looking at the official SDK documentation, then I am even more impressed by the amount of time that would have taken.

I also understand the new libraries you updated for libogc. I think the biggest issue is the wording I use. It's harder to convey the meaning in words, than by speaking to somebody. Plus, ever since my TBI, my thoughts are very disjointed, and I may even repeat the same thing twice in the same line, which causes me to have to re-read my posts a lot, and also which makes writing code now take a very long time compared to before.

But thank you for clarifying my fear of why it was not working, and don't take me as not using any of your stuff as a knock against you or anything. I would use your libraries to make my stuff compatible with your software, but there are some things I like to test and do on my own, so I get the accomplishment of doing it myself. If all I did was use somebody else's work in my own, I would not feel accomplished at all.

At any rate, I do see what you've done in your source code, the problem is that on 5.5, it can't be fully utilized yet, and I am truly sorry if what I said offended you in anyway. I'll stop now, before I say anything else that can be twisted.

nice post @dimok . maybe young @brienj gets his head around it and levels up. most of the naysayers are young and clueless,but also wellmeaning and enthusiastic as hell. i guess that excuses some of the bad vibes. btw.. : does androids dream of electric sheep?grownups knows this

edited with manners
brienj isn't really one of those "12yo trolls" he's a homebrew developper and a very good asset to have in theWii U homebrew scene, but he did act a bit unprofessional the way he expressed himself, I hope he can continue contributing in the scene and focus more on working together with other developpers instead of acting this way in public. So no we don't want him to leave forever ^^.
I am 45 years old, have a beautiful wife, 5 kids, three that still live at home, and sometimes I am not the best at communicating properly. I have over 25 years of programming experience. That is all, have a nice day.
 
Last edited by brienj,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Faust03 @ Faust03: it was also the only game I played