Hacking error -2011 on virgin 4.0

[nicksasa]

fogbank , did you try ES_GetTitleTmd ?

 

[fogbank]

fogbank , did you try ES_GetTitleTmd ?

I'm not seeing that function anywhere. Maybe I need an update?

I see ES_GetDeviceCert which might be useful here.

 

[fogbank]

Well i just figured that comex reads this from nand somehow. If you can read the file but not get the size, that's not a problem. You could just read more than required and calculate the size of the tmd.

Maybe ES_GetStoredTMDSize

 

[nicksasa]

sorry it is ES_GetStoredTmd

 

[fogbank]

But why would an ES_AddTitleStart error tell you anything about /tmp/title.tmd?

Here's a stab:

Assuming ES_AddTitleStart writes the title.tmd to /tmp AND
assuming that ES_AddTitleFinish deletes the title.tmd from /tmp AND
assuming that ES_AddTitleStart sets some sort of flag indicating success or failure AND
assumimg that ES_AddTitleFinish reads that flag to see if it needs to do anything (like delete /tmp/title.tmd) AND
assuming that the code you wrote did not return from a failed ES_AddTitleStart but continued with the "delete /tmp/title.tmd and write a modified title.tmd to /tmp" part

THEN

A failed ES_AddTItleStart would not result in title.tmd being written to /tmp AND
ES_AddTitleFinish would not bother to delete title.tmd from /tmp

SO

your modified title.tmd would still be in /tmp after the ES_AddTitleStart error.

Just a wild guess and probably wrong...

 

[WiiPower]

I can't follow. You know that you get the error message in the IOS35 downgrader that AddTitleStart failed?

Also, i write the tmd to the temp folder just before finishing the title, and i assume comex does the same.

I saw the UNSIGNED(!) tmd after the revision was set 0 where the tmd has to be. This is what made me fall from my couch. There's are at least 2 BIG exploits in the current IOS. And i hope TT uses something else to install the HBC, or these 2 are difficult to patch.

 

[fogbank]

I can't follow. You know that you get the error message in the IOS35 downgrader that AddTitleStart failed?
Also, i write the tmd to the temp folder just before finishing the title, and i assume comex does the same.

I was referring to comex's code, not yours

Trying to guess how there might be a title.tmd left in /tmp after the IOS35 downgrader ran.

 

[WiiPower]

I can't follow. You know that you get the error message in the IOS35 downgrader that AddTitleStart failed?
Also, i write the tmd to the temp folder just before finishing the title, and i assume comex does the same.

I was referring to comex's code, not yours

Trying to guess how there might be a title.tmd left in /tmp after the IOS35 downgrader ran.

I don't think it does. And it's really difficult to check that. Does it exit to loader or reboot the Wii, i don't want to test. ANY IOS reload will delete the temp folder, so even if it was left there, you have only few chances seeing it.

 

[fogbank]

Trying to guess how there might be a title.tmd left in /tmp after the IOS35 downgrader ran.

I don't think it does. And it's really difficult to check that. Does it exit to loader or reboot the Wii, i don't want to test.
Ahh.. I was just speculating (obviously wrong).

QUOTE(WiiPower @ Jul 3 2009, 03:18 PM)

ANY IOS reload will delete the temp folder, so even if it was left there, you have only few chances seeing it.

Wow, good info. Thanks!

 

[saratis]

I tried downgrading to IOS15 But the IOS36 patch keeps telling me i need to install IOS15. What am i doing wrong?

 

[fogbank]

I've been trying to figure out how comex's worked without a file on SD and without downloading anything first. If ES_AddTitleStart requires a TMD and a cert, I thought of reading it from the NAND but I think I'm running into permissions problems:

/sys/cert.sys
/title/00000001/0000000x/content/title.tmd

Well i just figured that comex reads this from nand somehow. If you can read the file but not get the size, that's not a problem. You could just read more than required and calculate the size of the tmd.

The certs are included as data in comex's dol (part of patchmii that he used), so he didn't have to read it from NAND. I don't see any indication that the title.tmd is included though.

I've made a quick and dirty app that just downgrades the TMD revision of IOS16 using certs and the tmd from IOS16 v512 as data. It works great to allow IOS16 v257 to be installed on 4.0. Obviously it's not for distribution though. I'm going to take another shot at reading the title.tmd from NAND instead. Thanks again for the nice exploit code (and thanks to comex also)

 

[Dteyn]

Great work guys, it's always cool to watch some sweet reverse engineering skills and to watch the discussion of Wii internals by those who are knowledgeable about such things.

Kudos!

 

[Riicky]

Dteyn....lmao that little bug in the bottom right of your post made me smack the monitor...classic!

 

[Dteyn]

Hehehe yeah, I like to keep people on their toes.. I've always George Carlin's suggestions.

Like pull up next to someone in traffic, make eye contact and scream "PULL OVER!! PULL OVER!! PULL OVER!! ... they pull over, you keep goin! Let THEM figure it out! After all, you don't wanna have anything to do with an asshole like that."

Or "Here's one, walk in to a gift store and ask for your gift. I say 'Hi there, I saw your sign and came in for my gift, to save you the trouble of looking all over for me!' They never seem to have mine!"

Anyways, sorry...

 

[fogbank]

Well i just figured that comex reads this from nand somehow. If you can read the file but not get the size, that's not a problem. You could just read more than required and calculate the size of the tmd.

I managed to get my little app (IOS16 TMD downgrader) working by reading the TMD from NAND using ES_GetStoredTMDSize and ES_GetStoredTMD.

Probably easy stuff for some, but it was fun for me.

Thanks to nicksasa for the suggestions.

Now I may look into grabbing the cert from the NAND too.

EDIT: punctuation

 

[WiiPower]

Does it work when you use the latest IOS36 from the NUS server? Comex' one does work on virgin 4.0 Wiis.

 

[fogbank]

Does it work when you use the latest IOS36 from the NUS server? Comex' one does work on virgin 4.0 Wiis.

Yes. I update the Wii before every test.

Title=1-24 (IOS36) vers: 12.22 (3094)

But I'm not sure what IOS36 has to do with my app. My HBC is running off of IOS55, and I don't reload any IOS in my app. I'm only downgrading the revision number on the IOS16 TMD and then exiting.

Here's how I test:

Update via NUS. Verify IOS16 v512 is installed. Attempt to install IOS16 v257 via WadManager running on IOS55 (error -1035).

Run my app. Verify IOS16 revision = 0. Install IOS16 v257 via WadManager running on IOS55 (success).

 

[WiiPower]

Always integrate an IOS_GetVersion in your system apps. If you did not add code to skip it, it's running on IOS36. Also the HBC does load an IOS when launching apps, it does not have to be the same as it uses itself.

 

[fogbank]

Always integrate an IOS_GetVersion in your system apps. If you did not add code to skip it, it's running on IOS36. Also the HBC does load an IOS when launching apps, it does not have to be the same as it uses itself.

I did not know that! I always thought that the apps were running on whatever IOS the HBC used unless you reloaded.

Thanks...learn something new everyday

 

[fogbank]

The manipulated IOS is UNSIGNED(for all those that don't understand, that's worse than trucha signed)
- the IOS is UNSIGNED, but you can still launch it...

By "UNSIGNED" do you mean the IOS has an invalid signature?

When I downgrade the TMD for IOS16 by reading it from NAND I end up with a TMD that is identical to the original with the exception of the title version (now 0). The signature on the TMD is the same as before.

But since the signature no longer matches the encrypted hash of the TMD contents (we modified the contents) the signature would be considered "invalid".

Is that the same as what you mean by "UNSIGNED"?

EDIT: typo