Hacking Fake Update Server

[KiiWii]

Its a great idea, theres nothing simpler than updating your PSP via the official update method and getting the latest version of CFW.

Hope this idea comes to fruition as it would be incredibly useful.

Off topic: @ fors: any news on your wii's?

KiiWii

 

[wolffangalchemist]

i'd like this it would make updating your wii a lot less stressful and there's no "am i gonna lose mah homebrez oh noez!!!" while updating with this method.

 

[ether2802]

But still we need to have the HBC previously installed, right??

 

[digitydogs]

If i can get this to do what i want it to this will be usable on factory wii's.
Waiting on a little feedback/info from one or two people while im examining the update dumps.
Once i get that info i'll publish it here to help speed up the effort.
Thanks to fors input about the soap platform used the most difficult thing at this point to me is safely altering the updates. Redirection of the wii should be rather simple, I'm just going to have the wii point to a proxy on the LAN that will have the wii server redirected to the local computer hosting the faked updates.

 

[Screemer]

technically you *could* fake an update server, as NUS only uses Axis/SOAP, both easily found open source. using some of the wii's packet data already found online in some documentation, by imitating the handshake / connection its very possible to fake the update server. That and i've already located and redirected the update functions in the system menu to wherever i want (ie, a subdomain of my server, nus.csm.safe-leek.com)

if i remember it correctly, you mentioned a custom update-server and that you are planing ss like that in the cSM-thread a good month ago. like you said it shouldn't be a problem to download the official files from nus and patch them "on-the-fly" during the installation process. looking forward to something like that.

 

[Deleted User]

I actually thought about a fake server, but with shop channel.
That way, you could put a HBC channel to download from the shop channel and bypass the whole twilight hack thingo.
I mean i know we can definately redirect the traffic to a local server. But would the wii accept the HBC channel as a channel?
how does the wii install VC or other channels, what format would they be in?

 

[Ga1l0w]

If this works...you'll be my new hero.

 

[digitydogs]

Ok just got a reply from fors with a little more detail, which i'll share here. As i thought the hardest part (At least for me) is going to be modifying the updates. anything in () below is my addition

Get Apache Tomcat running and install the Apache SOAP module on whatever server / computer for testing. (simple) Search google for that documentation some guy did with a few snapshots of packet information. *OR* sniff your wii communicating to NUS and figure out how exactly the request is sent and how the response is. (again simple to do) im 99% sure that a request is sent via the header of the HTTP request, which the SOAP applet running on NUs reads and says "okay you're this firmware, you need an update" and responds with the locations of said titles, easily accessible via standard HTTP ,i.e. patchmii.

_me again_
So we just need to figure out what exactly is said to the SOAP server. check the header. Modify a update and test it out. I'll be doing the sniffing and searching for the aforementioned documentation this evening. Already have an apache server set up with soap installed so i can begin testing as soon as i get the info and file structure used by the NUS. I'll try first with a current update as i have my testing wii still on 3.2. Assuming the standard (untouched) update can be installed from there its just a matter of understanding/altering an official update. The first alteration I will try is just changing the version number to 3.5 and trying to update to that, if it succeeds then i'll move on to seeing about adding channels and changing the IOS's installed.

 

[djtaz]

If you put a DNS server on the same machine and add in a hostfile for the nintendo site to point at your own server the wii will point to that instead as it wont know its not the real ninty server.

 

[digitydogs]

another good way to do it taz.... seen my member title recently? lol

 

[20clarky08]

lmaooo @ digitydogs

how on earth did u manage that lol

 

[Forsaekn]

you can also take a look at Wiimpersonator, there's some vague information about the handshake there as well. It seems like the SOAP applet replies with the location of a tmd to download, which once decrypted, has all titles to update/download listed in it (the whole idea behind the tmd/tik per title).

 

[digitydogs]

For others looking into this Wiimpersonator logs....
http://wii.marcansoft.com/wiimpersonator/reports/
And more info
http://mozy.org/wii/

 

[ether2802]

Cool this is gettin' done, I may not even need a ModChip for my frezzeing WiineaPig

 

[djtaz]

another good way to do it taz.... seen my member title recently? lol

Lmao .... i told u already , it wasnt a t****** ... she just had very masculine features for a woman.

and back on topic ... yeah that DNS trick is used for open wireless networks for sites like hotmail and gmail paypal and ebay to spoof peoples logins and get passwords .... prob better use to point the DNS at the local server

Fors ! welcome back man - where u been ??

 

[ether2802]

so if I change the DNS to the IP of my PC it may do something???

 

[IronMask]

God I love it when a plan comes together my Wii fam... I have been rockin' so hard with work and this multi-cios sytem menu thread of thoughts that turned wild... I would have missed this thread because it is definately worth the find... Yea... that's weird how you mention the firmware of the psp and how that dark angel guy got it updating from the server like that.... i was just trying to learn how to do that with the pandora battery...until i found i had a psp3000 which is kinda loopy right now..

Keep this coming guys.. this is some good shit... here.

 

[Beige]

This is a very interesting concept... Something like this would not mean we could circumvent needing the Twilight Hack or other console-based exploit to install the HBC, but it would allow better control over resisting Nintendo's hate for homebrew, but could lead to some serious bricks without proper testing.

Honestly, following the PSP CFW concept of updating would be best. Especially when revisions are launched, because it would be a waste of effort to do a complete update when a couple of files could be replaced/appended. Of course, it would also be an easy way of updating applications that require a cIOS or specific IOS version (such as the backup loader) Honestly, I'm thinking that wiigator is waiting for BootMii so he could use it to load a custom System Menu/IOS off of the SD card so the Backup Loader could run completely off of 'the System Menu' and something like this would simply patch the SD card files.

DO NOT REGARD THIS POST AS FACT, IT IS ONLY A THEORY. I CAN NOT SPEAK FOR WIIGATOR OR ANYONE INVOLVED IN THE SCENE.
Although, if you do want me to speak for you for some reason (I can translate poor English if needed), send me a PM

 

[digitydogs]

This actually would allow us to do away with the need for the twilight hack as we could have the update install any channel/Wad we want. I.E. the HBC

 

[Beige]

This actually would allow us to do away with the need for the twilight hack as we could have the update install any channel/Wad we want. I.E. the HBC

But how would we get the connection info into the system menu without some sort of homebrew? Are you proposing that you are able to fake the server itself via the network?