Homebrew How does "Move" channel to SD work?

[tpb8675309]

OK.. So I have IOS60 and IOS36 patched on a 4.0U Wii. Moving Homebrew, Neogamma, or Virtual Console channels to my SD and running them from there work fine.

Had a few questions about the guts of how all that works. Take homebrew for example.

Before I move the channel to sd, I know I have something like:nand/ticket/00010001/4a4f4449.tik
nand/title/00010001/4a4f4449/content/title.tmd
nand/title/00010001/4a4f4449/content/*.appAnd after I move the channel to sd, I know I have something like:nand/ticket/00010001/4a4f4449.tik
nand/title/00010001/4a4f4449/content/title.tmd
sd/private/wii/title/jodi/content.binSo I guess my question is...[*]Do the *.tik files change in any way to point to the SD after the move?[*]Do the *.tmd files change in anyway to point to the SD after the move?[*]How does one build a valid content.bin on an SD progamatically?
I have devKitPPC up and running and have toyed with the examples. If anyone has some code hints they can throw my way, I'd like to try to code something up. I can't seem to find the "offical" API doc set for devKitPPC so I'm kinda winging it. Also, since I'm patched on IOS60, I guess I could fakesign the content.bin if needed, but I would think I could go ahead and grab the real keys and just use those.

My end goal (as I posted in the WM thread) is to build or mod a Wad installer that would land all the *.app stuff on the SD and the *.tik and *.tmd on the nand. I always move channels to my SD anyway, so figure this method would be an option that some people might like.

thx

 

[giantpune]

channels moved to the sd card are just there for storage. when they are launched, they are copied back to the nand and loaded as before.

but if that doesnt deter you, have a read of this.
http://www.wiibrew.org/wiki/Content.bin

 

[tpb8675309]

Did some testing....

[*]Do the *.tik files change in any way to point to the SD after the move?[*].[*].No, they are the same whether on the SD or in NAND.

[*].[*]Do the *.tmd files change in anyway to point to the SD after the move?[*].No, they are the same whether on the SD or in NAND.

[*].[*].[*]How does one build a valid content.bin on an SD progamatically?QUOTE(giantpune @ Dec 5 2009, 10:53 AM) have a read of this.
http://www.wiibrew.org/wiki/Content.bin

OK.. noted... but there are a lot of wholes in that doc set... guess this is the case for all the "Wii Internals" stuff anyway.QUOTE(giantpune @ Dec 5 2009, 10:53 AM)

channels moved to the sd card are just there for storage. when they are launched, they are copied back to the nand and loaded as before.

but if that doesnt deter you..

Actually not true....
I'll agree that while a channel is in execution that their are *.app files in their nand/title/00010001/*/content folder... And System Menu (or the titles themselves perhaps) choose to leave those *.app files in the nand/title/00010001/*/content folder after they exit. This is definitely the case with HBC 'JODI', but this is not the case with VC NES Mario Bros 3 'FCWE'. If you move that title to SD, play the title, then exit, the content folder only has a title.tmd file. No *.app files are left over. This is good news since now I can put 2GB worth of channels on my SD card so long as most of them clean up after themselves as well as 'FCWE' does.

This brings me back to my other questions. How does system menu determine that some titles shouldn't be displayed on the "Wii Menu" since they have been moved to the "SD Menu". Originally I thought it would just display all 00000000.app banners under the nand\title0010001 folder, but this isn't the case. If I move both 'JODI' and 'FCWE' from "Wii Menu" too "SD Menu" then run both titles for a few minutes, the 'JODI' title has a 00000000.app file left in it's content folder, but the 'FCWE' title does not. More so, somehow the system menu knows not to display either 'JODI' or 'FCWE' on the main "Wii Menu".

So somewhere there has to be a list of what title banners to display and which ones not to display. I started poking around in nand/title/00000001/00000002/data and found tmds.sys. This seems to have many title.tmd files concatenated together, but surprisingly it doesn't change at all when I move a title to the SD Menu. So some other file must have the "title-is-on-sd" indicator. Also, I know that it can be "deducing" it by reading the SD because it's behavior doesn't change when the SD is removed.

Back to basics... does anyone know how the system menu knows that a title has been moved to SD and therefor to NOT display it in system menu?

thx

 

[giantpune]

basically 00010001, 00010004, and 00010002 will show up on the system menu. http://www.wiibrew.org/wiki/Title_database

i think what you should have gathered from the content.bin page is that there is another key that the wii uses to encrypt and decrypt content.bin. it hasnt been found out by homebrewers. until that is known, we cant reproduce a content.bin that the system menu will be able to load. so you can mimic this with a homebrew app. but anything you create will have to be played via homebrew.

there is a list in the nand of all the titles stored on the wii and i assume that somewhere in that list is where the flag is that says where the title should be. (uid.sys i think). you should probably just get this file. make a change. get the file again, and open both up in a hex editor with diff turned on.
and just a guess, but when you play a game from a content.bin, there is still a flag left that it is meant to be on the SD card and not the nand. it wouldnt be right to assume that games delete themselves because there were games made before the system was in place. how would they know to delete themself from nand.

when you turn off your wii, what really happens is that there is a flag set to turn off, then the system menu is booted. it sees the flag and turns off. im guessing that when you go back to the system menu for that brief second, it sees the flag about the game that needs to be deleted from nand and does that. also, since the code that HBC used to record itself as being loaded was in bushing's own words "buggy", they quit using it. so the system menu doesnt see that HBC was booted, and doesnt even bother to see if it needs removed from the nand.

 

[tpb8675309]

Fantastic info! Many thanks!

I'll check out uid.sys and see if it changes on a "Move" operation. I'm also looking through parse-channel.c since it seems to have all the code I need.

Now on to keys... It wasn't clear from the article on the first read, but I see your point now. The content.bin is encoded with two keys. The header with the (known) SD (header) key, and the data with the (unknown) SD data key.

I guess this brings on to fake-signing. Since I have Trucha restored on my 4.0u IOS60, can't I fake sign SD data in a way that would still be decryptable to the patched IOS60, or am I missing some fundamentals on what patching Trucha back into IOS60 actually does?

EDIT: Upon reflection, signing and encrypting are kinda different operations, so perhaps truncha won't work unless I know how to encrypt the content.bin.

thx