UPDATE 2013-01-03: Patches updated to allow installation of hidden titles now. (was still broken with error -1017 with older patches)
Thanks to FIX94 for bringing this issue to my attention, so I could fix it
IOS236 Installer also updated with these patches.

Well, I am sure that thread title caught your attention Well, maybe.

With the release of HBC v1.1.1 (v1.1.2 now) (for those who do not know of this, links here, here and here), access to AHBPROT-related features is now available on the vWii of the Wii U.

So anyways, I installed the new HBC this morning, but unable to make a NAND dump due to BootMii being unable to be installed on the vWii. However, I managed to fully dump the entire unencrypted contents of my Wii U's vWii NAND using WiiPower+Nicksasa's old FS Toolbox app, which I had modified to add in support for AHBPROT runtime IOS patching so it would actually work in vWii. The main reason I wanted to dump the NAND contents was to have a look at the vWii IOS, especially due to them being hardcoded to throw error -1017 if trying to install a system title, and I wanted to try patch that out.

FS Toolbox MOD dol+src here, use it at your own risk! Could brick vWii if you do not know what you are doing.

So I managed to get what I wanted, and after a while messing around in IDA (despite me not really having much coding or reverse engineering knowledge), I managed to find out where this new IOS "feature" was, and managed to create a few patches that, when applied via either AHBPROT supporting app, or by hex editing the ES IOS module then rewriting it to NAND, will then allow that vWii IOS to be able to install system titles like IOS once more (and presumably system menu too, but I am too scared to try that right now, since I do not have any way to recover vWii if it does not like that).

UPDATE 2012-12-11: (Patches updated, should work for all versions of vWii IOS now)
So, here are the patches I made, 3 in total, must apply all 3 to ES module in IOS (well technically 5, pt1 and pt2 patches get applied twice each)

Code:

Kill_AntiSysTitleInstallv3_pt1 <- must patch 2 instances of this pattern!
681A2A01D005
681A2A0146C0
Kill_AntiSysTitleInstallv3_pt2 <- must patch 2 instances of this pattern!
D0023306429AD101
46C03306429AE001
Kill_AntiSysTitleInstallv3_pt3
68FB2B00DB01
68FB2B00DB10

Modified iospatch.c for AHBPROT apps with these added patches here. <- link updated 2013-01-03, updated with v3 of my patch.

Now that we can install IOS wads on vWii, what can we do?
Well, here is where that big "But..." in the thread title comes in.
Answer is, not much at all, at least not yet.

You can install older IOS (and cIOS if you have signature patch enabled too), but you cannot do much with them. I have not tested any with games, so do not know what would happen there, but just testing them out in Multi-Mod Manager (WiiMod would blackscreen on me every time I tried loading it with AHBPROT support on vWii... do not know why), I noticed that both older Wii IOS, and cIOS, which are based on them, you can reload to them, and perform basic things (like navigate around the app for example), but nothing really too awesome.

However, every time you try to initialize SD or USB with either old Wii IOS or cIOS, they would crash, freezing the Wii U, which is of course no real use at all. Also, for me, it seemed that initializing network abilities is not doable with these either. Trying did not freeze the Wii U like initiializing SD or USB did, but just "failed to initialize network" error message in apps.

So, long story short, these patches allow Wii U vWii IOS to install system titles once again, no more error -1017. Do so at your own risk though. You can reload to older IOS, but can not use many features without them crashing and freezing up the Wii U. For things like USB Loaders to work on Wii U vWii, I believe things like d2x cIOS would have to be updated to support using vWii IOS as bases for vWii cIOS.

...I think that sums it all up. Well, enjoy!

UPDATE 2012-01-03:
IOS236 installer updated with new v3 patches: here

 

Is it possible that SD and USB on the vWii is accessed differently than on the original Wii, and the IOS's installed in the vWii make up for this? Can we make a cIOS using one of the vIOS as a base?

 

Really cool damysteryman, I was going to try and look at this this morning as I figured it would be fairly straight forward to create a patch to disable the IOS and SM check, but I guess you beat me too it. What happens if instead of trying to install a patched Wii IOS, you try to install a patched vWii IOS such as making an IOS 236 based on vWii 236 (00000007-00000024)? Clearly the normal IOS patches still worked on the vWii IOSs since you were able to apply them and install an IOS using AHBPROT. I suspect that the more complex custom modules needed for cIOS d2x will require further modification, but hopefully that won't take the d2x team too long (it might be a little harder without a USB gecko to debug with, we really need a way to emulate a USB Gecko over the WiFi). I'm not sure if the vWii IOSs on NUSD are signed using the WiiU common key or the vWii common key, I suspect the prior in which case the installer will need to patch a WAD (dumped from a vWii) instead of downloading the vWii IOS from NUSD (unless someone releases the Wii U common key in the next few days).

 

The vWii IOSs have a hard coded block against installing any IOS or System Menu version. However, the way a lot of HABPROT apps work is to patch the IOS running in memory, so it is possible to simply patch out this check, and that is what damysteryman has found (I'm still going to try to find a single patch version just for fun, I like reverse engineering assembly code). However, even if you install a patched Wii IOS, it doesn't actually work, my guess is that we need to install patched vWii IOSs. This is slightly more complicated as we can't download these from NUS (I checked, they are in fact encrypted with the Wii U keys), but I suspect that if you dumped IOS 58 (the one with USB2) from the vWii and used it to install a cIOS, it might work. I will try this later this afternoon if I have the time (and if it works and I have a lot of free time, I will throw together a cIOS installer that just does the whole dump -> patch -> install process for you).

 

So, homebrew can still be run from the use of vWii IOS58, I ran a sysCheck. sysCheck did not recognize IOS512 and IOS513.

 

How safe is it to do just a basic NAND dump using FSToolbox on the vWii?

 

Working on a version of blue dump to be used to dump wads. I will try to have it done by tonight.


Edit: Just to be clear vWii IOSs can't be downloaded from NUS, and shouldn't be uploaded online (as they are the property of Nintendo). To protect yourself from future updates, everybody should dump all the versions of IOS from their vWii as soon as possible. I can confirm from the wiimpersonator logs that none of the IOSs have been updated since the launch day update (the first version that had them). The only updates to the vWii since launch have been one updat to the BC-NAND (whatever the hell that is), and two to the instruction manual channel.

 

I modified a Wad-Manager with your stuff and it fails patching Anti-Install-Patch #4 and thus still returns -1017. Maybe #4 is region specific?

 

According to this: http://crediar.no-ip.com/OTPKeysWiiMode.jpg the vWii common key is the same of the Wii common key, but nus downloader can't decrypt vWii content.

 

So vWii updates are handled by Wii U Mode?