Hacking ida stuff

[dpad_5678]

Waiting can load loadiine

I hope not. Be happy with Homebrew you postless noob.

 

[davetheshrew]

this isnt for loadiine, this is a step towards iosu.

 

[davetheshrew]

Heres an update, zip file is updated and link is on first post

Added and renamed some functions to match SMEA's released IOSUHax information and credited him
Added in more found functions in both ARM and PPC decompiles
Add documentation about the ARM ARM926EJ-S Processor (Technical Doc PDF)

 

[Puddies]

Nice work @davetheshrew
Thank you for sharing.

 

[IncredibleWhanG]

My heads sore have had ida open all night

 

[davetheshrew]

tell me about it lol

 

[pwsincd]

interresting stuff dave...

 

[loler55]

I give it a look later but without programming skills useless for me i dont understand how we can load the modifieded firmware to see what happen
You modifie firmware files and then?

 

[davetheshrew]

I give it a look later but without programming skills useless for me i dont understand how we can load the modifieded firmware to see what happen
You modifie firmware files and then?

not at modifying stage yet, more like finding functions in ppc and ARM, adding them to the list, stuff like this.

P.s I dont have mad skills either, but learning to use ida and c is beneficial, try follow the steps and congratulate yourself.

 

[loler55]

Ok i understand
Can anyone make a video how we find functions and upload it .make an example to find a function and people like me can help
.i make a german translation i think it help too

Ok i try it out i will report
I hacked some weps in the past without programming skills
Google helps

 

[Net-KILLER]

Ok i understand
Can anyone make a video how we find functions and upload it .make an example to find a function and people like me can help
.i make a german translation i think it help too

Ok i try it out i will report
I hacked some weps in the past without programming skills
Google helps

What is a wep ?

 

[EclipseSin]

What is a wep ?

weapons id assume. cheating.

that or aireplay WEP hacking.

 

[Net-KILLER]

weapons id assume. cheating.

that or aireplay WEP hacking.

Oh I see. BackTrack/Kali and stuff..
I thought it's a device or something

 

[EclipseSin]

Oh I see. BackTrack/Kali and stuff..
I thought it's a device or something

Well, yea I guess. I never used those. I always set it up myself on ubuntu.

 

[Net-KILLER]

Well, yea I guess. I never used those. I always set it up myself on ubuntu.

Aircrack-ng ?
I'm more the debian guy.

 

[davetheshrew]

Thanks guys I will use aircrack and wireshark to hack ppc, excellent info

 

[Net-KILLER]

Thanks guys I will use aircrack and wireshark to hack ppc, excellent info

sorry for the off topic stuff

 

[recgame77]

@davetheshrew
Hi if i undersand the iosu is able to write any data on the seeprom (and even slc/mlc maybe) and the seeprom contains hashes of variouspart of the firmware that can brick the wiiu if do not match.

Do you have a list of functions to not test/fuzz to prevent brick ?
DO you know how to dump the slc and mlc to prevent such bricks in case of error ?

Best Regards

 

[davetheshrew]

Ok from the stuff Im reading the Wii-U's SHA-1 has a purposely set fault in SHA-1's #10 key sequence which is what tripped up smea and bricked his console (most likely) but saved it with a previous dump. To dump will take hardmodding (until iosu and cfw), theres a article somewhere showing someone doing it ,I forget where, I will google in a bit. I will forward your question on though as Im not a dev. Hopefully I will have an answer for you soon.

 

[recgame77]

main link in gbatemp is here : https://gbatemp.net/threads/wii-u-hardmod.413847/

basically the mlc is easy to dump (similar to 3DS hardmod) but the few posts that i read here and there report bricks and never got a clean explanation on this one
The slc seemed to be dumped with a teensy by smea, i guess through low level open nand interface (like ps3 tsop).

the seeprom is located inside the latte (i think ) and can not be accessed without chip destruction ;(

Still don't want to break the wiiu , waiting for a crystal clear tuto for this, don't have the smea & co guts