Hacking Injecting a Banner into a WiiWare DLC

[Rockman GFF]

I was recently trying to inject an already made Banner in a WiiWare DLC.

I've tried different U8 extractions including HowardC's and none of them work with the generic first 00000000.app File. I'm able to Hex a different Name and Subtitle for the App and that works just fine viewing it from Save Data from Data Management. Is such a thing possible at this point in time?

Thanks in Advance.

 

[diddy81]

yes it uses the same principle as replacing the banner in a iso which i have just done for the SMB Team

the trick with doing it for a iso was you need to make the 00.app the same size or smaller then the one thats already there

 

[giantpune]

doing it for a channel or a ISO is easy. and it doesnt matter if it is bigger or smaller than the original. diddy probably just used trucha signer or a bugged version of wiiscrubber

in a wad, just replace the boot content with your new one, update the hash and size in the TMD and pack it into a wad and install it.

for a disc based game, you just replace the file and update the fst. most apps should update that automatically, but it seems that not every app that tries to update the fst does it correctly.

 

[diddy81]

i have wiiscrubber 1.4
but i wasnt testing it like that i unpacked and repacked the 00.app with u8tool to switch the header from IMET (banner) to IMET (dvd banner) then placed it in my sneek game folder
but if it was bigger it bricked

you said about editing the fst.bin what edit does that need ? as sneek will not automaticly edit that

 

[giantpune]

the fst is just a list of all the files, offsets, and sizes and crap in the ISO. you need to put the correct size for the new file and possibly shift all the offsets for files after the bnr if the new size is big enough to make it run into the next file.

example...
a
opening.bnr starts at 0x1000000 on the ISO and is 0x2400 bytes. the next file in the game starts at 0x1003000. you can exchange the opening.bnr with a file up to 0x3000 bytes and you only need to change the size of 1 fil.

b
opening.bnr starts at 0x1000000 on the ISO and is 0x2400 bytes. the next file in the game starts at 0x1002400. even if you change the file with one 1 byte bigger, it will overlap with the next file. so you must raise that offset up to make the files not overlap.

 

[leic7]

doing it for a channel or a ISO is easy. and it doesnt matter if it is bigger or smaller than the original. diddy probably just used trucha signer or a bugged version of wiiscrubber

in a wad, just replace the boot content with your new one, update the hash and size in the TMD and pack it into a wad and install it.

will this method also work for the homebrew channel? if so, could you please specify what you mean by the "boot content"? and location of the size in the TMD?

 

[diddy81]

the fst is just a list of all the files, offsets, and sizes and crap in the ISO. you need to put the correct size for the new file and possibly shift all the offsets for files after the bnr if the new size is big enough to make it run into the next file.

example...
a
opening.bnr starts at 0x1000000 on the ISO and is 0x2400 bytes. the next file in the game starts at 0x1003000. you can exchange the opening.bnr with a file up to 0x3000 bytes and you only need to change the size of 1 fil.

b
opening.bnr starts at 0x1000000 on the ISO and is 0x2400 bytes. the next file in the game starts at 0x1002400. even if you change the file with one 1 byte bigger, it will overlap with the next file. so you must raise that offset up to make the files not overlap.

right i get you so i should use wiiscrubber 1.4 to add the opening.bnr then extract the fst.bin and copy both on to sneek

or would you suggest a better program

 

[giantpune]

i posted code for a fst creator in a thread around here. that code is what i use to replace files for playing in sneek's di. the code compiles fine in linux. there is also a windows "port" here.

when adding files or changing filenames ( anything that affects the size of the fst.bin itself) you need to update the boot.bin as well. this tool does that too. simply replacing files doesnt change the size of the fst.bin, even if the sizes inside the fst are changed.

 

[sr_corsario]

yes it uses the same principle as replacing the banner in a iso which i have just done for the SMB Team

the trick with doing it for a iso was you need to make the 00.app the same size or smaller then the one thats already there

Noooo... you are wrong. (that happens "some" time ago)

With Wiiscrubber 1.4 you can replace any file with any size. The progran will "automatically" change all necesary information on fst.bin file.

However... and thats not a fst.bin or wiiscrubber problem... In disc the banner cant be bigger than 516Kb (dont remember exactlly... but in any case cant arrive to 600Kb). If you use a banner to big, it will freeze your wii (And will need to reboot and extract disc)

 

[stev418]

I think the OP's question was missed here, from what i understand he is wanting to change a DLC banner, not a channel banner.
DLC banners are installed to title/00010005/ and show as a 'save file'

let me turn on my wii and have a look into, i have mucked around with this before if i remember rightly

EDIT: easiest way that springs to mind is to do it by hex editing, since thats my preferred method for most stuff and i don't see any tool to do it yet.

1 - Replace the DLC 00000000.app header with the header from a VC 'save banner' banner.tpl
2 - Use a tpltga convertor to extract tgas
3 - Edit tgas and repack
4 - Remove the .tpl header and replace the DLC header back
5 - pack the new 00000000.app into wad

Note: to repack save file .tgas use TexConv.exe with this script and command "texconv Conv_save_icon.tcs 00000000.tpl"

IMPORTANT: if you are repacking DLC wads choose a good tik signer like T-signer, many other wadpackers will null areas of DLC tiks that are needed to function such as the 'parent' TITLEID

 

[Rockman GFF]

Replace the DLC 00000000.app header with the header from a VC 'save banner' banner.tpl

Success!

After doing that, I was easily able to inject a TPL that was already pre-made through the Main Game's Data for basic Save Banners. The DLC uses the same ones from what I've seen from both 9 and 10.

I used a Hex Editor to change that Header, then used tplcon to inject the other one in, reput the old Header I had back on, then finally copy and paste all the gibberish stuff that ends in the old App file, into the new one at the end so it has the same exact filesize.

This is very convenient for me seeing as the Japanese one isn't dumped yet. wwpacker18's DLC Region Changer also works wonders. It's probably the same with the 00000000.app, I'll have to compare files in Hex whenever it does get dumped down the road.

This whole thing is going to be useful whenever 11's DLC comes out in English first. Thanks a bunch, stev418. That English Banner was annoying me for a couple of days now.