Toggle sidebar

Hacking Injecting into Wii VC on Wii U

  • Thread starter Thread starter CeeDee
  • Start date Start date
  • Views Views 24,166
  • Replies Replies 155
  • Likes Likes 6
CeeDee
CeeDee

CeeDee

you can do anything
Member
Level 22
Joined
May 4, 2014
Messages
5,489
Solutions
4
Reaction score
11,107
Trophies
6
XP
11,963
Country
United States
Alright, I've got nothing on this.

I've got a decrypted copy of an eShop Wii VC game (Mario Galaxy 2) and apparently, the Galaxy 2 game itself is in some some strange split file format, with files named "hif_000000.nfs" through "hif_000005.nfs"
All except hif_000005 are 250MB, with the last one being the remainder of the game, like a standard split RAR archive, but it's not.
The beginning of the first file starts with "EGGS" which I'm unsure if it's a reference to Yoshi, or something else entirely, but nothing I've tried can open these.

I'll probably upload it somewhere, if anyone else wants to take a look at it.
Here's what the file system looks like:

upload_2016-11-28_20-31-18.png
 
  • Like
Reactions: iVcU, CatmanFan, Quantumcat and 3 others
Sorry, but as of my writing this, no one has reverse-enginerred the .nfs format in order to be capable of creating Wii VC injects.

However, someone has been working hard at figuring out exactly how OSv1 works, and from what I've read of his findings, it may be possible to create a sort of forwarder that could load Wii games in the SNEEK (extracted filesystem) format. Don't get your hopes up, though.
 
  • Like
Reactions: CeeDee
Irastris said:
Sorry, but as of my writing this, no one has reverse-enginerred the .nfs format in order to be capable of creating Wii VC injects.

However, someone has been working hard at figuring out exactly how OSv1 works, and from what I've read of his findings, it may be possible to create a sort of forwarder that could load Wii games in the SNEEK (extracted filesystem) format. Don't get your hopes up, though.
Click to expand...
Can I get a link to this? It'd be rather nice to read into.
 
CeeDee said:
Alright, I've got nothing on this.

I've got a decrypted copy of an eShop Wii VC game (Mario Galaxy 2) and apparently, the Galaxy 2 game itself is in some some strange split file format, with files named "hif_000000.nfs" through "hif_000005.nfs"
All except hif_000005 are 250MB, with the last one being the remainder of the game, like a standard split RAR archive, but it's not.
The beginning of the first file starts with "EGGS" which I'm unsure if it's a reference to Yoshi, or something else entirely, but nothing I've tried can open these.

I'll probably upload it somewhere, if anyone else wants to take a look at it.
Here's what the file system looks like:

View attachment 70658
Click to expand...
Woah, whats that fw.img up there?
 
  • Like
Reactions: CeeDee
ItsKipz said:
Woah, whats that fw.img up there?
Click to expand...
Probably a custom fw.img(vWii).
Someone said that he can launch Wii VC title from redNAND. This can be an explaination (dunno)

--------------------- MERGED ---------------------------

C0mm4nd_ said:
Probably a custom fw.img(vWii).
Someone said that he can launch Wii VC title from redNAND. This can be an explaination (dunno)
Click to expand...
I decrypted a game too for seeing these things
 
  • Like
Reactions: CeeDee
ItsKipz said:
Is anyone here brave enough to launch that via cfwbooter? dissecting that fw.img might help with the vwii on rednand problem.
Click to expand...
It should be launched from vWii I think

--------------------- MERGED ---------------------------

I think .nfs files are a encrypted splitted wbfs/iso
 
  • Like
Reactions: CeeDee and Deleted member 388912
CuriousTommy said:
Is it possible to open the fw.ing?
Click to expand...
From where? PC or Wii U?

If you try opening it with WiiXplorer from vWii itself, probably won't work. Try opening the file from Windows Explorer on PC and it give you the prompt to burn it to CD/DVD, which isn't really useful unless you're making a SNES Station PS2 disc or trying to make (v)Wii backup discs.
 
  • Like
Reactions: CeeDee
Ok... opened the img and found these intersting bytes
2F 64 65 76 2F 75 73 62 2F 6F 68 30 00 00 00 00 6F 6C 64 20 68 75 62 20 69 6E 73 74 0A 00 00 00 13 8A 1E 2C 13 8A 1D A6 13 8A 1D AE 13 8A 1E 3C 13 8A 1E 58 13 8A 1E 8A 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1D 28 13 8A 1D EC 13 8A 1D 9E 13 8A 1D B6 13 8A 1D 9E 65 72 72 6F 72 3A 20 61 62 6F 72 74 65 64 20 67 65 74 20 64 65 76 20 64 73 63 0A 00 28 6E 75 6C 6C 29 00 00 28 6E 69 6C 29 00 00 00 13
 
  • Like
Reactions: CeeDee
C0mm4nd_ said:
Ok... opened the img and found these intersting bytes
2F 64 65 76 2F 75 73 62 2F 6F 68 30 00 00 00 00 6F 6C 64 20 68 75 62 20 69 6E 73 74 0A 00 00 00 13 8A 1E 2C 13 8A 1D A6 13 8A 1D AE 13 8A 1E 3C 13 8A 1E 58 13 8A 1E 8A 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1D 28 13 8A 1D EC 13 8A 1D 9E 13 8A 1D B6 13 8A 1D 9E 65 72 72 6F 72 3A 20 61 62 6F 72 74 65 64 20 67 65 74 20 64 65 76 20 64 73 63 0A 00 28 6E 75 6C 6C 29 00 00 28 6E 69 6C 29 00 00 00 13
Click to expand...
might be useful to show what the bytes are in text, too
Code: 
00000000: 2f64 6576 2f75 7362 2f6f 6830 0000 0000  /dev/usb/oh0....
00000010: 6f6c 6420 6875 6220 696e 7374 0a00 0000  old hub inst....
00000020: 138a 1e2c 138a 1da6 138a 1dae 138a 1e3c  ...,...........<
00000030: 138a 1e58 138a 1e8a 138a 1ccc 138a 1ccc  ...X............
00000040: 138a 1ccc 138a 1ccc 138a 1ccc 138a 1ccc  ................
00000050: 138a 1ccc 138a 1ccc 138a 1ccc 138a 1ccc  ................
00000060: 138a 1d28 138a 1dec 138a 1d9e 138a 1db6  ...(............
00000070: 138a 1d9e 6572 726f 723a 2061 626f 7274  ....error: abort
00000080: 6564 2067 6574 2064 6576 2064 7363 0a00  ed get dev dsc..
00000090: 286e 756c 6c29 0000 286e 696c 2900 0000  (null)..(nil)...
000000a0: 13                                       .
 
  • Like
Reactions: CeeDee and CuriousTommy
ihaveamac said:
might be useful to show what the bytes are in text, too
Code: 
00000000: 2f64 6576 2f75 7362 2f6f 6830 0000 0000  /dev/usb/oh0....
00000010: 6f6c 6420 6875 6220 696e 7374 0a00 0000  old hub inst....
00000020: 138a 1e2c 138a 1da6 138a 1dae 138a 1e3c  ...,...........<
00000030: 138a 1e58 138a 1e8a 138a 1ccc 138a 1ccc  ...X............
00000040: 138a 1ccc 138a 1ccc 138a 1ccc 138a 1ccc  ................
00000050: 138a 1ccc 138a 1ccc 138a 1ccc 138a 1ccc  ................
00000060: 138a 1d28 138a 1dec 138a 1d9e 138a 1db6  ...(............
00000070: 138a 1d9e 6572 726f 723a 2061 626f 7274  ....error: abort
00000080: 6564 2067 6574 2064 6576 2064 7363 0a00  ed get dev dsc..
00000090: 286e 756c 6c29 0000 286e 696c 2900 0000  (null)..(nil)...
000000a0: 13                                       .
Click to expand...
This text:
/dev/usb/oh0..../dev/usb/ehc.............Üàïþÿ..[USB] %s....0.9-svn-r590..../dev/usb/usb...........G.....................................................................j................1......~......exit(%d) called.....exit() printing usage information.......(null)..(nil)....m.X.m.&.m.&.m.&.m.&.m.&.m.&.m.š.m. .m.&.m.¦.m.&.m.&.m.¬.m.¶.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.¼.m...m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.¶.m.r.m.r.m.ä.m.r.m...m.r.m.r.m.¶
From 0x00002E90 to 0x0000305F

/dev/usb/usb.....m...m.>.m.8.m.2.m.,.m.&.m. .m...m...m...m...m...m...m...m...m...m...m..[USB_HID] %s....0.9-svn-r590..../dev/usb/hid.....m.ð.m‘..m‘..m.ð.m.ð.m.ð.m‘ .m‘(.m‘0.......Fexit(%d) called.....exit() printing usage information.......(null)..(nil)....m˜ô.m˜Â.m˜Â.m˜Â.m˜Â.m˜Â.m˜Â.m™6.m™<.m˜Â.m™B.m˜Â.m˜Â.m™H.mšR.m™..m™..m™..m™..m™..m™..m™..m™..m™..m™..m™X.m™º.m™..m™..m™..m™..m™..m™..m™..m™..m™..m™..m™..mšR.m™..m™..m™€.m™..m™º
From 0x00004E90 to 0x0000502F

From 0x00006FD0 to 0x0000725F and others

--------------------- MERGED ---------------------------

In frisbiiU this: [SDK+Nintendo:Error_2_4_0]
Code: 
5B 53 44 4B 2B 4E 69 6E 74 65 6E 64 6F 3A 45 72 72 6F 72 5F 32 5F 34 5F 30 5D
 
Last edited by C0mm4nd_,
  • Like
Reactions: CeeDee
ihaveamac said:
might be useful to show what the bytes are in text, too
Code: 
00000000: 2f64 6576 2f75 7362 2f6f 6830 0000 0000  /dev/usb/oh0....
00000010: 6f6c 6420 6875 6220 696e 7374 0a00 0000  old hub inst....
00000020: 138a 1e2c 138a 1da6 138a 1dae 138a 1e3c  ...,...........<
00000030: 138a 1e58 138a 1e8a 138a 1ccc 138a 1ccc  ...X............
00000040: 138a 1ccc 138a 1ccc 138a 1ccc 138a 1ccc  ................
00000050: 138a 1ccc 138a 1ccc 138a 1ccc 138a 1ccc  ................
00000060: 138a 1d28 138a 1dec 138a 1d9e 138a 1db6  ...(............
00000070: 138a 1d9e 6572 726f 723a 2061 626f 7274  ....error: abort
00000080: 6564 2067 6574 2064 6576 2064 7363 0a00  ed get dev dsc..
00000090: 286e 756c 6c29 0000 286e 696c 2900 0000  (null)..(nil)...
000000a0: 13                                       .
Click to expand...
aborted get dev disk? usb/oh0? hmmm...
 
  • Like
Reactions: CeeDee
've got a decrypted copy of an eShop Wii VC game (Mario Galaxy 2) and apparently, the Galaxy 2 game itself is in some some strange split file format, with files named "hif_000000.nfs" through "hif_000005.nfs"
All except hif_000005 are 250MB, with the last one being the remainder of the game, like a standard split RAR archive, but it's not.
The beginning of the first file starts with "EGGS" which I'm unsure if it's a reference to Yoshi, or something else entirely, but nothing I've tried can open these.
Click to expand...


this is interesting,
i'v seen a .wbfs file of galaxy2 and the size was 1355776 bytes, this looks close to the 5X250 mb +l ast smaller .nfs file.

have you compare the iso wbfs with the ""splitted files"" joined (1+2+3+4+5) ? maybe it's not encrypted...

a vc n64 decrypted have folders: code, meta, content, in content you can find a folder ROM, with a rom image (non crypted) of the game allowing injecting in a easy way roms.
so why the NFS file should be encrypted ? the others files seems to be a "basic" loader, that mount the wbfs and lunch the game via the channel VWII.

it could be interesting to swap 2 VCWII NFS files (brick risk anyway !) to see if the loader cares what it runs.
 
jose1209 said:
this is interesting,
i'v seen a .wbfs file of galaxy2 and the size was 1355776 bytes, this looks close to the 5X250 mb +l ast smaller .nfs file.

have you compare the iso wbfs with the ""splitted files"" joined (1+2+3+4+5) ? maybe it's not encrypted...

a vc n64 decrypted have folders: code, meta, content, in content you can find a folder ROM, with a rom image (non crypted) of the game allowing injecting in a easy way roms.
so why the NFS file should be encrypted ? the others files seems to be a "basic" loader, that mount the wbfs and lunch the game via the channel VWII.

it could be interesting to swap 2 VCWII NFS files (brick risk anyway !) to see if the loader cares what it runs.
Click to expand...
Another thing is trying to load a vWii VC with loadiine

--------------------- MERGED ---------------------------

Tried to load fw.img and nothing. It doesn't load
 
  • Like
Reactions: TotalInsanity4

Site & Scene News

Go to forum More news

Popular threads in this forum

Homebrew Tutorial  miigrate: Recover and move Wii U & vWii savedata and Miis to a new console

Wiimmfi on Wii-U

WiiU scaling issues are more fundamental than we thought

Guide - how to fix your vWii by using vWii Compat Title Installer or vWii Decaffeinator

Hacking  vWii — every title hangs on black screen when launched normally through the Wii Menu (fully stock, freshly restored)

Hardware Homebrew  Using a Large HDD (2TB+) on Wii U with Separate GameCube / Wii / Wii U Partitions

Emulation  nullDC4Wii : Dreamcast emulator running on Wii & WiiU

Updating boot1 to install isfshax