Hacking My vWii hacking steps

[norbyte]

Hey guys,

first of all: thanks again to all who made homebrew possible on vWii! I read all the wiki pages and posts carefully and finally I got everything working at first time!
So I decided to share my findings and problems to create a little tutorial (this requires no IOS236!):
My wii u was a virgin wii u, 2.1.0E.

1. The exploit

Most savegame exploits are working, see http://wiiubrew.org/wiki/WiiMode. I used Bathaxx and got the game from a video store for 2,80 € / day.

2a. Dump the nand as virgin as it is

I'd like to have a nand dump without any homebrew, so that you can reset the vWii very easy back to its original state. But it was not as easy as I thought. My attempts were:

• using Bathaxx to load fstoolbox (mod by damnmysteryman) directly from sd card (I converted the dol to elf using doltool) --> App won't load --> SD card error -2
• using Bathaxx to load loadmii, then fstoolbox --> App won't load --> SD card error -2
• using Bathaxx to load WiiXplorer, then fstoolbox --> App won't load --> SD card error -2
• using Bathaxx to load Hackmii installer for installer --> Installer works (so this is not a sd card issue)
• using Bathaxx to load another Homebrew launcher with GUI --> App loads --> select fstoolbox --> /title/* could not be dumped --> error -101

So I gave up. This seems to be not possible!

2b. Dump the nand with HBC installed only

Dumping the nand from HBC should work with fstoolbox mod. So I installed HBC with boot.elf from hackmii installer 1.2 loaded by Bathaxx. My attempts were:

• start fstoolbox mod from HBC --> /title/* could not be dumped --> error -101
• start WiiXplorer from HBC, then fstoolbox --> works!!!

Somebody mentioned to start WiiXplorer first, so this worked only for me.
But as I said above, starting WiiXplorer directly after Bathaxx didn't work for me.

3. Install a backup loader

This requires HBC to be installed as mentioned in 2. I use UsbLoader GX 3 (my preferred loader) and I would re-use my existing partial nand from my wii. So these were my steps:

• not required, but good: rename /apps folder to /apps_wii and create a new apps folder for vwii apps only
• make a copy of the nand folder and rename it to nand_vwii
• make sure the nand_vwii has only files in title and ticket folder
• edit GXConfig.cfg in apps/usbloader_gx and set nand emulation path to usb1:/nand_vwii (replace usb1 if you have multiple partitions)
• download d2x v10 beta52 for vwii (I used not the alternate one)
• download d2x-cios-installer 2.2 mod and move the folder to apps/d2x-cios-installer
• in HBC start d2x-cios-installer 2.2 mod
• select d2x-v10-beta52-vwii, select base 56, select slot 249 and press A to install
• select d2x-v10-beta52-vwii, select base 57, select slot 250 and press A to install

My pre-configured usbloader gx works well in new nand path with my games (I didn't test singing games).
BUT: Even if you transfered your data from your old wii to wii u, the miis have to be reset manually. (f.ex. in Mario Kart Wii or Super Mario Galaxy)

Conclusion

This little tutorial is not complete and not for noobs! This was my way to get homebrew and usb loaders working. And you have to use a Y-cable for the usb hard drive! I have an Iomega 500GB 2,5" drive. The cable with to wires must be placed into the upper USB port.

My problems (only my?)

I don't want to unplug the drive every time. But if I start the wii u, the wiiu system menu wants to format the drive. I have to decline this every time.

I also read that even if I format the drive and repartition it, the wii u wants to reformat it. Is that normal? Does a workaround exist?

Thanks for reading and sorry for my bad English. Maybe this helps.

 

[Cyan]

Thanks for sharing this

I moved your post from the Wii's d2x topic (for 2dx development report) into WiiU hacking section
I think it will cover more users here.



The Miis where imported with the official Wii->WiiU transfer?
Your vWii had both the Miis and savegames restored fully?

You could have tried SavegameManagerGX, but if there's an error for mii channel don't care and it will work fine. I don't know if imported mii with SMGX are working without reseting them.

 

[norbyte]

Yes, the miis were imported with Wii -> WiiU transfer software. I made a backup of my wii before, because the software will delete some stuff from the wii. After transfering, I restored the backup and everything was like before.

The miis were no problem, you can exchange them with the new one, but games like Mario Kart Wii and Super Mario Galaxy gave me a warning. Of course, I could try Savegame Manager GX, but this is not the official way and I don't know any consequence. No bootmii -> no real backup -> no brick safety -> no norbyte. Safety first.

 

[[Truth]]

@Point 2a. Dump the nand as virgin as it is:
The hackmii installer uses a new, never before officially published IOS expoilt for installation.
I guess thats the reason why you can´t start fstoolbox and xyzzy directly from bathaxx.

 

[norbyte]

Truth, I'm no expert, but I guess this is not true.
The exploit is used to install the HBC as unsigned content.
But Bathaxx just loads software (boot.elf from sd card), like the hackmii installer itself or fstoolbox or xyzzy or whatever.

So I assume there's sth wrong with the elf file (or starting routine of the app) even if it seems to be valid.
Bathaxx loads fine --> finds the elf file --> loads the elf file --> for fstooltbox and others it returns directly back to Bathaxx --> sd card will be mounted again --> error -2 --> Bathaxx crashes and hangs the game

Btw: If you hold the wii power button after an exception occurs, the wii will shutdown hard. If I hold the wii u power button after the game hangs, nothings happens. I have to unplug the power supply. Is that normal for the wii u / vwii?

 

[Cyan]

By loading FSToolbox from a game exploit it's normal that you can't dump your NAND.
FSToolbox need access to the NAND (by using AHBPROT), which the HBC is providing if you put <ahb_access/> in the homebrew meta.xml

Without a homebrew launcher keeping the access rights, a channel with the AHBPROT flag, or something editing the hardware right, you can't dump the NAND.