Homebrew nandBinCheck (Wii Entry -- PC Software)

[giantpune]

I submit to you "nandBinCheck". This is a cross-platform PC program used to display information about a nand.bin for the Wii. Anybody who only has bootmii @ IOS knows that puckered butthole feeling you get when restoring a nand.bin. With this program, you take out all the guesswork.

nandBinCheck is a CLI program, so there are no fancy screenshots. It is able to display information about boot1 & 2, nand filesystem, permissions, ecc, hmac, SFFS, detect causes of many different types of bricks ( opera, 003, unbootable IOS ). With this program, you are almost guaranteed that a nand.bin is safe to install on a Wii. I have also used it many times to diagnose an otherwise unknown cause of brick. Here is the built-in help
<div class='codetop'>CODE</div><div class='codemain' style='height:200px;white-spacere;overflow:auto'>
usage: nandBinCheck nand.bin <other options>

Other options:
-boot shows information about boot 1 and 2

-fs verify the filesystem is in tact
verifies presence of uid & content.map & checks the hashes in the content.map
check sha1 hashes for title private contents
check all titles with a ticket titles for required IOS, proper uid & gid

-settingtxt check setting.txt itself and against system menu resources. this must be combined with "-fs"

-uid Look any titles in the uid.sys, check signatures and whatnot. this must be combined with "-fs"

-rsa Calculate and compare RSA signatures. this must be combined with "-fs"

-clInfo shows free, used, and lost ( marked used, but dont belong to any file ) clusters

-spare calculate & compare ecc for all pages in the nand
calculate & compare hmac signatures for all files and superblocks

-all does all of the above

-v increase verbosity

-continue try to keep going as fas as possible on errors that should be fatal

-nocolor don't use terminal color trickery

-about info about this program
</div>

and here is output of the program on a nand.bin somebody has sent me
<div class='codetop'>CODE</div><div class='codemain' style='height:200px;white-spacere;overflow:auto'>
checking boot1 & 2...
Boot1 B (vulnerable)
found 3 copies of boot2
"blocks 1 & 2: Marked as bad blocks; Content Sha1 matches TMD; TMD officially signed; Ticket officially signed; Version 2"
"blocks 3 & 4: Used for booting; Content Sha1 matches TMD; TMD is fakesigned; Ticket officially signed; BootMii 1.3"
"blocks 7 & 6: Backup copy; Content Sha1 matches TMD; TMD officially signed; Ticket officially signed; Version 2"
checking uid.sys...
checking content.map...
checking "/shared1/00000000.app" ...
checking "/shared1/00000001.app" ...
checking "/shared1/00000002.app" ...
checking "/shared1/00000003.app" ...
checking "/shared1/00000004.app" ...
checking "/shared1/00000005.app" ...
checking "/shared1/00000006.app" ...
checking "/shared1/00000007.app" ...
checking "/shared1/00000008.app" ...
checking "/shared1/00000009.app" ...
checking "/shared1/0000000a.app" ...
checking "/shared1/0000000b.app" ...
checking "/shared1/0000000c.app" ...
checking "/shared1/0000000d.app" ...
checking "/shared1/0000000e.app" ...
checking "/shared1/0000000f.app" ...
checking "/shared1/00000010.app" ...
checking "/shared1/00000011.app" ...
checking "/shared1/00000012.app" ...
checking "/shared1/00000013.app" ...
checking "/shared1/00000014.app" ...
checking "/shared1/00000015.app" ...
checking "/shared1/00000016.app" ...
checking "/shared1/00000017.app" ...
checking "/shared1/00000018.app" ...
checking "/shared1/00000019.app" ...
checking "/shared1/0000001a.app" ...
checking "/shared1/0000001b.app" ...
checking "/shared1/0000001c.app" ...
checking "/shared1/0000001d.app" ...
checking "/shared1/0000001e.app" ...
checking "/shared1/0000001f.app" ...
checking "/shared1/00000020.app" ...
checking "/shared1/00000021.app" ...
checking "/shared1/00000022.app" ...
checking "/shared1/00000023.app" ...
checking "/shared1/00000024.app" ...
checking "/shared1/00000025.app" ...
checking "/shared1/00000026.app" ...
checking "/shared1/00000027.app" ...
checking "/shared1/00000028.app" ...
checking "/shared1/00000029.app" ...
checking "/shared1/0000002a.app" ...
checking "/shared1/0000002b.app" ...
checking "/shared1/0000002c.app" ...
checking "/shared1/0000002d.app" ...
checking "/shared1/0000002e.app" ...
checking "/shared1/0000002f.app" ...
checking "/shared1/00000030.app" ...
checking "/shared1/00000031.app" ...
checking "/shared1/00000032.app" ...
checking "/shared1/00000033.app" ...
checking "/shared1/00000034.app" ...
checking "/shared1/00000035.app" ...
checking "/shared1/00000036.app" ...
checking "/shared1/00000037.app" ...
checking "/shared1/00000038.app" ...
checking "/shared1/00000039.app" ...
checking "/shared1/0000003a.app" ...
checking "/shared1/0000003b.app" ...
checking "/shared1/0000003c.app" ...
checking "/shared1/0000003d.app" ...
checking "/shared1/0000003e.app" ...
checking "/shared1/0000003f.app" ...
checking "/shared1/00000040.app" ...
checking "/shared1/00000041.app" ...
checking "/shared1/00000042.app" ...
checking "/shared1/00000043.app" ...
checking "/shared1/00000044.app" ...
checking "/shared1/00000045.app" ...
checking "/shared1/00000046.app" ...
checking "/shared1/00000047.app" ...
checking "/shared1/00000048.app" ...
checking "/shared1/00000049.app" ...
checking "/shared1/0000004a.app" ...
checking "/shared1/0000004b.app" ...
checking "/shared1/0000004c.app" ...
checking "/shared1/0000004d.app" ...
checking "/shared1/0000004e.app" ...
checking "/shared1/0000004f.app" ...
checking "/shared1/00000050.app" ...
checking "/shared1/00000051.app" ...
checking "/shared1/00000052.app" ...
checking "/shared1/00000053.app" ...
checking "/shared1/00000054.app" ...
checking "/shared1/00000055.app" ...
checking "/shared1/00000056.app" ...
checking "/shared1/00000057.app" ...
checking "/shared1/00000058.app" ...
checking "/shared1/00000059.app" ...
checking "/shared1/0000005a.app" ...
checking "/shared1/0000005b.app" ...
checking "/shared1/0000005c.app" ...
checking "/shared1/0000005d.app" ...
checking "/shared1/0000005e.app" ...
checking "/shared1/0000005f.app" ...
checking "/shared1/00000060.app" ...
checking "/shared1/00000061.app" ...
checking "/shared1/00000062.app" ...
checking "/shared1/00000063.app" ...
checking "/shared1/00000064.app" ...
checking "/shared1/00000065.app" ...
checking "/shared1/00000066.app" ...
checking "/shared1/00000067.app" ...
checking "/shared1/00000068.app" ...
checking "/shared1/00000069.app" ...
checking "/shared1/0000006a.app" ...
checking "/shared1/0000006b.app" ...
found 49 titles installed

Checking 00000001-00000004 ...
Unable to get title
version: 0.3 3 hex: 3

Checking 00000001-00000009 ...
Unable to get title
version: 2.4 516 hex: 204

Checking 00000001-0000000b ...
name: "fw.RVL.11.0.10.viper.0611141652 builder@ADONIS-"
version: 0.10 10 hex: a

Checking 00000001-0000000c ...
name: "fw.RVL.12.0.6.viper.0611041415 builder@ADONIS-"
version: 0.6 6 hex: 6

Checking 00000001-0000000d ...
name: "fw.RVL.13.0.10.viper.0611141652 builder@ADONIS-"
version: 0.10 10 hex: a

Checking 00000001-0000000e ...
name: "fw.RVL.14.1.1.viper.0611171440 builder@ADONIS-"
version: 1.1 257 hex: 101

Checking 00000001-0000000f ...
name: "fw.RVL.15.1.1.viper.0611171440 builder@ADONIS-"
version: 1.1 257 hex: 101

Checking 00000001-00000011 ...
name: "fw.RVL.17.2.0.viper.0611301141 builder@ADONIS-"
version: 2.0 512 hex: 200

Checking 00000001-00000014 ...
name: "fw.RVL.20.0.12.viper.0702221710 builder@ADONIS-"
version: 0.12 12 hex: c

Checking 00000001-00000015 ...
name: "fw.RVL.21.2.5.viper.0708311326 Administrator@R"
version: 2.5 517 hex: 205

Checking 00000001-00000016 ...
name: "fw.RVL.22.3.4.viper.0706121001 yasuh-to@TONKAT"
version: 3.4 772 hex: 304

Checking 00000001-0000001c ...
name: "fw.RVL.28.5.8.viper.0706220437 administrator@R"
version: 5.8 1288 hex: 508

Checking 00000001-0000001e ...
name: "firmware.64.0804050736 admin@FWPUBLISH"
version: 10.16 2576 hex: a10

Checking 00000001-0000001f ...
name: "firmware.64.0804050738 admin@FWPUBLISH"
version: 10.16 2576 hex: a10

Checking 00000001-00000021 ...
name: "fw.RVL.33.4.16.viper.0708272357 Owner@DEVOBUILD"
version: 4.16 1040 hex: 410

Checking 00000001-00000022 ...
name: "fw.RVL.34.4.15.viper.0708101612 Administrator@R"
version: 4.15 1039 hex: 40f

Checking 00000001-00000023 ...
name: "fw.RVL.35.4.16.viper.0708311458 Owner@DEVOBUILD"
version: 4.16 1040 hex: 410

Checking 00000001-00000024 ...
tmd fakesigned
name: "firmware.64.0907270645 admin@FWPUBLISH"
version: 13.23 3351 hex: d17

Checking 00000001-00000025 ...
tmd fakesigned
name: "firmware.64.0907270647 admin@FWPUBLISH"
version: 15.29 3869 hex: f1d

Checking 00000001-00000026 ...
name: "firmware.64.0808190218 admin@FWPUBLISH"
version: 14.25 3609 hex: e19

Checking 00000001-00000035 ...
name: "firmware.64.0808070708 admin@FWPUBLISH"
version: 16.17 4113 hex: 1011

Checking 00000001-00000037 ...
name: "firmware.64.0809190546 admin@FWPUBLISH"
version: 18.25 4633 hex: 1219

Checking 00000001-00000038 ...
name: "firmware.64.0907270701 admin@FWPUBLISH"
version: 21.29 5405 hex: 151d

Checking 00000001-00000039 ...
tmd fakesigned
name: "firmware.64.0908200523 admin@FWPUBLISH"
version: 22.29 5661 hex: 161d

Checking 00000001-0000003a ...
name: "firmware.64.1004131121 admin@FWPUBLISH"
version: 24.31 6175 hex: 181f

Checking 00000001-0000003c ...
tmd fakesigned
name: "firmware.64.0902040955 admin@FWPUBLISH"
version: 24.30 6174 hex: 181e

Checking 00000001-0000003d ...
name: "firmware.64.0907270706 admin@FWPUBLISH"
version: 21.29 5405 hex: 151d

Checking 00000001-00000046 ...
tmd fakesigned
name: "firmware.64.0907270708 admin@FWPUBLISH"
version: 26.31 6687 hex: 1a1f

Checking 00000001-000000c8 ...
ticket fakesigned
tmd fakesigned
name: "waninkoko"
version: 0.20 20 hex: 14

Checking 00000001-000000c9 ...
ticket fakesigned
tmd fakesigned
name: "waninkoko"
version: 0.20 20 hex: 14

Checking 00000001-000000ca ...
ticket fakesigned
tmd fakesigned
name: "firmware.64.0908200523 admin@FWPUBLISH"
version: 255.255 65535 hex: ffff

Checking 00000001-000000de ...
ticket fakesigned
tmd fakesigned
name: "firmware.64.0901230711 admin@FWPUBLISH"
version: 0.4 4 hex: 4

Checking 00000001-000000df ...
ticket fakesigned
tmd fakesigned
name: "firmware.64.0901260758 admin@FWPUBLISH"
version: 0.4 4 hex: 4

Checking 00000001-000000ed ...
ticket fakesigned
tmd fakesigned
name: "waninkoko"
version: 0.20 20 hex: 14

Checking 00000001-000000f9 ...
ticket fakesigned
tmd fakesigned
name: "waninkoko"
version: 0.20 20 hex: 14

Checking 00000001-000000fa ...
ticket fakesigned
tmd fakesigned
name: "waninkoko"
version: 255.255 65535 hex: ffff

Checking 00000001-000000fe ...
ticket fakesigned
tmd fakesigned
Unable to get title
version: 255.1 65281 hex: ff01
found 37 bootable IOS

Checking 00000001-00000002 ...
name: "systemmenu.rvl.0906251145 irduser@IPLBUIL"
one of the private contents' hash doesnt check out 8 "/title/00000001/00000002/content/0000007c.app"
expected 947a3f929323f6c8b3515d8960e7427a7a3e9d87
actual 016addccb393099ff7ee7d047115e92e4cdc0528
version: 1.193 449 hex: 1c1
requires IOS 60
incorrect uid/gid for data folder

Checking 00000001-00000100 ...
name: "bc.0803040819 BuildMaster@BUI"
version: 0.4 4 hex: 4

Checking 00000001-00000101 ...
tmd fakesigned
name: "mios.0803140448 BuildMaster@BUI"
version: 0.8 8 hex: 8

Checking 00010001-46414745 (FAGE) ...
ticket fakesigned
tmd fakesigned
name: "Super Mario Bros."
version: 0.2 2 hex: 2
requires IOS 9

Checking 00010001-4642324e (FB2N) ...
ticket fakesigned
tmd fakesigned
name: "SMB: The Lost Levels"
version: 0.1 1 hex: 1
requires IOS 21

Checking 00010001-48414445 (HADE) ...
name: "Internet Channel"
version: 4.0 1024 hex: 400
requires IOS 55

Checking 00010001-554e454f (UNEO) ...
ticket fakesigned
tmd fakesigned
name: "USB Loader GX"
version: 2.0 512 hex: 200
requires IOS 35

Checking 00010001-af1bf516 (....) ...
ticket fakesigned
tmd fakesigned
name: "Homebrew Channel"
version: 0.8 8 hex: 8
access : 3
requires IOS 58

Checking 00010002-48414341 (HACA) ...
Decrypted signature hash: 1f0608e879f09302b0cb8b2c6de8a305fbbbe191
SHA1 hash: a29dbb522703c31e004c01059eef9713ccb6bbfa
ticket RSA signature isn't even close ( 4 )
name: "Mii Channel"
version: 0.5 5 hex: 5
requires IOS 31

Checking 00010008-44495343 (DISC) ...
ticket fakesigned
tmd fakesigned
name: "DVD.enabling.stub marcan@hackmii"
version: 0.2 2 hex: 2
access : 3
requires IOS 36

Checking 00010008-48414b45 (HAKE) ...
Decrypted signature hash: 7445972fad0ef5cc08e7de9b621f22c11bde4c06
SHA1 hash: 607496a756efdb21d3d8e97c9d9092a87e070945
ticket RSA signature isn't even close ( 4 )
name: "eulav.0707051652 @SASAKIT-COM2"
version: 0.2 2 hex: 2
requires IOS 31

Checking 00010008-48414c45 (HALE) ...
name: "rgnsel.0707051714 @SASAKIT-COM2"
version: 0.2 2 hex: 2
requires IOS 31
Checking for 003 error ...
The system menu doesn't appear to perform the Korean-key check
System menu IOS does not appear to support the Korean-key check
The korean key is not present in this wii
Checking setting.txt stuff...
system menu resource matches setting.txt AREA setting.
AREA=USA
MODEL=RVL-001(USA)
DVD=0
MPCH=0x7FFE
CODE=LU

SERNO=123456789
VIDEO=NTSC
GAME=US

Comparing uid.sys against the filesystem...
00010000-3132334a (123J) was installed at the factory and is now missing
00010000-0000dead (....) was installed at the factory and is now missing
00010000-3132314a (121J) was installed at the factory and is now missing
00010002-48414141 (HAAA) was installed at the factory and is now missing
00010002-48414641 (HAFA) was installed at the factory and is now missing
00010002-48414241 (HABA) was installed at the factory and is now missing
00010002-48414741 (HAGA) was installed at the factory and is now missing
00010000-31323245 (122E) was installed at the factory and is now missing
00010000-30303032 (0002) was installed at the factory and is now missing
15 titles were installed before any user intervention
Can't find TMD for 00010000-52454445 (REDE)
00010000-52454445 (REDE) has been deleted
TMD for 00010000-52474850 (RGHP) is fakesigned
checking for lost clusters...
total used clusters 34b5 of 0x8000
found 0 lost clusters
UNK ( 0xffff ) c (3a43, 3a44, 3a45, 3a46, 3a47, 59c9, 59ca, 59cb, 59cc, 59cd, 59ce, 59cf)
free 46ff
verifying ecc...
2 out of 927296 pages had incorrect ecc.
they were spread through 2 clusters in 2 blocks:
(2, 6)
0 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 522 files
0 files had bad HMAC data
checking HMAC for superclusters...
0 superClusters had bad HMAC data
</div>


warnings are shown highlited in blue. these are things that you probably need to look at.
errors are shown in red. these are things that will likely result in a brick.

download for windows users... <a href="http://www.multiupload.com/0K54B43OAN" target="_blank">http://www.multiupload.com/0K54B43OAN</a>
* <a href="http://www.multiupload.com/8Z9GYQEUQU" target="_blank">hotfix - svn r78</a> ( this exe still needs the .dll files from the above archive )
windows package r106 <a href="http://www.multiupload.com/3G7I6CH3UX" target="_blank">http://www.multiupload.com/3G7I6CH3UX</a>

linux & mac can build it from source code... <a href="http://code.google.com/p/wiiqt/" target="_blank">http://code.google.com/p/wiiqt/</a>

 

[asper]

I obtained this log:

** nandBinCheck : Wii nand info tool **
from giantpune
built: Jan 29 2011 03:36:05
checking boot1 & 2...
Boot1 C (fixed)
found 2 copies of boot2
"blocks 1 & 2: Used for booting; Content Sha1 matches TMD; TMD officially signed; Ticket officially signed; Version 3"
"blocks 7 & 6: Backup copy; Content Sha1 matches TMD; TMD officially signed; Ticket officially signed; Version 3"
checking uid.sys...
checking content.map...
checking "/shared1/00000000.app" ...
checking "/shared1/00000001.app" ...
checking "/shared1/00000002.app" ...
checking "/shared1/00000003.app" ...
checking "/shared1/00000004.app" ...
checking "/shared1/00000005.app" ...
checking "/shared1/00000006.app" ...
checking "/shared1/00000007.app" ...
checking "/shared1/00000008.app" ...
checking "/shared1/00000009.app" ...
checking "/shared1/0000000a.app" ...
checking "/shared1/0000000b.app" ...
checking "/shared1/0000000c.app" ...
checking "/shared1/0000000d.app" ...
checking "/shared1/0000000e.app" ...
checking "/shared1/0000000f.app" ...
checking "/shared1/00000010.app" ...
checking "/shared1/00000011.app" ...
checking "/shared1/00000012.app" ...
checking "/shared1/00000013.app" ...
checking "/shared1/00000014.app" ...
checking "/shared1/00000015.app" ...
checking "/shared1/00000016.app" ...
checking "/shared1/00000017.app" ...
checking "/shared1/00000018.app" ...
checking "/shared1/00000019.app" ...
checking "/shared1/0000001a.app" ...
checking "/shared1/0000001b.app" ...
checking "/shared1/0000001c.app" ...
checking "/shared1/0000001d.app" ...
checking "/shared1/0000001e.app" ...
checking "/shared1/0000001f.app" ...
checking "/shared1/00000020.app" ...
checking "/shared1/00000021.app" ...
checking "/shared1/00000022.app" ...
checking "/shared1/00000023.app" ...
checking "/shared1/00000024.app" ...
checking "/shared1/00000025.app" ...
checking "/shared1/00000026.app" ...
checking "/shared1/00000027.app" ...
checking "/shared1/00000028.app" ...
checking "/shared1/00000029.app" ...
checking "/shared1/0000002a.app" ...
checking "/shared1/0000002b.app" ...
checking "/shared1/0000002c.app" ...
checking "/shared1/0000002d.app" ...
checking "/shared1/0000002e.app" ...
checking "/shared1/0000002f.app" ...
checking "/shared1/00000030.app" ...
checking "/shared1/00000031.app" ...
checking "/shared1/00000032.app" ...
checking "/shared1/00000033.app" ...
checking "/shared1/00000034.app" ...
checking "/shared1/00000035.app" ...
checking "/shared1/00000036.app" ...
checking "/shared1/00000037.app" ...
checking "/shared1/00000038.app" ...
checking "/shared1/00000039.app" ...
checking "/shared1/0000003a.app" ...
checking "/shared1/0000003b.app" ...
checking "/shared1/0000003c.app" ...
checking "/shared1/0000003d.app" ...
checking "/shared1/0000003e.app" ...
checking "/shared1/0000003f.app" ...
checking "/shared1/00000040.app" ...
checking "/shared1/00000041.app" ...
checking "/shared1/00000042.app" ...
checking "/shared1/00000043.app" ...
checking "/shared1/00000044.app" ...
checking "/shared1/00000045.app" ...
checking "/shared1/00000046.app" ...
checking "/shared1/00000047.app" ...
checking "/shared1/00000048.app" ...
checking "/shared1/00000049.app" ...
checking "/shared1/0000004a.app" ...
checking "/shared1/0000004b.app" ...
checking "/shared1/0000004c.app" ...
checking "/shared1/0000004d.app" ...
checking "/shared1/0000004e.app" ...
checking "/shared1/0000004f.app" ...
checking "/shared1/00000050.app" ...
checking "/shared1/00000051.app" ...
checking "/shared1/00000052.app" ...
checking "/shared1/00000053.app" ...
checking "/shared1/00000054.app" ...
checking "/shared1/00000055.app" ...
checking "/shared1/00000056.app" ...
checking "/shared1/00000057.app" ...
checking "/shared1/00000058.app" ...
checking "/shared1/00000059.app" ...
checking "/shared1/0000005a.app" ...
checking "/shared1/0000005b.app" ...
checking "/shared1/0000005c.app" ...
checking "/shared1/0000005d.app" ...
checking "/shared1/0000005e.app" ...
"The hash for at least 1 content is bad"
checking "/shared1/0000005f.app" ...
checking "/shared1/00000060.app" ...
checking "/shared1/00000061.app" ...
checking "/shared1/00000062.app" ...
checking "/shared1/00000063.app" ...
checking "/shared1/00000064.app" ...
checking "/shared1/00000065.app" ...
checking "/shared1/00000066.app" ...
checking "/shared1/00000067.app" ...
checking "/shared1/00000068.app" ...
checking "/shared1/00000069.app" ...
checking "/shared1/0000006a.app" ...
checking "/shared1/0000006b.app" ...
checking "/shared1/0000006c.app" ...
checking "/shared1/0000006d.app" ...
checking "/shared1/0000006e.app" ...
checking "/shared1/0000006f.app" ...
checking "/shared1/00000070.app" ...
checking "/shared1/00000071.app" ...
checking "/shared1/00000072.app" ...
checking "/shared1/00000073.app" ...
checking "/shared1/00000074.app" ...
checking "/shared1/00000075.app" ...
checking "/shared1/00000076.app" ...
checking "/shared1/00000077.app" ...
checking "/shared1/00000078.app" ...
checking "/shared1/00000079.app" ...
checking "/shared1/0000007a.app" ...
checking "/shared1/0000007b.app" ...
checking "/shared1/0000007c.app" ...
checking "/shared1/0000007d.app" ...
checking "/shared1/0000007e.app" ...
checking "/shared1/0000007f.app" ...
checking "/shared1/00000080.app" ...
checking "/shared1/00000081.app" ...
checking "/shared1/00000082.app" ...
checking "/shared1/00000083.app" ...
checking "/shared1/00000084.app" ...
checking "/shared1/00000085.app" ...
checking "/shared1/00000086.app" ...
found 72 titles installed

The dump had been done few minutes ago; is the problem in the "/shared1/0000005e.app" or in some other place ?
This is a screenshot selecting that file with your nandextract for windows: http://http://img262.imageshack.us/img262/.../immaginedr.jpg

I think this will bring to a brick only if that file is related to ssytem menu or system menu IOS, isn't it ? And it should not...

 

[giantpune]

please, for the love of god, i hope people dont start posting these logs all over the place. and if you do, please put it inside

[codebox][/codebox]
and/or
[spoiler][/spoiler]

i hate it when somebody posts a 500000 line syscheck and then 3 other people quote them.

anyways, about your 0000005e.app, this is saying that the hash expected in your shared content map does not match the actual file. even if this does happen to be part of your system menu or its IOS, there still in no guarantee that it is a fatal error.

this is simply a warning that you need to look into what titles use that .app ( most likely it is or was used by some IOS ). the bad thing about this is that the system menu doesnt seem to delete any shared contents, EVER. the wii and IOS dont seem to have any way to correct this. it is, however, correcctable using ISFS calls to delete the borked .app and write it again correctly; once you track down exactly which one it is.

 

[asper]

Sorry for the long post, I will include it inside some box next time !

How can I track back the origin of that file to know which app/IOS installed it ? Can I use a Wii FTP software to delete/replace it ?

 

[giantpune]

to figure out exactly what all titles rely on that busted .app, you need to extract "/shared1/content.map" and open it in a hex editor. then locate the 0000005e and it will tell you the hash. then look at all the TMD in your nand ( you can skip disc games and DLC ). any TMD that has a content with the same sha1 you saw in the content.map relies on the borked .app. once you know one of the titles that rely on this .app, you can download the .app from NUS.

and for fixing it, there is not any single program that runs on the PC or Wii that allows you to write to the nand individual files ( correctly ). its not rocket science if if want to write a program that will write this .app for you. but as of right now, this is the only way to do it.

 

[asper]

Thank you for your answer but i tested a method that can be (MAYBE) faster: I extracted the file and opened with an hex editor finding that:

IOSVersion: FSP 11/24/2008 15:36:10 64M

Could this be the FSP IOS MODULE related to IOS48 ? For what I read over the net only IOS48 has this FSP module insted of FFS...


Anyway, in the content.map file, i must check the bytes of the title name (in the example 0000005e that in HEX is 30 30 30 30 30 30 35 65) and then take the 20 following bytes, BEFORE the next 0000005f (30 30 30 ecc) ?


EDIT:
Well, yes, the SHA1 bytes are the ones that I wrote and I was able to find them in IOS60 (0000003C) title .TMD (last 20 bytes of the .TMD file): could this be related to the patches I applied almost 1,5 year ago to my IOS60 ?

 

[giantpune]

more than just IOS48 use the FSP module. a quick grep found 3 FSP versions in my nand. and they are in the shared content, so they can be used by many different titles.

when you open the content.map in a hex editor, resize the window so it is 28 bytes wide. then its really easy to see the names and hashes.

Spoiler

EDIT>> rather than try to hold you hand any walk you through it, i have updated the program to display this information. i dont have any nands that are in the same situation as yours, so it is not tested. but i believe it should be working fine. for now, youll have to build the program from the source code to try it out.

 

[asper]

I was editing my post when you answered so I re-wrote my discoveries and my new question:

Well, yes, the SHA1 bytes are the ones that I wrote and I was able to find them in IOS60 (00000001/0000003C) title .TMD (last 20 bytes of the .TMD file): could the error be related to the patches I applied almost 1,5 year ago to my IOS60 ?

 

[asper]

Thank you for the software update ! (but I am a windows user an I am not able to compile for it

so I will patiently wait for a compiled version).

With " i have updated the program to display this information" you mean that now it shows which title is related to a specific file in the shared folder ? If so it is FANTASTIC !

Do you think that the error could be related to the patches I applyed to IOS60 using (if I well remeber) pimp-my-wii ?

 

[giantpune]

there are millions of ways to break the wii FS. and pimp-my-wii is notorious for being poorly written and doing stupid things. however, i cannot say with any certainty what it was that left your wii in this state.

 

[asper]

Reinstalling a non-patched IOS60 (taken from NUS for example) should do the trick in your opinion ?

 

[giantpune]

no. like i said, the wii doesnt seem to have any way to correct borked shared contents. if you try to install a title that uses this content, it will see that there is already an entry in the content.map and skip over installing that one.

 

[asper]

So I don't think I am able to substitute that file... any suggestion ?

 

[giantpune]

write your own program to correct that file using ISFS or call up nintendo and request they fix it.

 

[asper]

I don't think I have the skill to do that (rockt-science-style for me

)..... anyway I can always try to phone Nintendo.....

Thank you for your support man, and sorry to have wasted your time with my questions !

 

[mike81]

Thanks for this tool.

A couple of days ago I installed Homebrew Channel and Bootmii onto an unmodified red Wii. Immediately after installing both, I used Bootmii to do a nand backup. I used nandbincheck on my nand.bin file and this is the output:

Spoiler

checking boot1 & 2...
Boot1 D (fixed)
found 2 copies of boot2
"blocks 1 & 2: Used for booting; Content Sha1 matches TMD; TMD officially signed
; Ticket officially signed; Version 4"
"blocks 7 & 6: Backup copy; Content Sha1 matches TMD; TMD officially signed; Tic
ket officially signed; Version 4"
checking uid.sys...
checking content.map...
checking "/shared1/00000000.app" ...
checking "/shared1/00000001.app" ...
checking "/shared1/00000002.app" ...
checking "/shared1/00000003.app" ...
checking "/shared1/00000004.app" ...
checking "/shared1/00000005.app" ...
checking "/shared1/00000006.app" ...
checking "/shared1/00000007.app" ...
checking "/shared1/00000008.app" ...
checking "/shared1/00000009.app" ...
checking "/shared1/0000000a.app" ...
checking "/shared1/0000000b.app" ...
checking "/shared1/0000000c.app" ...
checking "/shared1/0000000d.app" ...
checking "/shared1/0000000e.app" ...
checking "/shared1/0000000f.app" ...
checking "/shared1/00000010.app" ...
checking "/shared1/00000011.app" ...
checking "/shared1/00000012.app" ...
checking "/shared1/00000013.app" ...
checking "/shared1/00000014.app" ...
checking "/shared1/00000015.app" ...
checking "/shared1/00000016.app" ...
checking "/shared1/00000017.app" ...
checking "/shared1/00000018.app" ...
checking "/shared1/00000019.app" ...
checking "/shared1/0000001a.app" ...
checking "/shared1/0000001b.app" ...
checking "/shared1/0000001c.app" ...
checking "/shared1/0000001d.app" ...
checking "/shared1/0000001e.app" ...
checking "/shared1/0000001f.app" ...
checking "/shared1/00000020.app" ...
checking "/shared1/00000021.app" ...
checking "/shared1/00000022.app" ...
checking "/shared1/00000023.app" ...
checking "/shared1/00000024.app" ...
checking "/shared1/00000025.app" ...
checking "/shared1/00000026.app" ...
checking "/shared1/00000027.app" ...
checking "/shared1/00000028.app" ...
checking "/shared1/00000029.app" ...
checking "/shared1/0000002a.app" ...
checking "/shared1/0000002b.app" ...
checking "/shared1/0000002c.app" ...
checking "/shared1/0000002d.app" ...
checking "/shared1/0000002e.app" ...
checking "/shared1/0000002f.app" ...
checking "/shared1/00000030.app" ...
checking "/shared1/00000031.app" ...
checking "/shared1/00000032.app" ...
checking "/shared1/00000033.app" ...
checking "/shared1/00000034.app" ...
checking "/shared1/00000035.app" ...
checking "/shared1/00000036.app" ...
checking "/shared1/00000037.app" ...
checking "/shared1/00000038.app" ...
checking "/shared1/00000039.app" ...
checking "/shared1/0000003a.app" ...
checking "/shared1/0000003b.app" ...
checking "/shared1/0000003c.app" ...
checking "/shared1/0000003d.app" ...
checking "/shared1/0000003e.app" ...
checking "/shared1/0000003f.app" ...
checking "/shared1/00000040.app" ...
checking "/shared1/00000041.app" ...
checking "/shared1/00000042.app" ...
checking "/shared1/00000043.app" ...
checking "/shared1/00000044.app" ...
checking "/shared1/00000045.app" ...
checking "/shared1/00000046.app" ...
checking "/shared1/00000047.app" ...
checking "/shared1/00000048.app" ...
checking "/shared1/00000049.app" ...
checking "/shared1/0000004a.app" ...
checking "/shared1/0000004b.app" ...
checking "/shared1/0000004c.app" ...
checking "/shared1/0000004d.app" ...
checking "/shared1/0000004e.app" ...
checking "/shared1/0000004f.app" ...
checking "/shared1/00000050.app" ...
checking "/shared1/00000051.app" ...
checking "/shared1/00000052.app" ...
checking "/shared1/00000053.app" ...
checking "/shared1/00000054.app" ...
checking "/shared1/00000055.app" ...
checking "/shared1/00000056.app" ...
checking "/shared1/00000057.app" ...
found 65 titles installed
Checking 00000001-00000009 ...
Checking 00000001-0000000c ...
Checking 00000001-0000000d ...
Checking 00000001-0000000e ...
Checking 00000001-0000000f ...
Checking 00000001-00000011 ...
Checking 00000001-00000015 ...
Checking 00000001-00000016 ...
Checking 00000001-0000001c ...
Checking 00000001-0000001f ...
Checking 00000001-00000021 ...
Checking 00000001-00000022 ...
Checking 00000001-00000023 ...
Checking 00000001-00000024 ...
Checking 00000001-00000025 ...
Checking 00000001-00000026 ...
Checking 00000001-00000029 ...
Checking 00000001-0000002b ...
Checking 00000001-0000002d ...
Checking 00000001-0000002e ...
Checking 00000001-00000030 ...
Checking 00000001-00000035 ...
Checking 00000001-00000037 ...
Checking 00000001-00000038 ...
Checking 00000001-00000039 ...
Checking 00000001-0000003a ...
Checking 00000001-0000003d ...
Checking 00000001-00000050 ...
Checking 00000001-000000fe ...
ticket fakesigned
tmd fakesigned
found 29 bootable IOS
Checking 00000001-00000002 ...
incorrect uid/gid for data folder
Checking 00000001-00000003 ...
Checking 00000001-00000004 ...
Checking 00000001-0000000a ...
Checking 00000001-0000000b ...
Checking 00000001-00000010 ...
Checking 00000001-00000014 ...
Checking 00000001-0000001e ...
Checking 00000001-00000028 ...
Checking 00000001-00000032 ...
Checking 00000001-00000033 ...
Checking 00000001-00000034 ...
Checking 00000001-0000003c ...
Checking 00000001-00000046 ...
Checking 00000001-000000de ...
Checking 00000001-000000df ...
Checking 00000001-000000f9 ...
Checking 00000001-000000fa ...
Checking 00000001-00000100 ...
Checking 00000001-00000101 ...
Checking 00010001-48414445 (HADE) ...
Decrypted signature hash: c828fd85a69faa7ad8f55719a8709a2143c00857
SHA1 hash: a77874681e1d0c54494b13b2f74605e126ee4624
ticket RSA signature isn't even close ( 4 )
Checking 00010001-48414a45 (HAJE) ...
Checking 00010001-48415045 (HAPE) ...
Checking 00010001-48415445 (HATE) ...
Decrypted signature hash: 3dd2b01bdb0eda56011610d73873220edb26362c
SHA1 hash: fd101f02da159d4f7085dbf48b5b1009d58be445
ticket RSA signature isn't even close ( 4 )
Checking 00010001-af1bf516 (....) ...
ticket fakesigned
tmd fakesigned
Checking 00010002-48414141 (HAAA) ...
Checking 00010002-48414241 (HABA) ...
Checking 00010002-48414341 (HACA) ...
Checking 00010002-48414641 (HAFA) ...
Checking 00010002-48414645 (HAFE) ...
Checking 00010002-48414741 (HAGA) ...
Checking 00010002-48414745 (HAGE) ...
Checking 00010002-48415941 (HAYA) ...
Checking 00010004-524d4345 (RMCE) ...
Checking 00010008-48414b45 (HAKE) ...
Checking 00010008-48414c45 (HALE) ...
Checking for 003 error ...
Checking setting.txt stuff...
Comparing uid.sys against the filesystem...
00010001-48434745 (HCGE) was installed at the factory and is now missing

00010001-48434c45 (HCLE) has been deleted
00010000-52535045 (RSPE) has been deleted
00010001-58485145 (XHQE) has been deleted
checking for lost clusters...
found 0 lost clusters
UNK ( 0xffff ) 19 (31c, 31d, 31e, 31f, 2040, 2041, 2042, 2043, 2044, 2045, 2046,
2047, 3808, 3809, 380a, 380b, 380c, 380d, 380e, 380f, 3c4b, 3c4c, 3c4d, 3c4e, 3
c4f)
free 4311
verifying ecc...
2 out of 997824 pages had incorrect ecc.
they were spread through 2 clusters in 2 blocks:
(2, 6)
0 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 441 files
0 files had bad HMAC data
checking HMAC for superclusters...
0 superClusters had bad HMAC data

I see that it shows a few things in blue. Is this a problem? I don't see why there should be any issues when I only installed Homebrew Channel and Bootmii. Thank you for the help.

 

[giantpune]

the blue stuff is just something you might care to see. stuff that is incorrect or that wouldnt happen on a wii if you used it only like nintendo wants you to use it usually shows up in blue. stuff that is more severe will show up in red. this is stuff that probably will cause a brick.

the "incorrect uid/gid for data folder" in your system menu comes from priiloader and/or dopmii. the 2 "ticket RSA signature isn't even close" are from official channels. and they seem to happen under normal circumstances for some nintendo channels. i havent looked too deeply into what is happening. the "...has been deleted" happens when you delete something with ATD. When you delete something using the system menu, it leaves behind a couple files, but ATD removes all those files, leaving only the entry in the uid.sys.

btw, you can use "-v -v" and it will tell you more details.

 

[mike81]

Thank you for responding. Good to know that there are no issues.

 

[giantpune]

i just pushed an update (r78) and put a binary in the first post that should fix the RSA error messages when looking at tickets for the mii/weather/news/ect channels.

 

[giantpune]

first post updated with package containing the latest version of the 3 nand tools and necessary dlls.