Hacking Now that theres IOSUHAX - can my USB drive be swapped between my WiiU's?

[Jow Banks]

I have two WiiU's and one external Hard Drive.
Both are running redNAND and working fine except I can only use the external hard drive on one of them at a time.

If I switch the USB drive from one to the other, it gives me an error about trying to use a deleted account or something like that.

If I format the USB drive, then go to the eShop and re-download the games again - it works again but only on one of them at a time.

Can someone real smart with IOSUHax come up with a workaround?

 

[Irastris]

As of right now, it's not possible. Every Wii U has a unique key for encrypting the USB drives. Until someone can find a way to rewrite that key in the NAND to be the same as another Wii U, it will be impossible to share USB drives between the two consoles.

 

[Conn0r]

As of right now, it's not possible. Every Wii U has a unique key for encrypting the USB drives. Until someone can find a way to rewrite that key in the NAND to be the same as another Wii U, it will be impossible to share USB drives between the two consoles.

I heard that somebody found the keys in the otp and can decrypt the drive and reencrypt the drive with a computer.

 

[Irastris]

I heard that somebody found the keys in the otp and can decrypt the drive and reencrypt the drive with a computer.

Correct, but they haven't found a way to actually modify the files within the drive, last I checked.

 

[Jow Banks]

With redNAND, couldn't there be a way to locate where the IOS uses the OTP USB Key to encrypt/decrypt the USB and tell it to use something else?
Like tell it it use the Common Key instead?

redNAND is capable of formatting a USB drive on the fly so it seems this would be possible.
If so, a USB drive would be sharable on any redNAND WiiU

 

[xtheman]

Its iosuhax not ISOHAX

 

[Cyan]

thread's title fixed

 

[tunip3]

thread's title fixed

It could be possible if each Wiiu has a custom USB code that could be changed as it would mean we could achieve global sycronisation

 

[Jow Banks]

I heard that somebody found the keys in the otp and can decrypt the drive and reencrypt the drive with a computer.

Do you have a link to the post for this?

I was looking in the latest decoded fw.img, but didn't see where the USB key was.

Spoiler

IOS_CRYPTO:04025000  Wii_U_0x12_keyhandle  % 4
IOS_CRYPTO:04025004  Wii_U_0x12_keyhandle_seed  % 4
IOS_CRYPTO:04025008  Wii_U_0x12_keyhandle_Key  % 4
IOS_CRYPTO:04025010  +SEEPROM_certificate_data  % 0x10
IOS_CRYPTO:04025020  +Wii_U_Starbuck_ancast_key  % 0x10
IOS_CRYPTO:04025030  +Wii_U_SEEPROM_key  % 0x10
IOS_CRYPTO:04025040  +Wii_U_NAND_key  % 0x40
IOS_CRYPTO:04025080  +Wii_U_NAND_HMAC  % 0x40
IOS_CRYPTO:040250C0  +Wii_U_drive_key  % 0x10
IOS_CRYPTO:040250D0  +Wii_U_devkit_fallback_key  % 0x10
IOS_CRYPTO:040250E0  +Wii_RNG_key  % 0x10
IOS_CRYPTO:040250F0  +Unknown_Key_4  % 0x10
IOS_CRYPTO:04025100  +Key_to_encrypt_decrypt_SSL_RSA_key % 0x10
IOS_CRYPTO:04025110  +Unknown_Key_3  % 0x10
IOS_CRYPTO:04025120  +Wii_U_XOR_key  % 0x10
IOS_CRYPTO:04025130  +Unknown_0x10_long_Key  % 0x10
IOS_CRYPTO:04025140  +Unknown_0x20_long_Key  % 0x20

 

[lembi2001]

Do you have a link to the post for this?

I was looking in the latest decoded fw.img, but didn't see where the USB key was.

Spoiler

IOS_CRYPTO:04025000  Wii_U_0x12_keyhandle  % 4
IOS_CRYPTO:04025004  Wii_U_0x12_keyhandle_seed  % 4
IOS_CRYPTO:04025008  Wii_U_0x12_keyhandle_Key  % 4
IOS_CRYPTO:04025010  +SEEPROM_certificate_data  % 0x10
IOS_CRYPTO:04025020  +Wii_U_Starbuck_ancast_key  % 0x10
IOS_CRYPTO:04025030  +Wii_U_SEEPROM_key  % 0x10
IOS_CRYPTO:04025040  +Wii_U_NAND_key  % 0x40
IOS_CRYPTO:04025080  +Wii_U_NAND_HMAC  % 0x40
IOS_CRYPTO:040250C0  +Wii_U_drive_key  % 0x10
IOS_CRYPTO:040250D0  +Wii_U_devkit_fallback_key  % 0x10
IOS_CRYPTO:040250E0  +Wii_RNG_key  % 0x10
IOS_CRYPTO:040250F0  +Unknown_Key_4  % 0x10
IOS_CRYPTO:04025100  +Key_to_encrypt_decrypt_SSL_RSA_key % 0x10
IOS_CRYPTO:04025110  +Unknown_Key_3  % 0x10
IOS_CRYPTO:04025120  +Wii_U_XOR_key  % 0x10
IOS_CRYPTO:04025130  +Unknown_0x10_long_Key  % 0x10
IOS_CRYPTO:04025140  +Unknown_0x20_long_Key  % 0x20

I don't recall there being a post for this however @NWPlayer123 posted a screenshot of her HDD hooked up to her PC and Hexedit displaying the encryted contents of the drive on twitter.

I believe this is what the post is referring to.

 

[AboodXD]

As of right now, it's not possible. Every Wii U has a unique key for encrypting the USB drives. Until someone can find a way to rewrite that key in the NAND to be the same as another Wii U, it will be impossible to share USB drives between the two consoles.

Unfortunately, that's not possible. The key is the same for every console, but the seed needed for getting the key (which is console-specific) is in OTP, and OTP is read-only (One Time Programmable memory), just like boot0.
Changing that is impossible. (without a CFW?)

Possible workaround:

1. Well, you can decrypt the contents and re-encrypt them again, but that would be a gimmick.
2. I think someone can make a title launcher that asks for a bin file created by otp2sd on the first Wii U, and launch a title from the USB on the other Wii U by getting the seed from the bin file.

There are more workarounds, but those are the relevant ones.

 

[QuarkTheAwesome]

As with most "now with IOSU" things - possible, just hasn't been made yet.

As some others have hinted; the Wii U encrypts its USB drives using a console-specific key. This key is stored in the OTP; which means we can't modify it directly but we can, with the wonders of CFWs, do basically everythong else (intercept and modify, don't use, read from new location etc.)

Also yes, Nikki did manage to decrypt a bit of their USB, although they don't seem to be able to mount the filesystem or anything yet.

Edit: does this count as a ninja?

 

[lordelan]

Might be possible soon with Crediar's FSDumper and (U)Neek once it comes out.
I'm still waiting for this anyway as it should allow the USB drive staying on FAT32 in order to be used by Wii U and vWii.

 

[AboodXD]

Edit: does this count as a ninja'd?

You bet.

but we can, with the wonders of CFWs, do basically everythong else (intercept and modify, don't use, read from new location etc.)

I don't think a CFW is needed, here is what I think to be a simpler way:

I think someone can make a title launcher that asks for a bin file created by otp2sd on the first Wii U, and launch a title from the USB on the other Wii U by getting the seed from the bin file.

 

[C0mm4nd_]

The USB seeds are stored in the SEEPROM not in the OTP...
In the OTP you can find the key for ENCRYPT the seeds.
http://wiiubrew.org/wiki/Hardware/OTP
http://wiiubrew.org/wiki/Hardware/SEEPROM

 

[AboodXD]

Nice plot-twist you got there buddy.

 

[Benoit934]

May be we can bypass Encryption and decription but in my case I like to work only on USB and doing nothing and the NAND

But if we are able to reverse the process we can make a RAW copy of a disk without mounting it, but if I remember well an account is linked to a WiiU so if we put ours saves and everything on a USB drive then put those datas on another WiiU we need to unlink the account every times

 

[75mak]

Is it possible to decrypt the drive, and then reinsert the unique key of the other Wii u you want to change to?

 

[RandomUser]

How about dumping the SEEPROM from one Wii U and inject it to another Wii U redNAND and emulate the said SEEPROM. Would that work as a workaround?
I am aware of currently no SEEPROM emulation, as of yet.

 

[NWPlayer123]

How about dumping the SEEPROM from one Wii U and inject it to another Wii U redNAND and emulate the said SEEPROM. Would that work as a workaround?
I am aware of currently no SEEPROM emulation, as of yet.

Yes, theoretically, and it'll recognize the drive as if it was yours, technically everyone could be using the same seed since the key to encrypt it is the same but that would get a little messy

As with most "now with IOSU" things - possible, just hasn't been made yet.

As some others have hinted; the Wii U encrypts its USB drives using a console-specific key. This key is stored in the OTP; which means we can't modify it directly but we can, with the wonders of CFWs, do basically everythong else (intercept and modify, don't use, read from new location etc.)

Also yes, Nikki did manage to decrypt a bit of their USB, although they don't seem to be able to mount the filesystem or anything yet.

Edit: does this count as a ninja?

That was just a one-night tinker project to see if I could do it, never bothered to figure out how it's read, I just wanted to decrypt it, and again the key is the same for every console, it's just the seed is unique and regenerated on system format, you could technically just change the seed in SEEPROM when running iosuhax stuff and swap drives and it'll be able to read it