Homebrew (Partial) Idea For a 5.5.2 Exploit

[Wolfer473]

Okay, so before you ignore this I've already asked some devs in the discord server and they said that this might be doable but there are some issues that could (maybe) be solved.

THEORY: The eShop uses the same mvplayer.rpl in 5.5.2 that the internet browser used in 5.5.1, and the eShop also has JIT. So theoretically, the Exploit video should work in the eShop.

ISSUES:
1) Unlike Crunchyroll ads, the eShop uses an SSL connection with the servers, so it would be extremely hard (if not impossible) to remap a video (i.e. The Super Mario Cat Show that you can play/watch in the eShop.) to the exploit .mp4.

2) This is still untested, so even after all of that work fixing the SSL, it might not work. (i.e missing an essential library item, code execution failing, video player has a different patch from internet browser, etc.)

3) I was thinking of attempting to redirect the eShop to a custom server where we could play the exploit .mp4, but (again curse SSL) that would either require remapping to redirect the Wii U or maybe changing the URL using FTPii and going into the title information, but that would require access to the Homebrew launcher, which kind of defeats the purpose.

So I wanted to put this theory out there in case anyone can come up with a solution to these problems, or to tell me it can't be done so I stop working on it.

Thanks for reading.

 

[iAqua]

Okay, so before you ignore this I've already asked some devs in the discord server and they said that this might be doable but there are some issues that could (maybe) be solved.

THEORY: The eShop uses the same mvplayer.rpl in 5.5.2 that the internet browser used in 5.5.1, and the eShop also has JIT. So theoretically, the Exploit video should work in the eShop.

ISSUES:
1) Unlike Crunchyroll ads, the eShop uses an SSL connection with the servers, so it would be extremely hard (if not impossible) to remap a video (i.e. The Super Mario Cat Show that you can play/watch in the eShop.) to the exploit .mp4.

2) This is still untested, so even after all of that work fixing the SSL, it might not work. (i.e missing an essential library item, code execution failing, video player has a different patch from internet browser, etc.)

3) I was thinking of attempting to redirect the eShop to a custom server where we could play the exploit .mp4, but (again curse SSL) that would either require remapping to redirect the Wii U or maybe changing the URL using FTPii and going into the title information, but that would require access to the Homebrew launcher, which kind of defeats the purpose.

So I wanted to put this theory out there in case anyone can come up with a solution to these problems, or to tell me it can't be done so I stop working on it.

Thanks for reading.

as shown by crunchyroll and watchup, not all mvplayers are the same. if you figure out (somehow) how to remap a video, i'll be willing to give it a try though.

 

[Wolfer473]

as shown by crunchyroll and watchup, not all mvplayers are the same. if you figure out (somehow) how to remap a video, i'll be willing to give it a try though.

Yeah, but I figured Nintendo would want to save as much time as possible developing those apps, and since there both in the same group (can be run while software is suspended) that they would save time and use the same mvplayer. If you would be willing to give it a try please do because I'm kind of stuck right now.

 

[iAqua]

Yeah, but I figured Nintendo would want to save as much time as possible developing those apps, and since there both in the same group (can be run while software is suspended) that they would save time and use the same mvplayer. If you would be willing to give it a try please do because I'm kind of stuck right now.

i'm not a magician, and i certainly can't fake a ssl cert. redirecting will be up to you or anyone else really wanting to try this. sorry.

 

[Wolfer473]

i'm not a magician, and i certainly can't fake a ssl cert. redirecting will be up to you or anyone else really wanting to try this. sorry.

K thanks anyway. I know that the redirecting of SSL is almost impossible, and I should probably be the one screwing around with it since it was my theory.

 

[shinyquagsire23]

I could see it happen if there were an mp4 which could be contenthax'd or if there were mp4s or something cached in the save but otherwise I'm doubtful, and it still wouldn't help anyone on 5.5.2 in that case.

 

[iAqua]

I know i'm reviving an old thread but i'm just here to confirm that using a exploit mp4 doesn't work (without modification)
here's an example of a remapped video,
Failed to fetch tweet https://twitter.com/aquaaaah/status/906694040921399296