Hacking quadforce 2.0 freeze on fzero AX modeselect

[AndehX]

How old is your Wii, does it have a vuln boot1? (Aka can you install bootmii into boot2)

i replied to you on twitter btw, just incase you forgot to check

but yeah, bootmii is installed to boot2. In bootmii's info section it says boot1? and boot2v4
My wii is an original 2006 model

 

[naxil]

Throwing another nonworking log on the pile.

Spoiler

GCLoader
Built  : Apr 30 2013 17:21:26
Version : 0.7
VI:TVNtsc480Prog
Using config v2 from RAM
Booting DML
MenuMode:2
AppLoader Size:0001141C
Apploader Entry:0x81200194
Apploader Init: 0x812001bc
Apploader Main: 0x8120049c
Apploader Final:0x81200d40
Apploader Initialized.  $Revision: 28 $.
This Apploader built Dec  6 2001 23:25:55
Game:RunGame->DVDLowRead( 0x81201400, 00000020, 00000420)
Game:RunGame->DVDLowRead( 0x81201540, 00000020, 00000440)
Game:RunGame->DVDLowRead( 0x817e18c0, 00002000, 00000440)
Game:RunGame->DVDLowRead( 0x81201420, 00000100, 00018000)
Game:RunGame->DVDLowRead( 0x80003100, 000024e0, 00018100)
Game:RunGame->DVDLowRead( 0x800055e0, 002095c0, 0001a5e0)
Game:RunGame->DVDLowRead( 0x8020eba0, 00000020, 00223ba0)
Game:RunGame->DVDLowRead( 0x8020ebc0, 00000020, 00223bc0)
Game:RunGame->DVDLowRead( 0x8020ebe0, 0000e860, 00223be0)
Game:RunGame->DVDLowRead( 0x8021d440, 0011cfc0, 00232440)
Game:RunGame->DVDLowRead( 0x804408e0, 00002740, 0034f400)
Game:RunGame->DVDLowRead( 0x80444300, 000049c0, 00351b40)
Game:RunGame->DVDLowRead( 0x817e38c0, 0001c740, 00356500)
Game:RunGame->entrypoint(80003154)
Game:Region:0
enterpoint(0x80003154)

vaguerant . the info isn't complete (megazig say that to him). him say to me (but i haven't usbgecko)

---run usbgecko app. set breakpoint so that exception vectors are hooked. crash game. get backtrace. get registers. dump mem1---

can u enter on #dm (efnet) or #wiiflow (abjects) and talk with megazig or crediar for send good log about that freeze?

 

[naxil]

for complete debug "Added cheating/debugging support, requires sd:/sneek/kenobigc.bin" (from real nand, use this path for kenobigc)

 

[wiikey]

Game booting fine here using wiiflow

 

[WiiUBricker]

Game booting fine here using wiiflow

For the avoidance of doubt, you are not related to the wiikey team, aren't you?

 

[wiikey]

No im not lol

 

[naxil]

no way to get this full log on freeze?
damn! why i have sdgecko and not usbgecko?

 

[Vague Rant]

Gave this another look. Is this right?

Spoiler: Registers

CR  : 24200088  XER : 00000000  CTR : 801AA088  DSIS: 40000000
DAR : 86B10FD5  SRR0: 8020469C  SRR1: 0000B032  LR  : 802045DC
r0  : 00000000  r1  : 80458AA0  r2  : 8044C300  r3  : 00000000
r4  : 86B10FB9  r5  : 0000FCCD  r6  : 00000000  r7  : 0000CCC0
r8  : 00000000  r9  : 0000CCD0  r10 : 00000001  r11 : 00000004
r12 : 00000200  r13 : 804488E0  r14 : 00000000  r15 : 00000000
r16 : 00000000  r17 : 00000000  r18 : 00000000  r19 : 00000000
r20 : 00000000  r21 : 00000000  r22 : 00000000  r23 : 0000054D
r24 : 809EA3C0  r25 : 0000A9A0  r26 : 809DF9E0  r27 : 809CF220
r28 : 809EA620  r29 : 809D00E5  r30 : 00000000  r31 : 80332FD0

f0  : FFC00000  f1  : FFC00000  f2  : 40000000  f3  : 41800000
f4  : 00000000  f5  : 00000000  f6  : 00000000  f7  : 42960000
f8  : 3983E577  f9  : 3F800000  f10 : 3ACCCCCD  f11 : 00000000
f12 : 00000000  f13 : 00000000  f14 : 00000000  f15 : 00000000
f16 : 00000000  f17 : 00000000  f18 : 00000000  f19 : 00000000
f20 : 00000000  f21 : 00000000  f22 : 00000000  f23 : 00000000
f24 : 00000000  f25 : 00000000  f26 : 00000000  f27 : 00000000
f28 : 00000000  f29 : 00000000  f30 : 00000000  f31 : 00000000

Spoiler: Backtrace?

8020469C:  8004001C	lwz	r0,28(r4)
802046A0:  54000529	rlwinm.	r0,r0,0,20,20
802046A4:  41820010	beq-	0x802046b4
802046A8:  80040000	lwz	r0,0(r4)
802046AC:  60000100	ori	r0,r0,256
802046B0:  90040000	stw	r0,0(r4)
802046B4:  88040012	lbz	r0,18(r4)
802046B8:  28000000	cmplwi	r0,0
802046BC:  40820010	bne-	0x802046cc
802046C0:  80040000	lwz	r0,0(r4)
802046C4:  60000080	ori	r0,r0,128
802046C8:  90040000	stw	r0,0(r4)
802046CC:  88C40013	lbz	r6,19(r4)
802046D0:  38000000	li	r0,0
802046D4:  38A00001	li	r5,1
802046D8:  38E40060	addi	r7,r4,96

MEM1 dump?