[RELEASE] Reencrypt WFS USBs/MLCs to transfer them between consoles (wfs-reencryptor)

[EyeKey]

I have promised to made this tool for few years and it is finally ready. This utility is able to reencrypt the whole device (mlc or usb, or even decrypt it for research purposes). So it can transfer a USB that is encrypted for one console keys to another. Or restore a USB after a factory reset by reencrypting it with the new key.

This utility is still very experimental, so use at your own risk. It is always recommended to create a backup.

The utility can be downloaded as part of the latest WFS Tools release

Source code

Usage:

usage: wfs-reencryptor --input <input file> [--output <output file>]
                       [--input-type <type>] [--input-otp <path> [--input-seeprom <path>]]
                       [--output-type <type>] [--output-otp <path> [--output-seeprom <path>]]

options:
  --help                  produce help message
  --input arg             input file
  --input-type arg (=usb) input file type (usb/mlc/plain)
  --input-otp arg         input otp file (for usb/mlc types)
  --input-seeprom arg     input seeprom file (for usb type)
  --output arg            output file (default: reencrypt the input file)
  --output-type arg       output file type (default: same as input)
  --output-otp arg        output otp file (for usb/mlc types)
  --output-seeprom arg    output seeprom file (for usb type)

Example usage for reencrypting a usb:

wfs-reencryptor --input /dev/sdb --input-otp old_console_otp.bin --input-seeprom old_console_seeprom.bin --output-otp new_console_otp.bin --output-seeprom new_console_seeprom.bin

Example usage for decrypting a usb:

wfs-reencryptor --input /dev/sdb --input-otp otp.bin --input-seeprom seeprom.bin --output-otp new_console_otp.bin --output-type=plain

The rest of the wfs tools are able to handle the plain file (if specified --type=plain when using them)

For reencrypting a usb on Windows, please read the explanation on the Github page. In a future version it will be possible to specify the device letter.

It is also possible to specify the `--output` arg if you don't want to overwrite the original disk.

IMPORTANT NOTE: You still need to have a valid ticket installed to any title that you want to access.

 

[ber71]

Excellent work.
However, this utility will be really useful when we got a faketik-like program, which doesn't exist atm.

 

[EyeKey]

Excellent work.
However, this utility will be really useful when we got a faketik-like program, which doesn't exist atm.

Yeah a very good point, I forgot to mention in the post that you won't be able to see/access any title that you don't have the ticket to installed already. I will edit it

 

[V800]

So, if you plan to use it in the future, you need the seeprom, the otp and the tickets from the old usb, am I right?

 

[Dakangel]

Thank you @EyeKey this is just what i was looking for experimient between two Wii u's and the games trought them.

I was thinking for a possibility of an Aroma Module that force the console to completely ignore the encryption / decription calls and instead directly read the games trought a wfs keyless partition (or a fat32 partition) similar to the original wii do it.

That could open a new way to recycle hdd devices with different consoles ,plus an Aroma Pluggin that disable the formating device warning.

 

[SDIO]

Very cool, wished I had that when my eMMC died.
Here is described how you can get the old USB key after a Factory Reset: https://gbatemp.net/threads/im-work...u-saves-from-a-usb-drive.629969/post-10124024
Maybe it could even be added to the wfs-lib to automatically try previous keys or have it as an option.

 

[CrazySquid]

Oh, so this will allow me to format my Wii U but still be capable of using the very same HDD with the games and all on it? That's great, I'm a bit afraid of the "experimental part". but I guess it should be stable enough, right?

 

[tmnr1992]

Regarding the tickets, according to this guide: https://gbatemp.net/threads/play-ss...d-on-sysnand-without-cfw-or-aocptcher.464178/, the tickets are located in: storage_slc/rights/ticket/apps/xxxx/xxx.tik, so would it be possible to simply copy the entire apps folder from one console to the other? Or would I need to edit the tickets in some way first?

Also while checking with FTPiiU the path I found was: /storage_slc/sys/rights/ticket/apps, not sure why the guide does not include the sys folder.

 

[CrazySquid]

Regarding the tickets, according to this guide: https://gbatemp.net/threads/play-ss...d-on-sysnand-without-cfw-or-aocptcher.464178/, the tickets are located in: storage_slc/rights/ticket/apps/xxxx/xxx.tik, so would it be possible to simply copy the entire apps folder from one console to the other? Or would I need to edit the tickets in some way first?

Also while checking with FTPiiU the path I found was: /storage_slc/sys/rights/ticket/apps, not sure why the guide does not include the sys folder.

That's what I'm going to do. You can also use tik2sd. In theory I think it should work without the need of editing them.

 

[EyeKey]

Oh, so this will allow me to format my Wii U but still be capable of using the very same HDD with the games and all on it? That's great, I'm a bit afraid of the "experimental part". but I guess it should be stable enough, right?

The "experimental part" is that it hasn't been tested thoroughly and I don't know if anything unexpected may fail. If you are planning to do that I would recommend to use DumpesterU or wfs-extract first to backup all your games/saves so you could restore them in the worst case.

 

[CrazySquid]

The "experimental part" is that it hasn't been tested thoroughly and I don't know if anything unexpected may fail. If you are planning to do that I would recommend to use DumpesterU or wfs-extract first to backup all your games/saves so you could restore them in the worst case.

Right, I made a raw image of the HDD, that worked for me in the past as baclup so I will keep it if anything goes wrong. Thanks for the clarification!

 

[CrazySquid]

@EyeKey I have another question, but can this application format in WFS? I mean, having a FAT32 device and making it a encrypted WFS for use with the WIi U on a Windows PC? I'm trying to do that using the following command:

wfs-reencryptor --input F:\ --input-otp otp.bin --output-otp otp.bin --input-seeprom seeprom.bin --output-seeprom seeprom.bin

Since it's for the same console (this time, I'm just trying the application) I use the same otp.bin and seeprom.bin in both the output and input, but it fails with the following message:

Error: FileDevice: Failed to open file

I tried using the CMD with admin privilegies, but it doesn't work. May try with a Linux machine.

EDIT: After further inspection, I think it's not possible to do what I want to do (having a FAT32/NTFS device and format it in the WFS format without actually lose data). I think I'm better waiting for direct writing support on PC of the WFS filesystem.

EDIT2: Huh, this is weird, the program is not working on Linux when I want to use wfs-fuse or wfs-info:

$ ./wfs-fuse --input /dev/sdb --type usb --otp otp.bin --seeprom seeprom.bin
Error: FileDevice: Failed to open file

EDIT3: Used the following command

$ sudo ./wfs-fuse /dev/sdb /mnt --otp otp.bin --seeprom seeprom.bin

And I get:

Missing type (--otp)

I have otp.bin and seepron.bin in the same directory as wfs-fuse, what I'm doing wrong? (Yes, the USB is in WFS format this time)

EDIT4: I managed to get it to work by specifing that is a USB type, but still... seems unstable in my use, but I guess that's normal since it's in a experimental state, right?

 

[EyeKey]

EDIT3: Used the following command
And I get:

I have otp.bin and seepron.bin in the same directory as wfs-fuse, what I'm doing wrong? (Yes, the USB is in WFS format this time)

Sorry there is a small bug in this version. You must specify `--type usb`

And yes the FAT32 thing is not possible. The write support to WFS is still WIP (but I have made a lot of progress lately, at the current rate I hope that an experimental version will be released sometime in the next 6 months)

 

[CrazySquid]

Sorry there is a small bug in this version. You must specify `--type usb`

And yes the FAT32 thing is not possible. The write support to WFS is still WIP (but I have made a lot of progress lately, at the current rate I hope that an experimental version will be released sometime in the next 6 months)

I have just one last question, I'm trying to reencrypt a test USB drive. First I decrypted it via

sudo ./wfs-reencryptor --input /dev/sdb --input-otp otp.bin --input-seeprom seeprom.bin --output-otp otp.bin --output-type=plain

Now, it's a "plain" WFS USB. If I specify "plain" when using other WFS tools it works fine. The console doesn't recognice the decrypted drive. How I can encrypt the USB drive again? I'm trying with

sudo ./wfs-reencryptor --input /dev/sdb --input-type plain --input-otp otp.bin --input-seeprom seeprom.bin --output-otp otp.bin --output-seeprom seeprom.bin

And I get:

Exploring blocks...
Found 1158 blocks! Reencrypting...
Done!

However the device remains as "plain" and the Wii U doesn't recognice it, I'm doing something wrong?

EDIT: I'm a dumbass, I forgot to specify what type I device I wanted, so I added "--output-type=usb"

 

[EyeKey]

I have just one last question, I'm trying to reencrypt a test USB drive. First I decrypted it via

sudo ./wfs-reencryptor --input /dev/sdb --input-otp otp.bin --input-seeprom seeprom.bin --output-otp otp.bin --output-type=plain

Now, it's a "plain" WFS USB. If I specify "plain" when using other WFS tools it works fine. The console doesn't recognice the decrypted drive. How I can encrypt the USB drive again? I'm trying with

sudo ./wfs-reencryptor --input /dev/sdb --input-type plain --input-otp otp.bin --input-seeprom seeprom.bin --output-otp otp.bin --output-seeprom seeprom.bin

And I get:

Exploring blocks...
Found 1158 blocks! Reencrypting...
Done!

However the device remains as "plain" and the Wii U doesn't recognice it, I'm doing something wrong?

Specify --output-type usb (otherwise it assumes that it should be kept at the same format as input)

 

[CrazySquid]

Specify --output-type usb (otherwise it assumes that it should be kept at the same format as input)

Yes, that was the issue... Sorry about that! Tried the re-encrypted USB on the Wii U and played a bit with the game that was installed, and yes, it works perfectly fine, so I guess it's safe to use for the day I factory reset my Wii U and want to re-encrypt my real HDD . (Always with a raw image-backup, just to be safe)

Thanks a lot for this, it is REALLY helpful, I will wait for the blessed day we can finally write to the WFS system from the PC.

Thanks again for all your efforts!