Homebrew [RELEASE] Tiramisu Environment | Free CBHC

Dogbert8

Active Member
Newcomer
Joined
Sep 23, 2010
Messages
32
Trophies
0
XP
531
Country
United States
are you using cbhc?
No, I am not. That was uninstalled (and verified as uninstalled) before doing anything with Tiramisu.

Edit: Also, in case it helps, I followed the same process, using the same files, on two other systems (yes, I have three) and it worked perfectly on the other two. This is the only system that doesn't allow me to access the boot options.
 
Last edited by Dogbert8,

Maschell

Well-Known Member
OP
Member
Joined
Jun 14, 2008
Messages
1,028
Trophies
1
XP
3,539
Country
Gambia, The
I am having some difficulty getting it to autoboot to Tiramisu. When I go to Boot Options, it gives me this error message:

"Sorry, your system.xml file has not yet been tested with this tool. Boot options cannot be modified."

But checking the system is required to even get to the Boot options selection, so I can't figure out what is wrong here. This is a fresh install with files I downloaded from the official site just an hour ago.
This sounds like you've already modified your system.xml before (or used a tool that modified the system.xml). The installer only actually modifes the system.xml if the changes will result in a file with known hash.

Without a copy of your system.xml it's hard to tell whats going on though.
 

Dogbert8

Active Member
Newcomer
Joined
Sep 23, 2010
Messages
32
Trophies
0
XP
531
Country
United States
This sounds like you've already modified your system.xml before (or used a tool that modified the system.xml). The installer only actually modifes the system.xml if the changes will result in a file with known hash.
This one is my "backup" system. I bought it second hand (saw a price I couldn't pass up), installed CBHC on it, stored it away, uninstalled CBHC, and installed Tiramisu. I didn't do anything else that would modify files. It was not hacked when I got it, though I suppose the previous owner could have hacked it, then deleted any obvious evidence of the hacking before selling it to me. The CBHC uninstall should have restored the system.xml to its original state (and did on my other consoles). Anything I can do to figure out what the problem is or fix it?

I assume it is possible to get a copy of system.xml via one of the FTP programs. I can run one and see if I can get a copy.
 

godreborn

Well-Known Member
Member
Joined
Oct 10, 2009
Messages
28,407
Trophies
2
XP
18,360
Country
United States
This one is my "backup" system. I bought it second hand (saw a price I couldn't pass up), installed CBHC on it, stored it away, uninstalled CBHC, and installed Tiramisu. I didn't do anything else that would modify files. It was not hacked when I got it, though I suppose the previous owner could have hacked it, then deleted any obvious evidence of the hacking before selling it to me. The CBHC uninstall should have restored the system.xml to its original state (and did on my other consoles). Anything I can do to figure out what the problem is or fix it?

I assume it is possible to get a copy of system.xml via one of the FTP programs. I can run one and see if I can get a copy.
check title id of the system.xml. that's what would've been changed with cbhc. it's the same depending on region.
 

Dogbert8

Active Member
Newcomer
Joined
Sep 23, 2010
Messages
32
Trophies
0
XP
531
Country
United States
Here's my system.xml:
<?xml version="1.0" encoding="utf-8"?>
<system type="complex" access="777">
<version type="unsignedInt" length="4">21</version>
<cmdFlags type="unsignedInt" length="4">0</cmdFlags>
<default_os_id type="hexBinary" length="8">000500101000400a</default_os_id>

<default_title_id type="hexBinary" length="8">0005001010040100</default_title_id>

<log type="complex">
<enable type="unsignedInt" length="4">0</enable>
<max_size type="unsignedInt" length="4">8388607</max_size>
</log>
<standby type="complex">
<enable type="unsignedInt" length="4">0</enable></standby>
<ramdisk type="complex">
<cache_user_code type="unsignedInt" length="4">1</cache_user_code>
<max_file_size type="unsignedInt" length="4">10485760</max_file_size>

<cache_delay_ms type="unsignedInt" length="4">10000</cache_delay_ms>
</ramdisk>
<simulated_ppc_mem2_size type="hexBinary" length="4">00000000</simulated_ppc_mem2_size>

<dev_mode type="unsignedInt" length="4">0</dev_mode>
<prev_title_id type="hexBinary" length="8">0000000000000000</prev_title_id>

<prev_os_id type="hexBinary" length="8">0000000000000000</prev_os_id>
<default_app_type type="hexBinary" length="4">90000001</default_app_type>

<default_device_type type="string" length="16"></default_device_type>
<default_device_index type="unsignedInt" length="4">0</default_device_index>

<fast_relaunch_value type="unsignedInt" length="4">0</fast_relaunch_value>

<default_eco_title_id type="hexBinary" length="8">0005001010066000</default_eco_title_id>

</system>
 

godreborn

Well-Known Member
Member
Joined
Oct 10, 2009
Messages
28,407
Trophies
2
XP
18,360
Country
United States
I think os id and title id are correct anyway. seems to be a US version of the console, I believe (i.e. 100). as for the rest of it, I'm not sure.
 

Maschell

Well-Known Member
OP
Member
Joined
Jun 14, 2008
Messages
1,028
Trophies
1
XP
3,539
Country
Gambia, The
Here's my system.xml:
<?xml version="1.0" encoding="utf-8"?>
<system type="complex" access="777">
<version type="unsignedInt" length="4">21</version>
<cmdFlags type="unsignedInt" length="4">0</cmdFlags>
<default_os_id type="hexBinary" length="8">000500101000400a</default_os_id>

<default_title_id type="hexBinary" length="8">0005001010040100</default_title_id>

<log type="complex">
<enable type="unsignedInt" length="4">0</enable>
<max_size type="unsignedInt" length="4">8388607</max_size>
</log>
<standby type="complex">
<enable type="unsignedInt" length="4">0</enable></standby>
<ramdisk type="complex">
<cache_user_code type="unsignedInt" length="4">1</cache_user_code>
<max_file_size type="unsignedInt" length="4">10485760</max_file_size>

<cache_delay_ms type="unsignedInt" length="4">10000</cache_delay_ms>
</ramdisk>
<simulated_ppc_mem2_size type="hexBinary" length="4">00000000</simulated_ppc_mem2_size>

<dev_mode type="unsignedInt" length="4">0</dev_mode>
<prev_title_id type="hexBinary" length="8">0000000000000000</prev_title_id>

<prev_os_id type="hexBinary" length="8">0000000000000000</prev_os_id>
<default_app_type type="hexBinary" length="4">90000001</default_app_type>

<default_device_type type="string" length="16"></default_device_type>
<default_device_index type="unsignedInt" length="4">0</default_device_index>

<fast_relaunch_value type="unsignedInt" length="4">0</fast_relaunch_value>

<default_eco_title_id type="hexBinary" length="8">0005001010066000</default_eco_title_id>

</system>
For some reason your `ramdisk>cache_user_code` is set to 1:
<cache_user_code type="unsignedInt" length="4">1</cache_user_code>
If you set this to
<cache_user_code type="unsignedInt" length="4">0</cache_user_code>
it should work. But keep in mind to be VERY careful when manually modifying your system.xml. I personally would just change this single byte of the file with a hex editor and double check that only this byte is different. Make sure to have slc + otp + seeprom backup so you can unbrick in worst case

I uploaded a copy with a known hash which coldboots into the Wii U Menu (USA, 0005001010040100) . But please make sure the SHA1 Hash of the downloaded system.xml still is "124562D41A02C7112DDD5F9A8F0EE5DF97E23471". (removed because the file could brick people from other regions)
 
Last edited by Maschell,

Dogbert8

Active Member
Newcomer
Joined
Sep 23, 2010
Messages
32
Trophies
0
XP
531
Country
United States
That worked like a charm, Maschell. After replacing the file with the one you provided, I was able to turn on autoboot without a problem. Thank you so much for your quick work to help me, and for your work on this project in general. It is very much appreciated!
 
  • Like
Reactions: Maschell

pressplay

Member
Newcomer
Joined
Feb 20, 2017
Messages
18
Trophies
0
Age
44
XP
247
Country
Argentina
Just for curiosity: which is the difference between payload.elf, payload.rpx and root.rpx in sd://wiiu? I guess payload.elf is the CustomRPXLoader, and payload.rpx is the EnvironmentLoader. What about root.rpx? Maybe is it the PayloadLoaderPayload recall when navigating to wiiuexploit.xyz?
 

Maschell

Well-Known Member
OP
Member
Joined
Jun 14, 2008
Messages
1,028
Trophies
1
XP
3,539
Country
Gambia, The
Just for curiosity: which is the difference between payload.elf, payload.rpx and root.rpx in sd://wiiu? I guess payload.elf is the CustomRPXLoader, and payload.rpx is the EnvironmentLoader. What about root.rpx? Maybe is it the PayloadLoaderPayload recall when navigating to wiiuexploit.xyz?
The root.rpx is the PayloadLoader. It's the same .rpx that is injected into H&S. When you exit the system settings basically the whole console is rebooting but this time into the Wii U Menu instead of H&S. So still mantain code execution we redirect the Wii U Menu once to the sd card (=> the root.rpx) which allows us to relaunch the CustomRPXLoader (payload.elf) => reboot into EvironmentLoader (payload.rpx) => reboot into Tiramisu without actually rebooting into H&S
 
  • Like
Reactions: BaamAlex

pressplay

Member
Newcomer
Joined
Feb 20, 2017
Messages
18
Trophies
0
Age
44
XP
247
Country
Argentina
Thanks Maschell, very clear and kind of you. Just to complete, I forgot to ask about the payload.elf in sd:/wiiu/payloads/default. From the documentation it is chainloaded by PayloadLoaderPayload. So maybe payload.elf in the root of the SD is the PayloadLoaderPayload, and payload.elf in payloads/default is the CustomRPXLoader. Correct?
 
Last edited by pressplay,

MockyLock

Well-Known Member
Member
Joined
Apr 21, 2011
Messages
358
Trophies
0
XP
1,873
Country
France
Hello, me again !
So, following these advices:
Hi MockyLock

This WiiU Forwarder to the vWii forwarder for USBLGX worked for me:
https://gbatemp.net/threads/usb-loader-gx-forwarder-channel-for-wii-u-menu.482595/

for the vWii Forwarder i used the UNEO Forwarder V 5.1 from here
https://sourceforge.net/projects/usbloadergx/files/Releases/Forwarders/

i had to reinstall/do a redump of USBLGX on the SD-Card before it worked. More details of my odyssey till it was working you will find here :
https://gbatemp.net/threads/usb-loader-gx.149922/post-9730164
I finally did this :
- copied back the 50_hbl_installer.rpx file in tis folder.
- kept the vWii forwarder to USBLGX (it was an [UNEO] one, not sure about its version.
- uninstalled my previous version of WiiU forwarder to vWii forwarder (using the Data Management in the System Settings app of the WiiU).
- installed the version above using Wup Installer Y Mod

And guess what, evrything is working again. My WiiU Forwarder lead me to USBLGX. Nice !
However, and just for the discussion with no complain, the process seems a bit more longer than my previous one. I'm pretty sure that before, once the WiiU forwarder started, waiting for a few secondes, USB Loarder booted pretty straight.
Now i can see the WiiU Forwarder channel screen fading, then the Wii "splashs creen" displayed, then USB Loader GX come on screen.

Thank you all for your work, thank you @Maschell @GaryOderNichts
Thank to @V10lator too
 
Last edited by MockyLock,
  • Like
Reactions: Donnie-Burger
General chit-chat
Help Users
  • No one is chatting at the moment.
    KenniesNewName @ KenniesNewName: Apple is the new Disney