Hacking SNEEK v2

[gameking66]

Does the ticket say "TheMostAwesomest" ?
Did you use the TMD from a NAND dump of the Wii you are running SNEEK on, or did you try the console ID 11111111 and modified TMD values?
I tried both ways, they both say TheMostAwesomest. I fakesigned a clean NAND and I extracted my Wii's.


What version of HBC? I have only tested this on 1.0.6.

When you tried the TMD from your Wii did you have device.cert in the sys folder? If so, remove it.

When you tried the "fakesigned" TMD did you have device.cert in the sys folder? If so, did it look something like this when viewed in a hex editor:

Spoiler

CODE

Spoiler

[email protected].....&.a.f%...K..Su~....b\..Qp.bx{..p.&x... .X6..,..................................................................Root-CA00000001-MS00000002..........................................NG11111111..................
...................................j.....F.T.....P...^...-.\66..{.....". .../5.6..b.o..}|.W.h................................................................
.

1.0.6
I used the complete Wii backup, so it had the Wii's TMD and device.cert.
When I tried the fakesigned TMD, I did have device.cert, with the proper serial to match the fakesigned TMD (3131313131313131 at C6).

 

[fogbank]

I tried both ways, they both say TheMostAwesomest. I fakesigned a clean NAND and I extracted my Wii's.

What version of HBC? I have only tested this on 1.0.6.
When you tried the TMD from your Wii did you have device.cert in the sys folder? If so, remove it.

1.0.6
I used the complete Wii backup, so it had the Wii's TMD and device.cert.
When I tried the fakesigned TMD, I did have device.cert, with the proper serial to match the fakesigned TMD (3131313131313131 at C6).

Where did you get device.cert? Did you extract it from your Wii using GetDeviceCert or something similar?
Have you tried any of these steps on a NAND made from scratch?

Other suggestions:
- Install an unpatched IOS61 on your real NAND, reinstall HBC v1.0.6 on your real NAND and dump the NAND again.
- Try the HBC installer WAD that Wilsoff posted earlier in this thread on your SNEEK NAND. If it doesn't work try a different SD card (it didn't work for me on my first SD card). Make sure you have removed any traces of HBC on the SNEEK NAND before you try the installer wad.

 

[gameking66]

I tried both ways, they both say TheMostAwesomest. I fakesigned a clean NAND and I extracted my Wii's.

What version of HBC? I have only tested this on 1.0.6.
When you tried the TMD from your Wii did you have device.cert in the sys folder? If so, remove it.

1.0.6
I used the complete Wii backup, so it had the Wii's TMD and device.cert.
When I tried the fakesigned TMD, I did have device.cert, with the proper serial to match the fakesigned TMD (3131313131313131 at C6).

Where did you get device.cert? Did you extract it from your Wii using GetDeviceCert or something similar?
Have you tried any of these steps on a NAND made from scratch?

Other suggestions:
- Install an unpatched IOS61 on your real NAND, reinstall HBC v1.0.6 on your real NAND and dump the NAND again.
- Try the HBC installer WAD that Wilsoff posted earlier in this thread on your SNEEK NAND. If it doesn't work try a different SD card (it didn't work for me on my first SD card). Make sure you have removed any traces of HBC on the SNEEK NAND before you try the installer wad.

The real WAD is unmodified. My real NAND has no homebrew changes at all except bootmii/boot2. The device.cert comes from a bootmii NAND backup.

 

[gameking66]

I'm getting really random crashes on r78/r80 on the Sys Menu, and more than half the time it just won't boot to the sys menu (freezes at health).

 

[mrplick]

Anyone else having issues with Metroid Prime Trilogy? Up to and including R79 mp1, mp2 and mp3 loaded with no problems. Anything from R80 onward will not load mp3. Mp1 and mp2 work ok but mp3 starts to load then black screen and system resets back to menu.

thanks

 

[bewitched]

HBC keeps scam screening me, even with a fakesigned TMD.

Finally i got the HBC to work on a clean virgin nand

I checked my previously created nand's and there where still some files from the hbc present

Then it hit me... everything i needed was posted here so i started from scratch again:
1. Build a clean nand, i used, System Menu v290 3.2E, IOS30-64-v2576, IOS35-64-v3349, IOS36-64-v3351, IOS38-64-v3867, IOS61-64-v5405 and used the setting.txt from my bootmii Wii nand backup to build 3.2E. Then, still in SNEEK, updated to 4.2E.
2. Made a backup of the 3.2E and the 4.2E nands, just to be sure.
4. Extracted a hbc-1.06-.wad to the nand on my sd-card.
5. Copied the title.tmd from my bootmii Wii nand dump (with hbc installed) to the sd > @fogbank thanks: "It appears that each HBC installation is tied to the console it was installed to by modifying an area of the TMD" here

Started SNEEK and there it was the HBC channel... Clicked on it and it loaded fine, no scam screen, now i'm happy

6. Made a backup of the 4.2E clean nand with HBC

 

[diddy81]

if you made a clean nand (3.2)
then got the HBC installer wad (from the other thread)
patch the wad to IOS30
install it and open it in sneek
this will install HBC fine on 3.2
then update to 4.2

that works great

 

[bewitched]

if you made a clean nand (3.2)
then got the HBC installer wad (from the other thread)
patch the wad to IOS30
install it and open it in sneek
this will install HBC fine on 3.2
then update to 4.2

that works great

I've tried that wad in 4.2, but it hangs on the scam screen, do i have to use it in 3.2 and how do i patch it to IOS30?

Edit:
With the earlier mentioned setup, using the boot2.bin for SD everything works fine. But the DI version (rev80) gave me headaches, i loaded up sneek, the screen stayed black. I had used the di module before so i was 100% sure that was ok.
Going back to the boot2_sd.bin and everything works fine.
For this setup i used an 8GB microsd in a SDadapter.

To rule things out i tested my Wii nand 4.2E backup on an official Nintendo 2GB SD with the same DI (rev80) and that was working fine. So i copied the virgin nand with the hbc to the 2GB SD with di and it's working just fine.

It seems that something on that 8GB microsd is preventing di from loading, but what

It works with the normal sneek and i used it with di rev80 before. I formatted it to Fat32 32KB.

 

[wilsoff]

if you made a clean nand (3.2)
then got the HBC installer wad (from the other thread)
patch the wad to IOS30
install it and open it in sneek
this will install HBC fine on 3.2
then update to 4.2

that works great

I've tried that wad in 4.2, but it hangs on the scam screen, do i have to use it in 3.2 and how do i patch it to IOS30?

Easiest way is to load it up in customizemii and change startup IOS to 30 and then pack wad. I wonder if patching it to use 60 for 4.0 and 70 for 4.1/4.2 would work?

 

[diddy81]

cant see a reason why not
it wasn't working on 4.2 for me just kicked me back to the sys menu
worked great on 3.2 after patching the wad to IOS 30

 

[bewitched]

cant see a reason why not
it wasn't working on 4.2 for me just kicked me back to the sys menu
worked great on 3.2 after patching the wad to IOS 30

Strange it loads fine now (3.2E) but i get the warning that it can not be installed, no known vulnerable IOS found, and i can only exit.

 

[wilsoff]

Strange it loads fine now (3.2E) but i get the warning that it can not be installed, no known vulnerable IOS found, and i can only exit.

Install the oldest versions of a couple of IOS that you can find on NUSD. They should have the Trucha bug in them.

 

[arasium]

Hi everybody.

I haven't any pb compiling sneek (either uneek or sneek+DI). But, if i want to create a virgin nand, i can't continue.

I mean, i see a white screen "Press A to continue", but i can't resync my wiimotes, so i can't press A

Is osmeone has an idea? Do i need to put some files from my nand dump in order to don't resync my wiimotes?

 

[User423]

Hi everybody.

I haven't any pb compiling sneek (either uneek or sneek+DI). But, if i want to create a virgin nand, i can't continue.

I mean, i see a white screen "Press A to continue", but i can't resync my wiimotes, so i can't press A

Is osmeone has an idea? Do i need to put some files from my nand dump in order to don't resync my wiimotes?

Sync your WiiMote with the Red Sync Button (press the one at the SD-Slot and the one at the batteries some seconds)

 

[fogbank]

Where did you get device.cert? Did you extract it from your Wii using GetDeviceCert or something similar?
Have you tried any of these steps on a NAND made from scratch?

The real WAD is unmodified. My real NAND has no homebrew changes at all except bootmii/boot2. The device.cert comes from a bootmii NAND backup.

I don't think you can get device.cert from a bootmii NAND backup. Last I checked you had to use a different utility to generate device.cert. Try GetDeviceCert.

I grabbed a newer Wii (LU65) out of storage, installed bootmii IOS, and repeated the HBC "fakesign" procedure with a NAND made from scratch. It worked perfectly.

 

[arasium]

Hi everybody.

I haven't any pb compiling sneek (either uneek or sneek+DI). But, if i want to create a virgin nand, i can't continue.

I mean, i see a white screen "Press A to continue", but i can't resync my wiimotes, so i can't press A

Is osmeone has an idea? Do i need to put some files from my nand dump in order to don't resync my wiimotes?

Sync your WiiMote with the Red Sync Button (press the one at the SD-Slot and the one at the batteries some seconds)

Of course i've already tried this. But this doesn't sync my wiimotes..... Can i paste the sysconf from my dump into the clean nand?

 

[bewitched]

Strange it loads fine now (3.2E) but i get the warning that it can not be installed, no known vulnerable IOS found, and i can only exit.

Install the oldest versions of a couple of IOS that you can find on NUSD. They should have the Trucha bug in them.

Thanks that did the trick, so now i have 2 methods for installing the HBC in a clean nand

 

[Cyan]

*snip*

...do you have at least one game on your HDD, as the FAQ suggests?

Yes I did.
I have games/SMNP/ with the correct file structure (I even checked few times for upper/lower case).
my HDD is working fine with Uneek, so I think it is compatible. I even tried to launch sneek+di with the drive already spinning (not started from a shut down, the drives keep spinning while using Wc24).

I set the correct files at the correct place and tested it many times too.
I made a clean nand, and updated it to 4.2E, still no luck.
I tried with another drive (USB stick), not working either.

The only thing I didn't try is reinstalling python. I never got any error while compiling, but it may be a good idea to try that.


could it be my cluster size ?
Does someone else got DI working with cluster smaller than 32k?
my hdd has 16k cluster, and my usb stick 8k.

 

[FenrirWolf]

Is your FAT32 partition the first partition on the drive?

 

[fogbank]

Finally i got the HBC to work on a clean virgin nand

5. Copied the title.tmd from my bootmii Wii nand dump (with hbc installed) to the sd > @wilsoff thanks: "It appears that each HBC installation is tied to the console it was installed to by modifying an area of the TMD" here
I believe that was my quote

QUOTE(bewitched @ Apr 7 2010, 10:30 AM) Strange it loads fine now (3.2E) but i get the warning that it can not be installed, no known vulnerable IOS found, and i can only exit.

Install the oldest versions of a couple of IOS that you can find on NUSD. They should have the Trucha bug in them.

Thanks that did the trick, so now i have 2 methods for installing the HBC in a clean nand

It's good that you got it working, but SNEEK does not require a trucha bugged IOS to install anything, and the HBC installer definitely does not either. But no matter, as long as you got it working