Hacking SNEEK v2

[noobwarrior7]

I guess at that point someone would be pretty sad and repentant.

so for future reference...there was a bug and I dont know if it ever got fixed...

...on certain wiis....with certain dumps.....

hitting the home button in the sys menu itself and asking to return to system menu..


...would result in an endless cycle of the "backmenu screen" every 7 seconds or so.
so if you get that.....it does happen.


I would mention the other bugs that were not mentioned as being attended to so you could hunt for them and try to recreate them, but the bugtracker is not accessible, and thats the only interesting one I remember, aside from it hating certain versions of preloader.

 

[SanGor]

you can add bugs here -> http://code.google.com/p/sneek/issues/list

 

[noobwarrior7]

does anyone else get a really HARD (relatively speaking) click/thump from the disc drive about 2 seconds after boot with the SNEEK sd in?.....that is not in the beta, I know cause I just went back and forth between them several times.

forgot to mention...theres a disc in it.

 

[wilsoff]

MEGA FAQ

This post is a collection of questions and answers from this thread. It's not my work, I just collated it.
Thanks go to: crediar, Det1re, giantpune, skOld, SifJar, DeadlyFoez, SanGor, pepxl, fenrirWolf, xflak40, daxtsu, cwstjdenobs, diazao, nicksasa, dabotsonline, Leathl, noobwarrior7, etc (sorry if I've missed you)

SD-FS = SecureDigital-File System
Which means your unpacked nand dump on your sd card

If you're having any issues please start with crediar's faq
http://code.google.com/p/sneek/wiki/FAQ

What files do I need and where should I put them?
sd:/bootmii/armboot.bin (on sneek googlecode)
sd:/bootmii/ppcboot.elf (the one that came with BootMii)
sd:/bootmii/bootmii.ini (autoboot enabled)
sd:/0000000e.app (from IOS60v6147 downloaded and must be decrypted (requires key.bin) with NUSDv1.3b or Leathl's NUSFileGrabber. Can be deleted once you make boot2.bin)
sd:/boot2.bin (download and unpack boot2diff.zip r9 or boot2diff.zip r16 give it 00000000e.app and run the undiff.bat. Check input and output against the hashes)
sd:/shared1/... (files from nand dump)
sd:/shared2/... (files from nand dump)
sd:/sys/... (files from nand dump)
sd:/ticket/... (files from nand dump)
sd:/title/... (files from nand dump)
Any other folders you got from your nand dump (probably empty and not needed)

Can I get boot2 and easier way?
No it's basically ninty code that is patched, hence boot2.bin contains ninty code and therefore copyright and illegal to share. Legal for you to download from NUS and use though.

Does this run under bootmii as IOS?
Yes. Install priiloader to the real NAND, set it to autoboot Bootmii as an IOS.

How do I get a nand dump and where do I put it?
Use one fo the following:
NAND FS dumped using FSToolbox
crediar's soon to be released FS dumper
FS extracted from bootmii dumps (e.g. with showmiiwads)
If you'd like to use dumps obtained with Waninkoko's FSdumper, you'll need to add what that program misses, specifically the files in /title/00000001/00000002/data/
Dumps people are using for triiforce probably wont work. sneek needs all the IOS and stuff that the simple dumper skips. it will be like turning on a wii with no IOS or system menu.

can I access apps on the SD card when running from the SD-FS?
SD support for Wii applications is currently disabled (r16), due it not working very well. This means that the SD card menu from the systemmenu is not available. It behaves as though there is no SD card present.
If you still want to give it a try simply change line 1593 (r16) in the main.c of the ES module to

CODE
*SDStatus = 1;

Note: this feature is buggy and might break the FS on your SD card, make a backup before using thise feature!! May only work with r9 and not r16.

If I can't access the SD card, how do I load apps in HBC?
Put them on a USB stick/drive in usb:\apps\appname\boot.dol
Note: not all homebrew works -> http://wiki.gbatemp.net/wiki/index.php?tit...w_Compatibility
Try CIOS 236(from TBR) that sometimes works with sneek for whatever reason.
http://wiibrew.org/wiki/Homebrew_Channel#Loading_from_USB

How do I add channels?
You can install wads to the SD-FS using showmiiwads.
Open showmiiwads and go to Options > Change NAND backup path -> Set the nand backup folder in showmiiwads to the root of your SD card
In showmiiwads go to File > Open folder -> choose the folder that contains the wad you want to install
Once the wad is listed in showmiiwads then right click on the wad and choose Extract > To NAND.
and you're done... the wad should show up next time you boot the SD-FS with SNEEK.

Btw. for those that didn't knew, you can simply drag multiple wad files onto the ShowMiiNand View to add them to the installation queue. Once you click "Install" (will appear in the status bar), it will install them all in one turn


Where can I get that special looking wadmanager I've seen in the videos?
It hasn't been released (yet).

what versions/regions of the systemmenu work?
All should work, from 1.0U to 4.2K as long as you have a valid nand dump
It can be a completely different SD-FS from the one you have installed on your real NAND
You can even upgrade your SD-FS through Ninty and the system menu
* SNEEK only works with modular IOSs (>28) if the system tries to load any IOS <= 28 it will fall back to IOS 35, so assure IOS 35 is installed.

Can I use Anyregion Changer on the SD-FS?
Use ARC to change the region (top half of ARC menu)
Then use NUSD to download a matching systemmenu wad
Then use showmiiwads to install the systemmenu wad to the SD card (PC side operation). Go Korea!

How do I switch between SD-FS and real NAND?
Turn off the wii.
Take out (or insert) the SD card. That's it.
If you want to go back to bootmii simply get armboot.bin from bootmii and put it back in sd:\bootmii\ . Or run the hackmii installer and use it to "prepare an SD card" which will do the same thing.

Is there an app that helps me swap quickly between bootmii and SNEEK?
If you've got them both set up, see BootMii Switch
There was an app released a while ago called BootMii Switch or something like that which would switch "BootMii" and "BootYou" folders on your SD card, meaning you could have BootMii as "BootYou" and SNEEK as "BootMii" and if you wish to switch, run the app.
Or just have 2 SD cards

will cios / usbloading work
Generally not.
All nintendo system IOS load correctly with patches applied.
Waninkoko's and Hermes cIOS fail.
This includes 202, so mplayer_ce is essentially broken.
It seems that every cIOScorp IOS loads fine EXCEPT 60. With a 4.1 SD-NAND and priiloader and corp IOSes, it cant even start to load the first part of IOS60. it just hangs. Putting the original IOS60 back on the nand, and tell priiloader to use 70, will boot a rockband 2 DVDr and everything works as it should. When the same DIP from corp 3.6 is added to IOS60 and installed the 4.1 SD-NAND, it works. So something about the way they used IOS70 for the IOS60 there doesn't work in sneek.
One report that uLoader and 222/223 work if installed before the nand dump was made (unconfirmed).

Why don't 222/3 &249 work?
We don't know. Crediar mentioned that SNEEK doesn't have any checks in place, so I think you're going to have to ask Waninkoko and Hermes about it when the code is public.

What if I install more than 47 channels?
Crediar added a hack to get the system menu not to bitch about the size of the channels, but you are still limited to 47 titles to display. The rest are just not shown. You can use any homebrew that loads channels on the emulated nand and you will bypass the 47 limit, e.g. triiforce, you just don't see the animation in the system menu.

When i use the ninty update function while using sneek, will this update my boot2 version in the real NAND or the SD-FS?
It won't update either instance of boot2 (at least with current updates =< 4.2).
It reports as boot2-v5 so won't be updated.
Crediar said that he implemented the boot2 update function so that it returns success but actually doesn't do anything at all.
Furthermore, once SNEEK is running, ZERO changes are made to the real NAND.

Can I use system format from the wii settings menu to format my SD-FS
Sometimes. You can always run it, but it may brick you SD-FS so have a back up. No risk to your real NAND.

can I use a nand dump from a different wii?
Yes, and without and messing about, it just works.
You may have to resync the wiiremotes
HBC may bitch that it's been hacked and nag you with the scam screen and give you the bird

if someone else uses my nand can they download the stuff I've bought
Probably, so don't give you NAND dump away easily! It's illegal.
May require device.certs (may not be required as of v2.)

Can I run a nand from USB so I can use the SD slot with SNEEK?
No. This is probably technically impossible given space restrictions and the amount ofcode required to get USB working in this way.

Wads that I download with NUSD don't work / aren't decrypted.
NUSD requires key.bin, google is your friend (and so are showmiiwads / customizemii)
And tick the decrypt box (bottom right)

I want to compile it all myself
Read page 10 of this thread onwards

my wiimote won't connect
Are you using a dump from another Wii? If so you'll need to resync them by pressing the red buttons.
If it still fails unplug your wii and take the batteries out of your wiimotes for 5 minutes. Then try again.

if I run trucha bug restorer from Sneek will it trucha bug the emulated nand or nand itself?
The emulated nand. Once sneek is running, the wii basically uses your SD card as the nand. It does not touch the real nand.

where the hell has my filesystemdump to go?
The six or seven folders need to be in the root of sd:\
E.g. sd:\shared1\...

why is this so awesome?

• You can install way more shizz. Real NAND capacity of 512 MB vs SNEEK "NAND" capacity of 16 GB (possibly 32 GB)
• Great for testing and tinkering:
  • Install and test custom themes by copying a single file to you SD card and popping it into your Wii
  • Install and test custom channels quickly and with an easy way to delete them if they're bad
  • Ultimate brick protection and rapid recovery. People say bootmii makes you "brickproof". With this, you can take it 1 step farther, not only can you recover from a brick, you can do it as easy as turning off your wii and turning it back on.
  • You can be nosey and see a lot of what your wii is really doing with a usb gecko.
  • You can test out different things before you do them to your real wii. deleting titles, patching stuff etc, see the effects before trying on a real nand
• No wear and tear on nand
• Able to change system menu version / region just by swapping sd cards, e.g. 3.2E and 4.1K - good for playing and devving
• Think about it, if you always use SNEEK at home, then all you need to do is put bannerbomb and the hackmii installer on the same SD card. Then you are able to take your Wii with you and it's the size of an SD card. You just have to find any other Wii in the world and you can make it behave as though it's your Wii in approximately 60 seconds. I'm sorry if you can't see it, but that rocks!

How do I remove preloader from my dump

1) navigate to /title/00000001/00000002/content (this is the sysmenu folder)
2) there should be a file in there called 100000xx.app (xx depends on systemmenu) this is effectively main.dol of the system menu
3) delete 000000xx.app (this is effectively preloader.dol)
4) rename 100000xx.app to 000000xx.app (swap the leading 1 for a 0)

e.g. on 3.2E
1. delete sd:/title/00000001/00000002/content/00000046.app
2. rename sd:/title/00000001/00000002/content/10000046.app to sd:/title/00000001/00000002/content/00000046.app

I updated the SD NAND and the shop channel vanished
We're not sure why this happens to some Wiis. To get it back...
Downloaded the shop channel with NUSDv1.3 and install it to SD-NAND with showmiiwads. Now it should show in the menu.

where can I report bugs?
you can add bugs here -> http://code.google.com/p/sneek/issues/list

how do I install custom systemmenus (themes) onto the SD-FS>
Simply replace sd:/title/00000001/00000002/content/000000xx.app with your .csm file:
You can figure out the actual file name of 000000xx.app here:

CODE
Version/Region NTSC-U NTSC-J PAL (E) Korea

3.2 00000042.app 00000040.app 00000045.app ?
4.0 00000072.app 00000070.app 00000075.app ?
4.1 0000007b.app 00000078.app 0000007e.app ?
4.2 00000087.app 00000084.app 0000008a.app ?

source: Complete Softmod Guide
Your CSM file will have to match the version and region of the system menu installed on your SD-NAND

what's the smallest NAND possible?
http://code.google.com/p/wii-fsck/wiki/EssentialFiles
For a SNEEK NAND you can make it even smaller. You need the following and nothing more:
1. Systemmenu, e.g. v290 is 3.2E (get from NUSD)
2. Systemmenu IOS (non-STUB) (must be the one required by 1 above, e.g. IOS30 for 3.2) (get from NUSD)
3. setting.txt (placed in SD:/title/00000001/00000002/data/setting.txt) (must match region of systemmenu) (get from a NAND dump)
NOTE: with this set up it:
WILL give you a black screen for up to five minutes before it goes to first time set up.
WILL give you a black screen for up to five minutes between the health screen and showing you the system menu.
This is for the first time only. After that it will be fast.



Why is it slow?
It's not if you get it set up right.
Get a fast/good quality sd card, sd or sdhc
Format it first to eliminate fragmentation issues
Try to use a nand dump without preloader (it seems to slow the boot process)
Performance is also related to the NAND Dump you use (setup and size)
It should speed up if you remove the debug code (thanks giantpune):

Spoiler

CODE
From: http://pastie.org/804570

oops. looks like i mixed up the vsprintf and string files then. it should all overwrite existing code. the only differences are the lines starting with #

/////////////
vsprintf.c
////////////

#ifdef DEBUG
static char ascii(char s) {
if(s < 0x20) return '.';
if(s > 0x7E) return '.';
return s;
}
#endif

void hexdump(void *d, int len)
{
#ifdef DEBUG
u8 *data;
int i, off;
data = (u8*)d;
for (off=0; off<len; off += 16)
{
dbgprintf("%08x ",off);
for(i=0; i<16; i++)
if((i+off)>=len)
dbgprintf(" ");
else
dbgprintf("%02x ",data[off+i]);

dbgprintf(" ");
for(i=0; i<16; i++)
if((i+off)>=len) dbgprintf(" ");
else dbgprintf("%c",ascii(data[off+i]));
dbgprintf("\n");
}
#endif
}


/////////////////
string.c
//////////////////

#ifdef DEBUG
int dbgprintf( const char *fmt, ...)
{

if ( (*(vu32*)(HW_EXICTRL) & 1) == 0)
return 0;

va_list args;

char *buffer = (char*)heap_alloc_aligned( 0, 2048, 32 );

va_start(args, fmt);
vsprintf(buffer, fmt, args);
va_end(args);

GeckoSendBuffer( buffer );

heap_free( 0, buffer );

return 1;
}
#endif


///////////////////////////
global.h
//////////////////////////

//#define DEBUG 1
#define false 0
#define true 1

#define SHARED_PTR ((void *)0x13600000)
#define SHARED_SIZE (0x18000)

#ifdef DEBUG
int dbgprintf( const char *fmt, ...);
#else
#define dbgprintf(...)
#endif
#define debug_printf dbgprintf

//////////////////////////

How do I make the latest version work with USB Loader?
Start reading here: http://gbatemp.net/index.php?showtopic=205...t&p=2651163

Can I install HBC natively?
Some people can/could with this, but it's unreliable:

http://gbatemp.net/topic/205511-sneek-v2/page__view__findpost__p__2582962

 

[noobwarrior7]

for the why is this so awesome:
-make your Wii's contents totally PORTABLE to anyone else with a working BootMii install, as all signature checks and permissions checks are disabled once the app loads from bootmii
-IF you installed BootMii, never actually made a NAND backup (not realizing this was a step for safety), bricked your Wii, and have been stuck only able to boot BootMii, you can now use a nand dump from any other Wii to restore life to yours.

Posts merged

im gonna re-test all of the usb stuff right now...back in a jiff.

update: so I found that while I could get the beta to work with a uloader 3.0c channel...this does not load very much of anything that I have tried thus far...but I havent tried a channel...I would encourage anyone who has a usbloader channel particularly uloader, and usb cios installed, to make a dump and try their channel...

however, I can confirm that the priiloader installer code dumps during install.

 

[crwys]

Nice FAQ wilsoff, I am going to try this sometime today, hopefully.

 

[daxtsu]

Well I tried using a dump with 222/223 installed BEFOREhand, and I still can't get uloader to work. :/

It just freezes with a black screen.

 

[longtom1]

@wilsoff or Det1re,

Can you make a list of home brew app compatibility from what we all experience and compile it together.

Sorry, I don't mean to sound like adding more work for you, but you guys are the most informative people here so far and we know to look at the first post for all basic info.

I tried wiixplorer from usb and it just black screened
TriiforceMRCv7 loaded but then crashed
dop-ios modv11 loaded to IOS selection screen and then crashed when selecting IOS
Neogamma black screened HBC and full install channel

Just made a new dump with ios236 and going to try that with different apps

 

[daxtsu]

dop ios mod(10.1) works fine for me. Triiforce freezes(no CIOS 249 working), WiiXplorer black screens.

 

[wilsoff]

@wilsoff or Det1re,

Can you make a list of home brew app compatibility from what we all experience and compile it together.

Sorry, I don't mean to sound like adding more work for you, but you guys are the most informative people here so far and we know to look at the first post for all basic info.

Done, please can everyone contiute to this wiki?
http://wiki.gbatemp.net/wiki/index.php?tit...w_Compatibility

 

[diazao]

@wilsoff, nice post

I just can't get the point, I made a dump with all of this installed: cIOS38 rev17, cIOS 222/223, 236 (TBR)
And all i got was black screens... I rly didn't understand the point of installing the "36" to 236 with TBR, should I load the emulated menu with the 236 IOS (Priiloader) ? :S

 

[wilsoff]

@wilsoff, nice post

I just can't get the point, I made a dump with all of this installed: cIOS38 rev17, cIOS 222/223, 236 (TBR)
And all i got was black screens... I rly didn't understand the point of installing the "36" to 236 with TBR, should I load the emulated menu with the 236 IOS (Priiloader) ? :S

Not all of the wording is mine. I left bits of it in the first person because I was too lazy to reword it. Unfortunately I don't have the answers, and please accept there are almost certainly inaccuracies in there, but hopefully it's a good summary of the last 26 pages.

Hopefully whoever wrote that originally will recognise it and respond.

 

[T-Error]

does anybody know why the shop-channel disappears when I update from 4.1 to 4.2? I tried it again this time from an official 4.1.

 

[longtom1]

does anybody know why the shop-channel disappears when I update from 4.1 to 4.2? I tried it again this time from an official 4.1.

Worked for me had shop channel on 4.0e updated got some error at the end but checked settings and said 4.2e shop still worked tried it

 

[T-Error]

no errors for me. and 4.2e in the settings but the shop is gone. and I also never had preloader installed. only cIOS249,222,223,202.

 

[wilsoff]

no errors for me. and 4.2e in the settings but the shop is gone. and I also never had preloader installed. only cIOS249,222,223,202.

Same for me. Let's try to spot a pattern / commonalities. Some facts aout my case:
1. I was using someone elses nand dump
2. going from 4.0U to 4.2U by ninty systemmenu update
3. nand dump made with bootmii and extracted with showmiiwads
4. dumped nand came from a December 2009 wii which came with 4.0U
5. nand dump was made almost immediately after purchase, with just HBC, DVDX and Bootmii IOS installed. no other changes/updates were made

 

[T-Error]

no errors for me. and 4.2e in the settings but the shop is gone. and I also never had preloader installed. only cIOS249,222,223,202.

Same for me. Let's try to spot a pattern / commonalities. Some facts aout my case:
1. I was using someone elses nand dump
2. going from 4.0U to 4.2U by ninty systemmenu update
3. nand dump made with bootmii and extracted with showmiiwads
4. dumped nand came from a December 2009 wii which came with 4.0U
5. nand dump was made almost immediately after purchase, with just HBC, DVDX and Bootmii IOS installed. no other changes/updates were made

It was my NAND dumped today with FS-Toolbox. It had 4.1e through WANINKOKOS update. This was my first attempt which endet with no shop. Then i tried it again this time using wii sports resort to get an ofiicial 4.1. successful with remaining shop. Then an update via menu and bam shop gone.
Does anybody know how the shop-channel is called in the dump/which folder?

EDIT: found it, its 48414141.tik in 00010002/48414241 . and showmiiwads doesnt show the shopchannel either. but the files are the same on both dumps. I dont get it. ^^

EDIT 2: not the same files in title/00010002/48414241/content 5 new 2 gone

EDIT 3: replaced the folder title/00010002/48414241/ with the old one and the shop came back, but it is not working it asks me to update, trying to get the newest shop via NUS-downloader now.

 

[SanGor]

crediar added his fsdumper http://code.google.com/p/sneek/downloads/list

 

[Krestent]

SNEEK isn't working for me. I have a bootmii/boot2+IOS wii. My NAND Dump is that of a 3.2E Wii. THe actual NAND has 4.0U. I used elfins to insert the ES+FS modules into 00000003.app and used Boot2Me to make it boot2.bin.

If I have the SNEEKed SD card inserted at startup, the Wii just blank screens me. If I load Bootmii/IOS, I get a black screen and the DVD drive LED flashes slowly. Have I done something wrong?

 

[longtom1]

SNEEK isn't working for me. I have a bootmii/boot2+IOS wii. My NAND Dump is that of a 3.2E Wii. THe actual NAND has 4.0U. I used elfins to insert the ES+FS modules into 00000003.app and used Boot2Me to make it boot2.bin.

If I have the SNEEKed SD card inserted at startup, the Wii just blank screens me. If I load Bootmii/IOS, I get a black screen and the DVD drive LED flashes slowly. Have I done something wrong?

happened to me forgot to leave a copy of ppcboot.elf in sneekbootmii folder