Tmbinc says: "Wii hacked it!"

Status
Not open for further replies.

Railgun

( ' _ ' )
OP
Member
Joined
Feb 20, 2006
Messages
326
Trophies
0
Location
GBAtemp City
XP
307
Country
Gambia, The
QUOTE said:
Tmbinc has detailed his exploits in hacking the Wii to run unsigned code on the Debugmo blog...

http://debugmo.de/?p=59

Summary...
Quote:
QUOTE said:
* First thing which ever executes on the Wii is the “boot0? code, which is probably stored inside the hollywood in a mask rom.
* boot0 loads the first 0×2F pages (”boot1?) from flash, decrypts them with a fixed aes key, calculates a SHA-1 hash (with some obscure bugs specialities, I still couldn’t calculate it by hand), and checks that versus the expected values, read from some internal memory.
* If the hash bytes in the “internal memory” is all-zero, the hash check is skipped. This is probably used for production, and maybe for devkits.
* boot1 then searches a certain header in flash, where it extracts specific information where to find boot2.
* At that position, some certificate chain is checked, and finally the boot2 “tmd” is verified, and the hash extracted.
* The boot2 payload is load from flash, decrypted, and hash-checked (against the hash from the boot2 tmd).
* boot2 will then load the firmware, or whatever. That’s not my region of interest at the moment.

SOURCE

Wow, the homebrew is coming soon i think
smile.gif
 
Status
Not open for further replies.

You may also like...

General chit-chat
Help Users
  • No one is chatting at the moment.
  • Shape @ Shape:
    Neither do the mechs of mech warrior 2. Much better game.
  • K3N1 @ K3N1:
    People would say different if cod Gundam was a thing
    +1
  • Shape @ Shape:
    Omg do you know how much money I would spend if that was a thing? Especially if you get to assemble the gundams somewhat like those old model toy kits. The answer is zero dollars. I would spend zero dollars. It would still be so good, though.
  • K3N1 @ K3N1:
    Liar
    +1
  • Shape @ Shape:
    $118.49
  • x65943 @ x65943:
    I bought 1-2 switch, imagine my pain
    +2
  • x65943 @ x65943:
    for full price at launch
    +2
  • Shape @ Shape:
    Full price at launch for full exploitability without modchips. Or so I hear.
    +1
  • K3N1 @ K3N1:
    You should like buy a 3rd one and ship it to my address
  • x65943 @ x65943:
    No no lads, the game called 1-2 switch
    +1
  • x65943 @ x65943:
    Where you feel the controller vibrate and guess how many virtual ice cubes are inside of it
    +2
  • K3N1 @ K3N1:
    You should still buy me a switch so I don't have to pay for it
  • The Real Jdbye @ The Real Jdbye:
    best game on the switch amirite
  • The Real Jdbye @ The Real Jdbye:
    i just saw a video yesterday that mentioned how it's a good thing 1-2-switch wasn't a pack in title because it would've made everyone lose faith in the switch immediately and they might have a point
    +1
  • Sonic Angel Knight @ Sonic Angel Knight:
    It was this one, The "video" Jdbye watched this one. :P
  • K3N1 @ K3N1:
    What no The Real video Jdbye?
  • M4x1mumReZ @ M4x1mumReZ:
    @Shape, Quake is great.
    +1
  • Sonic Angel Knight @ Sonic Angel Knight:
    QUAKER OATS! :P
    +1
  • K3N1 @ K3N1:
    Remember to eat your oats
    +1
  • Shape @ Shape:
    I prefer to nuke my oats. At quake.
    +1
  • M4x1mumReZ @ M4x1mumReZ:
    @K3N1, Remember to also eat your greens.
    M4x1mumReZ @ M4x1mumReZ: @K3N1, Remember to also eat your greens.