Hacking Twilight Hack workaround for 4.0

[nutzo]

While trying to rescue a bricked (boot hang) Wii (3.4) that never had the homebrew channel installed, I figured out a way to install the twilight hack WITHOUT using the Wii menu.

Since this method doesn't use the Wii menu, it should also work under 4.0.
However, I don't currently have a Wii running unmodified 4.0 to test on.
Any one want to try this?

This method requires a mod chip, so it won't work for everyone.


Requirements
Mod chip installed on 4.0 Wii
Backup disk 1.3 (goggle it)
Copy of Zelda, modified to autoboot using bootme
SaveMii or SaveMiiFrii (to boot into recovery mode)
SD Card.

Access to Wii with a mod chip running 3.4 or earlier.


1. Copy the Twilight hack save file to 3.X Wii internal memory
2. Insert the Backup 1.3 disk in the drive
3. Exit to the Wii menu and power down the Wii
4. Boot the Wii into recovery mode, the Wii will automatically boot the Backup disk.
If you boot to the Wii menu instead of recovery mode you will need to start again with step 1
5. From the Backup disk menu, choose backup one.
6. Find and select the file that contains the save with the twilight hack (RZDE for the USA)
7. You now have the Twilight hack saved to the SD card in a format readable by the Backup disk.


8. Put the Homebrew install (or other boot.dol file you want to run) into the root of the SD card.
8. Insert the SD card and the Backup disk into the 4.0 Wii
9. Boot the Wii into recovery mode
10. Choose restore and select the saved twilight hack file from the SD card
11. Eject the Backup disk, and insert your autoboot version of Zelda.
This step is the key, since if you boot to the menu, you will need to restart again at step 8
12. Press the power button until the Wii powers off (4-5 seconds)
13. Boot the Wii in recovery mode, Zelda will boot automatically after several seconds.
14. Load the game save, walk backwards and the boot.dol in the root of your SD card should be loaded.

 

[wchill]

Not everyone has 2 Wiis with modchips.
So, while it makes sense, it's also not very practical.
Good guide though.

 

[nutzo]

Actually someone could upload and make the file from the 3.x wii available, then you wouldn't need the 1st Wii.

I can't do it at this time, because the Wii I got the file off of isn't mine, and I'm not sure if there is anything in the file that could tie it back to the source Wii

 

[wchill]

Yeah, but I still have to say that a lot of people on 4.0 don't have modchips.
So it's still kinda useless for them :/

 

[Tigran]

If this works.. It will be a life saver.

 

[pspmte]

Found this ages ago check mine and Fellaw thread on unbricking

You cant boot recovery menu on 4.0


Ios16 is blocked

 

[ether2802]

and I don't think is going to work for 4.0 cause the Twilight Hack beta1 is for 3.0 - 3.3 and the beta2 is for 3.4 only, if this is any posible, you'll need a new Twilight hack that has the access key in SysMenu 4.0....!!

 

[wchill]

Yeah, but he's trying to avoid the system menu altogether.
That's why we need the gayfish disc and an autoboot Zelda; it's so that the System Menu doesn't delete the Twilight Hack save.

 

[jt1394]

pspmte, I can't seem to find that thread, could you link it?

Are you sure that 4.0 can't boot pinkfish at all? It would seem that they would still need to use a repair disc, so unless they created a new version I would expect it to still boot.

Also, IOS16 wasn't exactly blocked, its slot was filled. My impression, which very well could be wrong, was that the slot was filled with a truncha fixed version. If that is the case and it is a full IOS version, just fixed, I would still expect pinkfish to boot as it is validly signed.

All of this is speculation, though, I don't have a pinkfish disc or system menu 4.0.

 

[wchill]

If you're using an unmodified gayfish disc, then it'll have a vaild, non-trucha signature.
So, it should boot.
I'm not too sure on the recovery menu though.

 

[pspmte]

The loader exploit Zelda hack used is blocked it would never work if you could get the save on there

Our only way into this is WADs install homebrew as a wad with a new exploit and i cant help thinking Wanko is really trying to tell us somthing with his new app?

We had idea of using the .rkb file the recovery menu makes, but then the menu is blocked due to 4.o ios 16 lock

 

[wchill]

No, the Wii SysMenu is completely bypassed in this. The SysMenu does the actual deleting, but if it doesn't run, it can't delete the save, can it?
AFAIK, the Wii Menu doesn't let you copy the save over at all, that's all.

 

[FenrirWolf]

I think he's talking about the exploit that allows the HBC to be installed, not the one that allows the TP Hack to be copied to the Wii. They're two different things.

 

[wchill]

While trying to rescue a bricked (boot hang) Wii (3.4) that never had the homebrew channel installed, I figured out a way to install the twilight hack WITHOUT using the Wii menu.

Since this method doesn't use the Wii menu, it should also work under 4.0.
However, I don't currently have a Wii running unmodified 4.0 to test on.
Any one want to try this?

This method requires a mod chip, so it won't work for everyone.


Requirements
Mod chip installed on 4.0 Wii
Backup disk 1.3 (goggle it)
Copy of Zelda, modified to autoboot using bootme
SaveMii or SaveMiiFrii (to boot into recovery mode)
SD Card.

Access to Wii with a mod chip running 3.4 or earlier.


1. Copy the Twilight hack save file to 3.X Wii internal memory
2. Insert the Backup 1.3 disk in the drive
3. Exit to the Wii menu and power down the Wii
4. Boot the Wii into recovery mode, the Wii will automatically boot the Backup disk.
If you boot to the Wii menu instead of recovery mode you will need to start again with step 1
5. From the Backup disk menu, choose backup one.
6. Find and select the file that contains the save with the twilight hack (RZDE for the USA)
7. You now have the Twilight hack saved to the SD card in a format readable by the Backup disk.


8. Put the Homebrew install (or other boot.dol file you want to run) into the root of the SD card.
8. Insert the SD card and the Backup disk into the 4.0 Wii
9. Boot the Wii into recovery mode
10. Choose restore and select the saved twilight hack file from the SD card
11. Eject the Backup disk, and insert your autoboot version of Zelda.
This step is the key, since if you boot to the menu, you will need to restart again at step 8
12. Press the power button until the Wii powers off (4-5 seconds)
13. Boot the Wii in recovery mode, Zelda will boot automatically after several seconds.
14. Load the game save, walk backwards and the boot.dol in the root of your SD card should be loaded.

Looks like the TP Hack to me.
The TP Hack lets you install the HBC, so yeah.

 

[pspmte]

Tried every combination possible: Both regions, with every IOS coming with 4.0, on Wank's and official version. Same symptoms like in 3.3: Disc just spins up and keeps spinning. I even deleted new IOS16, to make sure it uses the CD's version.

Guess Nintendo created themselves a newer version of Pink Fish for internal usage and disabled the leaked one. If the new one won't get leaked, no chance to recover any backups made before 4.0.

Bottom line for Anti-brick measures Fellaw

 

[FenrirWolf]

Also, let's say that this does manage to load the TP Hack but can't install the HBC because the installer is blocked. Perhaps this method could be used to install cIOS and then perform a downgrade.

 

[jt1394]

The Twilight hack install was actually two vulerabilities. The first allowed you to boot homebrew code, the second allowed for the install of the homebrew channel. Both of those exploits were fixed in 4.0. Even if we get the twilight hack back into memory, we still can't install HBC yet.


If/when bannerbomb comes out this whole thread is a moot point, though. If it isn't released soon, this could be the first step in getting HBC running again assuming there is another sufficient exploit to install homebrew within zelda's IOS. Of that, I am completely unqualified to even speculate.

 

[wchill]

Well, in the future the HBC will be able to install on 4.0, so this thread isn't completely pointless.
And cIOS + downgrade could work, but it'd be too damn confusing for most.

 

[FenrirWolf]

On second thought, maybe it wouldn't be able to install cIOS either. But it probably could do the DVDX downgrade trick.

 

[wchill]

DVDX doesn't work either.
DVDX and HBC apparently use the same exploit or something.
We'll have to wait for a new HBC, I'm afraid.