Hacking What are title.cert, title.tmd and title.tik files?

Kate0012

Active Member
OP
Newcomer
Joined
Dec 31, 2017
Messages
43
Trophies
0
XP
217
Country
Canada
So far I only have "some" knowledge about the .tik file....and I have no idea what .cert and .tmd files are, or what roles they play.

If anyone can provide me with some explanation that would be greatly appreciated.
 

Stalls

Well-Known Member
Member
Joined
Oct 10, 2015
Messages
138
Trophies
0
XP
216
Country
United States
I'm guessing the .cert file is a certificate of some sort (correct me if I'm wrong), but i know the .tik file is the ticket which proves that you own the game.
 

GerbilSoft

Well-Known Member
Member
Joined
Mar 8, 2012
Messages
2,380
Trophies
1
Age
33
XP
3,985
Country
United States
I'm not too familiar with the changes in the Wii U files, but for Wii:
  • Ticket: Contains the title ID, console ID (for downloaded titles), and encrypted title key.
  • TMD, aka Title Metadata: Contains the required IOS version and SHA-1 hashes of all of the title's contents.
  • Certificate chain: Contains the certificates for the ticket and TMD signers, as well as the certificate authority.
Ticket and title metadata are all signed by Nintendo using the certificates listed in the certificate chain. Those certificates are also signed by Nintendo. (Note that the certificate chain only contains public keys, so they can only be used to verify signatures, not to create new ones.)
 
Last edited by GerbilSoft, , Reason: fix link

Kate0012

Active Member
OP
Newcomer
Joined
Dec 31, 2017
Messages
43
Trophies
0
XP
217
Country
Canada
I'm not too familiar with the changes in the Wii U files, but for Wii:
  • Ticket: Contains the title ID, console ID (for downloaded titles), and encrypted title key.
  • TMD, aka Title Metadata: Contains the required IOS version and SHA-1 hashes of all of the title's contents.
  • Certificate chain: Contains the certificates for the ticket and TMD signers, as well as the certificate authority.
Ticket and title metadata are all signed by Nintendo using the certificates listed in the certificate chain. Those certificates are also signed by Nintendo. (Note that the certificate chain only contains public keys, so they can only be used to verify signatures, not to create new ones.)

Actually, I just noticed that these are from the "Wii homebrew" page. Are they applicable to Wii U?
 

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,658
Trophies
2
Age
44
Location
Engine room, learning
XP
15,230
Country
France
yes, WiiU ticket/tmd files have a little different structure but have the same function and work the same way.

if you need the wiiu structures, I think they are available on wiiubrew.org too

maybe this can help you ?
https://gbatemp.net/posts/6011039
my file contains both wii and wiiu tmd structure (might be incomplete though, I added only what I needed)
I should have the one for ticket file if you need.
 
Last edited by Cyan,

huma_dawii

Well-Known Member
Member
Joined
Apr 3, 2014
Messages
3,855
Trophies
1
Age
31
Location
Planet Earth
XP
3,851
Country
United States
Can I install a game I own via eShop by extracting the title.tik from my console and then grabbing some USB ready files from the internet and replace the fake ticket with my legit ticket and it will install with no problems? (This is more like for having an offline backup of my LEGIT games, is that posible?)
 

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,658
Trophies
2
Age
44
Location
Engine room, learning
XP
15,230
Country
France
yes you can do that. you can use tik2sd to get your tickets.
attention : some ticket files contain more than one game's ticket. sometime a tik file can contain a game+dlc too (like zelda).
there are tools to split multi tickets into individual tik files. you can look on wikitemp >wiiu apps to get a link to existing apps, or use an hexeditor.


your ticket will contain your ConsoleID, so you can reinstall it only on your console.
if you want to use your extracted ticket to install on another console*, you'll have to delete the ConsoleID (to make it look like it's a disc ticket not tied to any console). I'm not sure it's enough to make it work. You'll of course require a CFW to use this edited ticket as its signature will mismatch.
* for example your console is bricked, you buy a new one, your backups are useless.

Instead of "finding" usb ready games from the internet, you can re-download them from NUS using JNUSTool (command line for games, the GUI is for game updates only), or other NUS downloaders.
getting encrypted files + your own ticket will make legit game backup for your console.
Attention : sometime, files from NUS are corrupted. usbhelper used to check the downloaded files, most (all?) other NUS downloaders are not checking them. you can't be sure your NUS files are proper backups without trying installing them with WUP installer.

like explained by Gerbilsoft, the tmd contains all Sha1 of the content, but it's sha1 of decrypted files, not encrypted .app files. so it requires decryption and file extraction to check integrity. I don't know if a tool added a check function other than usbhelper.
 
Last edited by Cyan,

huma_dawii

Well-Known Member
Member
Joined
Apr 3, 2014
Messages
3,855
Trophies
1
Age
31
Location
Planet Earth
XP
3,851
Country
United States
yes you can do that. you can use tik2sd to get your tickets.
attention : some ticket files contain more than one game's ticket. sometime a tik file can contain a game+dlc too (like zelda).
there are tools to split multi tickets into individual tik files. you can look on wikitemp >wiiu apps to get a link to existing apps, or use an hexeditor.


your ticket will contain your ConsoleID, so you can reinstall it only on your console.
if you want to use your extracted ticket to install on another console*, you'll have to delete the ConsoleID (to make it look like it's a disc ticket not tied to any console). I'm not sure it's enough to make it work. You'll of course require a CFW to use this edited ticket as its signature will mismatch.
* for example your console is bricked, you buy a new one, your backups are useless.

Instead of "finding" usb ready games from the internet, you can re-download them from NUS using JNUSTool (command line for games, the GUI is for game updates only), or other NUS downloaders.
getting encrypted files + your own ticket will make legit game backup for your console.
Attention : sometime, files from NUS are corrupted. usbhelper used to check the downloaded files, most (all?) other NUS downloaders are not checking them. you can't be sure your NUS files are proper backups without trying installing them with WUP installer.

like explained by Gerbilsoft, the tmd contains all Sha1 of the content, but it's sha1 of decrypted files, not encrypted .app files. so it requires decryption and file extraction to check integrity. I don't know if a tool added a check function other than usbhelper.

I tried to do that but my backup failed to install right at the end! :(
 

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,658
Trophies
2
Age
44
Location
Engine room, learning
XP
15,230
Country
France
at the end?
which error code or error message did you get?

I suppose if it was a ticket error it would have not installed from the start.
It can be a file corruption. are you sure your .app files are good and complete? (it's usually the message you get from installers : verify your files are good and complete).
if you have this message, it's what I meant with tools not checking the downloads, only USBHelper does. to know your encrypted files are good and complete you need to install them on the console and see if you get an error or not.
 

MrBerzerk

Member
Newcomer
Joined
Dec 5, 2019
Messages
9
Trophies
0
Age
42
XP
47
Country
Canada
yes you can do that. you can use tik2sd to get your tickets.
attention : some ticket files contain more than one game's ticket. sometime a tik file can contain a game+dlc too (like zelda).
there are tools to split multi tickets into individual tik files. you can look on wikitemp >wiiu apps to get a link to existing apps, or use an hexeditor.


your ticket will contain your ConsoleID, so you can reinstall it only on your console.
if you want to use your extracted ticket to install on another console*, you'll have to delete the ConsoleID (to make it look like it's a disc ticket not tied to any console). I'm not sure it's enough to make it work. You'll of course require a CFW to use this edited ticket as its signature will mismatch.
* for example your console is bricked, you buy a new one, your backups are useless.

Instead of "finding" usb ready games from the internet, you can re-download them from NUS using JNUSTool (command line for games, the GUI is for game updates only), or other NUS downloaders.
getting encrypted files + your own ticket will make legit game backup for your console.
Attention : sometime, files from NUS are corrupted. usbhelper used to check the downloaded files, most (all?) other NUS downloaders are not checking them. you can't be sure your NUS files are proper backups without trying installing them with WUP installer.

like explained by Gerbilsoft, the tmd contains all Sha1 of the content, but it's sha1 of decrypted files, not encrypted .app files. so it requires decryption and file extraction to check integrity. I don't know if a tool added a check function other than usbhelper.

Hey Cyan,
I've spent a week trying to understand how to legit backup my MANY digital games in case my console fries.
Please correct me if I've got this process wrong.
1. Get a copy of my legit digital game with a NUS downloader like USBHelper
2. Use tik2sd to get all my tik files off of my console.
3. Overwrite the .tik file in the NUS downloaded game with my extracted tik file.
4. Use WUP installer to put back on console.
5. If console is fried, remove console ID from tik, and put on new console with WUP installer.
6. Will have to use CFW on new console, because crt mismatch. (Any way of fixing that, or have I done all I can do?)
 

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,658
Trophies
2
Age
44
Location
Engine room, learning
XP
15,230
Country
France
I'm also rusty on WiiU hacking :P
it's all from memory, I didn't do anything for few years.
I might tell wrong things too.



Up to step2, it's fine. Step 3 might be wrong.

If you get a non-free game from NUS, it'll not have a ticket (no tik file), so no tik to overwrite.
There are free content on NUS with "ALL" consoleID in the provided ticket, for example demos, or some DLC like zelda or mario kart free car, etc.


I don't remember if Tik2SD actually extracts tickets (it should based on the tool's name, right?), or only generate a list.
But in both cases, you should note that some ".tik" file located on your console can store multiple tickets in one file !
You'll have to use another tool to extract them individually to match all your Titles individually (if you want to put them along the WUP installable file format)


I don't remember if step5 is required or not.
CFW will bypass signature check, but I don't remember if it also bypass ConsoleIDs.
if that's an issue, then just replace the consoleID with zeros (meaning not tied to any ConsoleID, working on all console).
The Signature won't match anymore due to edited ticket, but you can use CFW to install/launch them.
 

MrBerzerk

Member
Newcomer
Joined
Dec 5, 2019
Messages
9
Trophies
0
Age
42
XP
47
Country
Canada
I'm also rusty on WiiU hacking :P
it's all from memory, I didn't do anything for few years.
I might tell wrong things too.



Up to step2, it's fine. Step 3 might be wrong.

If you get a non-free game from NUS, it'll not have a ticket (no tik file), so no tik to overwrite.
There are free content on NUS with "ALL" consoleID in the provided ticket, for example demos, or some DLC like zelda or mario kart free car, etc.


I don't remember if Tik2SD actually extracts tickets (it should based on the tool's name, right?), or only generate a list.
But in both cases, you should note that some ".tik" file located on your console can store multiple tickets in one file !
You'll have to use another tool to extract them individually to match all your Titles individually (if you want to put them along the WUP installable file format)


I don't remember if step5 is required or not.
CFW will bypass signature check, but I don't remember if it also bypass ConsoleIDs.
if that's an issue, then just replace the consoleID with zeros (meaning not tied to any ConsoleID, working on all console).
The Signature won't match anymore due to edited ticket, but you can use CFW to install/launch them.

Thanks for replying to this old thread. :)
I've found that if I use the sig patch, everything works without any modifications. Literally everything. The thing is it is kind of a drag having to hotboot the sig patch every time I have to start the console. Maybe someday, as the Wii U comes to a real EOL, someone will come out with a shutoff/verifyer for the sig/tik verification process like with the Wii Shop.
Until then, I guess I'm stuck having to use cfw on my legit digital games. (If my original system ever dies.)
 

godreborn

Welcome to the Machine
Member
Joined
Oct 10, 2009
Messages
31,783
Trophies
2
XP
21,150
Country
United States
@Cyan , you're right tik2sd does extract tickets as well as provide a list. it even extracts the disc ticket if a disc is in the drive. that ticket is located in a separate folder, which name escapes me.

edit: okay, the disc ticket is located in a folder named "odd."
 
  • Like
Reactions: Cyan and MrBerzerk
General chit-chat
Help Users
    KenniesNewName @ KenniesNewName: Ok just because you said so