Hacking Why Zelda?

[WiiCrazy]

http://log.hackmii.com/?d=8&m=8&y=2008

It's said that zelda has debug symbols on the disc, that makes debugging easier... It's a good reason to choose zelda...

Now with today's accomplishments it's whole a lot easy to create a save exploit... one with a debugging device like usbgecko with necessary skills can create a similar hack maybe even using the tweezers original chainloader without much hassle...

But today, it's just totally unnecessary, just buy or rent the zelda...

 

[WiiPower]

http://log.hackmii.com/?d=8&m=8&y=2008

It's said that zelda has debug symbols on the disc, that makes debugging easier... It's a good reason to choose zelda...

Now with today's accomplishments it's whole a lot easy to create a save exploit... one with a debugging device like usbgecko with necessary skills can create a similar hack maybe even using the tweezers original chainloader without much hassle...

But today, it's just totally unnecessary, just buy or rent the zelda...

Does the usbgecko work without Gecko OS?

 

[WiiCrazy]

Guess you can use it... homebrew channel uses it... usbgecko is not much different from a gamecube controller attached to the wii, if you send the correct data to it, it will just transfer that through usb...

But if you are talking about hooking the game, of course you should use gecko os... but if you are exploitting the game through save the first step is actually hooking the game... which of course you can simplify by simulating the hook with gecko os patches instead of everytime getting the modified save into the wii...

 

[WiiPower]

That's what i thought. Without the twilight hack you weren't able to debug wii games, that's why they used the gamecube version of zelda.

 

[cracker]

1. As mentioned before it was an upgraded version of the GC version so it possibly had the same exploitable code in it

It's not an upgraded version, both versions were developed as one game with only 2 differences: the controls and they are mirror inverted.


I would consider the controls an upgrade...

QUOTE(WiiCrazy @ Dec 28 2008, 01:35 PM)

http://log.hackmii.com/?d=8&m=8&y=2008

It's said that zelda has debug symbols on the disc, that makes debugging easier... It's a good reason to choose zelda...

Now with today's accomplishments it's whole a lot easy to create a save exploit... one with a debugging device like usbgecko with necessary skills can create a similar hack maybe even using the tweezers original chainloader without much hassle...

But today, it's just totally unnecessary, just buy or rent the zelda...

Does the usbgecko work without Gecko OS?

Yes but you can't remotely debug without using Gecko OS to hook and boot the game with WiiRD.

 

[kytran]

lolol i borrowed the game from a guy at work, and still have it.. almost 2 years.. guess he was happy cause i set him up with gamma as well , why need the disc

 

[WiiCrazy]

That's what i thought. Without the twilight hack you weren't able to debug wii games, that's why they used the gamecube version of zelda.

I posted a reply to this but it seems it ended up in /dev/null ...

so basically it can't be gamecube disc that they worked on since gamecube has limited hardware and the actual hack would be running in wii mode...

also they had previously the means of running unsigned code through trucha signed discs with modchip...

and finally, getting unsigned code running on the wii is not enough to produce the actual hack... the harder thing is to code something that loads something else and do stuff which actually needs the debugging...

 

[WiiPower]

That's what i thought. Without the twilight hack you weren't able to debug wii games, that's why they used the gamecube version of zelda.

I posted a reply to this but it seems it ended up in /dev/null ...

so basically it can't be gamecube disc that they worked on since gamecube has limited hardware and the actual hack would be running in wii mode...

also they had previously the means of running unsigned code through trucha signed discs with modchip...

and finally, getting unsigned code running on the wii is not enough to produce the actual hack... the harder thing is to code something that loads something else and do stuff which actually needs the debugging...

They debugged the gamecube game, found the exploit, and then they figured somehow out, how to use this overflow on wii hardware. This is still difficult, but with the debugging of the gamecube version they knew where to look.

 

[raulpica]

That's what i thought. Without the twilight hack you weren't able to debug wii games, that's why they used the gamecube version of zelda.

I posted a reply to this but it seems it ended up in /dev/null ...

so basically it can't be gamecube disc that they worked on since gamecube has limited hardware and the actual hack would be running in wii mode...

also they had previously the means of running unsigned code through trucha signed discs with modchip...

and finally, getting unsigned code running on the wii is not enough to produce the actual hack... the harder thing is to code something that loads something else and do stuff which actually needs the debugging...

They debugged the gamecube game, found the exploit, and then they figured somehow out, how to use this overflow on wii hardware. This is still difficult, but with the debugging of the gamecube version they knew where to look.

Actually, they debugged Zelda Wii by patching it to output debug info (the disc was trucha-signed), discovered the stack smash vulnerability, created a faulty save and there's the TP hack.

It seems to me that they haven't used the GC version at all

 

[WiiCrazy]

They debugged the gamecube game, found the exploit, and then they figured somehow out, how to use this overflow on wii hardware. This is still difficult, but with the debugging of the gamecube version they knew where to look.

The application on the gamecube game and wii one do not match, how could they possibly find the exploit by debugging the gamecube game?

So you know, when you change a lot of thing in a program and recompile lots of changes occur in the underlying assembly code... That kind of hacking is done at the assembly level...

It doesn't seem rational to me...

You can find a similar exploit just modifying the savefile of games that relies on user's text entry, change the text with a lengthy one and expect the game crash...
That's the part you are finding the exploit... You don't need to debug anything for this step...

If you happen to create a nice crash which actually you get data into the executing code's space then you try diverting that code into the other part of your code in the savefile...

The second step needs the debugging and should be done on the actual wii game...

 

[raulpica]

Maybe I was too cryptic in my previous post

So... here's how it really went (took the two most esplicative quotes from this log):

22:16:19 no, more like "unspecified source of decrypted update partition" -> unencrypted IOS -> discovery of starlet -> understanding of how discs are signed and encrypted in general (H0-H4), discovery of strncmp bug
-> tweezer attack -> retail AES common key -> patched Lego Star Wars disc
Bushing found a way to get a decrypted update partition and by examining it, they discovered some traces of ARM code in the disassembly. That was the discovery of Starlet.
With that, they understood how discs are signed and encrypted and discovered that there was a signing bug. By using the tweezer attack, they got the keys.
Knowing about the signing bug and having the keys, they could actually fake-sign discs.

That was just before the 24C3. After that...
dasda18:34:39 and the twilight hack: tweezers => keys => decrypted disc => decrypted ios => trucha bug => patch zelda to output debug info => create faulty save => mess around.

Having the Trucha bug, they just took Zelda, decrypted the disc, and patched the game to output debug info. By looking at the debug info, they found the vulnerability in Epona's name. Creating a faulty savegame, they stack-smashed the game and ran arbitrary code thru it. That's how the TP hack was created.

Nice story, huh?

I hope I haven't done some errors in the explaining

 

[Katie]

Hello!
Sorry if this question was already asked but if I buy a brand new Zelda in store, will it be debugged?
thanks

I am totally newbie and trying to understand how all this works ;-)

 

[WiiPower]

That was just before the 24C3. After that...

18:34:39 and the twilight hack: tweezers => keys => decrypted disc => decrypted ios => trucha bug => patch zelda to output debug info => create faulty save => mess around.

Having the Trucha bug, they just took Zelda, decrypted the disc, and patched the game to output debug info. By looking at the debug info, they found the vulnerability in Epona's name. Creating a faulty savegame, they stack-smashed the game and ran arbitrary code thru it. That's how the TP hack was created.

Nice story, huh?

I hope I haven't done some errors in the explaining

Thank you, i really thought they used the gamecube version.

 

[raulpica]

Hello!
Sorry if this question was already asked but if I buy a brand new Zelda in store, will it be debugged?
thanks

I am totally newbie and trying to understand how all this works ;-)
Don't worry, every copy of Zelda Wii out there works perfectly

QUOTE(WiiPower @ Dec 28 2008, 05:17 PM) Thank you, i really thought they used the gamecube version.

You're welcome

Glad to have been helpful

 

[snikerz]

well, if you go and buy zelda you will be able to execute the twilight hack and install the homebrew channel. debugging is a completely different story!

 

[Katie]

thanks!!! I feel so "newbie" ;-) now I have to understand how to downgrade from 3.4 to 3.2 ;-) I am actively readings topics... sounds complicated!
Thanks again!

 

[cracker]

thanks!!! I feel so "newbie" ;-) now I have to understand how to downgrade from 3.4 to 3.2 ;-) I am actively readings topics... sounds complicated!
Thanks again!

Do you have a chip or the Hombrew Channel installed already? If not then you can't downgrade (yet).

 

[Katie]

no my wii is new !!! argggggg

but thanks for the information! (I love the "yet")
do you then advice me to wait before bying zelda or put a chip?

 

[snikerz]

It's possible to install the HBC on 3.4

 

[Fakie!]

Well, I wouldn't mind a Wii Sports hack

, tho it's probably not possible. And it would probably screw Nintendo lol.