Wii Mode Keys!!! Thanks crediar.

DeadlyFoez Nov 21, 2012.

  1. JoostinOnline

    JoostinOnline Certified Crash Test Dummy

    Member
    14
    Apr 2, 2011
    United States
    The Twilight Zone
    It's not a bootmii dump.
     
  2. angelXwind

    angelXwind -angelXwind sinks back into her hiding hole-

    Newcomer
    2
    Jul 19, 2010
    United States
    Inside her hiding hole.
    http://hackmii.com/2008/04/keys-keys-keys/ Reading up on this.
    Problem is, the AES key that's used in DeadlyFoez's dump is significantly shorter than anything I can find in my keys.bin.
     
  3. DeadlyFoez
    OP

    DeadlyFoez XFlak Fanboy

    Member
    11
    GBAtemp Patron
    DeadlyFoez is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Apr 12, 2009
    United States
    it appears that my nand dump may be corrupt. I'll have to try dumping it again.
     
  4. angelXwind

    angelXwind -angelXwind sinks back into her hiding hole-

    Newcomer
    2
    Jul 19, 2010
    United States
    Inside her hiding hole.
    Yes, that would be apparent. However, we just need to construct a keys.bin that uses the NAND keys that DeadlyFoez (crediar?)'s tool dumped. No matter if it's dumped with BootMii or not, the NAND dump will be encrypted in the same way. Hence why all those tools need "keys.bin" to decrypt the contents of the NAND dump.
     
  5. techboy

    techboy GBAtemp Advanced Maniac

    Member
    3
    Mar 15, 2009
    United States
    Pennsylvania
    NANDExtract says "Can't find superblock. Are you sure this is a full (with ecc) or bootmii nand dump?", then crashes when I hit OK. I assumed this dump was the former it has the 16MB extra size for ECC data, and bootmii doesn't run on vWii (yet).

    I tried entering the key manually (there's a menu option in NANDExtract for this) and using a keys.bin (which may or may not have been made correctly, but I based it on the offsets shown on Wiibrew's Bootmii page and a good keys.bin).
     
  6. angelXwind

    angelXwind -angelXwind sinks back into her hiding hole-

    Newcomer
    2
    Jul 19, 2010
    United States
    Inside her hiding hole.
    Yeah, did the same thing with the keys.bin. Didn't work.

    We need the 60-byte ng_sig.

    ECC Private Key appears to be "NG Private Key"
    Console ID is presumably (probably wrong) "NG ID"
    PRNG seed is presumably "RNG key"
    ng_key_id is probably "NG ID"
    ng_sig ... is something the tool didn't appear to dump.
     
  7. megazig

    megazig SU

    Member
    3
    Oct 25, 2008
    United States
    your console id is there. they don't need a database of your wii
     
  8. HorreC

    HorreC Advanced Member

    Newcomer
    1
    Nov 10, 2012
    United States
    Thats what I thought too. But they were very quick to call me down for it...
     
  9. DeadlyFoez
    OP

    DeadlyFoez XFlak Fanboy

    Member
    11
    GBAtemp Patron
    DeadlyFoez is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Apr 12, 2009
    United States
    I was able to dump the NAND without it going corrupt on me. *snip*
     
    tmv_josue and JoostinOnline like this.
  10. techboy

    techboy GBAtemp Advanced Maniac

    Member
    3
    Mar 15, 2009
    United States
    Pennsylvania
    Nice :)

    You might want to remove the link though...mods removed your old ones and said you can't link to dumps. :(

    In other news, I'm downloading as fast as you're uploading :P I keep refreshing and watching more rar parts show up :)

    EDIT: Extracted beautifully in NANDEXtract. Not corrupt this time :) The homemade keys.bin works fine. Thanks Deadly! Let the exploration and experimentation begin!

    EDIT2: Here's a shot of a vWii NAND as seen in ShowMiiWads: [​IMG]
    HCTE is a new channel we haven't seen yet, either in impersonator or on WiiUBrew. It's the system transfer tool :)
     
  11. SifJar

    SifJar Not a pirate

    Member
    7
    Apr 4, 2009
    Wait, almost all IOS are stubs? That seems weird...

    EDIT: And System Menu has 75 contents? I thought it had ~10 before?

    EDIT: Wait, does this have correction for the new title IDs of NAND titles, or does that not matter?
     
  12. the_randomizer

    the_randomizer The Temp's official fox whisperer

    Member
    24
    GBAtemp Patron
    the_randomizer is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Apr 29, 2011
    United States
    Dr. Wahwee's castle
    So....what will this mean in the long run?
     
  13. techboy

    techboy GBAtemp Advanced Maniac

    Member
    3
    Mar 15, 2009
    United States
    Pennsylvania
    IOSes that have all of their contents marked as "shared" show as 0MB. They pack just fine into the 1.xMB IOSes we're all used to seeing.

    The SM needs to be looked into. Something funky there. It's the only thing I can't make a wad of...ShowMii gives an error.

    EDIT: Wads of vWii titles! http://i.imgur.com/0ryUK.png
    EDIT2: The SM is strange. TMD lists 9 contents if examined in hex editor, but there's only 2 in the title folder. Shared SM contents maybe? Not sure why showmii says 75, but still no wonder why it won't pack.
     
  14. angelXwind

    angelXwind -angelXwind sinks back into her hiding hole-

    Newcomer
    2
    Jul 19, 2010
    United States
    Inside her hiding hole.
    I've been playing around with the NAND dump.
    The vWii's system menu "v513" crashes on both SNEEK and Dolphin. Apparently, it's encrypted. Installing a regular SystemMenu v513 over it makes it work.
    "Wii U Menu" will reboot the Wii.
    The vWii's Wii Shop Channel functions perfectly.
    The vWii's Wii System Transfer sends you to a download page on the Shop Channel. The channel it downloads will not function, spitting out an error message.
    All vWii IOSes will not function on a regular Wii (but do in Dolphin) for some reason. Please do not attempt installing any.
    IOS512 and IOS513 are mysteries.
     
  15. techboy

    techboy GBAtemp Advanced Maniac

    Member
    3
    Mar 15, 2009
    United States
    Pennsylvania
    When I unpacked it, the title IDs *came out of extraction* correct (as "00000001" instead of "00000007"). I didn't change anything.

    And the SM has 9 contents according to its TMD.

    EDIT: Also, regarding the question that's been asked several times around here about settings changes from the Wii U side, there is a SYSCONF in the normal place on the vWii (/shared2/sys/)...whether it's being used is beyond me though.

    EDIT2: Channels...
    • Wii Menu Manual works fine.
    • Transfer channel runs but is just a "Download assistant" of sorts that takes me to the shop entry for the vWii version of the transfer app. I'm trying to download it...
    • Wii U Menu channel reboots the wii.
    • Wii Shop that comes with the vWii does not work on Wii ("You cannot use the Wii Shop Channel. See the Wii Menu electronic manual for more information", and a button to open the Wii Menu Manual channel).
     
  16. JoostinOnline

    JoostinOnline Certified Crash Test Dummy

    Member
    14
    Apr 2, 2011
    United States
    The Twilight Zone
    What's up with IOS512 and IOS513?
     
  17. techboy

    techboy GBAtemp Advanced Maniac

    Member
    3
    Mar 15, 2009
    United States
    Pennsylvania
    Wondering the same thing. They're a few hundred KB, about the size of a MIOS, and don't work if reloaded to.

    Also, anyone notice something missing in the ShowMiiWads picture? The stubs are missing.

    UPDATE: Some more on this stuff...

    The SM is a big mess that someone needs to figure out how to reassemble properly. Most of the contents are marked as type 0x8001, which I think is "shared" (not sure though, Wiibrew makes no mention of what the type field values mean). The corresponding app files from shared1 make no sense (several are IOS modules). If I just copy the contents referenced in the TMD and make a wad, I brick the SNEEK NAND.

    I succeeded in downloading the "vWii half" of the Wii U Transfer Tool (the one you use on your Wii U before going to the Wii) using the Wii Shop. Title ID is same as the one that comes on the vWii, but the beginning 4 bytes are 00010001 instead of 00010002. Didn't try running it.

    Also, vWii IOSes do not appear to work on Wii (or at least on SNEEK).
     
  18. Bent

    Bent GBAtemp Regular

    Member
    6
    Nov 6, 2002
    United States
    Viewing the ticket for some (maybe all) of the IOS's in a hex editor shows the string "GottaGetSomeBeer".
     
  19. techboy

    techboy GBAtemp Advanced Maniac

    Member
    3
    Mar 15, 2009
    United States
    Pennsylvania
    I think the wad packer did that.

    Look in the file system of the extracted nand: /ticket/00000001/ The tickets are proper there.

    Here's a side-by-side: http://i.imgur.com/3K6Ym.png One on the left is from vWii IOS9 after it was WAD'd then unpacked again. Right side is the ticket as seen in the /ticket/00000001/ folder.
     
    djbubba2002 likes this.
  20. the_randomizer

    the_randomizer The Temp's official fox whisperer

    Member
    24
    GBAtemp Patron
    the_randomizer is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Apr 29, 2011
    United States
    Dr. Wahwee's castle
    Anyone?
     
Quick Reply
Draft saved Draft deleted
Loading...