Hacking Wii U disc/download format

  • Thread starter Thread starter Hiccup
  • Start date Start date
  • Views Views 3,880
  • Replies Replies 6

Hiccup

Well-Known Member
Member
Joined
Nov 21, 2009
Messages
1,004
Reaction score
312
Trophies
1
XP
2,058
Country
Is there info anywhere on the format of Wii U disc images, and the format(s) of Wii U download software.

Thanks
 
Is there info anywhere on the format of Wii U disc images, and the format(s) of Wii U download software.

Thanks
Yes.cs

http://svn.code.sf.net/p/vgmtoolbox/code/format/VGMToolbox/format/iso/NintendoWiiUOpticalDisc.cs

What scene releases and Cemu call a "title key" should actually be a "disc key." It's unique to the disc the title was dumped from, not to the title.

For tickets: http://www.3dbrew.org/wiki/Ticket (applies to Wii U)

So, you decrypt the title key using the common key and the title ID padded at the end with 0000000000000000 as the IV using AES-CBC.

Then for decrypting .app files, use the decrypted title key and the cIDX padded at the end with 0000000000000000000000000000 as the IV using AES-CBC.

The cIDX is obtained from the TMD; at 0xB04 are the content entries, each 0x30 bytes. The first 4 bytes are the content ID, essentially the filenames of the .app files. The next 2 are cIDX (content index.)
 
Last edited by Twili,
Thanks, but I don't really understand the code. I'm particularly interested in:
what different partitions are there
what header info is there in a disc image
 
Yes.cs

http://svn.code.sf.net/p/vgmtoolbox/code/format/VGMToolbox/format/iso/NintendoWiiUOpticalDisc.cs

What scene releases and Cemu call a "title key" should actually be a "disc key." It's unique to the disc the title was dumped from, not to the title.

For tickets: http://www.3dbrew.org/wiki/Ticket (applies to Wii U)

So, you decrypt the title key using the common key and the title ID padded at the end with 0000000000000000 as the IV using AES-CBC.

Then for decrypting .app files, use the decrypted title key and the cIDX padded at the end with 0000000000000000000000000000 as the IV using AES-CBC.

The cIDX is obtained from the TMD; at 0xB04 are the content entries, each 0x30 bytes. The first 4 bytes are the content ID, essentially the filenames of the .app files. The next 2 are cIDX (content index.)
This actually isn't as correct as you think it is. Take two of the exact same games and dump them from the same console. You should yield the same title key. Take two discs from two different consoles and you should yield two different title keys. As far as I can tell the title key is somehow being changed by the drive key. The only other way to have two different title keys would be if the two discs had different firmware updates contained in disc. Other than that it is your unique console that makes the ID change on the title key.
But by all means feel free to not listen to me at all. (I mean what do I know ;))
 
this info?
 

Attachments

  • disc_layout.png
    disc_layout.png
    8.3 KB · Views: 1,158
  • Like
Reactions: Hiccup and Vexiant

Site & Scene News

Popular threads in this forum