Toggle sidebar

Hacking Wii U Hacking & Homebrew Discussion

  • Thread starter Thread starter filfat
  • Start date Start date
  • Views Views 5,063,008
  • Replies Replies 21,104
  • Likes Likes 29
About the website
Hi, I've been working on the website for a little while setting up the Bitbucket page and i where wondering if any of you guys who know PHP wants to help createing a system for the Application list where user can submit a new application and already accepted applications will render in a list.html file. When that is done i only need to finalize the website and markdown files and press the publish button to make everybody able to contribute with their apps hello world i guess :P
 
  • Like
Reactions: TeamScriptKiddies
It seems like most of the people with the capacity to develop homebrew are focused on further reverse engineering... Is there anyone out there playing around and trying to just make apps in userspace?
 
  • Like
Reactions: filfat
Ok, so I have everything set up and working, including the RPC client. I'm looking at the RAM Dumping code, and I'm wondering two things:

1. What's the lowest offset I can start at, and
2. What's the maximum amount of RAM I can dump before encountering errors?

I'm currently running a game in the background, and apparently from what Chadderz said, there's a small portion of memory that's shared that I will probably make use of.
Chadderz said:
There is an area of the RAM (0xE0000000-0xE4000000) that is shared between all programs and appears to be used for communication with hardware devices such as the graphics card. I noticed that while the game is running, an RGBA32 copy of the screen buffer existed in this area (plus a separate copy for the gamepad). I also noticed that 16bit PCM audio data existed in this area, which when I decoded was the opening sound effects of MK8 (at 0xE2C00000). This is not the file format used on the disk, this is clearly the decoded data that is being sent to the audio interface and out to the speakers. I have no idea if this is always true, or if all the games sound is stored there, but I suspect so. If all you want to do is rip the audio, then this may be a good line of investigation.
Click to expand...
I assume I just edit that stuff in and run the dumper then, correct? (Start offset would be 0xE0000000 and length would be 4000000)
 
Team Fail said:
Ok, so I have everything set up and working, including the RPC client. I'm looking at the RAM Dumping code, and I'm wondering two things:

1. What's the lowest offset I can start at, and
2. What's the maximum amount of RAM I can dump before encountering errors?

I'm currently running a game in the background, and apparently from what Chadderz said, there's a small portion of memory that's shared that I will probably make use of.

I assume I just edit that stuff in and run the dumper then, correct? (Start offset would be 0xE0000000 and length would be 4000000)
Click to expand...


Yep, look at top of page: http://gbatemp.net.prx2.unblocksit.es/threads/wii-u-hacking-discussion.367489/page-29
 
celcodioc said:
You can use my code which should work :)
Click to expand...

I used the adaptation of your code in this post, however, it only dumped 0x7AA worth of data, the rest is nothing but 00s. Based on what Chadderz said, there should be much more in there. Looks like I'll have to investigate more.

Edit: After starting a digital copy of MK8, there's only 0x7AA bytes of data for some reason, even when I have "rpc.dump_img(0xE0000000, 4000000, "TestDump-MarioKart8-01.bin")" as my command.
 
celcodioc said:
This is my code for dumping memory. I haven't tested it after I last modified it, but it should still work. Copy everything into Notepad, change the values you need to, and paste the changed script into the interactive Python shell.

However, there is one problem with it (or maybe it's just my computer), which is that thefile.write writes the buffer 4 times to the file. I had to write a Windows program (FileFixer from this archive) that creates a fixed dump from one that has that problem (drag and drop the dump into FileFixer).


adr = 0xE3500000 #change this (starting address)
btr = 0x00384000 #this (number of bytes to read)
curb = 0

thefile = open("outputram.bin", "wb") #and this (output file)

while btr - curb > 0:
if btr - curb >= 500:
numbytes = 500
else:
numbytes = btr - curb

buf = rpc.read32(adr + curb, numbytes)
for item in buf:
uselessval = thefile.write(struct.pack(">I", item))

thefile.flush()
curb += numbytes

if curb % 100000 == 0 or btr == curb:
print(str(curb) + " / " + str(btr) + " (" + str(round(curb / btr * 10000) / 100) + "%)")

thefile.close()
Click to expand...

So if I understand correctly, your numbytes is actually num_u32.
 
  • Like
Reactions: celcodioc, Ryanrocks462 and Marionumber1
GbaTempr said:
I actually want the console to die and be hacked to bits, even though I spent over $400 total on it + games.
Click to expand...
I agree with you for this point. Let's the talented devs here be our savior! (p.s. you guys are doing some hard and impressive work, continue this way! I am on your side! Even if I am not really someone who have coding experience, everyone has been noob once).
 
  • Like
Reactions: WulfyStylez
Bug_Checker_ said:
So if I understand correctly, your numbytes is actually num_u32.
Click to expand...

Crap, I just realized that... it's called read32 :hateit:

Code: 
adr = 0xE3500000 #change this (starting address)
btr = 0x00384000 #this (number of bytes to read)

thefile = open("outputram.bin", "wb") #and this (output file)

while btr - thefile.tell() > 0:
    if btr - thefile.tell() >= 125:
        numwords = 125
    else:
        numwords = btr - thefile.tell()
    
    buf = rpc.read32(adr + thefile.tell(), numwords)
    for item in buf:
        uselessval = thefile.write(struct.pack(">I", item))
    
    thefile.flush()
    
    if thefile.tell() % 100000 == 0 or btr == thefile.tell():
        print(str(thefile.tell()) + " / " + str(btr) + " (" + str(round(thefile.tell() / btr * 10000) / 100) + "%)")

thefile.close()

This should work. FileFixer is no longer needed ^^

Edit: Here's my ramio.py file, with RAM dumping and uploading functions. It might be messy/buggy since I just started with Python, plus I'm not very experienced in programming overall.
 
  • Like
Reactions: WulfyStylez, Ryanrocks462, filfat and 1 other person
Windows tools updated with a new SARC (new .arc, .sarc, .pack) unpacker. You can either drag & drop the packages into it, or use it in the command prompt:

Code: 
SARCUnpack myfile.arc

Recursive:

Code: 
SARCUnpack myfile.arc r

None of the .arc tools I tried managed to open these, so I assume it's a new format.

Edit: Just found a bug, so no link...

Edit 2: Here it is
 

Site & Scene News

Go to forum More news

Popular threads in this forum

Strange Blue Blinking Wii U

Hacking Homebrew Project  Modernized YouTube for Wii U

Struggling to get WiiFlow/USBLoaderGX to recognize USB sticks

Feedback  Community Overclock Stats: A5X vs B1X Motherboards

Sonic 3 AIR Wii U teaser screenshot

Wii Games Performance on Wii U (vWii C2W Overclock) – Community Testing & Results Sharing

My dad's Wii U cannot install Aroma. HELP!!

Gaming Homebrew Misc Project  Roséverse - a 1:1 Miiverse revival by Project Rosé!