Hacking Wii U Hacking & Homebrew Discussion

[IbbyPlays]

From what I understand, it sounds like games run in userspace but to mod them you need kernel. Does this mean that we can store programs as save data?

 

[keine]

$ openssl enc -in kernel_no_header.img -out kernel_no_header_d.img -d -aes-128-cbc
enter aes-128-cbc decryption password:
bad magic number
?

$ openssl enc -in kernel_no_header.img -out kernel_no_header_d.img -d -aes-128-cbc -kfile akey
bad magic number

 

[Bug_Checker_]

$ openssl enc -in kernel_no_header.img -out kernel_no_header_d.img -d -aes-128-cbc
enter aes-128-cbc decryption password:
bad magic number
?

your "-K" option needs to be the ancast key. (Assuming that you have the correct semi-decrypted kernel file)

 

[keine]

I must either have the wrong key....or I'm trying to decrypt the wrong portions of the files.
Looking at tail -c + 257 kernel.img
I'm looking at kernel.img and fw.img. Both have the magic ancast bytes at the beginning.

$ sha1sum akey
2ba6f692ddbf0b3cd267e9374fa7dd849e80f8ab *akey

Thanks for the tips bug_checker. I really appreciate it.
I highly doubt I'm going to return to libc (or equivalent) anytime soon, but its fun to follow along.
I'd really like to cut my teeth on some homebrew development when its opened up.

 

[Bug_Checker_]

I must either have the wrong key....or I'm trying to decrypt the wrong portions of the files.
Looking at tail -c + 257 kernel.img
I'm looking at kernel.img and fw.img. Both have the magic ancast bytes at the beginning.

$ sha1sum akey
2ba6f692ddbf0b3cd267e9374fa7dd849e80f8ab *akey

forget about "-k" and "-kfile" and just use "-K"(w/no spaces in between 16 byte number) option(w or w/o "-iv" option)

 

[Deleted member 342493]

Whut?, can someone please explain me how to download things from NUS? (I mean Wii U data)
Thank you people, and thanks comex for bringing the Wii U common key

 

[Bug_Checker_]

Whut?, can someone please explain me how to download things from NUS? (I mean Wii U data)
Thank you people, and thanks comex for bringing the Wii U common key

Sorry,if you don't have a cetk(tik), then everything download(encrypted etc) is useless.

 

[Deleted member 342493]

Sorry,if you don't have a cetk(tik), then everything download(encrypted etc) is useless.

But it can't been decripted with the common key? (yeah, I know it sound like a super noob, but well...)

 

[Bug_Checker_]

But it can't been decrupted with the common key? (yeah, I know it sound like a super noob, but well...)

To decrypt content(s) for nearly everything including system IOSU you need a ticket(cetk).
For game content(etc) they have an unique(ish) encypted(scrambled) title key inside the ticket.
The encrypted title key(from the cetk/ticket) needs to be decrypted with the Wii U commonkey and the Title ID(+ zero padding) as the iv. Then the decrypted title key is used as the key to decrypt the content(s).

There are other keys and sometimes things are double "wrappped"(encrypted). Check f0f web page on keys.

 

[Deleted member 342493]

To decrypt content(s) for nearly everything including system IOSU you need a ticket(cetk) that has an unique(ish) encypted(scrambled) title key inside it.
The encrypted title key(from the cetk/ticket) needs to be decrypted with the Wii U commonkey and the Title ID(+ zero padding) as the iv. Then the decrypted title key is used as the key to decrypt the content(s).

There are other keys and sometimes things are double "wrappped"(encrypted). Check f0f web page on keys.

Oh yes, they reveal a lot of them, ancast keys from vWii mode, Wii U mode, etc.
So, for a normal user like me is imposible to decrypt things from NUS even with the common key?
This is my last queston, and again, sorry about of this noob question, is just I would like to see how cafe2wii works, download, decrypt and try to modify it...

 

[IbbyPlays]

If I understand the principles of an exploit, we need to:

1. Push our code into the console's RAM (don't know how)
2. Cause the browser to have an unhandled exception so that it freaks out and asks the console "Yo man, I'm having some problems, what do I do?"
3. Have the console go "Just run whatever is in the RAM, maybe that will fix it!"

 

[NWPlayer123]

If I understand the principles of an exploit, we need to:

1. Push our code into the console's RAM (don't know how)
2. Cause the browser to have an unhandled exception so that it freaks out and asks the console "Yo man, I'm having some problems, what do I do?"
3. Have the console go "Just run whatever is in the RAM, maybe that will fix it!"

Basically you use something like an array or w/e to be a pointer to your code so it jumps to it and starts executing it, which is why you need an "out of bounds" exploit usually.
The reason most crashes aren't exploitable is because of number 1 - you need to have user input to write the code needed to do anything, which is why the browser is perfect.

 

[yahoo]

If I understand the principles of an exploit, we need to:

1. Push our code into the console's RAM (don't know how)
2. Cause the browser to have an unhandled exception so that it freaks out and asks the console "Yo man, I'm having some problems, what do I do?"
3. Have the console go "Just run whatever is in the RAM, maybe that will fix it!"

Not quite. First, there are 3 different exploits: webkit (userland), kernel and iosu. It sounds like you are only describing the webkit exploit. The source is right here: https://bitbucket.org/Marionumber1/wiiu-userspace/src . All three of the steps you listed are right there.
Step 1 is the heap spray, it happens in javascript. Step 2 you have sort of right, but your narration is inaccurate. The whole point of an unhandled exception is that the console has no idea there's anything wrong. If it knew that something was wrong, that would be called a handled exception. Step 3 happens because we've sprayed the heap with pointers to our code, and the console carries on like there's nothing wrong at all, but executes our code because we've overwritten what it would normally have done.

Again, these steps only describe the webkit exploit, which means we have access to userspace and can only overwrite memory that userspace is allowed to. These 3 steps you detail are not needed for anyone that has a console system firmware versions 4.0.0 through 5.1.0 because there is already a webkit exploit that does exactly these 3 steps.

The main difference between a webkit (userspace) exploit and a kernel or iosu exploit is what area of memory we can overwrite; a kernel exploit would be an unhandled kernel except that allows overwritting areas of memory that only the kernel has access to, and an iosu exploit would similarly be an unhandled iosu exception that allows overwriting areas of memory that only iosu has access to.

Hope that makes sense.

 

[Marionumber1]

If I understand the principles of an exploit, we need to:

1. Push our code into the console's RAM (don't know how)
2. Cause the browser to have an unhandled exception so that it freaks out and asks the console "Yo man, I'm having some problems, what do I do?"
3. Have the console go "Just run whatever is in the RAM, maybe that will fix it!"

Not exactly how it works. The unhandled exception tells us that it's accessing some sort of invalid memory. Once we know it's doing that, we set the memory up so that it accesses what we put there rather than having an exception. What we put there influences the browser to run our code, if we get it right.

 

[keine]

Whut?, can someone please explain me how to download things from NUS? (I mean Wii U data)
Thank you people, and thanks comex for bringing the Wii U common key

It looks like at least some of the WiiU system software from NUS can be downloaded and decrypted. I guess the games are encrypted with another key which I don't quite fully understand yet.
Use the modified GitHub Nus Downloader and the titleID index at WiiUBrew. Compile the NUS Downloader with the common key inserted. The tmd's don't seem to download correctly when using the NUS downloader program, so grab those manually. Use crediar's CDecrypt.exe to decrypt a decryptable NUS package. ckey needs to be binary. TitleIds do not copy paste into the NUS Downloader.

I haven't gotten farther than this. And from there I have quite a bit of unknowns. Getting it in a analyzable form (kernel.img -> ELF?). Mapping in the syscall table. And more. Still scratching head on the IV. The SHA1 in the ancast image header is the SHA1 of the aes-128-cbc portion of the binary. I thought it might be the iv. What an iv is and if its need in the ancast image case.

However from reading the NinjaHax writeup....I think exploits might be far far harder than finding a buffer overflow returning to libc and ROP, or similar if I knew what I was talking about.

 

[aceoyame]

Anyone have a compiled binary of the new downloader to share? I keep getting warnings thrown when I compile it

 

[keine]

I got errors too. It was related to one of the pre compilation commands set in VS. Getting rid of it fixed it for me. Check project settings.

 

[NWPlayer123]

Anyone have a compiled binary of the new downloader to share? I keep getting warnings thrown when I compile it

There's a reason the common key isn't included, because people would get in trouble if it was shared like that

 

[aceoyame]

There's a reason the common key isn't included, because people would get in trouble if it was shared like that

Like the original NUS downloader didn't have the Wii's common key? Not sure why everyone is getting worked up over a string of characters.

 

[aceoyame]

There's a reason the common key isn't included, because people would get in trouble if it was shared like that

Thanks for the info, i'll give it a try later