Hacking Wii U Hacking & Homebrew Discussion

[FPSRussi4]

Regarding Kernel Exploit benefits-would this mean I'm able to use third party adapters for Wii U games, like Mayflash 3-in-1 Joybox to play SSB4 and whatnot?

 

[NWPlayer123]

Regarding Kernel Exploit benefits-would this mean I'm able to use third party adapters for Wii U games, like Mayflash 3-in-1 Joybox to play SSB4 and whatnot?

Yes, you would be able to.
EDIT: Assuming you disassemble the game and code it in manually.

 

[FPSRussi4]

Yes, you would be able to.
EDIT: Assuming you disassemble the game and code it in manually.

The smugness is strong....thanks. I guess.

I guess the same goes for SSB4.

 

[NWPlayer123]

I'm just saying it's possible, nothing beyond that There are no limitations stopping you if you have access to all memory and can patch in the code needed.

 

[Mr. Mysterio]

I know it is possible to "replace" the NUS server within a local network. It's as simple as designating the correct IP address to an alternate device, then disconnecting the local network from the internet.

I would suggest the following procedure to trick the Wii U into updating to an old version:
- Capture the data sent between the Wii U and NUS during a system update.
- Create a website on a local network that responds with the recorded data from NUS.
- Test if a Wii U with a higher firmware can downgrade using this fake update server. (There may be some unforeseen problems here.)

Hopefully the data sent from NUS is statically encrypted. It could be that each time the Wii U connects to NUS the data is encrypted differently.

 

[Damieh79]

EDIT: question already answered.

 

[leorod199]

Friends , I use mikrotik in my house , it has a tool that captures all the connections of a specific device. I put the IP WiiU and captured all connections to update and eshop .

 

[Mr. Mysterio]

Very nice leorod199!
I'll try that myself!

 

[75mak]

Will having a kernel exploit make finding an IOSU exploit or finding ancast key any easier.

And will having the ancast key allow for custom IOSUs? And modified firmwares that dont update from nintendos servers? doing such (if possible) would probably rule out online play i assume.

If Ancast key is important, do you think team f0f would kindly leak that key in the case of a kernel exploit becoming available and a homebrew / linux framework is created, like they requested two years ago

 

[Onion_Knight]

Will having a kernel exploit make finding an IOSU exploit or finding ancast key any easier.

And will having the ancast key allow for custom IOSUs? And modified firmwares that dont update from nintendos servers? doing such (if possible) would probably rule out online play i assume.

If Ancast key is important, do you think team f0f would kindly leak that key in the case of a kernel exploit becoming available and a homebrew / linux framework is created, like they requested two years ago

Both Vwii and Wii U ancast keys are out. Important keys remaining are Wii U private key, drive key and boot 1 key, I believe

 

[TehLexinator]

I've been messing around with this. It's quite simple to forward that address to whatever you want with a good router, or even by editing your hosts file. But I haven't been able to get it to even see an update on my machine.

Best I got was the thing saying my system is up to date, even though it's not.

I'm gonna putz around with it some more, but its not looking promising.

 

[Bug_Checker_]

Both Vwii and Wii U ancast keys are out. Important keys remaining are Wii U private key, drive key and boot 1 key, I believe

That should read "Both Vwii and Wii U Espresso ancast keys are out."
Still not public are:
vWii common key
Wii U ancast key
Wii U boot1 key

 

[SirByte]

I know it is possible to "replace" the NUS server within a local network. It's as simple as designating the correct IP address to an alternate device, then disconnecting the local network from the internet.

I would suggest the following procedure to trick the Wii U into updating to an old version:
- Capture the data sent between the Wii U and NUS during a system update.
- Create a website on a local network that responds with the recorded data from NUS.
- Test if a Wii U with a higher firmware can downgrade using this fake update server. (There may be some unforeseen problems here.)

Hopefully the data sent from NUS is statically encrypted. It could be that each time the Wii U connects to NUS the data is encrypted differently.

NUSDownloader is able to do this; with Kelton2 saying all firmwares are still downloadable I should set it up in the weekend. The "problem" is usually that the updater, which runs on the device (Wii U), checks not only whether the update is digitally signed, but it also compares the version number to the version already installed. If the current one is higher it will not work. On the PSP I had to install a newer firmware once, but my CFW faked it as 9.90 to prevent updates; turned out it was as simple as editing the version string in flash0:/vsh/etc/version.txt

So it won't be as easy as that on the WiiU, but maybe you are on to something. Perhaps there is a way if the updater somehow checks with the NUS for the version numbers, and when it requests a certain file we can feed it another one instead which will still have a correct digital signature, only a different version than expected. My Wii U has never been connected to the Internet (and won't be for a while) so I can't test this.

Marcan's Wiimpersonator does stuff like this:
[check] INFO: Wiimpersonator: Check invoked for dev wiiu region USA
[soap] INFO: Checking for updates...
[soap] INFO: Title ID Version FsSize
[soap] INFO: 00050010-10000100 20b9 131072

so the trick for our NUS emulator would be to reply Version 20ba but with the FsSize (Filesystem Size?) of the older version. The Wii U will think it's an update and retrieve it. What happens from there I don't know.

 

[Onion_Knight]

NUSDownloader is able to do this; with Kelton2 saying all firmwares are still downloadable I should set it up in the weekend. The "problem" is usually that the updater, which runs on the device (Wii U), checks not only whether the update is digitally signed, but it also compares the version number to the version already installed. If the current one is higher it will not work. On the PSP I had to install a newer firmware once, but my CFW faked it as 9.90 to prevent updates; turned out it was as simple as editing the version string in flash0:/vsh/etc/version.txt

So it won't be as easy as that on the WiiU, but maybe you are on to something. Perhaps there is a way if the updater somehow checks with the NUS for the version numbers, and when it requests a certain file we can feed it another one instead which will still have a correct digital signature, only a different version than expected. My Wii U has never been connected to the Internet (and won't be for a while) so I can't test this.

Marcan's Wiimpersonator does stuff like this:
[check] INFO: Wiimpersonator: Check invoked for dev wiiu region USA
[soap] INFO: Checking for updates...
[soap] INFO: Title ID Version FsSize
[soap] INFO: 00050010-10000100 20b9 131072

so the trick for our NUS emulator would be to reply Version 20ba but with the FsSize (Filesystem Size?) of the older version. The Wii U will think it's an update and retrieve it. What happens from there I don't know.

It will probably brick it if you try downgrading from 5.3 to anything below since they implemented amiibo's with that update. You'll have all sorts of issues. It would actually be easier to just find a new userland exploit than try what you're suggesting.

 

[TeamScriptKiddies]

It will probably brick it if you try downgrading from 5.3 to anything below since they implemented amiibo's with that update. You'll have all sorts of issues. It would actually be easier to just find a new userland exploit than try what you're suggesting.

There's no doubting there's a huge risk of bricking during something like this. Even if you were to use an NUS emulator like this for an actual upgrade, what's to say something isn't missed or your code is buggy/faulty and it leads to a brick anyways, never mind a downgrade, then things could get even hairier.

As much as I'd love to see something like this work, unless somebody is willing to risk a FULL BRICK its not going to happen. Anybody who decides to play around with the firmware/NAND/eMMC needs to realize that these are very untreaded waters and we really have know idea exactly what could happen (good or bad). Just keep this in mind...

 

[Mr. Mysterio]

NUSDownloader is able to do this; with Kelton2 saying all firmwares are still downloadable I should set it up in the weekend. The "problem" is usually that the updater, which runs on the device (Wii U), checks not only whether the update is digitally signed, but it also compares the version number to the version already installed. If the current one is higher it will not work. On the PSP I had to install a newer firmware once, but my CFW faked it as 9.90 to prevent updates; turned out it was as simple as editing the version string in flash0:/vsh/etc/version.txt

So it won't be as easy as that on the WiiU, but maybe you are on to something. Perhaps there is a way if the updater somehow checks with the NUS for the version numbers, and when it requests a certain file we can feed it another one instead which will still have a correct digital signature, only a different version than expected. My Wii U has never been connected to the Internet (and won't be for a while) so I can't test this.

Marcan's Wiimpersonator does stuff like this:
[check] INFO: Wiimpersonator: Check invoked for dev wiiu region USA
[soap] INFO: Checking for updates...
[soap] INFO: Title ID Version FsSize
[soap] INFO: 00050010-10000100 20b9 131072

so the trick for our NUS emulator would be to reply Version 20ba but with the FsSize (Filesystem Size?) of the older version. The Wii U will think it's an update and retrieve it. What happens from there I don't know.

I agree that downgrading with this method would be VERY risky. Maybe the right approach is for the NUS emulator to trick the console into "updating" to the same version it already has, but modify one file in the update. If the modified file is the OS boot code, it would have total access to all the hardware and fully elevated privileges! The console shouldn't brick if it just re-installs the same files (except one carefully modified file).

PS How do I use the NUS downloader to download the Wii U updates? (Or is that even the right tool?)

 

[Damieh79]

I agree that downgrading with this method would be VERY risky. Maybe the right approach is for the NUS emulator to trick the console into "updating" to the same version it already has, but modify one file in the update. If the modified file is the OS boot code, it would have total access to all the hardware and fully elevated privileges! The console shouldn't brick if it just re-installs the same files (except one carefully modified file).

PS How do I use the NUS downloader to download the Wii U updates? (Or is that even the right tool?)

I believe there's no way you can do that since the update will definitely be both encrypted by RSA *AND* signed by a hash (probably SHA-X).

However, I think that the just-downgrade approach might work. The problem is that we need to find someone who's willing to risk bricking his WiiU just for a humble "might".

 

[WulfyStylez]

I agree that downgrading with this method would be VERY risky. Maybe the right approach is for the NUS emulator to trick the console into "updating" to the same version it already has, but modify one file in the update. If the modified file is the OS boot code, it would have total access to all the hardware and fully elevated privileges! The console shouldn't brick if it just re-installs the same files (except one carefully modified file).

Totally not possible due to plenty of checks. If it was this easy, literally every system out right now would be hacked to bits.

NUS emulation is going to be impossible due to SSL, probably. Network traffic isn't encrypted with the common key... Even if you could, the updater probably does checks to the version title to make sure it's older than the one specified in the update manifest. Aaaaand actually that being said, you probably can't create your own update manifest, either. There's no reason update manifests wouldn't be RSA secured.

 

[75mak]

I believe there's no way you can do that since the update will definitely be both encrypted by RSA *AND* signed by a hash (probably SHA-X).

However, I think that the just-downgrade approach might work. The problem is that we need to find someone who's willing to risk bricking his WiiU just for a humble "might".

I could find plenty of wii u's ready to try that on. As long as the process doesnt involve opening up the hardware, i could easily experiment with something like that if i had all the neccessary things in place.

 

[WulfyStylez]

I could find plenty of wii u's ready to try that on. As long as the process doesnt involve opening up the hardware, i could easily experiment with something like that if i had all the neccessary things in place.

Even if it were possible, toying with downgrading is something you'd want dumps of emmc and system nand for, both of which would require hardware mods at this point.