Hacking Wii U Hacking & Homebrew Discussion

[WulfyStylez]

Is all this work to make a fancier "Hello World"?

Kinda, but also ironing out some bugs and figuring stuff out with our current exploit too.

 

[Adr990]

I know there is a other discussion going on, but this is a general topic, right?

I want to dump the WiiU NAND:

I've connected my SD card reader like this. According to WiiUBrew this should do it, right?
Sadly, this doesn't do anything, I've made my SD card reader always think like there is a SD card in there.

My SD card reader does work with the 3DS. (with only CLK, CMD, D0 and GND)

But my WiiU (with or without the 50K resistor) doesn't get the connection working.
Also, the WiiU shuts down (as in red led/standby) a second after it is booted when only CLK, CMD, D0 and GND are connected.

Perhaps I should solder behind the resistors? (R27,31,28,29,30)

I've soldered the connections on Side-A.

But I shall re-check my wires sometime later, and make pictures, but I don't have the time now.

 

[WulfyStylez]

I know there is a other discussion going on, but this is a general topic, right?

I want to dump the WiiU NAND:

I've connected my SD card reader like this. According to WiiUBrew this should do it, right?
Sadly, this doesn't do anything, I've made my SD card reader always think like there is a SD card in there.

My SD card reader does work with the 3DS. (with only CLK, CMD, D0 and GND)

But my WiiU (with or without the 50K resistor) doesn't get the connection working.
Also, the WiiU shuts down (as in red led/standby) a second after it is booted when only CLK, CMD, D0 and GND are connected.

Perhaps I should solder behind the resistors? (R27,31,28,29,30)

I've soldered the connections on Side-A.

But I shall re-check my wires sometime later, and make pictures, but I don't have the time now.

To clarify, you're dumping eMMC NAND, correct? Because there's little reason to do so at the moment. It's likely encrypted, and that particular chip is only used for storage, not for system software. Dumping it won't give you a lifeline for updates or anything. Or are you doing it just because you can?

 

[Adr990]

Yes, and oh.. I did think it would enable downgrading, yes. Oh well.. no way to do that than?

Anyways, I have the wires hooked up now, so perhaps, why not still try it?

 

[Marionumber1]

Yes, and oh.. I did think it would enable downgrading, yes. Oh well.. no way to do that than?

Anyways, I have the wires hooked up now, so perhaps, why not still try it?

I'm pretty sure it will enable downgrading, although the Wii U may have some checks in place to prevent it. However, it's worth noting that if one wants to downgrade, they'd probably need to reflash both the Wii U NAND and the Wii U eMMC. And of course, downgrading will only work if you made dumps before updating.

 

[WulfyStylez]

Yes, and oh.. I did think it would enable downgrading, yes. Oh well.. no way to do that than?

Anyways, I have the wires hooked up now, so perhaps, why not still try it?

Fair enough. Anyways, it's possible if you're using a cheap reader, it might not support SD mode (using DAT0-DAT3) - just SPI mode. You can read the 3DS eMMC through SPI mode, I know. Have you tried booting with the reader set up and the wii u powered on?

I'm pretty sure it will enable downgrading, although the Wii U may have some checks in place to prevent it. However, it's worth noting that if one wants to downgrade, they'd probably need to reflash both the Wii U NAND and the Wii U eMMC. And of course, downgrading will only work if you made dumps before updating.

The key there being you'd need to dump the NAND too, a much more involved process.

 

[Adr990]

Ah, I'll look in to dumping the Wii's NAND too than, thanks.

Edit:
Nvm, NAND is quite different in not being able to be dumped with an sdcard controller... We'll see about the WiiU's eMMC only then.. Just dumping it.

And I did solder wires with female heads, so I can connect the SD card reader at will.
So yes, I did connect the card reader while the WiiU is turned on, the WiiU doesn't freeze or shut down, but still turns up nothing on my computer.

 

[leorod199]

ADR990, http://www.psdevwiki.com/ps3/KLMAG2GE4A-A001 friend, who will be work with the app AutoGG ??

 

[Ryanrocks462]

All of you better check this out very important http://gbatemp.net/threads/wiiu-now-requiring-update-to-use-online-features.369772/

 

[WulfyStylez]

All of you better check this out very important http://gbatemp.net/threads/wiiu-now-requiring-update-to-use-online-features.369772/

Meh, we can probably spoof version if we still care in the future.

 

[Onion_Knight]

Does someone have a packet capture of their WiiU going online?

 

[WulfyStylez]

Does someone have a packet capture of their WiiU going online?

Have fun looking at unique handshakes and encrypted traffic.

 

[Adr990]

Meh, we can probably spoof version if we still care in the future.

Yeah, just like on the PS3.
Although, Sony fixed that after a couple of days. But maybe the WiiU won't be capable of that kind of 'thorough' checking.

 

[Onion_Knight]

Have fun looking at unique handshakes and encrypted traffic.

Wasn't thinking that...more like a replay action. If it only checks it during the intial connection, than you could conceivable do a replay attack against the server, and than just reset the connection your back on.

 

[WulfyStylez]

Wasn't thinking that...more like a replay action. If it only checks it during the intial connection, than you could conceivable do a replay attack against the server, and than just reset the connection your back on.

No, I know. A replay attack won't work because your handshake and responses and such will be unique every time you connect. If you send the server the same data in response to a different challenge, you won't be able to connect. Same on any modern console.

Yeah, just like on the PS3.

Although, Sony fixed that after a couple of days. But maybe the WiiU won't be capable of that kind of 'thorough' checking.

I'd kinda doubt it, yeah. I mean, this exploit took almost two months (!!) to patch? Either way, if it's like the Wii at all, it'll be a breeze.

 

[Onion_Knight]

No, I know. A replay attack won't work because your handshake and responses and such will be unique every time you connect. If you send the server the same data in response to a different challenge, you won't be able to connect. Same on any modern console.


I'd kinda doubt it, yeah. I mean, this exploit took almost two months (!!) to patch? Either way, if it's like the Wii at all, it'll be a breeze.

Thanks for the info, didn't know that.

 

[iNFiNiTY]

Anyone working on this, please read the SDK through in detail... it's not a clean sdk, someone owned it previously and added a lot of interesting stuff; only thing is its for DEBUG systems, but its not clear which potential exploits might be able to work alongside the browser hack or some other method now. Even the Nintendo logs are useful they actually give detailed info on things that were broken, even if it is old versions..

I should have made notes but there's a font exploit possibly related or separate to a locale/timezone bug (they both come up a lot in binaries and some commented code i need to go back and have a proper read now), an exploit to do with the nintendo PCM audio format (it seemed to be aimed at that at least) and the GX2 failoverflow exploit are scattered around there as well as some other strange bits. The ISO creation tools last made a RVL disc with Wii-U files and properties.. is that a trick or simply avoiding using the large ISO size to test a 'mastered' disc, idk but seemed very deliberate.

Some things are missing, some demos, but its got good documentation that hints at other things within accessible memory from the browser and tells us a lot of functions we had no clue about. One protocol just that seemed like it might cause problems was the controller communication with the system, Nintendo was making it sound extra careful to avoid memory problems. Also USB keyboards! they really locked down that, any usb device really.

Just read it and see anyway, it's big though. Some of the libraries seem to have been hacked, so whoever had the kit had control over the debug unit fully. And from the dates it means they've had full knowledge for ages but not much of a surprise i suppose

Edit: oh yeah just in general communication between devices would be good to look at, just there's so many, more likelihood of a mistake as they are all separate...

 

[WulfyStylez]

Anyone working on this, please read the SDK through in detail... it's not a clean sdk, someone owned it previously and added a lot of interesting stuff; only thing is its for DEBUG systems, but its not clear which potential exploits might be able to work alongside the browser hack or some other method now. Even the Nintendo logs are useful they actually give detailed info on things that were broken, even if it is old versions..

I should have made notes but there's a font exploit possibly related or separate to a locale/timezone bug (they both come up a lot in binaries and some commented code i need to go back and have a proper read now), an exploit to do with the nintendo PCM audio format (it seemed to be aimed at that at least) and the GX2 failoverflow exploit are scattered around there as well as some other strange bits. The ISO creation tools last made a RVL disc with Wii-U iiles and properties

Where's all this? Hidden in the docs or..?

 

[WulfyStylez]

Sorry for the double-post, but did this thread completely fall off the topic list for anyone else? Bumping because it's just not appearing anywhere for me.

 

[NWPlayer123]

Yeah, the system HAS to store something about the version because I have blocked literally every URL nintendo uses (trust me, I derped around in wireshark for a while) and it still pops up. It's probably because I have the download for 5.1.1 sitting on it's filesystem, so we'll need to test that once someone gets a kernel exploit working correctly and can allow me to look into that, but...

192.195.204.136
tagaya.wup.shop.nintendo.net
nppl.app.nintendo.net
account.nintendo.net
pushmore.wup.shop.nintendo.net

Here's some stuff I ran into when derping around in said Wireshark. As far as I can tell, that IP (192.195.204.136 with a port of 443, which redirects to account.nintendo.net http://www.ip-tracker.org/locator/ip-lookup.php?ip=192.195.204.136) is what the Wii U is sending data to when checking for the version(it's what popped up when I clicked on the icon for MK8 and it popped up with it's "you need to update" message). Here's a file with some of that data from one of my runs.