Hacking Wii U Hacking & Homebrew Discussion

[endoverend]

Were there any attempts to mess with that register on a physical level? Thinking about glitching here...

We don't know where that register is, and trying to physically find it would be next to impossible.

 

[BurningDesire]

We don't know where that register is, and trying to physically find it would be next to impossible.

Then what are these http://3dbrew.org/wiki/OTP_Registers I am trying to learn stuff so a detailed explanation will help

 

[gudenau]

Yes, if you ran an IOSU exploit, you could install a working homebrew channel. Then as soon as you turned off the system, you would be left with a title that has an invalid signature, either rendering it useless or possibly causing a brick. Unless there actually is a boot IOSU exploit, installing one is pointless at best, and dangerous at worst.

That being said, a boot0/boot1 exploit is not strictly necessary for a boot-time exploit. For example, let's say that some data parsed by the PPC early in the boot process (like Mii data) can be corrupted in an exploitable way. We could get PPC code running very early on at boot, exploit IOSU then, and have signatures disabled from that point forward.

On this note I have plans for this type of thing. Mwahahaha!

 

[FR0ZN]

We don't know where that register is, and trying to physically find it would be next to impossible.

Why would you? I'm talking about glitching the chip which holds the OTP at the time it probably writes to that register.
A soft reset for example might only reset the registers and that might expose the OTP to whatever can probably access it (IOSU?).

 

[BurningDesire]

Why would you? I'm talking about glitching the chip which holds the OTP at the time it probably writes to that register.
A soft reset for example might only reset the registers and that might expose the OTP to whatever can probably access it (IOSU?).

So like holding the power button on a 3ds then going back to the home menu. The part when your at the grey screen with the power off button... would that be the point where we can access the registers if where in a game that has access to them?

 

[FR0ZN]

I'm talking about hooking yourself up to the reset line on the PCB and sending a (perfectly) timed pulse (while that register gets written) and praying that you might leave that register unwritten.
I don't know about the architecture of the 3DS, but my understanding is that there are two CPUs ? ARM11 and ARM9 ... I don't know what might happen when you pulse a reset on ARM9 while controlling ARM11, it probably resets the entire hardware.
But then again, this is just me thinking out loud about the 3DS on a Wii U forum

 

[BurningDesire]

I'm talking about hooking yourself up to the reset line on the PCB and sending a (perfectly) timed pulse (while that register gets written) and praying that you might leave that register unwritten.
I don't know about the architecture of the 3DS, but my understanding is that there are two CPUs ? ARM11 and ARM9 ... I don't know what might happen when you pulse a reset on ARM9 while controlling ARM11, it probably resets the entire hardware.
But then again, this is just me thinking out loud about the 3DS on a Wii U forum

Yes. ARM9 and ARM11 exist on 3ds. What exist on the Wii U though? I am new to the Wii U's hardware/software architecture

 

[n00b2015]

Use wbfs2fat, it changes the format to Fat32 without deleting any game, you can play GC games on a Fat32 HDD, but not on a WBFS HDD, that's why I did it a long time ago.
You can load games Wii games on the FAT32 HDD with Wii Backup Manager and also GC games with DMToolbox.


/////does it work with wii flow?////////

anyone, before i do this

 

[FR0ZN]

Yes. ARM9 and ARM11 exist on 3ds. What exist on the Wii U though? I am new to the Wii U's hardware/software architecture

CPU, GPU and somewhere in there is a ARM CPU which runs IOSU.

 

[AboodXD]

Use wbfs2fat, it changes the format to Fat32 without deleting any game, you can play GC games on a Fat32 HDD, but not on a WBFS HDD, that's why I did it a long time ago.
You can load games Wii games on the FAT32 HDD with Wii Backup Manager and also GC games with DMToolbox.


/////does it work with wii flow?////////

anyone, before i do this

IDK, but I think USB Loader GX will work.

 

[n00b2015]

thanx

 

[BurningDesire]

About otp the physical address for espresso otp is located 0x0c320000 - 0x0c400000 if we have where it is located why can we find the boot keys?

 

[Marionumber1]

About otp the physical address for espresso otp is located 0x0c320000 - 0x0c400000 if we have where it is located why can we find the boot keys?

The Espresso and Latte OTPs are not the same.

 

[BurningDesire]

The Espresso and Latte OTPs are not the same.

Whats the difference?

 

[FR0ZN]

Thats a pretty big range for a OTP right?

 

[BurningDesire]

The latte otp is located at 0x0d000000 has no one started to explore it?

 

[FR0ZN]

That would be to easy. I remember at the CCC congress marcan was talking about side channel attacks to get to the boot1 key ... and that was when they had IOSU access and stuff.
So it's probably not exposed there all the time but only during boot time and then deleted again once the console hands over execution to the kernel or whoever is controling the system during runtime.

 

[Marionumber1]

Whats the difference?

They are different pieces of hardware, mapped to different memory addresses, and with different silicon pathways to the PPC and ARM. ARM likely cannot access the Espresso OTP, and under normal operation, the PPC can't access the Latte OTP.

 

[Chuardo]

Use wbfs2fat, it changes the format to Fat32 without deleting any game, you can play GC games on a Fat32 HDD, but not on a WBFS HDD, that's why I did it a long time ago.
You can load games Wii games on the FAT32 HDD with Wii Backup Manager and also GC games with DMToolbox.


/////does it work with wii flow?////////

anyone, before i do this

Probably, I personally prefer CFG USB Loader, you can have Wii and GC games in the same Loader and it's my favorite Backup Loader, I would recomend you CFG USB Loader over WiiFlow or any other, but use the one that you really like and feels better to you.

 

[Celyn]

Probably, I personally prefer CFG USB Loader, you can have Wii and GC games in the same Loader and it's my favorite Backup Loader, I would recomend you CFG USB Loader over WiiFlow or any other, but use the one that you really like and feels better to you.

You can in USBloader GX too