Hacking Wii U Menu Discoveries

[C0mm4nd_]

So in this post, I'll write all my discoveries 'bout Wii U Menu

Location:
storage_mlc/sys/title/00050010/10040200 (EU)
storage_mlc/sys/title/00050010/10040100 (USA)

"Directories"

meta/
     iconTex.tga - An icon with the Wii U Logo, not used though
     bootTvTex.tga - Black, not used
     bootDrcTex.tga - Black, not used
     bootLogoTex.tga - "Nintendo" not used though
     bootMovie.h264
     meta.xml - WUP-N-HASP (EU) Name: "Wii U Menu/Menu Wii U"
code/
     title.tmd
     title.fst
     preload.txt - "app.xml cos.xml men.rpx"
     men.rpx - Should be the menu executable
     cos.xml
     app.xml
content/  - good part
     factory/
           layout.txt - should be the default menu scheme for JPN (?)
     common/system/
           timeStamp.txt - (?) It contains a date and an hour (Seeming the time when it was builded?)
            revision.txt - 38945 (?, version)
             RegionLang.txt - cLangXX(for me En) cRegionXX(for me Eu) (region and language for Wii U Menu)
     common/sound/men/
           cafe_barista_men.bfsar (Should be the default sound)
           stream/BGM_SET_ACS.bfstm (Should be the account selection?)
     common/package - textures?
           Set2.pack
           Men2.pack - TV Textures (Miiverse plaza)
           Men.pack - DRC Textures (Home Menu, this should be modified for custom themes)
           Acs2.pack
     XX(Eu for me)/Model
           ConfigTvCap_XX.szs
           AccountTvCap_XX.szs
     XXYYYY(XX= region YYYY= language)/Olive
           1stNUP.xml (Miiverse Plaza offline)
     XXYYYY/Message
           AllMessage.szs - Menu messages

 

[Ryccardo]

content/{languages}/*.szs are SZS/Yaz0 compressed files which contain 2 layers of Sarc archives. Inside is the text!

 

[C0mm4nd_]

content/{languages}/*.szs are SZS/Yaz0 compressed files which contain 2 layers of Sarc archives. Inside is the text!

, unpacking soon

--------------------- MERGED ---------------------------

content/{languages}/*.szs are SZS/Yaz0 compressed files which contain 2 layers of Sarc archives. Inside is the text!

ConfigTvCap and AccountTvCap contains gsys.brfes
(btw, I know there's an utility for handling Wii U Formats but I don't remember the name)

--------------------- MERGED ---------------------------

AllMessages.szs contains over 9000 .msbt and .brfes

 

[Ryccardo]

AllMessages.szs contains over 9000 .msbt and .brfes

And most of them are duplicates and/or things that are actually part of the settings instead of Home (maybe used only for the initial setup)...

 

[C0mm4nd_]

Btw boot screens shouldn't be sign checked

 

[Mega-Mew]

content\Common\Package\Men2.pack_extracted\Common\Model\LoungeFloor.szs
is the model of the place with all the Mii.

Here the result of one of my test with a modified texture.
https://twitter.com/MegaMew_/status/810849179463454720

 

[C0mm4nd_]

content\Common\Package\Men2.pack_extracted\Common\Model\LoungeFloor.szs
is the model of the place with all the Mii.

Here the result of one of my test with a modified texture.
https://twitter.com/MegaMew_/status/810849179463454720

asd, btw 1stNUP.xml is what the Mii (offline mode) are saying
And now we know that Men2.pack is the TV pack
and Men.pack is the DRC pack

 

[Arck]

content\Common\Package\Men2.pack_extracted\Common\Model\LoungeFloor.szs
is the model of the place with all the Mii.

Here the result of one of my test with a modified texture.
https://twitter.com/MegaMew_/status/810849179463454720

lol nice meme

how did you inject the file back ?

 

[C0mm4nd_]

lol nice meme

how did you inject the file back ?

Repacking all and replacing

--------------------- MERGED ---------------------------

content\Common\Package\Men2.pack_extracted\Common\Model\LoungeFloor.szs
is the model of the place with all the Mii.

Here the result of one of my test with a modified texture.
https://twitter.com/MegaMew_/status/810849179463454720

Btw, is that your sysNAND or your redNAND?

 

[Arck]

Repacking all and replacing

no joke.

I mean which software to inject it back ?

Not the way to extract/repack

 

[CatmanFan]

So can we just edit the Wii U Menu files, transfer them back to the Wii U and have a modified Wii U Menu? It can have a risk of brick though...

 

[Mega-Mew]

Btw, is that your sysNAND or your redNAND?

sysNAND.

Just used Cafiine.

 

[C0mm4nd_]

So can we just edit the Wii U Menu files, transfer them back to the Wii U and have a modified Wii U Menu? It can have a risk of brick though...

I actually dunno if they're sig checked.
Btw, redNAND modding should be safe

 

[CatmanFan]

I actually dunno if they're sig checked.
Btw, redNAND modding should be safe

I know that already.

Also, I think only the bootscreen and icon should be sig checked, I don't even know.

 

[Arck]

sysNAND.

Just used Cafiine.

thanks

I know it's not hard to see which file do what, I just want to search new file format to write tool

 

[C0mm4nd_]

sysNAND.

Just used Cafiine.

So if we use CBHC to load SDCafiine and then the patched/unpatched home menu... permanent themed menu

 

[Arck]

So if we use CBHC to load SDCafiine and then the patched/unpatched home menu... permanent themed menu

Or whatever coldboothax with home menu file replaced will work.

--------------------- MERGED ---------------------------

So if we use CBHC to load SDCafiine and then the patched/unpatched home menu... permanent themed menu

btw it's really a bad way, why would you use sdcafiine if we have sign patch directly when we boot ?

 

[C0mm4nd_]

Or whatever coldboothax with home menu file replaced will work.

--------------------- MERGED ---------------------------


btw it's really a bad way, why would you use sdcafiine if we have sign patch ?

dunno, they can be sig checked

--------------------- MERGED ---------------------------

Or whatever coldboothax with home menu file replaced will work.

--------------------- MERGED ---------------------------


btw it's really a bad way, why would you use sdcafiine if we have sign patch directly when we boot ?

For now that's only redNand

 

[lebrawurschd]

we dont have sign patch directly when we boot cbhc boot order autoboot haxchi -> cfw
you still have to be careful about messing around with system files
its always better to have a backup and a working hardmod xD

 

[C0mm4nd_]

we dont have sign patch directly when we boot cbhc boot order autoboot haxchi -> cfw
you still have to be careful about messing around with system files
its always better to have a backup and a working hardmod xD

Or using SDCafiine