Hacking Wii U TLS Keys

[gudenau]

I would like to work on some networking stuff for the Wii U, but for my project I would need access to the TLS keys that the Wii U uses to connect to the Nintendo servers. Since the kernel is now out, I was wondering if anyone could aid me in getting them from either of my Wii Us.

 

[Deleted User]

dump then using DDD, or get them via JNUS

 

[gudenau]

dump then using DDD, or get them via JNUS

IIRC, they are encrypted past that and DDD could not dump system titles.

 

[crediar]

http://terranigma.be/ccerts.rar

 

[gudenau]

http:///ccerts.rar

Thanks, might not be the best idea to leave that link though.[/QUOTE]

 

[KiiWii]

http://terranigma.be/ccerts.rar

Trusty Crediar!

Hope this works for the OP.

Off topic:
No idea if you will reply but: do you have anything in the works for wii u at all you could tantalize us with?

 

[alkar]

Is there any way to inject custom cert to the Wii U so we can sniff trafic ?

 

[Deleted User]

In some apps, yes. For the full thing, we'd need boot time IOSU.

 

[gudenau]

Is there any way to inject custom cert to the Wii U so we can sniff trafic ?

Here is my sullution, change everything to http and MITM it, then write a server that takes care of the SSL stuff.

 

[Deleted User]

Like I said

 

[alkar]

I'd like to sniff eShop but I don't see how to rename https to http without the eShop ELF/executable.

Is there such a thing ? is the eShop app dumpable with ddd ?

 

[Deleted User]

..Yes!

 

[aracom]

Here is my sullution, change everything to http and MITM it, then write a server that takes care of the SSL stuff.

But that's not possible in many cases, since we can't replace RPX without losing online functionality, and that's what we want in the first place.

Is there any solution to that problem already?

 

[gudenau]

But that's not possible in many cases, since we can't replace RPX without losing online functionality, and that's what we want in the first place.

Is there any solution to that problem already?

Search RAM and change all https strings that could be used as a url to HTTP and insert a null at the end of the string for padding.

 

[aracom]

Search RAM and change all https strings that could be used as a url to HTTP and insert a null at the end of the string for padding.

Oh, OK, I know that, but it's not an option for e.g. the server splatfest files are stored on, since it sends a request directly at boot time, so I'm not able to patch it like that.