Hacking WUPinstaller (Update/Title installer) - modded to work on 5.4

Brainsick

Active Member
Newcomer
Joined
Jan 16, 2016
Messages
31
Trophies
0
XP
64
Country
United States
Both are freezing instantly. Very odd and irritating. I'm still baffled about the error code when trying to run the code532.bin file too... <scratching head>. I appreciate the help. I always try to read up on everything so I'm not ignorant going in to things like this. I successfully spoofed from 5.3.2 to 5.5.1 with the newer wupinstaller, but I need to get a good one running so I can update SSB and I'm at a roadblock here. I truly appreciate the replies and help.
 

rumblpak

Well-Known Member
Newcomer
Joined
Apr 12, 2007
Messages
53
Trophies
0
XP
242
Country
United States
The changes to the race exploit only allow for more likely success of ksploit itself, the addresses are still the same. The problem on 5.4 is the error code he hooks doesn't function properly, as soon as you hit a button, an OSFatal is thrown, halting the installation. By preventing this from happening so a person can get to the home menu, this fix allows the WiiU's background install process to continue. It's obviously not an ideal solution, but it's at least something until he can fix it properly.

I'm actually more curious about why it is failing than anything else but I don't have a development platform setup right now to test things. I'm not questioning whether it works or not, mostly just trying to understand the changes that were made and why they work. Based on what you changed it shouldn't have had a major affect on it other than bypassing register values that are checked to continue. Based on what you commented out, its much more likely that when this code is executed asynchronously that is throwing the OSFatal (which is why I probably didn't see anything at an initial glance). The code that is probably actually the root cause of why we see OSFatal is here:

Code:
mr 3, 30
mr 5, 31
nop
nop
nop
cmpwi 3, 0
bne error

Since you pass a null, this passes (as 0) and continues, but its more important to understand why this check is failing in 5.4 than to just bypass it.
 
Last edited by rumblpak,
  • Like
Reactions: Kakkoii

Kakkoii

Old fart
OP
Member
Joined
Sep 14, 2007
Messages
631
Trophies
0
XP
586
Country
Canada
I'm actually more curious about why it is failing than anything else but I don't have a development platform setup right now to test things. I'm not questioning whether it works or not, mostly just trying to understand the changes that were made and why they work. Based on what you changed it shouldn't have had a major affect on it other than bypassing register values that are checked to continue. Based on what you commented out, its much more likely that when this code is executed asynchronously that is throwing the OSFatal (which is why I probably didn't see anything at an initial glance). The code that is probably actually the root cause of why we see OSFatal is here:

Code:
mr 3, 30
mr 5, 31
nop
nop
nop
cmpwi 3, 0
bne error

Since you pass a null, this passes (as 0) and continues, but its more important to understand why this check is failing in 5.4 than to just bypass it.
I would like to know why it's failing too, but I don't have enough knowledge about this stuff yet to do it properly. Where about in the code are you deriving that ASM from?
One thing that confuses me also is how the offsets added to the base_addr var work. I tried various methods of comparing to the latest symbol tables I could find online, but the base_addr + 0x?? of say mpinstall compared to mpistatus does not seem to be anywhere near same amount it is in the sys tables I've looked at. Perhaps it is just because they are too old, but I'm not sure how I can get newer ones... I'd like to learn more though.
 
  • Like
Reactions: Brainsick

Brainsick

Active Member
Newcomer
Joined
Jan 16, 2016
Messages
31
Trophies
0
XP
64
Country
United States
I too don't know as much as I would like to know about this subject. However, it seems the old version on wiibrew MIGHT be working. Everything went as planned, ran it 2x and I am back at the Wii U menu now waiting about an hour to see if the SSB update has actually installed. I work in 7.5 hours, but I guess it is coffee time. Fingers crossed as I wait.... Thanks for your time @Kakkoii and I will definitely report back if it works.
 
Last edited by Brainsick,
  • Like
Reactions: Kakkoii

Kakkoii

Old fart
OP
Member
Joined
Sep 14, 2007
Messages
631
Trophies
0
XP
586
Country
Canada
If you're still wondering about that, it's mcppatch.s Lines 57 to 64 and lines 95 to 102
Oh, I didn't even think to look in there since mcppatch.S isn't referenced by anything else. I'm guessing it's what's used if you want to regenerate mcppatch.h, but how you would go about that I do not know.

edit: Alright, I've figured out how to compile the mcppatch... File matches the bytes he has in the .h file. Woot. Will look into this some more later.
 
Last edited by Kakkoii,

rumblpak

Well-Known Member
Newcomer
Joined
Apr 12, 2007
Messages
53
Trophies
0
XP
242
Country
United States
Oh, I didn't even think to look in there since mcppatch.S isn't referenced by anything else. I'm guessing it's what's used if you want to regenerate mcppatch.h, but how you would go about that I do not know.

edit: Alright, I've figured out how to compile the mcppatch... File matches the bytes he has in the .h file. Woot. Will look into this some more later.

Sorry about that, had to sleep for work this morning. Yeah its in the mcppatch.S. I was referencing the first event of it at line 57 because you said it failed rather quickly; however if its taking a bit longer to fail I can look into why it would fail during the install later.
 

Kakkoii

Old fart
OP
Member
Joined
Sep 14, 2007
Messages
631
Trophies
0
XP
586
Country
Canada
Sorry about that, had to sleep for work this morning. Yeah its in the mcppatch.S. I was referencing the first event of it at line 57 because you said it failed rather quickly; however if its taking a bit longer to fail I can look into why it would fail during the install later.
Yeah no worries, I assumed as much. It is indeed failing within a few frames of pressing the home button to activate the hook. It's very consistent, no matter what's being installed. Though oddly it still manages to install a bit of stuff if it's small enough, like the title spoof.
 

Enaske

Well-Known Member
Member
Joined
May 25, 2015
Messages
233
Trophies
0
Age
33
XP
144
Country
Yeah no worries, I assumed as much. It is indeed failing within a few frames of pressing the home button to activate the hook. It's very consistent, no matter what's being installed. Though oddly it still manages to install a bit of stuff if it's small enough, like the title spoof.

Can you tell me, how to host the code532.bin file? Just hosting with Apatache dosn't work since we can't call the bin532 file dirrectly. So I guess we have to wrap something around it?
 

Kakkoii

Old fart
OP
Member
Joined
Sep 14, 2007
Messages
631
Trophies
0
XP
586
Country
Canada
Can you tell me, how to host the code532.bin file? Just hosting with Apatache dosn't work since we can't call the bin532 file dirrectly. So I guess we have to wrap something around it?
I'm not very familiar with 5.3.2 loading methods, but here's the old 5.3.2 payload file that I've replaced the wupinstaller code in. Though I don't fully understand how this particular exploit works, so there's a good chance it won't work...
 

Attachments

  • wup5.3.2.zip
    11.4 KB · Views: 95

Kakkoii

Old fart
OP
Member
Joined
Sep 14, 2007
Messages
631
Trophies
0
XP
586
Country
Canada
Says Code not Found. File is called code.bin and code532.bin
:wtf: none of the .html files I gave even have code that could output information like that. That's weird. Try placing the code523.bin I gave in the last page into the same folder I guess?
 

Enaske

Well-Known Member
Member
Joined
May 25, 2015
Messages
233
Trophies
0
Age
33
XP
144
Country
Yeah,

I have them all in the same ROot folder.

Payload532.html
index.html
frame.html
code532.bin
code.bin

And Screen say: Code not found
 

Kakkoii

Old fart
OP
Member
Joined
Sep 14, 2007
Messages
631
Trophies
0
XP
586
Country
Canada
Yeah,

I have them all in the same ROot folder.

Payload532.html
index.html
frame.html
code532.bin
code.bin

And Screen say: Code not found
Did you capitalize that P in Payload532.html by mistake, or is the file written like that? Because that could be why. You could also try just deleting index and frame, and rename payload532.html to index.html
 

Enaske

Well-Known Member
Member
Joined
May 25, 2015
Messages
233
Trophies
0
Age
33
XP
144
Country
index.html same problem and payload532.html = small "p" sorry by spell mistake here.

But same on all : Code not found
 
Last edited by Enaske,

Enaske

Well-Known Member
Member
Joined
May 25, 2015
Messages
233
Trophies
0
Age
33
XP
144
Country
From what I understood is that code.bin is 5.4 and code.elf = 5.3.2 true? Can I simply rename your file? :o
 
General chit-chat
Help Users
    SylverReZ @ SylverReZ: Chilli dog