Content Installation Okay, taking a break from the banner creator for a while. Thought I'd try and resurrect my motivation by looking back at the other side(s). One thing am I wondering about is, is the need for fakesigning content related to the System Menu? or do other parts of the system need it?http://forum.wiibrew.org/read.php?27,5433,5433#msg-5433Sat, 12 Sep 2026 13:05:15 +0200 Phorum 5.2.23 http://forum.wiibrew.org/read.php?27,5433,6962#msg-6962 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,6962#msg-6962
Quote
bushing
Put more simply: The Wii doesn't have a keyring of public keys it can verify against. It has one key. Adding support for multiple keys is harder than removing the signature check.
Fair enough. Was just an idea :-)]]> whodares SoftwareMon, 05 Jan 2009 12:25:04 +0100 http://forum.wiibrew.org/read.php?27,5433,6961#msg-6961 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,6961#msg-6961 bushing SoftwareMon, 05 Jan 2009 12:15:37 +0100 http://forum.wiibrew.org/read.php?27,5433,6938#msg-6938 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,6938#msg-6938* Encrypt data with your public key and decrypt it with your private key.
* Encrypt data with your private key and decrypt it with your public key.
Signatures are basically hashes encrypted with the private key.
Nintendo's public key is stored in boot1, boot2 and every IOS. You could easily modify it given that you can install titles on the NAND. But why would you want to that then?
You can already run code on both CPUs. Adding a homebrew key would just make things way more complicated. It's easier to just patch out the signature check or make it always return true (1 byte patch) .
And you can't just magically add a new key when you can't install titles on the NAND. It therefore doesn't help you to run your own code.]]> svpe SoftwareMon, 05 Jan 2009 00:28:22 +0100 http://forum.wiibrew.org/read.php?27,5433,6919#msg-6919 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,6919#msg-6919
From what I remember of PGP, you create a keyset (Public and Private). You distribute the public key to your friends, and you receive their public keys. You add your friends' public keys into a "key pool" so you can easily encrypt stuff for them and validate their messages.

Now I'm working on the assumption that the Wii has a "key pool", and it has Nintendo's public key listed in it (in order to validate incoming code signing). Could we not add a Homebrew public key to this pool so it would then validate code signed by either Nintendo or Homebrew.

It's not that you want to remove or edit Nintendo's public key (because you'd still want to be able to play official games), so regardless where this is stored doesn't matter.


I did have concerns on the piracy side of this, but considering they can already pirate everything anyway, I thought I'd ask.]]> whodares SoftwareSun, 04 Jan 2009 20:54:56 +0100 http://forum.wiibrew.org/read.php?27,5433,6915#msg-6915 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,6915#msg-6915 icefire SoftwareSun, 04 Jan 2009 20:35:58 +0100 http://forum.wiibrew.org/read.php?27,5433,6854#msg-6854 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,6854#msg-6854
1. The Wii has a private and public key
2. Nintendo have a private and public key
3. Nintendo signs content with their private key
4. The Wii validates signatures against Nintendo's public key

This means that Nintendo's public key must be registered within the Wii.

Would it not be possible to add a new "trusted" public key from a keyset we generate to the Wii's system? Then we could sign our own content properly.]]> whodares SoftwareSun, 04 Jan 2009 11:14:12 +0100 http://forum.wiibrew.org/read.php?27,5433,6821#msg-6821 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,6821#msg-6821
Quote
tona
Quote
WiiCrazy
By the way, what was the Nintendo's fix to the fakesigning bug?
Is there still exists a silly mistake like the initial twilight hack removal code?
Did they actually replace the strcmp with memcmp?
How else would they fix it? It's not like they need to write any new code or anything--there's nothing to screw up here.

Maybe sampling some fake signatures and just adding a few extra checks for them... I don't know, if I did know some arm assembly then in the first place I wouldn't have asked that question...

What we are talking about is the last step of a huge process... maybe the easisest part of it... I can't see any reason they might still fail in the other parts of that big picture...]]> WiiCrazy SoftwareSun, 04 Jan 2009 01:43:30 +0100 http://forum.wiibrew.org/read.php?27,5433,6706#msg-6706 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,6706#msg-6706 svpe SoftwareFri, 02 Jan 2009 22:43:56 +0100 http://forum.wiibrew.org/read.php?27,5433,6705#msg-6705 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,6705#msg-6705
Quote
WiiCrazy
By the way, what was the Nintendo's fix to the fakesigning bug?
Is there still exists a silly mistake like the initial twilight hack removal code?
Did they actually replace the strcmp with memcmp?
How else would they fix it? It's not like they need to write any new code or anything--there's nothing to screw up here.]]> tona SoftwareFri, 02 Jan 2009 22:42:11 +0100 http://forum.wiibrew.org/read.php?27,5433,6703#msg-6703 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,6703#msg-6703Is there still exists a silly mistake like the initial twilight hack removal code?
Did they actually replace the strcmp with memcmp?]]> WiiCrazy SoftwareFri, 02 Jan 2009 22:37:58 +0100 http://forum.wiibrew.org/read.php?27,5433,6631#msg-6631 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,6631#msg-6631
Does the strcmp from the Wii check lengths as well? I would assume so, and if it does, you still need to get the second byte on the real hash to equal 0.

Is that really what Datel did? Hmmm, maybe they found an easy way to get the 2nd byte of the hash to 0. Otherwise it wouldn't make sense that they just wouldn't try and get the first byte.]]> whodares SoftwareFri, 02 Jan 2009 08:43:40 +0100 http://forum.wiibrew.org/read.php?27,5433,6615#msg-6615 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,6615#msg-6615 bushing SoftwareFri, 02 Jan 2009 04:07:23 +0100 http://forum.wiibrew.org/read.php?27,5433,5829#msg-5829 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5829#msg-5829 whodares SoftwareWed, 24 Dec 2008 10:58:38 +0100 http://forum.wiibrew.org/read.php?27,5433,5828#msg-5828 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5828#msg-5828 bushing SoftwareWed, 24 Dec 2008 10:40:29 +0100 http://forum.wiibrew.org/read.php?27,5433,5826#msg-5826 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5826#msg-5826
Quote
tona
It's most certainly not just a simply coded workaround--not something you could do by just picking the right libogc functions.
Yeah, I realise that it would probably be the case. But I wasn't sure if it might have just been a data trick?]]> whodares SoftwareWed, 24 Dec 2008 10:13:27 +0100 http://forum.wiibrew.org/read.php?27,5433,5825#msg-5825 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5825#msg-5825
As far as I know, the new exploit is just another IOS bug that can be used to get "kernel mode" permissions. Once you have that in IOS, you can do pretty much whatever you want. I'd assume it's something of that sort.

It's most certainly not just a simply coded workaround--not something you could do by just picking the right libogc functions.]]> tona SoftwareWed, 24 Dec 2008 09:57:29 +0100 http://forum.wiibrew.org/read.php?27,5433,5824#msg-5824 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5824#msg-5824
I appreciate the details are currently not wanted to be made public, I have email and PM, and I understand if nobody wants to say anything at all.

As I said in my last edit, I might not understand how it works anyway.]]> whodares SoftwareWed, 24 Dec 2008 09:51:45 +0100 http://forum.wiibrew.org/read.php?27,5433,5823#msg-5823 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5823#msg-5823 tona SoftwareWed, 24 Dec 2008 09:38:56 +0100 http://forum.wiibrew.org/read.php?27,5433,5822#msg-5822 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5822#msg-5822
Quote
tona
Argon is just a modchip

Quote
tona
Quote

How about the shop channel? That's allowed to install content. I might try and disassemble that tonight.
Erm? It just uses ES_Add* calls. You don't need permissions for those AFAIK. You just have to provide a valid ticket/TMD/content.
lol, yeah, I think I'm losing the plot a bit :-)

Quote
tona
There is code in libogc for using "ISFS" (Available and useful on most IOS, possibly not the post-Oct23 update ones). patchmii uses /tmp, and there are lots of examples of using ISFS directly (I have a few in my code, conf.c reads directly, my region changer sets permissions and stuff, even, IIRC).
I knew it was there, just wasn't aware anybody had used it, but if you have successfully, then I guess that's all good :-)

Quote
tona
What exactly are you trying to do, again? If you can install a patched IOS (fakesigned) why can't you just ES_AddTitle your own fakesigned content?

Edit: You may want to refer to bushing's initial response for how you "should" install a title.
Basically, I'm just looking for other ways to install content. I'm still on v3.2E, so I have no problems with fakesigning, but if I am to build a channel toolkit, I want to look at alternative ways to get the channel installed. I'm not saying I'll be successful (hell, 90% of my other projects don't make it, why should this be any different ;-) ) but it can't hurt to find out.

Edit: Installing a patched IOS, while not able to install on everybody elses, might allow me to insert USBGecko debugging into the IOS, so when I try installing content I can see what happens where...

In truth, I think I might be getting out of my depth here, but I shall try and crack on regardless]]> whodares SoftwareWed, 24 Dec 2008 09:37:08 +0100 http://forum.wiibrew.org/read.php?27,5433,5820#msg-5820 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5820#msg-5820
Quote
whodares
Everywhere over this side of the pond only seems to only sell the Argon chips, but they sound like just mod chips, as opposed to reading/writing NAND (somebody please correct me if I'm wrong). They're all out of stock anyway :-(
Argon is just a modchip, but it's also used to refer to a firmware you can put on the infectus2.

Quote

How about the shop channel? That's allowed to install content. I might try and disassemble that tonight.
Erm? It just uses ES_Add* calls. You don't need permissions for those AFAIK. You just have to provide a valid ticket/TMD/content.

Quote

Do you know how permissions can be read/written on files and directories? I was thinking of writing a test app which created a directory in the /tmp folder, copy some files into it, then delete them, but I am wondering if that would be a fair test against creating a folder in the /title directory.
There is code in libogc for using "ISFS" (Available and useful on most IOS, possibly not the post-Oct23 update ones). patchmii uses /tmp, and there are lots of examples of using ISFS directly (I have a few in my code, conf.c reads directly, my region changer sets permissions and stuff, even, IIRC).

Quote

I need to delve into IOS and work out where the security stuff lies, I could possibly use PatchMii to download an IOS, patch it so every UID has access to everything. Although I'm not really sure where that will get me.
Me neither. What exactly are you trying to do, again? If you can install a patched IOS (fakesigned) why can't you just ES_AddTitle your own fakesigned content?

Edit: You may want to refer to bushing's initial response for how you "should" install a title.]]> tona SoftwareWed, 24 Dec 2008 09:12:18 +0100 http://forum.wiibrew.org/read.php?27,5433,5819#msg-5819 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5819#msg-5819
How about the shop channel? That's allowed to install content. I might try and disassemble that tonight.

Do you know how permissions can be read/written on files and directories? I was thinking of writing a test app which created a directory in the /tmp folder, copy some files into it, then delete them, but I am wondering if that would be a fair test against creating a folder in the /title directory.

I need to delve into IOS and work out where the security stuff lies, I could possibly use PatchMii to download an IOS, patch it so every UID has access to everything. Although I'm not really sure where that will get me.]]> whodares SoftwareWed, 24 Dec 2008 08:47:46 +0100 http://forum.wiibrew.org/read.php?27,5433,5790#msg-5790 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5790#msg-5790
The actual uid of the IOS title is not usually used AFAIK... IOS itself just happily uses uid 0. Although someone more knowledgeable than me about IOS might correct me.]]> comex SoftwareWed, 24 Dec 2008 02:49:06 +0100 http://forum.wiibrew.org/read.php?27,5433,5770#msg-5770 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5770#msg-5770
The Certs are already on the NAND, and I can find the TMD and TIK for a selected IOS. I would have thought the IOS user would have NAND access.

Anyway, I'll try and grab me a cheap Wii after Christmas and give it a whirl.]]> whodares SoftwareWed, 24 Dec 2008 00:12:25 +0100 http://forum.wiibrew.org/read.php?27,5433,5719#msg-5719 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5719#msg-5719
On the other hand if you have an exploit that gives you NAND access, then adding a new title manually would save you from having to modify an existing IOS, which would be nice.

Quote

What do you guys use to backup and restore your NAND when things go horribly wrong? or do you just wing it and hope for the best?

Infectus?]]> comex SoftwareTue, 23 Dec 2008 17:17:39 +0100 http://forum.wiibrew.org/read.php?27,5433,5700#msg-5700 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5700#msg-5700
1. Change active user to Super User (if there is one, try System Menu or Shop Channel if not)
2. Open /sys/uid.sys, and write a new entry in it
3. Go to the /title/00010001 folder and attempt to create a new folder, and subfolder Content
4. Copy down the content files, and the tmd
5. Go to the /ticket directory and generate a ticket

Are file/dir permissions similar to Windows where you can specify which users can access the file, and whether they can create/read/write/delete/etc.? or is it a simple case of whomever created it owns it, and only they can manipulate it?

What do you guys use to backup and restore your NAND when things go horribly wrong? or do you just wing it and hope for the best?

PS. Could a mod move this thread to the IOS, considering if doesn't actually have anything to do with the Sys Menu now :-)]]> whodares SoftwareTue, 23 Dec 2008 12:53:47 +0100 http://forum.wiibrew.org/read.php?27,5433,5694#msg-5694 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5694#msg-5694When a new title is registered, it is given a "UID" (/sys/uid.sys), which is used to represent ownership in the filesystem. The title data directory is owned by this UID, and when one Identifies as this title, all fs operations are done under that UID.

Adding a uid to uid.sys isn't necessarily a daunting task, though, and I think if you completed that part successfully (regardless of setting up data dir perms) you would be able to install a title in a working fashion from the FS.

Edit: Oh, and it should be a given that you'd need sufficient permissions to create and edit all these files/dirs, etc.]]> tona SoftwareTue, 23 Dec 2008 11:07:14 +0100 http://forum.wiibrew.org/read.php?27,5433,5611#msg-5611 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5611#msg-5611
Thx]]> whodares SoftwareMon, 22 Dec 2008 08:23:46 +0100 http://forum.wiibrew.org/read.php?27,5433,5609#msg-5609 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5609#msg-5609 bushing SoftwareMon, 22 Dec 2008 06:21:10 +0100 http://forum.wiibrew.org/read.php?27,5433,5448#msg-5448 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5448#msg-5448
I assume there's safe guards from just creating the files on the NAND without going through the "registration" process?]]> whodares SoftwareSun, 21 Dec 2008 10:29:31 +0100 http://forum.wiibrew.org/read.php?27,5433,5441#msg-5441 Re: Content Installationhttp://forum.wiibrew.org/read.php?27,5433,5441#msg-5441 bushing SoftwareSun, 21 Dec 2008 05:35:19 +0100