Wiibrew Forums - Software

ANN: new version of libcwiid port with support for all Wiimote functions (no replies)

bukvicic — Sat, 19 Sep 2015 00:16:18 +0200

Hopefully this is the right forum for the following post... If not, apologies for the noise...

Back in 2011 Virginia Tech's Linux Laptop Orchestra (L2Ork) created a fork of the libcwiid open-source project that was abandoned by its original author. Since 2011, the library has been updated to support all Nintendo-branded controllers, including Wiimote, Nunchuk, Plus, Wii Fit, Classic, as well as the more recent Wiimote with MotionPlus Inside. The library also offers advanced features that as far as I can tell are still absent in other open source libraries, such as comprehensive out-of-box support for MotionPlus Inside version of Wiimotes, as well as interleaved mode that allows for use of both MotionPlus and extensions like Nunchuk and Classic. For more info, please visit L2Ork's software page (look under "Individual Externals" section) or check out the latest git snapshot from the pd-l2ork project found at [github.com]. Although some of the GUI demos that come with the library have not been fully updated to support all the latest features, the library has been extensively tested within L2Ork with up to 18 co-located Wiimotes connected concurrently during a live performance.

Best,

Ico

About GC - GBA link cable (2 replies)

Ryuryu — Wed, 08 Jan 2014 12:00:45 +0100

Please tell me how access to GBA using GC - GBA link cable.

What's the difference between IOS,cIOS,MIOS and cMIOS? (3 replies)

syc20099 — Tue, 16 Jul 2013 04:45:10 +0200

I have some questions about difference between IOS, cIOS , MIOS and cMIOS. I'm still confusing and I know cIOS is not our rule.
So, what's the difference between does 4? And what are they do in wii and homebrew applications?

Is there any way you can downgrade to System Menu 1.0? (4 replies)

keoghjacob — Sat, 19 Jan 2013 22:34:19 +0100

Is there a way that one could downgrade to the "Launch Menu" System Menu 1.0 w/out bricking your wii?

Wii disc unused areas seemingly random padding? (no replies)

gripple — Sun, 25 Nov 2012 23:32:54 +0100

Is the non-game data in a partition random? It's formatted the same as game data (ie every 32KiB is 1KiB of hashes, 31KiB data). After decrypting it it seems random, but it could be any number of things. Is there definitive evidence that it's random and can't be generated, or previous reverse-engineering progress worth reading? I can't find anything on the subject.

Learn how to reverse-engineer (no replies)

WojciechBusz — Mon, 17 Sep 2012 14:16:34 +0200

I just want to let you know about the upcoming issue of Software Developer's Journal. SDJ is an on-line magazine aimed at programmers. The upcoming issue will teach you how to reverse engineer software and malware with IDA and OllyDbg.

You can download a free teaser here: [sdjournal.org]

The issue will be live on September 22nd.

SSL Certificates rootca/clientcakey/clientca dumping (no replies)

Nadd — Mon, 27 Aug 2012 00:08:17 +0200

Hello,
I'm trying to figure out if and how its possible to dump these 3 .cer files from my own wii by nand dump,
I tried several tools to extract certain .app files and done some research on the wiibrew wiki regarding how wc24 connect works.
And opened some of the nand dump's files with a wii partition editor in which I a tree of 3 certificate structures, but I'm not sure if those were the ones and even if they are I couldn't separate the keys from each other...

My question is if it's possible to extract the root certificate, and the private and public wii certificate using the nand from the wii I own or if I need a different approach to this?

I used bootmii to extract the nand.bin and keys.bin, I also have ripped a file called device.cert with a different HB app.

EI_OSABI in syscall PPC_boot (3 replies)

arasium — Tue, 07 Feb 2012 15:49:07 +0100

Hi,

i'm actually trying to understand how the ios kernel works. I've notice that the EI_OSABI of the elf header checked in PPC_boot syscall is compared to the value 61.

What is this value? I've tried to find it in specific elf for PPC specification, but indicated values doesn't match to 61.

Edit: To add, the e_machine is set to ARM???!!!! This should be PPC no?

Thanks

Mailbox Bomb (1 reply)

SifJar — Thu, 10 Nov 2011 15:31:23 +0100

It seems giantpune and crediar have been working on something pretty cool:

[www.youtube.com]

Quotes from twitter:

Quote

@giantpune
anybody wanna buy an exploit for system menu 4.3?

Quote

@crediar
Better get rid of all your stockpiled exploit-Wii games, they're going to be worthless soon! -> goo.gl/t0jnc and remember, we work for tips!

Quote

@crediar
You just have to copy a prepared file onto your SD card. That's it!

Looks impressive. I'll update this post when it gets released.

WiiBoard Battery Level wrong (1 reply)

alf_red — Tue, 26 Jul 2011 13:08:41 +0200

Hi,

not sure if this is the right forum, but here goes:

I have been using the Wii Balance Board as input device for a PC, but cannot read the battery level.
I have tried this with the wiiuse library and the wiidevicelibrary, with the same results.
Since the Board appears as WiiMote, I have been using status requests to read the battery level in the same way as you would use on a normal WiiMote.

On the Wiimote it works, on the Board I always get a constant level (about 95%), independently of how low the battery voltage is.

Has anyone the same problems or did someone get this to work correctly?

RFC & regards,

ALF

What is this register? (no replies)

arasium — Mon, 09 May 2011 10:50:15 +0200

Hello,

int he boot2 arm header (the elf launcher), there are a piece of code wich write/read to/from 0xD8B4074.

Do you know what is this register?

[Resolved] Position dependent or not? (3 replies)

arasium — Tue, 03 May 2011 10:30:01 +0200

Hi,

i'm trying to understand how the elf loader at the beginning of the app file (the ES, FFS, IOSP one) works.
Referring to wiibrew and the code, it seems to be position independent.

For example, i've this:

LDR R12, =(sub_8C+1 - 0x448)
ADD R12, R12, PC

And sub_8C = 0x8C

The ADD instruction is at the 0x440 (so the PC is at the 0x448 offset) and R12 is the position independent address of sub_8C.

This is ok for me.

But i've also found this at the begining of the binary:

BL sub_60

This isn't position independent.... How can this works?

Smash Stack PAL/Korean (9 replies)

SifJar — Sun, 14 Jun 2015 02:56:19 +0200

Just putting this out there: [www.youtube.com]

Giantpune has ported Smash Stack to PAL and Korean (same stage apparently works for both, which is handy :P)

He says he has made a version that works with no SSBB savefile on the Wii, and another that works if there is a savefile.

IRC log:

[14:01:33]  [www.youtube.com]
[14:05:22] <+giantpune> actually, this is my pal version. turns out the same exact stage works to crash both version of the game
[14:10:58] <+giantpune> LOL. it looks like both my pal versions of the exploit work on the KOR version of the game. i made 1 version that works if there is no save file present on the wii and one version that does
[14:11:12] <+giantpune> if there is a save file^

Files aren't available for download yet, but once they are you can be sure you'll find the links at the WiiBrew wiki and probably in this thread too.

EDIT: It has been released. Grab it here: [giantpune.zzl.org]

Wii Shop Channel question (2 replies)

metroid_maniac — Tue, 18 Jan 2011 14:01:16 +0100

A loooooooong time ago, Nintendo made it impossible to change your Wii Shop Channel region. How does Nintendo identify your console?

Wii Balance Board wrong Data address on documentation (1 reply)

needle — Mon, 11 Jul 2011 16:27:01 +0200

Hi all,

first I'd like to thank the WiiBrew community for all the work they have done !

While working on a project using a Wii Balance Board I found that my Balance Board was not answering its data information on 0xA40008 but on 0xA40000.

Does it have ever be reported ? Is there a mistake on wiki page : [wiibrew.org] ?

Greetings,

needle

What happens if you try to load a title with corrupted metadata? (1 reply)

metroid_maniac — Thu, 06 Jan 2011 14:25:35 +0100

If you try to edit the TMD for a title, such as the HBC and you just mess up, creating an unreadable TMD, what happens? Does the Wii Menu not see it, does the Wii Menu banner brick, does the Wii Menu choke on it or does nothing happen? The needed IOS is specified in the TMD, so the Wii Menu would likely freeze at some point, probably when trying to reload the IOS to the one the channel wants. And what happens when Boot2 tries to load a System Menu with a malformed TMD

TMD - Maximum version? (2 replies)

metroid_maniac — Wed, 05 Jan 2011 19:48:22 +0100

Is there a maximum version a TMD may say a title has?

Insert Wii Startup Disc? (1 reply)

Dr.MarioX — Thu, 30 Dec 2010 00:02:49 +0100

I'd really like to see a video of this message- I'm tired of all the screenshots. And after reading HackMii's blog entry on it, I've become very interested in finding out more about it. I've read on Wii Brew's Wiki that IOS4 is used for this Error Message. Does that mean it is possible for regular Wii consoles not in this (I'm guessing prototype) state to access this screen? And has anyone ever tried to load a disc with a title ID 'RAAE' before into a Wii? It should refuse to load a disc like that.

Idea for new Wii exploits? (34 replies)

XICO2KX — Tue, 07 May 2013 13:49:05 +0200

Hello! :)
I was reading something about the Photo Channel on Wikipedia, and it says that it can read the following formats:
JPEG, JPG, MOV, AVI, MP3, AAC, M4A
And it also mentions that the current version v1.1 was last updated on December 10, 2007...
So, in theory, all the vulnerabilities discovered for those file formats since then should still be unfixed! :O
Here's just a few examples: :P
* WAV
* MJPEG
* M4A
* AAC
I know that all these exploits are platform/implementation dependent... :/
But who knows, maybe the programmers at Nintendo made similar mistakes! :)
Has anyone tried testing something like this yet? ^_^

Wii connect 24 useragent (5 replies)

jfmherokiller — Sat, 02 Oct 2010 19:19:08 +0200

I found the current user agent of the wii connect 24 service

User-Agent: WiiConnect24/2.2.255.0

the way I figured out the user agent of the wii was with fiddler and setting the proxy settings on the wii.
post any ideas on how we should try to use it.

Wii Debugging? (9 replies)

dashxdr — Tue, 21 Sep 2010 19:49:43 +0200

I'm wondering if a Wii debugger exists or could be made that could be active while a program is operational? It'd be nice to be able to freeze the CPU, look around memory, disassemble code, single step, but breakpoints, stuff like that.

It seems to me some sort of terminate but stay resident approach could work, maybe some sort of Wifi packet mechanism could be used for communication with a remote host. A packet could be sent to the Wii using the Wii's MAC address, and the TSR could pick it up and respond to debug style requests in the body of the packet.

Wii Disc format infos (2 replies)

arasium — Mon, 27 Sep 2010 09:04:23 +0200

I've read this page on wiibrew: [www.wiibrew.org]

But i still have questions about the disc format.

What are exactly the "Partitions information" (i don't uderstand what is the Total 2nd partitions in the disc (optional) and the offset associated).

Is each "Partition info table" composed of only "Partition table entry"(ies)?
In the case of the "Total 2nd partitions" filled with a value, it means that each partition has is own partition table?

Thank

Find wireless card code (no replies)

Possa — Thu, 19 Aug 2010 17:09:12 +0200

Hi,
if I want the code for managing the wireless card I need to find it in the System Menu.
Does anyone here know how to do? The first step!

I have to reverse the backup made with BootMii?
Which program do you suggest/recommend?

Or maybe has some piece of code ...

signed binary representation (3 replies)

arasium — Wed, 21 Jul 2010 10:02:21 +0200

Hi everybody.

I've this piece of code in the DI Module:

var_30= -0x30
var_2C= -0x2C
var_28= -0x28

PUSH    {R4-R6,LR}
SUB     SP, SP, #0x20
MOVS    R4, R1
MOVS    R1, #0x58 ; 'X'
MOV     R6, SP
NEGS    R1, R1
LSLS    R3, R3, #0x18
MOVS    R5, R0
STRB    R1, [R6,#0x30+var_30]
STR     R4, [SP,#0x30+var_2C]
STR     R2, [SP,#0x30+var_28]
CMP     R3, #0

Then the SP register is passed to the HandleDiCommand function.
So my question is about R1 and the di command associated.
Why doing "NEGS R1, R1" and then "STRB R1, [R6,#0x30+var_30]"? If i'm correct, the NEGS will only modify the MSBit.

So, i will have: R1 = 0b10000000 00000000 00000000 01011000

But then, if we only store one byte in the [R6,#0x30+var_30], why doing the NEGS before?

Perhaps the signed values aren't just with a sign bit (One's Complement or two's), and in this case, the NEGS have a real goal :)

Please help me.

Can someone name the IOS modules? (3 replies)

Mathew_Wi — Fri, 02 Jul 2010 09:17:27 +0200

I would just like to know what modules there is in this IOS. (IOS70)

If you can, can you just name is like this if you know it?
I only know the DI module is 00000002
00000000... (64 bytes)
00000001... (33368 bytes)
00000002... (27796 bytes) (DI)
00000003... (15352 bytes)
00000004... (10888 bytes)
00000005... (172344 bytes)
00000006... (373156 bytes)
00000007... (62896 bytes)
00000008... (447868 bytes)
00000009... (42572 bytes)
0000000a... (30584 bytes)
0000000b... (19184 bytes)
0000000c... (28472 bytes)
0000000d... (521008 bytes)
0000000e... (168636 bytes)

{MOVED TO REVERSE ENGINERING} NAND Dump Reading (8 replies)

NotAWiiHacker — Thu, 24 Jun 2010 18:44:44 +0200

So we've all heard about Bushings amazing work on the wii and team Twiizers and Twizzlers (forgive my spellings and great jobs) and they sometimes have a NAND Dump to work on and find holes in, but I was wondering if anyone knows how to make a NAND Dump readable? I've Tried a Hex Editor (and it in Binary mode) to no luck. So could anyone tell me how to do this to a NAND dump or if there is even a way to do it.

Best regaurds!

Wii Exploit Questions (2 replies)

SifJar — Thu, 24 Jun 2010 18:38:19 +0200

I have been reading a bit lately about PSP exploits and also on HackMii about the STM Release Exploit. And I have a few questions about Wii exploits (e.g. Twilight Hack, not IOS exploits, what would be called on PSP "user mode exploits")

1. How can the "return address" (assuming that's what its called on Wii) of the Wii be monitored? USBGecko I assume?
2. Is there a way you can find out all functions imported by a DOL?
3. In the STM Release Exploit HackMii post, it talks of how it is in Twilight Hack, yet it is an IOS exploit AFAIK. Is an IOS exploit necessary simply to load a DOL/ELF file? I thought the IOS exploits were used in the loaded DOL/ELF...

I think that's all for now, if anyone can answer at least some of these questions, that'd be very handy.

SD Card: How does it read\become recognized? (5 replies)

Gunstar_Hero — Sun, 20 Jun 2010 01:25:31 +0200

Does anyone know the logic behind how the SD card reader in a wii operates? And what part of the wii software handles this? (specifically the software) The main reason I ask is that I was led to believe that my sd card slot was dead, but then I found out something. I ran boot mii, and the sd card was detected and used to do a test backup. It's not the hardware, because I found the wii backup on my SD. So, it must be something in my wii Menu corrupted, right? The wii menu tries to recognize my card, but always fails. Most homebrew apps won't even acknowledge it. However, wii menu seems to be based off the spring "click" switch. Homebrew channel didn't look for that. It looked for whether it could be mounted and used (usb flash drive was recognized when I plugged it in) The SD was not. So, is there an IOS that handles SD data mounting specifically that could have possible been corrupted? Because, if bootmii worked, it couldn't be hardware wise, and its not my SD's or their formatting (multiple cards, tried all formats, all worked with a SD > USB adapter in the back of the wii)

Any ideas?

Nintendo channel title info file (7 replies)

frilak — Mon, 07 Jun 2010 05:13:44 +0200

Hi.
Could somebody advice me on the file format used for describing title info in Nintendo Channel? (.info)
I would really appreciate your help.

Thank you.

Anyone try to network 2 Wiis without Internet? (4 replies)

TheAltruist — Wed, 26 May 2010 17:08:48 +0200

So... yeah. Title says it all. Wii's that want to be networked want to be connected to the internet. In the event that Internet is not available, then what?
I'm thinking that spoofing the server would be possible. I'm just wondering if anyone's tried it. And if so, did you get it to work?
Also, if anyone has Wireshark captures of a networked game, that'd be really cool.