How to dump a ticket from any wii title

Hi,

i actually search a way of getting title ticket from the nand. A simple way is to read the file directly in the nand. But i wan't to do this with ES functions.

I've found the functions to read TMD and title contents, but nothing about the ticket. I've just see something about tikview!! Is it possible to recreate the ticket with tickviews?

?

Do you want to use ES functions now or not? Anyways, i haven't seen any ES function to get the ticket. There are at least 2 ways to get the ticket(and both are basically the same), using ISFS commands and using IOS commands.

Correct me if i'm wrong:
With ISFS or IOS, i think I need to read files in /ticket. But, to do that, i need special permission (like identify as SU)... I supposed the user of my homebrew won't have this, he will just have the HBC (and perhaps bootmii).


So, my idea was to use ES functions. We can use these functions to install titles (comex IOS35 downgrader or TBR use it) without any special permission (except for modified title, but i will always use original ios, no special cios). So i think i can use an ES funtion to dump ticket (like tmd or title content).

For the moment, i've found nothing. But, on wiibrew dev/es section, we can see that IOS_Ioctlv number 0x40 seems to do what i want.
Perhaps we can use this with something like that:

#define IOCTL_ES_GETSTOREDTIK 0x40

ES_GetStoredTicket(const tikview *view, tik *ticket)
{
     if(__es_fd<0) return ES_ENOTINIT;
    if(!ISALIGNED(view)) return ES_EALIGN;

     return IOS_IoctlvFormat(__es_hid, __es_fd, IOCTL_ES_GETSTOREDTIK, "d:d", view, sizeof(tikview), ticket, sizeof(tik));
}

I just checked it, the tickets are certainly not directly accessible using regular nand reading commands. The same goes for the tmd, so if there's an ioctl to read the ticket that may work. What do you need the ticket for anyways?

Is that code a serious attempt or just an example? If you want i could try to figure that out, but only if you can't figure it out yourself.

To get tmd, i can use ES_GetStoredTMD.


My goal is to dump some of my titles (system titles) into wad files, but i don't want to use some modified ios (if it's possible). I mean, i wan't to do this just after installing the HBC (ie, no ios36 with trucha patch or other "bad" ios(es) like cios249).


The problem, is that i can't install bootmii as boot2 in my wii, so i'm affraid :) I don't want to brick it.
But i will try to find someone with bootmii as boot2 to test my little app.

What system titles do you want to dump? I mean which are not downloadable without problems via NUS Downloader? HBC could be dumped, but it does not work when installed via a wad. Leaving only VC and WiiWare, but i don't understand what you would like to dump them for. Your tickets only work on your Wii, and everything else can be downloaded from NUS.

PS: It's cIOS or IOS249, there's no such thing as a cios249

My final goal is to create a patcher wich can patch ios on the wii without taking them from a wad or nus. It will dump them, patch them and install them (and i will add an option to keep them as a wad on the sd card). The patch files will be drop in a patch folder and the patcher will do everithing by himself.

I know that we can do this using nusd downloader and use these wads to apply the patch, but i'm just exploring all the capabilities of the wii, nothing else.