Blocking boot2 update?

This could be a really stupid idea but is there any reason why we can't block the boot2 update by poisoning a local DNS server for nus.shop.wii.com to a webserver we control and thus intercepting the GetSystemUpdate SOAP message and removing the XML block pertaining to boot2?

I've knocked up a quick PHP script which does just that while at work and haven't got around to testing it yet at home - but from everything I can see from here it should block the boot2 update by not even telling the Wii that there's an updated boot2...?

(Or am I going completely mad - lol)

Sorry if this is the wrong forum, but it was the best match I could see!

Reply Quote

you're going completely mad, either way, updating boot2 isn't that bad, you just reinstall bootmii, your chances of bricking are minimal, and there's really no reason to worry (contrary to my previous statements)

This is kinda interesting if it works, if only because it should mean that it would be possible to block other parts of updates you dont want like IOS updates or whatever. But as said above, boot2 update isnt too much to worry about, its meant to be pretty safe really.

Ok so this doesn't work (yet) cause the Wii uses https:// and checks the SSL certificate it gets (self signed certs are no good here).

So the question becomes if the system menu IOS had trucha would it be possible to fake-sign a SSL certificate?

(I'm not really sure whereabouts the trucha bug lies so I guess I'm deferring here to someone like bushing...)

:-)

Update: I've yet to see if enabling the proxy server persuades the Wii to use normal http:// - it would be convenient...



Edited 1 time(s). Last edit at 11/26/2009 11:08PM by cbkm.

Quote
cbkm
Update: I've yet to see if enabling the proxy server persuades the Wii to use normal http:// - it would be convenient...

http forced proxies dont seem to work as the wii seems to use several protocols at once, i wiresharked my router and found that the wii will connect to a server via tcp, http, and udp, for some reason all of them need to work in the connection test when you only need one to connect

Aye, it passes the connection test, connecting exactly as you describe.

Once it moves onto performing the actual update, it connects to port 443 and does the TLS handshake retrieving the certificate and then kills the connection before anything hits the apache2 logs.

The wii itself then errors with error 32007.

I guess i need to see if it needs https or if there's any case where it'll fail back to standard http. Failing that, the final avenue is seeing if a SSL certificate can be fakesigned....

Unlike the Wii's implementation of its own certificate system, its SSL implementation probably isn't as buggy, but is also probably RSA-based. You won't be able to do it.