So... Who will try the Sneek?

[wiibrew.org]

I'm following the how-to, but I dumb enough to not know how modify the IOS60, neither what is an NAND FS backup (it's a unencrypted dump of the NAND, with the file system and directories and stuff, right? How can I create this kind of dump?)

Some help would be cool. And some comments about how Sneek is running in your Wii would be cool too. =D



Edited 1 time(s). Last edit at 10/10/2009 08:52PM by DanielHueho.

The nand FS dump can be done with FSToolbox. Just run it and press 1 (i think, could be 2, check the wiki page)

I too am confused about the IOS60 modification thing. I'll read more into it and try to understand.

EDIT: Well, I can reduce the content count and change the title ID in the TMD, but I dont know how to identify the SD module. Anyone know?



Edited 1 time(s). Last edit at 10/10/2009 09:11PM by SifJar.

I found this tutorial about the NAND dump part: [forums.dolphin-emu.com]

I'm kinda afraid of using FSToolbox with all that brick warnings and stuff... So I will stick with this guide (and I will create a so-needed-for fixing-my-brix-but-so-delayed NAND backup as an bonus =P)

As for modding the IOS, I guess we need to hex-edit the TMD.

EDIT: Maybe the SD module is the 0000000e.app... Just a guess, though. It's the only IOS file (aside from the TMD and the ticket) changed for Sneek to work.



Edited 2 time(s). Last edit at 10/10/2009 09:24PM by DanielHueho.

Yaeah, I have hex-edited the TMD and ctek (ticket) a bit, but I can't work out how to idetify the SD module in the TMD, so I can't delete it. Other than that, its all reasonably straight forward, so I just need someone to explain that bit.

EDIT: For the bit with 0000000e, just make a batch file of the following, and copy it and 000000e (decrypted with NUSD, but remove the .app once its copied) to the SNEEK folder, then run the bat script (btw, this is for windows)

elfins.exe esmodule.elf 0000000e tmp.bin
elfins.exe fsmodule.elf tmp.bin 0000000e.app
boot2me.exe 0000000e.app boot2.bin

But I still dont know the bit about the SD module. Thats the final piece of the jigsaw, so to speak.



Edited 1 time(s). Last edit at 10/10/2009 09:28PM by SifJar.

I understanded the part about creating the new 0000000e.app (this sounds like the easiest part =P)

What I was trying to say is that maybe this file is the SD module itself.



Edited 1 time(s). Last edit at 10/10/2009 09:32PM by DanielHueho.

No it wouldnt make sense to delete that file, as it is needed later. and in the nfo it says delete the SD module entry from the TMD, not delete the SD module.

Quote
SifJar
and in the nfo it says delete the SD module entry from the TMD, not delete the SD module.

Exactly. My kick is, we need to delete the entry related to the SD module content (that file) but not the file itself.

yeah, but we need to know where in the TMD it is, and how to identify it.

EDIT:marcan deleted it from wiibrew, because of "blatant copyright infringement"? Whats that about? He also said something about GPL infringment, but he included the source, so surely its ok on that front?



Edited 1 time(s). Last edit at 10/10/2009 10:36PM by SifJar.

Oh noes, here we go again XD
Probably have something to do with Mini code. Maybe crediar forgot to release the source with his modifications.

Anyway, let's keep going:

I got Wii.py to work with AlexLH help, from IRC, here's the output of tmdinfo about the IOS TMD:

TMD:
 Versions: (todo) 0, CA CRL (todo) 0, Signer CRL (todo) 0, System 0-0
 Title ID: 00000001-0000003c
 Title Type: 1
 Group ID: '01'
 Access Rights: 0x00000000
 Title Version: 0x181e
 Boot Index: 14
 Contents:
  ID       Index Type    Size         Hash
  00000000 0     0x0001  0x40         88 ab 9c f7 e4 87 0b 76 6f 79 9a 67 4a fa
0c 53 87 b1 70 d5
  00000001 1     0x8001  0x8168       96 b0 35 da fc fa f8 26 d1 77 2a bd 07 b8
01 4a ed 15 03 5f
  00000002 2     0x8001  0x6c94       e1 a7 17 94 6e f3 90 d9 ca 11 82 da e6 cb
bb 61 f0 ac b0 cf
  00000003 3     0x8001  0x3bf8       3b c9 e4 16 d3 fa 86 d0 a0 99 b8 2e ce 0a
a7 ef f8 f5 9a 68
  00000004 4     0x8001  0x2a88       2e 51 d7 c3 dc 5b 6a d8 98 36 2a 9f 5a 53
09 a6 3c 91 19 42
  00000005 5     0x8001  0x2a138      00 ef 2f 8b bc d2 08 eb 5e 64 cd 91 65 54
40 5a d3 4e cf d5
  00000006 6     0x8001  0x5b1a4      e4 73 fd a0 35 15 12 40 d6 a6 f5 3c 50 36
9d 24 14 c3 6f 4d
  00000007 7     0x8001  0xf5b0       41 f6 57 42 94 b4 b3 5e 6e 40 14 35 a2 0c
bd c0 9e 36 f5 3f
  00000008 8     0x8001  0x6d57c      44 ca 68 b0 18 1d 6c 54 00 7e 66 37 d6 e9
35 07 4f 9e 06 82
  00000009 9     0x8001  0xa64c       1d 18 53 55 81 5b f6 4c 45 71 71 35 e6 54
03 3b ab 0c 93 bc
  0000000A 10    0x8001  0x7778       aa 6b 00 01 47 dd 12 c8 38 e4 0e 58 b2 5d
3f 5f 51 05 85 f8
  0000000B 11    0x8001  0x4be4       49 2e 1a 87 de f9 a6 4b ba ad 80 3c d9 58
d3 a2 78 af 3c ea
  0000000C 12    0x8001  0x6f38       9a 8d 1f cd 38 b7 22 cc 6b 6a ba 3f f2 12
3c 00 7c 82 e5 19
  0000000D 13    0x8001  0x7f330      51 37 d0 39 3c 98 09 7f 0d 59 70 6d 1c ee
c2 2f 75 48 d6 0c
  0000000E 14    0x8001  0x285f4      30 0a 10 b4 a2 b5 c5 90 86 36 c3 4d e2 26
07 c1 14 7d ab 4f

Edited 1 time(s). Last edit at 10/10/2009 11:03PM by DanielHueho.

it is illegal to keep or redistribute SNEEK. I assume crediar will be releasing the necessary extra source in the next day or two, so delete it for now, then download it when he does.

='( This was getting fun...

Oh, well, I will keep the readme, at least.

EDIT: Nonetheless, let's finish this IOS60 issue, just to be ready for the legal Sneek. I asked for help at the IRC again (=P), and discovered that the SD module is, in fact, the 00000004.app file. So, just did a quick search for the respective string showed by tmdinfo.py and done: here is what we need to kill:

00 00 00 04 00 04 80 01 00 00 00 00 00 00 2A 88 2E 51 D7 C3 DC 5B 6A D8 98 36 2A 9F 5A 53 09 A6 3C 91 19 42

Edited 1 time(s). Last edit at 10/11/2009 02:38AM by DanielHueho.

cool. shouldnt be too hard to do now then.

SNEEK v2 video:
[bit.ly]

To be released soon, I guess...



Edited 1 time(s). Last edit at 10/16/2009 05:49PM by DanielHueho.