Wii Message Board Photos

Actual Question:
Was progress ever made on decoding Wii Message Board photos? It seems odd that so much is known about the integral data structure of the Wii and how to manipulate it, but we can't convert some image files to the JPEGs they used to be (or the text files, for that matter).

EDIT: Also, is there a way to add SD-archived Message Board stuff (private/wii/title/HAEA) back to the Wii, probably by adding it to cdb.vff? The archive in question is what occurs when the Message Board (meaning cdb.vff?) runs out of space.

Superfluous Nonsense:
Since there doesn't seem to be any info on this, I figure I'll list what I know about the archive...

After HAEA the next two directories are hexadecimal (61B3C0E8 and 6812A496 for me), and then there is a list of years. For whatever reason, there is a year 2000 directory which looks different and I'll get into later.

For the normal ones, the next directories are months (00 January, 11 December). Past that are days. I don't have a single entry for a day 00, so these probably start at 01. What's next are the hours, which start at 00 and follow a 24-hour clock. Next, minutes, which start at 00.

After that the directories are the 4-character title ID (HAEA for the Board, RSPE for Wii Sports, HAPE for Mii Contest, etc.). The Board ones are written HAEA_#1 but all others it seems to be RSPE_01, HAPE_01.

Inside that you can see log, txt, and odh. log is play time records, txt is messages, and I don't know what odh is but there's a fair bet it has something to do with pictures. All files in these direcotires have the extension .000 and their titles are just 8 hexadecimal characters that mean nothing to me.



Edited 7 time(s). Last edit at 07/13/2011 03:42AM by Invis.

are you talking about parsing the vff file and reading the directories and files within it's filesystem? or are you talking about files and directories that are in the nand FS?

When the Message Board is full, the contents of the VFF are dumped to the SD card in the file structure I described above. Individual messages/photos end up as .000 files in there, so I figured that would be the easiest way to get them (easily accessible by computer, no parsing needed).

The second question would require parsing of cdb.vff and then also reassembling (injecting the text/photos into it), and I'm guessing that's harder. But the first one doesn't need need cdb.vff or any files on the actual Wii.

It just happens that I was messing with some other vff files when I first saw your post. I have written a little program that replaces the vff header with a "normal" fat one. Then the resulting file can be mounted read/write or parsed with pretty much any other tool that understands FAT filesystem.

After mounting the filesystem, I also see a folder for each year/month/day/etc. I honestly dont ever use the message board stuff, so nobody has sent me any pictures. So I cant look to see how they are stored. I did, however, find something interesting. I found the message where nintendo announced that the internet channel would be free and you get a free NES VC game. At the bottom of this message is attached a U8 archive. And inside that U8 archive there is 1 single file called "chjump.bin".

Inside chjump.bin are apparently instructions to boot HABA ( shopping channel ) and jump to display the internet channel...

0000:0000 | 43 68 4A 70  00 00 00 4D  00 00 00 01  00 00 00 00 | ChJp...M........
0000:0010 | 00 01 00 02  48 41 42 41  00 00 00 20  00 00 00 2D | ....HABA... ...-
0000:0020 | 3F 69 6E 69  74 70 61 67  65 3D 42 5F  30 35 2E 6A | ?initpage=B_05.j
0000:0030 | 73 70 26 74  69 74 6C 65  49 64 3D 30  30 30 31 30 | sp&titleId=00010
0000:0040 | 30 30 31 34  38 34 31 34  34 34 41 00  00          | 0014841444A..

(See libogc Wii_LaunchTitleWithArgs()).

This doesnt tell too much about the photos, but i think it is a start in the right direction. Look at your messages and see if you see any U8 archives attached to the bottom of them. And if you do, look at the files inside that archive.

EDIT>>>
I also see a similar U8 archive at the bottom of the message that says "...blablabla there is an update for the nintendo channel...". This U8 also contains a "chjump.bin" that loads the shopping channel with instructions to skip to a certain item. Also, it seems that all the play records are in folders named "log". These 2 messages with archives on them have both been in folders named "txt".

EDIT AGAIN>>>
Ok, so i sat down and sent a picture from the photo channel to my message board. it popped up as a file inside HAAA_01/odh/. inside this, there was no U8 archive. there is definitely enough bytes in this one to contain the huge image i sent. and there is a section with "AJPG" magic word (i sent a jpeg image). so, i would say this this is where the image is, and just needs to be converted to whatever format is suitable for displaying.



Edited 2 time(s). Last edit at 07/13/2011 11:18AM by giantpune.

Yep. I don't know if anyone's been working on a way to do it, though.

i set a breakpoint in the system menu as it reads the "AJPG" magic word. the function it is using to validate the header of the image is CArGBAOdh::decompressGbaOdh((uchar *,int,uchar *,int,uchar *,int,int)), and a bit farther back, ODHDecodeRGB565.

Among these CArGBAOdh...() functions are a couple named CArGBAOdh::fdct_fast((unsigned long *, unsigned char *, unsigned long, unsigned long *)), CArGBAOdh::huffmanDecoder((unsigned long *, SArCDJ_HuffmanRequest *, unsigned short **, int, unsigned long)), and CArGBAOdh::cdj_d_setDequantizationTable((SArCDJ_OdhMaster *, unsigned long)). I typed "fdct_fast" into my google machine and it popped me up here [infocenter.arm.com] . This page is talking about ARM stuff. And these function names all game Gba in them, which IIRC uses an ARM processor.

Also, if you look in that list on the left, just below the "fdct_fast" are links about setting up a table and huffman encoding. This seems like a lot of similarities to me. So, I think this page is definitely worth taking a look at to try to figure out their 1337 image format.

fdct_fast doesn't imply anything to do with ARM, or that specific page. An FDCT is a Fourier Discrete Cosine Transform, which is a common algorithm/function used in movie and image compression e.g. jpg, mpeg, aac... same goes for huffman encoding, which is one of the most basic entropy encoding algorithms and would be instantly familiar to any comp. sci. student.

i dont have enough messages for the system menu to dump them to the SD card. but, it looks like it encrypts them when it does transfer them to SD. if you are trying to decipher messages from dumped-to-SD archives, you will need to decrypt them first.

the IV is based on the current time and is stored at 0xa0 for 0x10 bytes. something called "keystr" is stored at 0x80 for 0x20 bytes, a signature is stored at 0xb0 for 0x1bc bytes. the message size is written to 0x78. and the message payload starts at 0x400. i think this should be enough to decrypt the message, either using the "keystr" or by using the wii SD key. the signature is checked by hmac as well like channels as save data that has been moved to SD.

if you have one of these messages that you can upload somewhere, i would like to take a look at it as well.

There's code in libwc24 SVN for mounting VFFs /w libff elmchan fatfs with either Wii or Linux/Win32. There's code in SVN for mounting them via FUSE too but I never bothered to finish it, giantpune's method sounds a lot easier.(zero interest in libwc24 myself anymore, since I don't have hardly any interest in wii hb anymore.)

Quote
qiantpune
if you have one of these messages that you can upload somewhere, i would like to take a look at it as well.

Here's a RAR with 000006DB.000 (log), 12818DB4.000 (txt), and 1283280C.000 (odh).

[www.mediafire.com]

The log is a fake "Today's Activities" made by the HBC, and the other two are a regular message and a photo from the Photo Channel.

Ive made a bit of progress with those messages. I managed to decrypt them, and figure out how the signature is generated. And aside from the image attachment, there is only like 16 bytes in the file which i havent figured out.

The message title and text are stored as u16 strings. Miis are stored in the same struct use to store them in any other context. The file can have up to 2 attachments. There are up to 10 play_recs attached to the file, and a list of anybody you sent a message to ( all these count as 1 big attachment ). There can be a u8 archive containing a chjump, bns sound, and/or images to use for the message envelope and paper. The 3rd type of attachment is the odh image. I got far enough into the format to get simple stuff like the width, height, and size out of it.

so as it is now, i can create a message on my computer with text and whatnot, encrypt it, sign it, and have the system menu display it. and to answer the part about putting messages into the cdb, i can do that, but there must be enough room for them. you can free up room by deleting other messages, as the file only holds like 14MiB.

Hello everyone,
sorry for bumping an old thread like this, but the Wii Message Board threads are extremely rare and I really need urgent help regarding my Wii Message Board posts.

I am a big fan of posting huge ammounts of photos from City Folk and memos on my Message Board for almost two years now. These are all valuable and irreplaceable memories for me and everyone who plays on the Wii.

The Wii system archives older Message Board messages automatically every now and then on the SD card, as is mentioned by original poster.

Recently my SD card got corrupted and I cannot access it via SD card reader on my PC (it only gives option to format it), and the Wii gives message "The Device Inserted in the SD Card Slot Cannot Be Used" whenever I try to access it.

When I scan the SD card with a recovery software I do see a folder structure very similar to what it used to be when I could read it with card reader before (when it wasn't corrupted). So it definitively reads folders wii > title > HAEA > *nested folders with dates, times and logs* > .000 files

Here is the printscreen of the folder structure, from the recovery scan:
http://s30.postimg.org/y3evj65y9/Screenshot.jpg

My question:
is there hope to make a clone of my corrupted SD card and to make it work again on the Wii?
In example, is it as easy as recovering all folder structure from the corrupted card on the PC and then copy and pasting the entire folder structure from the PC to the brand new SD card?
Will the Wii Menu read all data back normally? Will the Message Board show archived messages as it used to prior to card corruption?

More importantly, can this permanently mess up my Wii system if I insert such a new cloned card into Wii?
Note: my Wii console doesn't have and never had any modding software installed, and if possible I would love to keep it this way.

Thank you for reading and answering.