deroad shares more info about the Wii U's bootrom, and how Nintendo did a good job hiding where and how it calls the AES code.
According to hacker deroad, Nintendo did a nice job hiding some aspects of the Advanced Encryption Standard (AES) code on the Wii U bootrom.
He also shares more info about the bootrom, saying that he found some interesting stuff in there, but NOT keys.
Take a look:
I've read the whole bootrom code and i have to admit, that big N has done a good job on hiding where and how it calls the AES code.
Finding the AES implementation is easy, it's just before the ancast header check function and after the most useless function.
Finding how the AES implementation is called, is a little bit hard, for two reasons:
there are no cross references in the text segment; This means you will not see something like:
there are no addresses saved in the data segment:
AES_offset: .long AES_Decrypt
So how to find it? you have to read the code, because the value is hardcoded and saved into a memory on an unknown address (like 0xE0000000); then a function will load that addresses to the count (CTR) register and jumps there.
I'll make an example:
How normally should be:
How is obfuscated on the Wii U:
The last thing:
I had a lot of fun on reverse the whole bootrom. You'll find interesting stuff, there (but not keys :P).
And here we have a new homebrew game for hacked Wiis that will keep you sticked to the controller for days
We have been informed about a new homebrew game for the Wii, called Newo Asteroids and as you guessed is like the original Asteroids game but reimagined. Check it out:
Newo Asteroids is a game made in the style of classic Asteroids. In 2064 on a Wednesday, aliens disturb the asteroid belt sending asteroids hurdling towards the earth. It is your job to destroy every last asteroid in the solar system and bring peace to the galaxy.
Use your little ship to destroy asteroids threatening the earth while UFOs try to stop you.
Large free space environment filled with asteroids.
Power-ups, custom colours and alternate fire (focused or spread)
Game modes; Easy, Normal, Hard and Classic. Speed run options: 3, 5 and 10 minutes.
Customizable colours and 3d graphics in Textured, Flat, Cellshaded and Wireframe mode.
Looks like the guys over at WiiUHax managed to dump the Wii U's bootrom with a exploit, and its hashes match the ones published by team fail0verfl0w.
MarioNumber1 and the guys from Wii U Hax have found an exploit to access the Wii U hardware, and they were able to dump the "bootrom.bin", the first file the console access to boot.
Apparently, the hashes match the ones published by team fail0verfl0w (but, as you may know, they never shared their exploit to public due to "lack of interest" in the Wii U).
Also, seems that the exploit works in Wii mode (vWii), and supposedly can't be patched by Nintendo through updates...
Info from Wii U Hax:
It’s one small step for man , one giant leap for the wii-u scene.
I Can Exclusively reveal that the first step to a wii-u hack has been completed & tested & working
I have personally tested the exploit and it is 100% REAL .
Here Are The Hashes of My Bootrom.bin
sha-256 (B3DEDC6CA2C411F54F1BFEAC07D6F57DBB06D3CB7AB9A331C F5A7CBF2A50AF69)
They match Failoverflows
Many people have worked on bringing this to you , so please give all credit to Bubba , MarioNum1 , Hatax2 , Odcd007 , Joostinonline , Maxternal , Crower & Marcan
FILESIZE is 16,384 Bytes
Info from MarioNumber1:
As the person behind this, I should point out that Nintendo can't patch this exploit through firmware updates. What I (and fail0verflow before me) did was take advantage of a design flaw in the Boot ROM, and the Boot ROM can never be updated. Nintendo could change the Boot ROM with newer Wii U's, but all current Wii U's are vulnerable.
Dumping the Boot ROM is the first step of reproducing what fail0verflow did to hack the Wii U.
Yes, all you need to do is run a DOL in vWii mode with AHBPROT access.
So, it looks like the Wii U scene has just started. More info on the links below!
Asks more pressure on countries like Brazil and Spain.
Nintendo has asked the U.S. Government to put pressure on foreign countries to do a better job at tackling online piracy.
According to Nintendo's list of anti-piracy recommendations for the U.S. Trade Representative’s Special 301 report, they want the U.S. Government to put pressure on foreign countries – like Brazil, China, Mexico and Spain – to do a better job at tackling online piracy.
Here's the report by TorrentFreak:
The review is published annually and highlights countries that in the eyes of the U.S. are not doing enough to deter copyright infringement. Nintendo is one of the companies to submit recommendations on how other countries should tackle these issues.
The gaming company states that piracy is a chronic problem that results in “huge losses,” in part due to the inactivity of foreign countries who do very little to curb copyright infringement.
“In the past few years, the scope of online piracy for Nintendo has grown dramatically. Every month tens of thousands of illegal Nintendo game files are detected on the Internet. The legal environment to limit the flow of these files remains extremely challenging,” the company explains in its letter.
Like last year, Nintendo’s letter focuses on four countries – Brazil, China, Mexico and Spain – where these challenges remain unaddressed. For each of the countries the game company offers a set of recommendations on how the legal climate can be improved, hoping the United States Government will push for change.
According to statistics presented in the letter, no less than 16% of all online piracy of Nintendo products traces back to Spain. With 1.2 million downloads this is the second largest piracy market, just behind Italy with 1.4 million downloads.
While the volume of piracy has deceased somewhat compared to previous years, Nintendo wants Spain to take drastic action. Specifically, it points out that the local Intellectual Property Committee (IPC) should block pirate sites wherever possible.
“Since so many illegal video games are downloaded in Spain from foreign-based cyberlockers, and accessed through cyberlinkers or P2P linking sites hosted outside Spain, the IPC must address this issue by authorizing the blocking of linking sites,” Nintendo writes.
The irony of this suggestion is that Nintendo has made no efforts in the United States to have any of the major torrent or linking sites blocked. This is especially painful because their own research shows that many of the larger Spanish linking sites are hosted in America, and registered though U.S. companies.
In addition to blocking websites, the game company wants the U.S. Government to educate and train the Spanish on how to deal with copyright infringers effectively.
“The Spanish Government should work with the U.S. Government and rights holders to provide necessary IP training to Spanish prosecutors, judges and IPC officials, particularly focusing on Internet piracy and effective online investigation, prosecution, and adjudication of criminal copyright infringement on the Internet.”
Similar recommendations are made for Mexico, Brazil and China. In these countries Nintendo also wants ISPs to be held liable for their role in continuing high levels of Internet piracy. The gaming company says that this can be achieved by introducing notice and takedown procedures as well as stiffer penalties for companies that fail to take responsibility.
“Hold Internet Service Providers responsible for facilitating piracy under certain circumstances, including a requirement that ISPs expeditiously remove infringing content when notified by a rights holder representative,” Nintendo advises for Brazil.
Companies and individuals who continue to facilitate copyright infringement have to be prosecuted, Nintendo says, and to boost deterrence maximum penalties should be increased.
“Bring criminal prosecutions against major infringers, including those facilitating piracy on the Internet. The courts must impose stronger penalties against IP crimes, both traditional forms of piracy and online piracy, to raise awareness and foster deterrence,” Nintendo adds.
It is clear that Nintendo wants the U.S. to put more pressure on foreign countries, but
A neat tool for recovering saves from corrupted GameCube memory cards!
GCN MemCard Recover allws you to crecover files from corrupted or reformatted GameCube memory cards.
GCN MemCard Recover by 'GerbilSoft', is a PC utility that can recover files from corrupted or reformatted GameCube memory cards. You'll obviously need first to dump the memory card image to a computer-readable format using a Wii.
Stability has been improved. In particular, the custom model for the QTreeView now handles all required signals correctly.
Some parts of the program now utilize C++ 2011 functionality. A compatibility header has been included for older compilers.
The toolbar that was formerly located in the "Memory Card" view is now a window toolbar, and contains additional items, such as the "Preferred Region" selection.
Added preliminary support for displaying scanning progress in the taskbar. Currently, only the D-Bus DockManager protocol is supported. Support for Ubuntu's Unity and Windows 7 will be added later.
GcImage and Checksum functions have been split out into their own library, libgctools. This library depends on libpng but does not depend on Qt.
Added support for the Qt translation system. Currently, translations for en_US, en_GB, es_CL, and "1337" are included.
Fixed some corner cases with full memory card images and certain save files.
Support for Japanese save files is improved.
Added preliminary support for compiling with Microsoft Visual C++. The primary distributions will still be compiled with gcc/MinGW.
Banners and icons can now be exported as image files. Banners and non-animated icons are always exported as PNG. Icons can be exported as APNG, PNG (file per frame), PNG (vertical strip), and PNG (horizontal strip).
Added "Preferred Region" support. Some games don't have any way to determine the region by simply looking at the description, and in some cases, might be identical in every way other than the region code in the game ID. "Preferred Region" allows you to specify which region you want to prefer in the case that multiple save files in different regions are detected.
Added support for multiple database files. The included databases are now split by region, e.g. USA, JPN, etc. Homebrew and Unlicensed titles are also contained in their own databases.
Added a new utility "gcbanner". This utility can extract banner images and icons from GameCube BNR1 and BNR2 opening.bnr files as well as Wii save files (both raw banner.bin and encrypted save files). Animated icons can be extracted to the same formats supported by GCN MemCard Recover's icon extraction function. Banners and static icons are always extracted in PNG format.
The current directory and block tables can now be switched on the fly. This may allow for easier recovery of files that were deleted in the GameCube file manager, as long as no other files have been saved or updated in the meantime.
Added a "top-secret" easter egg.
For download links (Windows / Linux) and usage instructions, go to the tool's official site at WiiBrew, below!
Nintendo gains popularity in Belgium... as an XTC pill...
It looks like people are getting 'high' on an actual drug called 'Nintendo', which reports say, is quite strong.
The BEWSD (Belgian Early Warning System on Drugs) has warned of a new drug drug called "Nintendo", an XTC pill that is gaining popularity, and can also be quite deadly.
The drug contains a large dose of MDMA, better known as Ecstasy, which could potentially prove fatal for users at a young age.
While the drug has surfaced thanks to a program in Belgium where individuals can bring their substances in for a quality spot-check, the origin has not entirely been established, though reports suggest it could originate from China.
A user reports that the pills contain "approximately 200mg of MDMA" and that within an hour of eating half a Nintendo, the effects were extremely noticeable:
* 11:15pm - my friend is literally rolling around the floor and i'm complaining that nothing is happening.
* 11:30pm - it starts to kick in for me and i start smiling and touching things, we're both feeling very euphoric and a little empathetic with each other, we realised this was going to be fun
* 12pm - both rolling hard, i'm guessing because it's our first time its real strong for us, we're rolling everywhere, staring at my lampshade and laughing for ages, saying how pretty the walls and lights are!
* 1am - from this point on everything is a bit of a blur, the other half kicked in hard and i felt on top of the world, we were both so euphoric and empathetic we spent one second dancing and the next minute cuddling saying we loved each other
The comments at PillReports.com corroborate the strength of Nintendo, but there's also a ton of misspelled words and typos so take those with a grain of salt.
As you can see, the pills contain the logo of Nintendo, something that the company probably is not very happy about, as they can be confused with candies.
An European court has ruled that Nintendo can only block illegal video games and that they are powerless against 'jailbreakers'.
The European Union's top court has ruled that Nintendo cannot prevent the use of hacking equipment on its consoles, except in case of illegally copied video games.
The court rejected an appeal by Nintendo to stop Italian company "PC Box" from unlocking its consoles to offer "extra features". Apparently, PC Box sells Nintendo's consoles with additional equipment allowing jailbreaking of the devices...
Here's the report:
Nintendo cannot prevent its consoles from being tampered with to play multimedia from other providers, except in the case of illegally copied video games, the European Union‘s top court ruled Thursday.
Nintendo uses encryption software to restrict what can be played on its portable DS and fixed Wii consoles, but Italian company PC Box sells the devices with additional equipment that circumvents the encryption.
The issue ended up before a court in Italy, where the Japanese gaming company said PC Box was attempting to bypass its anti-bootlegging measures.
PC Box, on the other hand, argued that Nintendo users should be granted access to movies, videos and MP3 files from other providers when they do not breach Nintendo coprights, the court said.
The Milan court asked the European Court of Justice (ECJ) to clarify how much Nintendo is protected by EU copyright laws.
The ECJ found that Nintendo could only take steps to protect itself against "unauthorized acts of reproduction, communication, public offer or distribution" of copyrighted material.
It could not prevent the use of hacking equipment on its consoles that has other "commercially significant" purposes, the court ruled.
Take a look at this video by developer Smealum, showing a homebrew game (yeti3DS) running on the system as its own channel.
Developer 'Smealum' has released a video showcasing 'yeti3DS', a homebrew game, running on the Nintendo 3DS as its own channel.
Keep in mind that he is running code that only works on 4.1-4.5 FWs, but it's still a very nice progress, and it looks like the 3DS homebrew scene will finally take off!
Here's the info:
Sorry it’s been a while since my last post; I was really busy in November and December and basically got no 3DS work done back then. Fortunately though my schedule’s cleared up quite a bit since then and I’m happy to say that I’m back on track and making some fairly good progress. Let’s start with a little video I uploaded last night :
For those of you too lazy to watch the video (you know who you are…), it shows me booting into redNAND mode on 7.1 from 4.2 (works on 4.1-4.5 ofc) and running a homebrew game contained within its own little channel, complete with custom icon and banner. It also gives some other stuff.
This video is a glimpse at what I want for the up and coming 3DS homebrew scene, ie a way for people to make their own homebrew applications and install so that they’re directly accessible from home menu. This has a number of advantages over running code “on the bare metal” as some are already doing. For one thing, it means that homebrew code will be strictly limited to user mode code, the same way commercial games and applications are, which drastically lowers the likelihood of anyone’s (*cough*GW*cough*) code accidentally bricking your console. For another, it means that our code will be able to interface with every service provided by the 3DS’s OS; it’ll make stuff like FS, wifi and GPU access much easier. And of course, it just looks cool having your own channel in the menu, and being able to return to menu and switch between games instantly is a nice plus.
For that goal to become a reality, we basically need two things : a way to create new channels and a way to install them. I’m proud to say that I’m taking steps to make creating channels possible, by starting ctrulib (whose code is freely available on github). The idea is to make interfacing with 3DS services easier, by providing functions designed to do so and example code to understand how they’re used. Of course it’s not much at the moment; very few services are implemented and the examples don’t necessarily use them in exactly the way they were meant to be used. Nevertheless, it already provides the basics; enough to do basic interactions with NS, the HID module for user input and the GSP module for VRAM and later on GPU access. It’s very much a work in progress and will only keep growing. yeti3DS is an example of what can be achieved with ctrulib at the moment; not much, but a pretty cool start if you ask me. yeti3DS’s code is also available on github.
Now the thing is, there is at the moment no public way to install new channels, which means that even though you can just clone the ctrulib repo right now and compile it, you probably won’t be able to run what it produces. The reason for that is, basically, that I don’t have an installer ready. That’s the next big step for me and I’ll have to ask you to be patient. There is a fair bit of work involved and while I do expect to have an installer POC ready within the next couple weeks, there’s no telling how long it’ll take to get a safe package ready for mass consumption; users have already suffered through enough bricks, I’d rather my software didn’t add to the list.
So sit tight ! We’ll have nice 3DS homebrew soon enough. Feel free to ask any questions you may have (other than ETA requests), I’m not sure how clear this post was. (I’m pretty tired…)
InspectMii shows and logs every single significant setting on your Wii.
InspectMii by 'JoostinOnline', is a homebrew app for the Wii that shows and logs every single significant setting of your console. It is especially useful if you are looking for any conflicting or potentially problematic settings.
A new version is out. Here's the changelog for 1.1:
• Counter Bias hours are converted to years-months-days (thanks OverjoY).
• Changed the page titles to better convey the purpose of the file being checked.
• Added DNS Source to the network page.
• Greatly improved the file log code so it will save results even if the app crashes.
• Log file is now named "InspectMii.log".
• A fair amount of code cleanup.