Hacking BootMii's dumps getting smaller?

[Det1re]

I noticed something odd:

I've got four NAND dumps of my second Wii. So here's a table:

 # | Date/TimeÂÂ|ÂÂDescriptionÂÂ| NAND usage | RAR size
--+------------+---------------+------------+----------
1 | 2009/07/02 | 3.1E ONLYÂÂÂÂ |ÂÂ 29.7%ÂÂÂÂ|ÂÂ324MB
ÂÂ|ÂÂ 14:00ÂÂÂÂ| BootMiiÂÂÂÂÂÂ |ÂÂÂÂÂÂÂÂÂÂÂÂ|
--+------------+---------------+------------+----------
2 | 2009/07/02 | 4.0E HBCÂÂÂÂÂÂ|ÂÂ 32.4%ÂÂÂÂ|ÂÂ347MB
ÂÂ|ÂÂ 15:00ÂÂÂÂ| cIOS, BootMii |ÂÂÂÂÂÂÂÂÂÂÂÂ|
--+------------+---------------+------------+----------
3 | 2009/07/10 | 4.0E SV,ÂÂÂÂÂÂ|ÂÂ 41.7%ÂÂÂÂ|ÂÂ307MB
ÂÂ|ÂÂ 02:30ÂÂÂÂ| FW channelsÂÂ |ÂÂÂÂÂÂÂÂÂÂÂÂ|
--+------------+---------------+------------+----------
4 | 2009/07/18 | 4.0E more SVÂÂ|ÂÂ 42.0%ÂÂÂÂ|ÂÂ262MB
ÂÂ|ÂÂ 20:15ÂÂÂÂ|ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ |ÂÂÂÂÂÂÂÂÂÂÂÂ|


SV = various Savegames
FW = USB Forwarder

Anyone else notices the RAR sizes? The difference between dump #1 and #2 is the only one I understand. The others are odd. Also compare the "NAND usage" between those.
I used the same compression mode for all of them. Any explanation for this?

 

[retKHAAAN]

That's crazy. I've never compressed them before. Do you always let BootMii verify the dumps?

 

[Maikel Steneker]

Could it be that the dumps are encrypted? In that case, compression ratio is pretty much random.

 

[s3phir0th115]

Could it be that the dumps are encrypted? In that case, compression ratio is pretty much random.

That may be part of it, that's for sure. I'm not sure what the dumps look like in a hex editor to be certain though.

Although I'd have to say that getting a compression of 3xx MB for a ~512 MB file is pretty good, and I don't think you'd get that much of it was all just random encrypted trash. (Look at Wii ISO's being compressed without being scrubbed if you don't know what I mean.)

 

[Det1re]

That's crazy. I've never compressed them before. Do you always let BootMii verify the dumps?
All verified and working.

QUOTE(Maikel Steneker @ Jul 18 2009, 09:13 PM) Could it be that the dumps are encrypted? In that case, compression ratio is pretty much random.

They are. However this is a giant size difference for my understanding.

 

[Helsionium]

The dumps are supposed to be encrypted, because they're raw dumps of the NAND, which is encrypted, so they shouldn't be compressible at all. An encrypted 528 MB file should never compress to less than 500 MB.

 

[s3phir0th115]

The dumps are supposed to be encrypted, because they're raw dumps of the NAND, which is encrypted, so they shouldn't be compressible at all. An encrypted 528 MB file should never compress to less than 500 MB.

Hmm. That's why I didn't think they were encrypted.

My nand dump, compressed with 7z on Ultra settings, comes out to be:
330 MB (346,598,036 bytes)

That's damn good compression for something that's encrypted I must say.

 

[Helsionium]

Well, then it's obviously not encrypted. That's strange, because I thought all NAND dumpers simply extract the NAND, which would be encrypted. BootMii apparently decrypts it as well, though I don't know for what purpose.

 

[Det1re]

Well, then it's obviously not encrypted. That's strange, because I thought all NAND dumpers simply extract the NAND, which would be encrypted. BootMii apparently decrypts it as well, though I don't know for what purpose.

They must be encrypted, else we wouldn't need zestig to unpack them. However the encryption then might be the solution.

 

[Dteyn]

I've done 4 backups with BootMii so far, here are the file sizes:

# | Date/TimeÂÂ|ÂÂDescriptionÂÂ| 7z Ultra size
--+------------+---------------+--------------
1 | 2009/06/14 | 3.2U SV, HBCÂÂ|ÂÂÂÂ 369MB
ÂÂ|ÂÂ 02:00ÂÂÂÂ| cIOS, BootMii |
--+------------+---------------+--------------
2 | 2009/06/14 | 4.0U SV, HBCÂÂ|ÂÂÂÂ 305MB
ÂÂ|ÂÂ 04:45ÂÂÂÂ| cIOS, BootMii |
--+------------+---------------+--------------
3 | 2009/07/16 | 4.0U SV, HBCÂÂ|ÂÂÂÂ 384MB
ÂÂ|ÂÂ 23:00ÂÂÂÂ| cIOS, BootMii |
--+------------+---------------+--------------
4 | 2009/07/18 | 4.1U SV, HBCÂÂ|ÂÂÂÂ 400MB
ÂÂ|ÂÂ 15:00ÂÂÂÂ| cIOS, BootMii |

Before I did the latest backup today, I removed a couple WiiWare and VC games. But yet the dump compresses larger? Installing more stuff on the Wii seems to result in a smaller compressed NAND dump... whereas removing stuff from the Wii results in a larger NAND dump.

I think we're in the Twilight Zone... lol

 

[arctic_flame]

Simple, The encryption method is not a stream cipher.

Who said encrypting a file results in the result being pseudorandom?

 

[caitsith2]

Encryption is actually a 128 bit block cipher, AES, in CBC mode. What is compressing is repeats of completely erased blocks, which are NOT encrypted, as well as repeats of file data. (A new cluster is assigned to the file, if the file is in any way modified, as a wear leveling mechanism. Also, the AES CBC encryption, is done on a cluster at a time. So, if there are repeats of the same data, like ALL 0x00 through out 20 clusters, then the compression will be those 20 clusters compressed to the size of 1 cluster.

The size of 1 cluster on the NAND is 16KiB. There are 32768 clusters in total. The first 64 clusters make up boot 1 and boot 2. The last 256 clusters makes up your filing system table. In general, a 16KiB cluster is often encrypted, and it is only repeats of the same encrypted cluster data that actually compresses.

 

[OncleJulien]

maybe its simply cutting back on its fiber?

 

[Pip_X]

Deleteing data in the nand. is not actually deleting it. It simply mark it to be usable, ur data is still there eventhough u deleted it and it wont show up in the system. Hence ur backup size.