Hacking It's time to find a Exploit in the Wii

[AshuraZro]

Rather than hacking it, I want to see people try out Action Replay + GCOS to boot GCN backups. I've been told DOLs can be loaded and PSO simply won't work due to it not booting (or maybe it was online not booting, for obvious reasons, no ethernet port).

 

[shadow1w2]

I plan to try my hand at crazy Hex editing and see if I can do a few tricks.

I really wanna pllay some Japanese roms on the Wii

Darn nintendo forcing us to play only select stuff.

We want the Sin and Punishment N64 game already!
One great Treasure game.
Funny how they dont have the logo on the game, I was wondering why it felt like gunstar heroes and Alien Soldier so much for awhile xD

But ya, aslong as we can access the VC game data, we should be able to find a way to trick it into doing more or even running homebrew.

Though there might be some nasty protections on the system that'll send out the game info before you pllay it so nintendo can ban you.
Though nintendo is alot nicer than that.
Besides, I doubt any hacks will get out of hand.
The novelty of downloading games like that is kinda nice.

But again, I want some rare crap I cant get ahold of normaly >.<
I already played all the US games that were released, I grew up with em.
Gimme the rare unreadable stuff xD

 

[wiigamer]

well hmm java and the browser might do something but this system architecture is somewhat different from the gc and the homebrew community is not really large for nintendo so it might take a while.

 

[jhoff80]

Rather than hacking it, I want to see people try out Action Replay + GCOS to boot GCN backups. I've been told DOLs can be loaded and PSO simply won't work due to it not booting (or maybe it was online not booting, for obvious reasons, no ethernet port).

Won't work, in order to boot GCN backups, GCOS needs to be able to inject code into the drive using debug mode, and since the debug codes are unknown for the Wii, it won't work.

 

[AshuraZro]

I didn't expect a response on that one so quick. Good to see that it's at least been considered or looked into already.

Honestly though, I bought all my GCN games and my GCN is unmodified completely. I just streamed the mem card app to back files up rather than buying more memory cards for GCN so it's not a big deal for me.

 

[ohoni]

there kind of is a Wii 2, slated for '07 to have dvd compatibility.

From what I've heard that's supposed to just be a software update for the existing hardware. The Wii can already play DVD movies, it just lacks the decoding software and more importantly the liscenses necessary to have DVD playback capability. Those would have added probably $20-40 to the cost of each unit.

 

[The_Pope]

Generally, hacking is done via a buffer overflow. A buffer overflow allows editing of the current memory. From what I understand, previous softmod methods have simply restarted the booting sequence while bypassing the copy check. However, until the firmware for the Wii is dumped, it is unlikely that a exploit will be found. I may investigate the theory of man in the middling Nintendos servers, too see if unsigned code is sent over. However, I believe that the code sent from Nintendo will be signed. The Wii isn't even being released here till the 7th of December, so I won't be able to Wireshark some data until then.

 

[corbs132]

Generally, hacking is done via a buffer overflow. A buffer overflow allows editing of the current memory. From what I understand, previous softmod methods have simply restarted the booting sequence while bypassing the copy check. However, until the firmware for the Wii is dumped, it is unlikely that a exploit will be found. I may investigate the theory of man in the middling Nintendos servers, too see if unsigned code is sent over. However, I believe that the code sent from Nintendo will be signed. The Wii isn't even being released here till the 7th of December, so I won't be able to Wireshark some data until then.

erm... not quite. buffer overflows are when it feeds to much data to a specified variable, or in this case, validity check. this isn't always the case, as we have seen with the nds nopass cards literally spoofing the actual data.
and as for whoever said the wii dvd update will be firmware based, http://www.engadget.com/2006/11/14/nintend...bled-wii-in-07/ .

 

[The_Pope]

Generally, hacking is done via a buffer overflow. A buffer overflow allows editing of the current memory. From what I understand, previous softmod methods have simply restarted the booting sequence while bypassing the copy check. However, until the firmware for the Wii is dumped, it is unlikely that a exploit will be found. I may investigate the theory of man in the middling Nintendos servers, too see if unsigned code is sent over. However, I believe that the code sent from Nintendo will be signed. The Wii isn't even being released here till the 7th of December, so I won't be able to Wireshark some data until then.

Hehe, that is true. Guess thats what I get for posting without checking exactly what I said. Plus, I mostly pentest HTTP and HTTPS for things such as XSS and SQL injection, so I have much experiance using buffer overflows offensivly.

 

[mr.slacker]

Â
QUOTE(The_Pope @ Nov 21 2006, 04:17 AM)
Generally, hacking is done via a buffer overflow. A buffer overflow allows editing of the current memory. From what I understand, previous softmod methods have simply restarted the booting sequence while bypassing the copy check. However, until the firmware for the Wii is dumped, it is unlikely that a exploit will be found. I may investigate the theory of man in the middling Nintendos servers, too see if unsigned code is sent over. However, I believe that the code sent from Nintendo will be signed. The Wii isn't even being released here till the 7th of December, so I won't be able to Wireshark some data until then.
*


erm... not quite. buffer overflows are when it feeds to much data to a specified variable, or in this case, validity check. this isn't always the case, as we have seen with the nds nopass cards literally spoofing the actual data.
and as for whoever said the wii dvd update will be firmware based, http://www.engadget.com/2006/11/14/nintend...bled-wii-in-07/ .

I'm not sure, but I think you're both kind of right about buffer overflows.My understanding is you feed too much data to a variable, thus overwriting the next instruction with your own command to jmp to somewhere else in the code (i.e. where you've put your own code to do whatever you want). meh, whatev, in any case it will be an interesting avenue to look into.

And i really like the idea of investigating possible networking based attacks on the Wii. Ultimately we may not find a vulnerability like we're looking for, but just knowledge of how the networking works will definitely help in eventual wii developement.

I think the man in the middle attack sounds like a very cool idea the_pope. one question though; when I think man in the middling, i think of arp cache poisoning and sniffing out the packets between the wii and the nintendo servers; is this what you were thinking too, or do you have some other way to try? Which leads to the question, does the wii use some sort of arp tables that can be modified?

but i'm sure this is much more complicated than need be since we have full access to the target wii, the router, and our man in the middle. Dosn't the wii have a wired ethernet connection? could you just run the wii to a computer, do internet connection sharing, and sniff out the traffic on the NIC the wii's connected too?

Oh yeah, and before i get ahead of myself, does anyone know if the wii uses standard tcp/ip protocol? or is it like the ds that uses some weird proprietary format?

And could anyone explain how what internet enabled functions the wii has currently? (like, downloading virtual console games, i think someone said something about wii channels...). actually, does anyone know of an article or something that explains it? i guess listing everything out would kind of be a waste of time...

haha, sorry for the abundance of questions; there's just so many tests i want to run and things i want to try... but I'll shut up for now as posing questions instead of providing answers probably isn't all that helpful... I think my friend's little brother stood in line for a wii... ha, maybe i can borrow his... ha, if not, i'll probably get anxious and pose more things to try until i get a wii of my own...

 

[The_Pope]

Maybe Man in the Middling wasn't the correct term. I was thinking more of packet injection inbetween communication to Nintendo and the Wii, if it was a secure communication, or just plain setting up a pseudo server on a home computer and seeing exactly what we could do if we where 'Nintendo.'

 

[mr.slacker]

ah yeah, that sounds like a pretty good idea. i know you said don't have a wii, the_pope, but does anyone know if there is a sort of network setup screen in the wii that allows you to chose settings about what nintendo server you connect to, or is it limited to simply how you connect to the internet?

 

[Arm73]

I'm about to buy a Wi-Fi adaptor to connect the Wii to the net.
Once I do that, I know that my Wii will perform an update.
Now my concern is, should I avoid to go online for the moment, and wait for somebody to hack the wii, (I am not missing much anyway by not going online, for most of my interest I still use a PC) or go ahed and connect and perform the update ? But my concern is that if somebody finds anexploit in the Wii, but will work only with old firmware, then I'll be spoiled because there is no way to downgrade.
What do you guys think ? Update or not Update ? This is the question....
For sure the current firmware will be easier to hack.....new firmware tend to become more hacker proof.....

 

[ozzyzak]

If it's anything like the PSP firmware, someone will surely find a way to backtrack it.

 

[samsam12]

I Diarrhea My Pants!

 

[harrybuttox]

what is up with people bumping old posts lately...

 

[Eternal Myst]

JPH edit - quote removed
What was the point of that?

 

[WiiCrazy]

Well actually a nice old topic, maybe we should get our hands dirty.
Fiddling with ID3 tag of mp3 and meta content of jpg files could be a good start. Then maybe we can find an easy to use exploit than the current TP exploit. I guess there are plenty and all known by the HBC crew.

I'll start exploring things starting with the photo channel...

 

[Eternal Myst]

Well actually a nice old topic, maybe we should get our hands dirty.
Fiddling with ID3 tag of mp3 and meta content of jpg files could be a good start. Then maybe we can find an easy to use exploit than the current TP exploit. I guess there are plenty and all known by the HBC crew.

I'll start exploring things starting with the photo channel...

I don't think we need a new exploit.The TP hack is fine.It could not be easier than that.

 

[WiiCrazy]

Well actually a nice old topic, maybe we should get our hands dirty.
Fiddling with ID3 tag of mp3 and meta content of jpg files could be a good start. Then maybe we can find an easy to use exploit than the current TP exploit. I guess there are plenty and all known by the HBC crew.

I'll start exploring things starting with the photo channel...

I don't think we need a new exploit.The TP hack is fine.It could not be easier than that.

Well I think it could be, though may not be better since it would be less update proof.

How about this, you put a hacked jpeg photo into your sd and as soon as it's to be shown on the screen the exploit is fired.

Even not needed, It still makes sense just for the sake and fun of it.