Hacking Wii disc dumper v1.0 released by nitrotux

[ProdigySim]

Nitrotux probably doesn't give a damn anymore. He's just been heckled again and again for posting. If you appreciate what he's done, leave it at that. If not, who gives a rat's ass. I find it hard to believe that any of you have huge moral/principle issues with this

And here's what my rafb paste said:

CODELOAD:13470000;
LOAD:13470000; +-------------------------------------------------------------------------+
LOAD:13470000; |ÂÂÂÂ This file is generated by The Interactive Disassembler (IDA)ÂÂÂÂÂÂÂÂ|
LOAD:13470000; |ÂÂÂÂ Copyright (c) 2007 by DataRescue sa/nv, ÂÂÂÂÂÂÂÂ|
LOAD:13470000; +-------------------------------------------------------------------------+
LOAD:13470000;
LOAD:13470000; Input MD5ÂÂ : BBCA87678E7245959D293A6C59BDAAF5
LOAD:13470000
LOAD:13470000; ---------------------------------------------------------------------------
LOAD:13470000; File NameÂÂ : D:\wiidumpsd\IOS21-64-v514.001.elf
LOAD:13470000; FormatÂÂÂÂÂÂ: ELF (Executable)
LOAD:20200EA2; ---------------------------------------------------------------------------
LOAD:20200EA2
LOAD:20200EA2 loc_20200EA2ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ; CODE XREF: sub_20200C84+50j
LOAD:20200EA2ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ; DATA XREF: LOAD:jpt_20200CD4o
LOAD:20200EA2ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ MOVSÂÂÂÂR1, #0xA0ÂÂÂÂ ; jumptable 20200CD4 case 141
LOAD:20200EA4ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ LDRÂÂÂÂ R0, [R5,#8]
LOAD:20200EA6ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ LSLSÂÂÂÂR1, R1, #9
LOAD:20200EA8ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ CMPÂÂÂÂ R0, R1
LOAD:20200EAAÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ BHIÂÂÂÂ loc_20200EB6ÂÂ; Affected line
LOAD:20200EACÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ LDRÂÂÂÂ R2, [R5,#4]
LOAD:20200EAEÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ LSRSÂÂÂÂR3, R2, #2
LOAD:20200EB0ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ ADDSÂÂÂÂR3, R0, R3
LOAD:20200EB2ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ CMPÂÂÂÂ R3, R1
LOAD:20200EB4ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ BLSÂÂÂÂ loc_20200E1AÂÂ; Affected line
LOAD:20200EB6
LOAD:20200EB6 loc_20200EB6ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ; CODE XREF: sub_20200C84+226j
LOAD:20200EB6ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ MOVLSÂÂ R0, 0x7700
LOAD:20200EBAÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ BÂÂÂÂÂÂ loc_20200CE8
LOAD:20200EBC; ---------------------------------------------------------------------------


LOAD:13470000;
LOAD:13470000; +-------------------------------------------------------------------------+
LOAD:13470000; |ÂÂÂÂ This file is generated by The Interactive Disassembler (IDA)ÂÂÂÂÂÂÂÂ|
LOAD:13470000; |ÂÂÂÂ Copyright (c) 2007 by DataRescue sa/nv, ÂÂÂÂÂÂÂÂ|
LOAD:13470000; +-------------------------------------------------------------------------+
LOAD:13470000;
LOAD:13470000; Input MD5ÂÂ : 2A9C2E84A74CF8159053087C0409AF69
LOAD:13470000
LOAD:13470000; ---------------------------------------------------------------------------
LOAD:13470000; File NameÂÂ : D:\wiidumpsd\ios5.001.elf
LOAD:13470000; FormatÂÂÂÂÂÂ: ELF (Executable)
LOAD:20200EA2; ---------------------------------------------------------------------------
LOAD:20200EA2
LOAD:20200EA2 loc_20200EA2ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ; CODE XREF: sub_20200C84+50j
LOAD:20200EA2ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ; DATA XREF: LOAD:jpt_20200CD4o
LOAD:20200EA2ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ MOVSÂÂÂÂR1, #0xA0ÂÂÂÂ ; jumptable 20200CD4 case 141
LOAD:20200EA4ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ LDRÂÂÂÂ R0, [R5,#8]
LOAD:20200EA6ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ LSLSÂÂÂÂR1, R1, #9
LOAD:20200EA8ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ CMPÂÂÂÂ R0, R1
LOAD:20200EAAÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ LSLSÂÂÂÂR0, R0, #0ÂÂÂÂ; Affected line
LOAD:20200EACÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ LDRÂÂÂÂ R2, [R5,#4]
LOAD:20200EAEÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ LSRSÂÂÂÂR3, R2, #2
LOAD:20200EB0ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ ADDSÂÂÂÂR3, R0, R3
LOAD:20200EB2ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ CMPÂÂÂÂ R3, R1
LOAD:20200EB4ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ BÂÂÂÂÂÂ loc_20200E1AÂÂ; Affected line
LOAD:20200EB6; ---------------------------------------------------------------------------
LOAD:20200EB6ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ MOVLSÂÂ R0, 0x7700
LOAD:20200EBAÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ BÂÂÂÂÂÂ loc_20200CE8
LOAD:20200EBC; ---------------------------------------------------------------------------

Awesome, right?

The release of this isn't going to affect the "scene" or homebrew at all. It's not like any of you dump your own discs anyway. Since this uses Nintendo's code, it's not likely that any of the real homebrewers are going to integrate it into any of their programs. This release has essentially no practical repercussions on anything outside of itself. Seriously. Calm the fuck down. It's going to be a long time before shit like this matters. And in a few months (maybe less), you'll be able to delete IOS like this.

 

[suloku]

OK, but does the app work? I'm not gonna try installing an ios without being able to remove it, furthermore if even when removing it leaves traces.

I prefer to keep using my gecko instead. Maybe a onthefly patch to the ios21 could be made? when you load an ios is it loaded completely to memory? if it is it shouldn't be really a problem knowing where the restriction is.

 

[teq]

OK, but does the app work? I'm not gonna try installing an ios without being able to remove it, furthermore if even when removing it leaves traces.

I prefer to keep using my gecko instead. Maybe a onthefly patch to the ios21 could be made? when you load an ios is it loaded completely to memory? if it is it shouldn't be really a problem knowing where the restriction is.

Or maybe patch all of the IOSes to include this?

DVDLowUnencryptedRead isn't used by anything, so removing this limitation won't harm anything.

 

[OrGoN3]

I'm curious. Since the IOS5 cannot be removed, and we know what it changed, would I risk messing up my Wii if I installed an ios5.wad with the changes reverted?

 

[teq]

I'm curious. Since the IOS5 cannot be removed, and we know what it changed, would I risk messing up my Wii if I installed an ios5.wad with the changes reverted?

It wouldn't remove it, it would just overwrite it.

I don't think there's any harm in having it there, but I'm trying to discover if we can do more to unlock more features.



It might be possible to change all of the /dev/di syscalls to /dev/usb and run an external drive.

 

[nitrotux]

I'm curious. Since the IOS5 cannot be removed, and we know what it changed, would I risk messing up my Wii if I installed an ios5.wad with the changes reverted?

It wouldn't remove it, it would just overwrite it.

I don't think there's any harm in having it there, but I'm trying to discover if we can do more to unlock more features.



It might be possible to change all of the /dev/di syscalls to /dev/usb and run an external drive.

It should in theory be possible. If you can make the DVD interface exposed from Starlet to make it read internally from USB, then all Wii games can run from an external USB harddrive. You will need to fix a few encryption routines on Starlet aswell because they use the internal DVD routines too.

None of the Wii games will even know this is happening, since Ninty abstracted the interface so well.

 

[ProdigySim]

It should in theory be possible. If you can make the DVD interface exposed from Starlet to make it read internally from USB, then all Wii games can run from an external USB harddrive. You will need to fix a few encryption routines on Starlet aswell because they use the internal DVD routines too.

None of the Wii games will even know this is happening, since Ninty abstracted the interface so well.

That sort of thing should be possible. I think there are some people interested in coding their own IOS-replacement (or at least a stripped down from-scratch IOS) that they can distribute for homebrew/private key grabbing purposes.

But of course, that would require a little bit more than some ASM hacks... So it'll probably be a while before people are compiling their own IOS binaries.

 

[redact]

can anyone tell me how to enable DL dumping, because without that this program is pretty much useless

 

[PKGINGO]

I'm curious. Since the IOS5 cannot be removed, and we know what it changed, would I risk messing up my Wii if I installed an ios5.wad with the changes reverted?

It wouldn't remove it, it would just overwrite it.

I don't think there's any harm in having it there, but I'm trying to discover if we can do more to unlock more features.



It might be possible to change all of the /dev/di syscalls to /dev/usb and run an external drive.

If you did that, you would have to encapsulate the DVD calls inside the USB protocol somehow... I don't think that will be very easy... in fact, it could very very slow until ehci is enabled.

mercluke: Stop being an ass. The only reason you want it is for 1, maybe 2 games. Everything else is single layer anyway. So if this program is that useless, go buy yourself the special hardware you need to do this another way. It's ungrateful little trolls like you that people like me purposefully stop working on projects to spite you.

 

[teq]

If you did that, you would have to encapsulate the DVD calls inside the USB protocol somehow... I don't think that will be very easy... in fact, it could very very slow until ehci is enabled.

IOS handles the syscalls... so you can change what it interfaces with. The location of files on a DVD isn't hardcoded to the Wii.

 

[bubbleboy]

can anyone tell me how to enable DL dumping, because without that this program is just useless

useless? not really, only one game is DL so far..

 

[redact]

can anyone tell me how to enable DL dumping, because without that this program is just useless

useless? not really, only one game is DL so far..

there's at least two, i just can't remember what the other one's called

 

[spliffdizzle]

OK, to answer everyone's question that hasn't been answered (that I've seen anyways)...

IT DOESN'T WORK PROPERLY!

I've tried 2 discs (Wii Sports and Super Mario Galaxy), and both end with an error on part 2.bin (the final part). The final .iso size for the combined SMG is 4,697,651,200 bytes, which is roughly 2MB short of the proper size. I did try burning it, and the disc channel did recognize it, but the error message "Please insert the Super Mario Galaxy game disc" popped up even before the wii remote strap info screen. So, final word is NO DICE GUYS!

 

[caitsith2]

Can this disc dumper also dump gamecube game discs?

 

[kezman]

It doesn't even dump wii games properly.

 

[teq]

I was extremely hesitant to install this WAD before, due to the fact that:

A) There's no apparent author to credit it to.
B) There's no way of removing IOS wads once they're installed.


However, Bushing recently stated that it would be of no harm to install custom IOS versions, because they'll go ignored by the system if they aren't needed. In the same post, he mentioned that the IOS can't circumvent the drive in order to load backups. This doesn't rule out the front SD, WiFi, or the front usb ports, however.

I was thinking that since SD is limited on capacity and USB is limited on bandwidth, a WiFi ISO loader would be possible. It was done with Phantasy Star Online, so I don't see why it wouldn't be feasible.

 

[Richy Freeway]

there's at least two, i just can't remember what the other one's called

So if you can't remember what it's called, you obviously don't own it, so it doesn't matter if you can't dump it!

 

[JPdensetsu]

I't doesnt work for me :s

 

[nanika]

OK, to answer everyone's question that hasn't been answered (that I've seen anyways)...

IT DOESN'T WORK PROPERLY!

I've tried 2 discs (Wii Sports and Super Mario Galaxy), and both end with an error on part 2.bin (the final part). The final .iso size for the combined SMG is 4,697,651,200 bytes, which is roughly 2MB short of the proper size. I did try burning it, and the disc channel did recognize it, but the error message "Please insert the Super Mario Galaxy game disc" popped up even before the wii remote strap info screen. So, final word is NO DICE GUYS!

What happens if you set the offest to 4697651200 bytes?

 

[Fabi85]

worked perfect for me. edited the code a little to use a 1 gig sd card.

edited parts are:

CODE
...
if (part == 0)
{
offset = 0;
size = 750 * 1024 * 1024;
}
else if (part == 1)
{
offset = 0x17700000/2;
size = 750 * 1024 * 1024;
}
else if (part == 2)
{
offset = 0x17700000;
size = 750 * 1024 * 1024;
}
else if (part == 3)
{
offset = 0x17700000 + 0x17700000/2;
size = 750 * 1024 * 1024;
}
else if (part == 4)
{
offset = 2*0x17700000;
size = 750 * 1024 * 1024;
}
else if (part == 5)
{
offset = 2*0x17700000 + 0x17700000/2;
size = 1554251776 - 750 * 1024 * 1024;
}

...


void mainloop()
{
printf("Wii disc dumper v1.0 - nitrotux\n");



printf("Hit A to dump part 0 to SD\n");
printf("Hit 1 to dump part 1 to SD\n");
printf("Hit 2 to dump part 2 to SD\n");

printf("Hit B to dump part 3 to SD\n");
printf("Hit - to dump part 4 to SD\n");
printf("Hit + to dump part 5 to SD\n");

while(1)
{
WPAD_ScanPads();

u32 pressed = WPAD_ButtonsDown(0);

if ( pressed & WPAD_BUTTON_HOME )
exit(0);

if ( pressed & WPAD_BUTTON_A )
dumpdvd(0);

if ( pressed & WPAD_BUTTON_1 )
dumpdvd(1);

if ( pressed & WPAD_BUTTON_2 )
dumpdvd(2);
if ( pressed & WPAD_BUTTON_B )
dumpdvd(3);

if ( pressed & WPAD_BUTTON_MINUS )
dumpdvd(4);

if ( pressed & WPAD_BUTTON_PLUS )
dumpdvd(5);



VIDEO_WaitVSync();
}
}





...maybe its useful for someone