Hacking Wii disc dumper v1.0 released by nitrotux

[drfsupercenter]

OK, so it works for me?

If it's the correct size, it should play correctly... right?

I will install my WiiKey one of these days... but until then I'll just have to hope they will work. Because it's so hard to find NTSC dumps of a lot of games, I'm planning on just going to Blockbuster with some "free game rental" coupons and dumping ISOs of them.

Maybe the guy who said it was 2MB short ran out of room on the SD card? LOL

And no problem, I always like hosting hard-to-find programs since I get pissed when I can't find stuff... and I try to prevent that happening with things I can get my hands on.

By the way, how did you make the homebrew app access the DVD drive? I'm trying to make a DVD Player app (with the help of others), and I don't know how to incorporate that into it...

 

[nitrotux]

OK, so it works for me?

If it's the correct size, it should play correctly... right?

It should yes.

Maybe the guy who said it was 2MB short ran out of room on the SD card? LOL

I'm not sure. It's possible, but it would print a write error in that case.
I've also read that Wasabi users are having trouble reading certain parts of a GC/Wii disc.

QUOTE(drfsupercenter @ Jul 14 2008, 02:53 AM)

By the way, how did you make the homebrew app access the DVD drive? I'm trying to make a DVD Player app (with the help of others), and I don't know how to incorporate that into it...

I simply took the IOS21 wad, and patched out the restriction which only allows you to read from the lower part of a Wii disc.
This gives you an IOS which can read raw sectors from a DVD.

Normally, the standard Wii DVD drive will not accept any discs other than Wii or GC.
This is hardcoded into the DVD drive firmware, and has nothing to do with IOS.

However, there are 2 ways around this.
1. install a drive chip
2. modify the DVD drive firmware on-the-fly to authenticate any DVD (this would be done through another IOS hack and the Wii DVD debug commands?)

I am not exactly sure about (2), but it might be possible.

For example, if you would try my disc dumper with a video DVD and without a drive chip, then the WDVD_UnencryptedRead call will simply fail, because the disc is not properly authenticated.


On wikipedia it says here that video DVDs use the UDF filesystem, so I would imagine you would read raw UDF data and then extract the video files from there.

 

[drfsupercenter]

Ah, thanks for the info...

I was aware that you need a drivechip to make it work... but there's a way using a hacked IOS? I'm not any good at that stuff but I could always use help

Using a drivechip, it would be easy to play DVDs, right?

 

[nitrotux]

It's definitely possible to read video DVD's with a drive chip. But I have no insight in how difficult it is to read from a UDF filesystem.

Let me know how it turns out.

 

[zant]

so there is a possibility of running backup discs w / o a drive chip?

 

[teq]

so there is a possibility of running backup discs w / o a drive chip?

No, discs are out of the question, period... end of story.


USB Mass Storage, SD, and WiFi, however, aren't.

 

[ProdigySim]

It's definitely possible to read video DVD's with a drive chip. But I have no insight in how difficult it is to read from a UDF filesystem.

Let me know how it turns out.

I tried dumping a pressed DVD Video without a drive chip... Didn't work. Slapped in a chip, and it worked like magic. I clipped out the "Get Disc ID" code, so it wasn't that. I don't remember what the exact error was, but I'm pretty sure it was coming from the DVDLowRead function.

Why don't you quit hanging around GBATemp and go somewhere with a little more class?
Just ignore teq. Seriously. He doesn't have anything to offer (except bad justifications).

@teq: The Starlet isn't an architecture. And, yes, that makes a difference.

 

[teq]

Why don't you quit hanging around GBATemp and go somewhere with a little more class?
Just ignore teq. Seriously. He doesn't have anything to offer (except bad justifications).

Yeah, offer him up some class. Maybe #wiidev will take him back. While, you're at it, why don't you go with him, since you seem so high and mighty yourself.

QUOTE(ProdigySim @ Jul 13 2008, 08:15 PM) @teq: The Starlet isn't an architecture. And, yes, that makes a difference.

Shows how much you know.

The Starlet is an entire ARM9 based System on a Chip, moron: http://www.eu.necel.com/products/asic/4_sy...mart/index.html

 

[bushing]

As for zidane_genome's question, I am pretty sure someone will find an exploit in the Starlet to allow for on-the-fly patching, or someone will make a tool to completely install/uninstall a hacked IOS at will.

See.... it's comments like these that clearly prove you don't know what you're talking about.

Starlet has nothing to do with modifying IOS.

Okay, okay, enough of this. I stayed out of this thread because it degenerated so quickly into flaming and name-calling, but this is just silly.

You're arguing with the guy over semantics. Sure, any bug that could be found to allow IOS to be modified in memory without patching it on NAND would be an exploit in software (IOS) -- not in hardware (Starlet). However, you knew what he meant. That's like accusing someone of being an idiot for calling, say, the Twilight Hack a "Wii Exploit" instead of a "Zelda Exploit". The latter is more accurate, but the former is still a fair way to describe it.

As for Nitrotux and code theft -- I was originally skeptical of Nitrotux's claims; now it seems more like he sometimes has difficulty expressing himself well, but that might even be a language barrier issue. Who knows. He's also said some insightful things that were probably missed by most (who knew "abstracted" was a big word?).

In any case, I have seen no support for this claim that Nitrotux did not write this IOS hack. None of the IOS hackers that I know have said they wrote the patch. This is a pretty small number of people, because IOS is completely undocumented (beyond what I've written up on wiibrew.org) and completely specific to the Wii. So, getting to a point of hacking IOS isn't very easy, but once you've gotten there, this is a fairly straightforward patch. For someone with reverse-engineering experience from another project/scene, I find this believable. Nitrotux gets props for being the first person to actually publish a patched IOS to do something useful. (I don't even care about the disc dumper; a patch like this -- in conjunction with a drivechip -- is necessary make a burnable Wii-Linux "LiveCD" or a Wii-mode DVD player.)

I'm more than happy to have more people hacking on IOS -- I wrote some about this here and here. Distributing a modified version of IOS is a no-no, but svpe contributed a patch to PatchMii-core which should provide a better alternative.

 

[Jacobeian]

thanks for the clarification, I was also very sceptical about nitrotux at first but I think it's because he was coming from nowhere and we had so many examples before of code thieves just wanting their moment of fame...

anyway, my initial question to nitrotux remains: what was is approach for reverse engineering ? I mean, you got the IOS binary disassembled, then how did you find DVD read subroutine ? i imagine the code is pretty big no ?

this is just a question, what interess me, above the final result, is more the technical approach behind hacking

edit: i ask myself about the legal issue related to IOS distribution: does the fact that anybody "own" the original software, by having purchased a wii, allow us to distribute modified version of it ? just wondering...

edit2: I guess I found an answer about the way IOS was hacked, thanks a lot to svpe
Now, I wonder, how did DVD games access DVD ? using the simple DVD_read cmd ?

 

[Jacobeian]

OK, to answer everyone's question that hasn't been answered (that I've seen anyways)...

IT DOESN'T WORK PROPERLY!

I've tried 2 discs (Wii Sports and Super Mario Galaxy), and both end with an error on part 2.bin (the final part). The final .iso size for the combined SMG is 4,697,651,200 bytes, which is roughly 2MB short of the proper size. I did try burning it, and the disc channel did recognize it, but the error message "Please insert the Super Mario Galaxy game disc" popped up even before the wii remote strap info screen. So, final word is NO DICE GUYS!
What happens if you set the offest to 4697651200 bytes?



something I noticed is that the parameter type for offset (in the function WDVD_LowUnencryptedRead) is u32, wich limit you to 4294967295 bytes = 4GB

the max size is 4.7Gb so this need u64 type


also, according to wiibrew:

DVDLowUnencryptedRead
// Only works up to 0x0050000; in newer IOS versions (IOS30+) the whole
// data block (i.e. offset and offset + len) has to been within one of the following three
// areas (bytes >> 2):
// * 0x00000000 - 0x00001400 (limit of older IOS versions)
// * 0x460a0000 - 0x460a0008
// * 0x7ed40000 - 0x7ed40008
((u32*)inbuf)[0x00] = 0x8D000000;
((u32*)inbuf)[0x01] = size;
((u32*)inbuf)[0x02] = byte_Offset >> 2;
ios_ioctl( di_fd, 0x8D, inbuf, 0x20, dst, size);

when, in this DVD api:

QUOTE

int WDVD_LowUnencryptedRead(unsigned char **poutbuf, u32 len, u32 offset)
{
WDVD_AllocCommand();
WDVD_AllocOutput(len);

unsigned char* inbuf = ios_command;
unsigned char* outbuf = ios_out;

*poutbuf = ios_out;
int result = 0;

if(!inbuf || !outbuf) { result = -1; goto out; }

((u32*)inbuf)[0] = 0x8d000000;
((u32*)inbuf)[1] = len;
((u32*)inbuf)[2] = offset;

// memset(outbuf, 0x00, len);

result = IOS_Ioctl(di_fd, 0x8d, inbuf, 0x20, outbuf, len);

if (result != 1)
debug_printf("-> %d\n", result);

// if(result >= 0) {
// memcpy(buf, outbuf, len);
// }

out:
//if(outbuf) iosFree(di_hid, outbuf);
//if(inbuf) iosFree(di_hid, inbuf);

return result;
}

edit: nevermind, main.cpp probably handle this already ?

 

[caitsith2]

It is not main.cpp handling the offset issue, instead, it actually is the DVD drive dealing with it. THat 32 bit value is left shifted by 2, into a 34 bit value by the DVD drive, for what offset of the disc to go to. Because of this, Offset 0 gets you bytes 0-3, offset 1 gets you bytes 4-7, and so on.

 

[nitrotux]

The IOS DVD interface counts offset in dwords, and Jeff Epler's WDVD API originally counted size and offset in bytes (this required a u64 offset parameter).

I changed it so I did not have to deal with a u64.

 

[caitsith2]

CODE#include
#include
#include
#include
#include
#include
#include "wdvd.h"


static void *xfb = NULL;
static GXRModeObj *rmode = NULL;
bool fatinited = false;

void init()
{
IOS_ReloadIOS(5);

// Initialise the video system
VIDEO_Init();

// This function initialises the attached controllers
WPAD_Init();

// Obtain the preferred video mode from the system
// This will correspond to the settings in the Wii menu
rmode = VIDEO_GetPreferredMode(NULL);

// Allocate memory for the display in the uncached region
xfb = MEM_K0_TO_K1(SYS_AllocateFramebuffer(rmode));

// Initialise the console, required for printf
console_init(xfb,20,20,rmode->fbWidth,rmode->xfbHeight,rmode->fbWidth*VI_DISPLAY_PIX_SZ);

// Set up the video registers with the chosen mode
VIDEO_Configure(rmode);

// Tell the video hardware where our display memory is
VIDEO_SetNextFramebuffer(xfb);

// Make the display visible
VIDEO_SetBlack(FALSE);

// Flush the video register changes to the hardware
VIDEO_Flush();

// Wait for Video setup to complete
VIDEO_WaitVSync();
if(rmode->viTVMode&VI_NON_INTERLACE) VIDEO_WaitVSync();


// The console understands VT terminal escape codes
// This positions the cursor on row 2, column 0
// we can use variables for this with format codes too
// e.g. printf ("\x1b[%d;%dH", row, column );
printf("\x1b[2;0H");

}


bool initdvd()
{
u64 id;
unsigned char idstring[9];

printf("Initializing DVD...\n");

if (WDVD_Init() == false)
{
printf("Error initializing DVD\n");

return false;
}

if (WDVD_Reset() == false)
{
printf("Error resetting DVD\n");

return false;
}

if (WDVD_LowReadDiskId(&id) != 1)
{
printf("Error reading disc ID\n");

return false;
}

memset(idstring, 0, sizeof(idstring));
memcpy(idstring, &id, 8);


printf("Disc ID: %s\n", idstring);

return true;
}

#define DUMP_DVD 0
#define BENCH_DVD 1
#define BENCH_SD 2

bool dumpdvd(unsigned int part, unsigned long partsize, unsigned int benchmark)
{
char filename[255];
FILE *f;

if(benchmark == BENCH_DVD)
{
printf("Benchmarking DVD Drive\n");
}
else if (benchmark == BENCH_SD)
{
printf("Benchmarking SD Card\n");
}

if(benchmark != BENCH_DVD)
{
if (!fatinited)
{
printf("Initializing libfat...\n");
if(!fatInitDefault())
{
printf("Error cannot initialize libfat. Is SD card inserted?\n");

return false;
}

fatinited = true;
}
}


if (!initdvd())
{
return false;
}

if(benchmark == DUMP_DVD)
{
sprintf(filename, "/%d.bin", part);
printf("Writing file %s to SD\n", filename);

f = fopen(filename, "wb");

if (f == 0)
{
printf("Error opening file\n");

return false;
}
}
else if(benchmark == BENCH_SD)
{
sprintf(filename, "/benchmark.bin");
printf("Writing file %s to SD\n", filename);

f = fopen(filename, "wb");

if (f == 0)
{
printf("Error opening file\n");

return false;
}
}


unsigned long offset = 0;
unsigned long size = 0;

unsigned int maxsize = 50 * 1024;
int countdown = 0;
unsigned char* buffer;
//Size of SL DVD = 4699979776 Bytes
if(benchmark != BENCH_SD)
{
/*if (part == 0)
{
offset = 0;
size = 1500 * 1024 * 1024;
}
else if (part == 1)
{
offset = 0x17700000;
size = 1500 * 1024 * 1024;
}
else if (part == 2)
{
offset = 0x2EE00000;
size = 1554251776;
}*/
offset = (partsize >> 2) * part;
size = partsize;
if((offset + (size >> 2))>0x46090000)
{
size = 0x46090000 - offset;
size

 

[ssj4android]

Try 8,511,160,320 bytes for the DL DVD.

 

[caitsith2]

CODE#include
#include
#include
#include
#include
#include
#include "wdvd.h"


static void *xfb = NULL;
static GXRModeObj *rmode = NULL;
bool fatinited = false;

void init()
{
IOS_ReloadIOS(5);

// Initialise the video system
VIDEO_Init();

// This function initialises the attached controllers
WPAD_Init();

// Obtain the preferred video mode from the system
// This will correspond to the settings in the Wii menu
rmode = VIDEO_GetPreferredMode(NULL);

// Allocate memory for the display in the uncached region
xfb = MEM_K0_TO_K1(SYS_AllocateFramebuffer(rmode));

// Initialise the console, required for printf
console_init(xfb,20,20,rmode->fbWidth,rmode->xfbHeight,rmode->fbWidth*VI_DISPLAY_PIX_SZ);

// Set up the video registers with the chosen mode
VIDEO_Configure(rmode);

// Tell the video hardware where our display memory is
VIDEO_SetNextFramebuffer(xfb);

// Make the display visible
VIDEO_SetBlack(FALSE);

// Flush the video register changes to the hardware
VIDEO_Flush();

// Wait for Video setup to complete
VIDEO_WaitVSync();
if(rmode->viTVMode&VI_NON_INTERLACE) VIDEO_WaitVSync();


// The console understands VT terminal escape codes
// This positions the cursor on row 2, column 0
// we can use variables for this with format codes too
// e.g. printf ("\x1b[%d;%dH", row, column );
printf("\x1b[2;0H");

}


bool initdvd()
{
u64 id;
unsigned char idstring[9];

printf("Initializing DVD...\n");

if (WDVD_Init() == false)
{
printf("Error initializing DVD\n");

return false;
}

if (WDVD_Reset() == false)
{
printf("Error resetting DVD\n");

return false;
}

if (WDVD_LowReadDiskId(&id) != 1)
{
printf("Error reading disc ID\n");

return false;
}

memset(idstring, 0, sizeof(idstring));
memcpy(idstring, &id, 8);


printf("Disc ID: %s\n", idstring);

return true;
}

#define DUMP_DVD 0
#define BENCH_DVD 1
#define BENCH_SD 2

bool dumpdvd(unsigned int part, unsigned long partsize, unsigned int dvdtype, unsigned int benchmark)
{
char filename[255];
FILE *f;

unsigned long DVD_TYPE[3] = {
0x46090000, //Single Layer Wii DVD
0x7ed38000, //Dual Layer Wii DVD
0x15C16000, //Gamecube DVD
};

unsigned long PART_SIZE[3] = {
1500 * 1024 * 1024,
750 * 1024 * 1024,
375 * 1024 * 1024
};

if(benchmark == BENCH_DVD)
{
printf("Benchmarking DVD Drive\n");
}
else if (benchmark == BENCH_SD)
{
printf("Benchmarking SD Card\n");
}

if(benchmark != BENCH_DVD)
{
if (!fatinited)
{
printf("Initializing libfat...\n");
if(!fatInitDefault())
{
printf("Error cannot initialize libfat. Is SD card inserted?\n");

return false;
}

fatinited = true;
}
}


if (!initdvd())
{
return false;
}

if(benchmark == DUMP_DVD)
{
sprintf(filename, "/%d.bin", part);
printf("Writing file %s to SD\n", filename);

f = fopen(filename, "wb");

if (f == 0)
{
printf("Error opening file\n");

return false;
}
}
else if(benchmark == BENCH_SD)
{
sprintf(filename, "/benchmark.bin");
printf("Writing file %s to SD\n", filename);

f = fopen(filename, "wb");

if (f == 0)
{
printf("Error opening file\n");

return false;
}
}


unsigned long offset = 0;
unsigned long size = 0;

unsigned int maxsize = 50 * 1024;
int countdown = 0;
unsigned char* buffer;
//Size of SL DVD = 4699979776 Bytes
if(benchmark != BENCH_SD)
{
offset = (PART_SIZE[partsize] >> 2) * part;
size = PART_SIZE[partsize];
if((offset + (size >> 2))>DVD_TYPE[dvdtype])
{
size = DVD_TYPE[dvdtype] - offset;
size

 

[djcraze]

CODE#include
#include
#include
#include
#include
#include
#include "wdvd.h"


static void *xfb = NULL;
static GXRModeObj *rmode = NULL;
bool fatinited = false;

void init()
{
IOS_ReloadIOS(5);

// Initialise the video system
VIDEO_Init();

// This function initialises the attached controllers
WPAD_Init();

// Obtain the preferred video mode from the system
// This will correspond to the settings in the Wii menu
rmode = VIDEO_GetPreferredMode(NULL);

// Allocate memory for the display in the uncached region
xfb = MEM_K0_TO_K1(SYS_AllocateFramebuffer(rmode));

// Initialise the console, required for printf
console_init(xfb,20,20,rmode->fbWidth,rmode->xfbHeight,rmode->fbWidth*VI_DISPLAY_PIX_SZ);

// Set up the video registers with the chosen mode
VIDEO_Configure(rmode);

// Tell the video hardware where our display memory is
VIDEO_SetNextFramebuffer(xfb);

// Make the display visible
VIDEO_SetBlack(FALSE);

// Flush the video register changes to the hardware
VIDEO_Flush();

// Wait for Video setup to complete
VIDEO_WaitVSync();
if(rmode->viTVMode&VI_NON_INTERLACE) VIDEO_WaitVSync();


// The console understands VT terminal escape codes
// This positions the cursor on row 2, column 0
// we can use variables for this with format codes too
// e.g. printf ("\x1b[%d;%dH", row, column );
printf("\x1b[2;0H");

}


bool initdvd()
{
u64 id;
unsigned char idstring[9];

printf("Initializing DVD...\n");

if (WDVD_Init() == false)
{
printf("Error initializing DVD\n");

return false;
}

if (WDVD_Reset() == false)
{
printf("Error resetting DVD\n");

return false;
}

if (WDVD_LowReadDiskId(&id) != 1)
{
printf("Error reading disc ID\n");

return false;
}

memset(idstring, 0, sizeof(idstring));
memcpy(idstring, &id, 8);


printf("Disc ID: %s\n", idstring);

return true;
}

#define DUMP_DVD 0
#define BENCH_DVD 1
#define BENCH_SD 2

bool dumpdvd(unsigned int part, unsigned long partsize, unsigned int dvdtype, unsigned int benchmark)
{
char filename[255];
FILE *f;

unsigned long DVD_TYPE[3] = {
0x46090000, //Single Layer Wii DVD
0x7ed38000, //Dual Layer Wii DVD
0x15C16000, //Gamecube DVD
};

unsigned long PART_SIZE[3] = {
1500 * 1024 * 1024,
750 * 1024 * 1024,
375 * 1024 * 1024
};

if(benchmark == BENCH_DVD)
{
printf("Benchmarking DVD Drive\n");
}
else if (benchmark == BENCH_SD)
{
printf("Benchmarking SD Card\n");
}

if(benchmark != BENCH_DVD)
{
if (!fatinited)
{
printf("Initializing libfat...\n");
if(!fatInitDefault())
{
printf("Error cannot initialize libfat. Is SD card inserted?\n");

return false;
}

fatinited = true;
}
}


if (!initdvd())
{
return false;
}

if(benchmark == DUMP_DVD)
{
sprintf(filename, "/%d.bin", part);
printf("Writing file %s to SD\n", filename);

f = fopen(filename, "wb");

if (f == 0)
{
printf("Error opening file\n");

return false;
}
}
else if(benchmark == BENCH_SD)
{
sprintf(filename, "/benchmark.bin");
printf("Writing file %s to SD\n", filename);

f = fopen(filename, "wb");

if (f == 0)
{
printf("Error opening file\n");

return false;
}
}


unsigned long offset = 0;
unsigned long size = 0;

unsigned int maxsize = 50 * 1024;
int countdown = 0;
unsigned char* buffer;
//Size of SL DVD = 4699979776 Bytes
if(benchmark != BENCH_SD)
{
offset = (PART_SIZE[partsize] >> 2) * part;
size = PART_SIZE[partsize];
if((offset + (size >> 2))>DVD_TYPE[dvdtype])
{
size = DVD_TYPE[dvdtype] - offset;
size

 

[caitsith2]

Done. http://caitsith2.net/wii/wiidumpsd_1.2_unofficial.rar
(And for those who have already installed IOS5, http://caitsith2.net/wii/wiidumpsd_1.2_unofficial_no_ios.rar)

 

[djcraze]

Awesome, thanks! It looks like its going to take about 7 hours to dump a dual-layer game on my Wii. (About 1% every 4 minutes)

 

[nitrotux]

Great work caitsith2