The Wii has been hacked...

[LobStar]

I know it is old news... But what do you see coming out of this. What about support for those without drive chips?
With the current state of the Wii, I figured it would be good to go over the recent hack and my own personal theories.

If you haven't heard already, recently, there was an amazing hack that allowed the Wii to execute non-nintendo signed code. http://www.wiili.org/index.php/Wii_homebrew Has more info. The information is quite revealing and the source is very reputable, especially since it's at the CCC convention in Germany before many other hackers. The demoed exploit worked with a drive chip like the wiiboss or wiikey to bypass the protection against running burned DVDs. The code from what most likely is lego star wars, was used to boot into their own code directly from the wii menu.

The code was signed and encrypted with with the Wii's private key, which was obtained by booting homebrew gamecube code and exploiting a bug in ati's graphic chipset's hardware to read ram that normally can not be reached. In this ram was this secret code.

Now in order to make immediate use of this hack, a user will probably need a drive chip to disable checking for a burned DVD in order to execute this. However, I have a few theories on getting around this. Back when the Wii shop was hijacked to try making a make shift browser and being directed to google, there were some interesting proof's of concepts to redirect the wii to another host. Since we now have access to Wii updates from pirated Wii discs, we should be able to modify a release, say from Mario Galaxy, and redirect the Wii to a website to download the modified firmware from and flash it for us to remove the checks without needing a modchip. This could pave the way for homebrew firmware to launch homebrew, copied games, gamecube games, and gamecube homebrew without the need to open the console.

That is only one avenue of attack. Another would be the channels/virtual console. Since we may be able to now dump an unencrypted copy of firmware, we can look to see how these channels load and use that information to decrypt a virtual console game, write a pc program to lock it to another wii, transfer it to an SD card and run it to execute GCOS, flash the firmware for us, or boot a burned disc via a secondary disc channel.

Finally, Datel released power saves recently. If we can find a bug to crash a game and get it to run our code, like the xbox softmod, we can allow it to boot from a burned disc or run some code for us to allow flashing. Sadly this is the most unlikely scenario to happen, but is a completely different venue of attack for us to use which may help us learn more. Red Steel is so poorly programmed, I am sure we can somehow use it to do this.

This is now speculation, but has anyone tried coping a game, booting the original, and swapping it out with the copy? Since we are now out of the Wii's firmware, I think, we should be free of checking if the disc is burned or not. Because of tis new method of homebrew, we might be able to say, load lego star wars, go to the title screen, swap out the disc for a copied one with different code that can load when the user starts the game.

With the Wii's semi-recent USB keyboard support, perhaps someone can simulate a keyboard through a usb interface on a computer and possibly cause a stack overflow inside the firmware as well? Playing MJPEGs on the Wii is another idea.... can we create video data that can crash the photo channel? Buffer overflows are <3.

Does anyone else have any ideas or theories they would like to share for other venues of attack?

[casualsax3]

With the Wii's semi-recent USB keyboard support, perhaps someone can simulate a keyboard through a usb interface on a computer and possibly cause a stack overflow inside the firmware as well?

Speak more on this stack overflow within the firmware.

[LobStar]

I dont know the details of the Wii's implementation, but from what I understand, keyboards use scan codes and over USB it is encapsulated in an HID packet, again I could be talking out of my ass since I have no idea how the Wii reads this. But anyway, when the keyboard sends data, it usually gets sent to a hardware buffer which the system attempts to process when it has free cycles. What if we sent data fast enough that it filled up this buffer, what if the Wii doesn't have one? What if we send it a nonstandard keyscan code? A huge string of badly sanitized data? A malformed packet? If the programmers were lazy, the keyboard usb interface could be a very viable medium for trying to do a buffer overflow attack in this method. The best way to find out if this is possible is to either try it, which I do not have the knowledge or ability to do, or to take apart the firmware and see how it handles the code, which I could do, but I need the decryption key first.

It's just a few theories I had, might be something neat to try, could be me talking out of my ass. I'll leave that up to the experts, but it can never hurt to think of interesting ways to crash or attack the Wii .

[Rydian]

As a note of red steel, I haven't played it, but poorly designed, porly executed, and poorly programmed are entirely different things. You can have a gave that plays like shit have no holes at all, and something like super mario galaxy be the one to allow this modification.



casuals: Psh, go read some PSP homebrew sites, and you find "buffer overflow" every few pages.



Is it just me, or does every buffer overflow involved tga images? XD

Anyways. The Wii uses a PPC processor, right? Can anybody tell me the chances of hooking up a harddrive and running say, OS7 or 8 programs, based on the specs? Being able to run pre-written programs... people would have a field day.

EDIT: Haha. Imagine if the buffer overflow was CTRL-ALT-DELETE. How confusing would that be?
Also. MTU above 5K, anybody? I've seen routers choke on stuff above 1,500. It was a fiber-optic connection, too. 15/2 megabits, modem/router in one, and it didn't handle anything above 1,500 right. o_<;

[Panzer88]

it's basically a PPC, but it isn't EXACTLY a PPC, so it's not like everything would just work perfectly.

[Gil_Hamilton]

Anyways. The Wii uses a PPC processor, right? Can anybody tell me the chances of hooking up a harddrive and running say, OS7 or 8 programs, based on the specs? Being able to run pre-written programs... people would have a field day.

Slim to none.
Remember, processor is only PART of the equation.
An Amiga can't run MacOS, even though both systems were 68k-based. The REST of the hardware is just too different.

Commodore and Atari computer software wasn't interchangable, even though both used 6502s(hell, pretty much EVERYTHING from the late 70s/early 80s used a 6502).

[Rydian]

panzer: And it's not like most programs are written in assembly, either.


gil: I wasn't meaning the OS itself.
Then again, an API layer and all this might be too much work for too old of a program set.

[Gil_Hamilton]

panzer: And it's not like most programs are written in assembly, either.

Do you know what a compiler does?
It converts high-level languages to assembly. And from there it converts them to machine code.

THE LANGUAGE THE APP WAS AUTHORED IN IS IRRELEVANT.
YOU DO NOT RUN SOURCE.

gil: I wasn't meaning the OS itself.
Then again, an API layer and all this might be too much work for too old of a program set.

Either way, the point stands.
The "Classic" apps were written for an entirely different system architecture.

[Panzer88]

which was what I was trying to get at also.

[Rydian]

Gil: I know you don't run the source; I'm not that much out of compiled languages. Can't you just use a different compiler with a few changes? I'm just saying have lots of pre-written source would be nice, and asking if it's possible, no need to blow a gasket at me, I'm only human, and there's no need to treat ignorance in such a fashion.

Either way, the point stands.
The "Classic" apps were written for an entirely different system architecture.

Oh yes, filesystems and libraries and such.
That's a much better explanation, and all that was needed. No use fighting over whether the rocket will survive in space if you have no fuel for it.

[sweener2001]

if you're kind to ignorance, it never goes away

[Rydian]

google define:ignorance

google define:teaching

[Gil_Hamilton]

Gil: I know you don't run the source; I'm not that much out of compiled languages. Can't you just use a different compiler with a few changes? I'm just saying have lots of pre-written source would be nice, and asking if it's possible, no need to blow a gasket at me, I'm only human, and there's no need to treat ignorance in such a fashion.

If you have the source, it doesn't much matter WHAT processor it was coded for, does it?

Either way, the point stands.
The "Classic" apps were written for an entirely different system architecture.

Oh yes, filesystems and libraries and such.
That's a much better explanation...

Apparently not, since you still misunderstood it.

I mean hardware layout. How the processor interfaces with it's peripherals. What those peripherals are. How those peripherals behave.

just because two systems use the same CPU doesn't mean they're remotely compatible.

See: NES, Atari 5200.
Both systems are built around a 6502 at 1.79 MHz.
Both take COMPLETELY different approaches to system construction, and are fundamentally incompatible at all levels.

[Rydian]

Well, THAT'S the kind of info that could have stopped me from making an idiot of myself. T_T

[Gil_Hamilton]

Well, THAT'S the kind of info that could have stopped me from making an idiot of myself. T_T

That information was a rephrasing of this:

Slim to none.
Remember, processor is only PART of the equation.
An Amiga can't run MacOS, even though both systems were 68k-based. The REST of the hardware is just too different.

Commodore and Atari computer software wasn't interchangable, even though both used 6502s(hell, pretty much EVERYTHING from the late 70s/early 80s used a 6502).

[Rydian]

The hardware being different sounded like nothing, hardware needs drivers for the OS.

The way a program or OS or processer interacts with that hardware specifically being different... that's bigger.

I'm not used to dealing with other platforms, so my mindset is usually in the PC way.

[LobStar]

As a note of red steel, I haven't played it, but poorly designed, porly executed, and poorly programmed are entirely different things. You can have a gave that plays like shit have no holes at all, and something like super mario galaxy be the one to allow this modification.



casuals: Psh, go read some psp homebrew sites, and you find "buffer overflow" every few pages.



Is it just me, or does every buffer overflow involved tga images? XD

Anyways. The Wii uses a PPC processor, right? Can anybody tell me the chances of hooking up a harddrive and running say, OS7 or 8 programs, based on the specs? Being able to run pre-written programs... people would have a field day.

EDIT: Haha. Imagine if the buffer overflow was CTRL-ALT-DELETE. How confusing would that be?
Also. MTU above 5K, anybody? I've seen routers choke on stuff above 1,500. It was a fiber-optic connection, too. 15/2 megabits, modem/router in one, and it didn't handle anything above 1,500 right. o_<;

Trust me, it's poorly programmed. Geometry errors, lockups, problems/crashes randomly at checkpoints, bad clipping in certain instances.

TGA and bitmap images are the easiest to do, you can store them as uncompressed data so you can easily manipulate what data gets stored and is written over the memory. If you did it with a JPEG... youd have to find some way of making it reliable compress to reproduce your actual full on code... It would be moronic to try it. If you were insane... then maybe go for a different format. The thing about doing this with MJPEGs though is there is an uncompressed pcm audio stream that goes with it we might be able to piggy back code into....

Also no chance in hell it could run those applications easily. Just think about memory mapped IO... Youd have to emulate access to everything based on those addresses.. It would be like some Frankenstein version of vmware meets dosbox... Closest thing ive heard of doing what your describing is project L for the dreamcast. If you were familiar with the pc way, you probably would have thought about mmio first... Seriously though, anything is possible, but before you criticize people or ideas, or even not accept an answer, why don't you do some research. Wikipedia is a wonderful source of information, your old enough to know that.

[Rydian]

Lobstar: What you're describing is bad planning and a poorly put together game. ... unless it's a custom engine, then hell yes.

And too bad portable things don't play MKV files. Oh the fun you all could have.

Also, I don't know what project L is, I used my dreamcast to play dreamcast games, and I've never heard of mmio.

Also, maybe I didn't know what to look up? D: Maybe I needed a little more info, like being told how it's different, not that it's different. And I got that, point over.

It's like if somebody doesn't know what word to use, and you tell them to go look it up in the dictionary. D: Not any help.

You're a couple of hours too late to whip me. Try again tomorrow when I fuck up again.

[LobStar]

Yes because lockups and crashes are just bad planning...

MKV is just a container, I'm sure someone will port mplayer or similar to the psp...

Project L does exactly as you wanted, you really need to learn to google.... It's a saturn "emulator" for dreamcast trying to flip the byte order of the sh2 instructions for the sh4 processor and emulate the rest of the system.

You said you were not familiar with other platforms, only had a PC mindset... well PC uses memory mapped io! If you haven't heard of it, your mindset isn't anything then...

Didn't know what project L was?
http://www.google.com/search?hl=en&q=pr ... +dreamcast
Result NUMBER ONE!

Didn't know what to look for in memory mapped io?
http://www.google.com/search?hl=en&q=memory+mapped+io
Result NUMBER ONE!

I would say both of those sites said volumes about what they were...

Just these lines say more than enough:

"Project L is a port of the Linux Saturn Emulator yabause."

"Memory-mapped I/O (MMIO) and port I/O (also called port-mapped I/O or PMIO) are two complementary methods of performing input/output between the CPU and peripheral devices in a computer."

There is no excuse, there was plenty of information on what to look for and common sense on how to find it...

I do not "whip" people. And I do not troll the board, thats the point of a message board... it's not a chat room. I have school, and I work, and have a wonderful boyfriend and life. Why the hell would I leave that behind to "whip" you every waking moment you sign on?

If you have read my past posts, I am probably one of the kindest members on here to people, but ignorance is intollerable. You have a cute avatar, but it needs to think before it talks non-sense or tries to make claims it clearly cannot make.

[Gil_Hamilton]

The hardware being different sounded like nothing, hardware needs drivers for the OS.

The way a program or OS or processer interacts with that hardware specifically being different... that's bigger.

I'm not used to dealing with other platforms, so my mindset is usually in the PC way.

And a specific subset of PC at that.

You're just taking as a given that all systems with a given processor use the exact same IO behavior, northbridge/southbridge paradigm and behavior, and a host of other assumptions that aren't true.



Drivers only get you so far.


Also:
"The hardware being different " and "The way a program or OS or processer interacts with that hardware specifically being different" are the EXACT same thing.

A processor doesn't magically talk to the video card and sound card. There's a large, often complex, piece of intermediary hardware called a motherboard that provides the interface between all those separate pieces of hardware.


Expecting MacOS to run on a Wii(or 360) just because both use a PowerPC processor is like expecting a PCI video card to work in an AGP slot because AGP is based on PCI.

[LobStar]

So anyway, can we please get back on topic with other ideas of attacking the Wii? It's really a very interesting topic and I think a lot of people can benefit from our theories or speculation...

[mudlord]

Well, I think I know one guy that knows a fair bit about game exploits...

http://aluigi.org

He is a game security researcher, specialising in exploits of online games, like crashes, buffer overflows, and other nice things . You might be able to ask him about this, has he certainly knows his stuff when it comes to hacking and finding exploits. Plus, his site is a goldmine for code on anything related to this (and all under GPL).

Speak more on this stack overflow within the firmware.

Well, you can overflow the buffers to have a chance to shove data into the Wii, like unsigned code (if the Wii uses such a process).

More info on stack overflows is here:
http://en.wikipedia.org/wiki/Stack_overflow

Sure its a Wiki link, but the info is accurate enough.

What if we send it a nonstandard keyscan code? A huge string of badly sanitized data? A malformed packet?

Problem is there, the firmware might have exception handling to these sort of situations, IF Nintendo bothered about security.

[LobStar]

Yeah, thats why I just had theories. I dont have a decrypted copy of firmware to trace to find out if they did or not. I have no way to test my ideas yet, but when I can, I would like to have some ideas to look at or if someone else is looking for ideas to look into exploiting the Wii, a place for people to start looking or experiment with would be a neat find .

Anyway, it would be awesomeif someone used the keyboard to hack the Wii lol, it was just an idea though.

In regards to aluigi's site: That is just AMAZING. I Bow before his greatness....

[Rydian]

"Yes because lockups and crashes are just bad planning... "

- So if I use a faulty driver and get a BSOD, it's microsoft's poor planning?
It depends on whether they made the engine or not.

"MKV is just a container, I'm sure someone will port mplayer or similar to the psp... "

- I'm talking about all the different data you can include in an MKV. It does subtitles and such, right? Or am I thinking of a different format? At least I know it does multiple audio streams.

"Project L does exactly as you wanted, you really need to learn to google.... It's a saturn "emulator" for dreamcast trying to flip the byte order of the sh2 instructions for the sh4 processor and emulate the rest of the system. "

- Too bad that doesn't do what I wanted. :\ Which involves the wii and os7-8 programs, which I now know can't be done.

"You said you were not familiar with other platforms, only had a PC mindset... well PC uses memory mapped io! If you haven't heard of it, your mindset isn't anything then... "

- Or maybe I'm not a programmer? :\ Learn that not everybody knows as much as you do, and you can teach without insulting. Yes, I know quite a bit about computers. No, I do not know exactly how a processor works or any assemlby or machine code. I know OF them, but that's about it. >_<;

"Didn't know what project L was?
http://www.google.com/search?hl=en&q=pr ... +dreamcast
Result NUMBER ONE! "

- Maybe I don't care because this thread has nothing to do with the dreamcast and I don't own one anymore, or even own a computer strong enough to emulate one. And I never played a saturn, though I heard shining force was the 8th coming of jesus.
Now that I know what it is, I may go look it up later if I want info, thank you, but explaining what it had to do with the conversation would have helped.

"Didn't know what to look for in memory mapped io?
http://www.google.com/search?hl=en&q=memory+mapped+io
Result NUMBER ONE!"

- Don't care, have thought of no ways looking that up will help me.

"I would say both of those sites said volumes about what they were... "

- *shrug*

"There is no excuse, there was plenty of information on what to look for and common sense on how to find it... "

- You're talking about the wrong thing. Project L and mapped IO didn't come into this conversation until WELL after I made the mistake with the PPC chip. So mind explaining how I would have known to look up Project L without ever hearing about it before, how I would have known that it even exists, let alone that it has any relevence to this conversation, before I was told of it?
If you're going to rag on me, take a hint from the other members of this forum and do it for something that's actually my fault.

"I do not "whip" people."

- I wasn't being serious. :\ I was joking at how much I failed, and then you continued to press on me how wrong I was after I already got the point.

"And I do not troll the board"

- I didn't say you did. It doesn't appear you do.

"I have school, and I work, and have a wonderful boyfriend and life. Why the hell would I leave that behind to "whip" you every waking moment you sign on? "

- Hunh, and I thought you were a guy. Oh well.
Me? I have no life right now, so I have ample time to defend myself for the things I did not do wrong. If you go to other threads, you can see me messing up, feel free to rag on me for that, hell, I got called a collosal fail and wasn't fighting it, because it was my fault. But I'm getting talked to like this because I WAS NOT AWARE OF SOMETHING EXISTING? That's just not right.

"If you have read my past posts, I am probably one of the kindest members on here to people, but ignorance is intollerable. "

- Well, then there's another mistake of mine. I was taught that being ignorant means you just don't know.

And apparantly you didn't "google define:ignorance". Every definition except the last (the last is rudeness) says something akin to this:
unaware because of a lack of relevant information or knowledge; "he was completely ignorant of the circumstances";
So I think you can forgive me for not knowing already.

"You have a cute avatar,"

- Thank you, I have quite a collection of art people drew me I could have used, but I used this because I had already had it in the correct format for use elsewhere.

"but it needs to think before it talks non-sense or tries to make claims it clearly cannot make."

- See entire above post.
I just didn't know, and that's no reason to get like this with me. Instead of telling me everything I'm doing wrong, why not teach me why I'm wrong and help me learn right?




My volunteer free time is on gaiaonline, the largest message board on the planet, in the computers and technology section. I'm on for multiple hours (I'm a secretary), my average postcount a day is around 33 there. I'm constantly trying to help people with computer issues, and it's generally things I know about, such as program errors, dualbooting, what the hell "apt-get" means, why a .mswmm file can't be uploaded to youtube, stuff like that. Never anything as deep as this, so I thought if I joined this board and hung around, I'd learn more, and so far, I've learned far more from reading ya'll's posts to eachother than any post directed at me. Take it easy on me? I'm new here and don't know nearly as much as all of you, and that's not a crime. On gaia, if somebody says something wrong, I don't get upset at them or yell at them again what they're obviously not understanding, I explain exactly why what they're doing is wrong, what the right way is, and provide links if needed.


There's a big lack of communication here. If I don't get something, try explaining it better. If you don't have the time, then give me a link and explain what the link is to, or some keywords for me to go look up.

Also:
"The hardware being different " and "The way a program or OS or processer interacts with that hardware specifically being different" are the EXACT same thing.

No they're not.
The second can be thought of as a subset of the first, while the first is a generalization that covers the second.
"Hardware being different" is very general. If I am using the onboard audio of my motherboard, and then insert and use a sound card, the hardware is different. Suddenly I have hardware mixing and no noise from the motherboard interfering with my audio. The hardware is being different. I can still use the same OS and programs, can't I?
I just needed a better explanation, because I don't know all this stuff yet.





If this post seems to get off track a bit, it's because I got two kitties yesterday and now they're wanting attention and distracting me.

[Panzer88]

there is a reason we have a quote tag, so it's easy to see what they said, and what you said.