Hacking rw-r-r-0644 found a boot1 coldboot exploit for the Wii U

[Flame]

So rw-r-r-0644 found a boot1 coldboot exploit for the Wii U. Hopefully this will lead to a coldboot executable with out needing to buy a DS game. so once the eShop does go down we will be still have homebrew one way or another.

Upon startup, boot1 loads and processes the latest SLC ISFS superblock. Directory entries are parsed using a recursive function without any limitation on recursion depth. A carefully crafted superblock with a sufficient directory depth can be used to overwrite memory preceding the boot1 stack and eventually gain arbitrary code execution. For example, it is possible to redirect FLA's FS device structure pointer to the superblock area, allowing an attacker to point structure's functions to a controlled memory location.

https://wiiubrew.org/w/index.php?title=Wii_U_System_Flaws&curid=564&diff=2993&oldid=2955

It finally happened, rw-r-r-0644 did the impossible and found a boot1 coldboot exploit:https://t.co/p0RrrAXdBe

Amazing job!

— Mike Heskin (@hexkyz) April 10, 2021

 

[DinohScene]

Noice!
Amazing job indeed!

 

[Lightyose]

Interesting.

 

[Alexander1970]

So rw-r-r-0644 found a boot1 coldboot exploit for the Wii U. Hopefully this will lead to a coldboot executable with out needing to buy a DS game. so once the eShop does go down we will be still have homebrew one way or another.





https://wiiubrew.org/w/index.php?title=Wii_U_System_Flaws&curid=564&diff=2993&oldid=2955

https://twitter.com/hexkyz/status/1380934706661748737

Thank you for this awesome News.
(Where are these "The Wii U is dead..." Guys now....? )

And/Plus:

With Maschell´s new Aroma Homebrew Enviroment we also do not need a DS Game to buy for Coldboot.

 

[Lightyose]

Well, I already paid for the DS game so. . .

 

[Frankbel]

Perhaps now I will hack my WiiU.

 

[godreborn]

Well, I already paid for the DS game so. . .

so what. what was that $7? I paid $60 for true blue on the ps3, just to play a handful of new games. and, this is supposedly from the same people who brought us sx os. I'm damn glad they're being prosecuted, damn leechers on the scene.

 

[linkinworm]

im not sure how they would implement this without a hack already installed, theres no serial port of any kind on the wiiu other than i think the IR sensor port maybe? (im sure i read the wiis sensor port could do some things) and i dont think you can load any data off the SD card so early in the chain

 

[Blasingame]

Hopefully this will also allow for tools to recover / unbrick systems too Very good news!

 

[The Catboy]

I might have an excuse to plug my Wii U! It's been hacked, for 3 years now, but I haven't even looked at it since hacking it.

 

[godreborn]

I might have an excuse to plug my Wii U! It's been hacked, for 3 years now, but I haven't even looked at it since hacking it.

I play my wii u daily. I'm currently testing the dark mode theme by default. I just got done playing it in fact. I didn't sleep last night, so I'm a bit agitated and hyper sensitive, so bear with me. I hope to go to sleep early tonight.

 

[jeffyTheHomebrewer]

Wii U? Boot1? Huh?

--------------------- MERGED ---------------------------

I just keep it plugged in, like my Wii

 

[The Catboy]

I play my wii u daily. I'm currently testing the dark mode theme by default. I just got done playing it in fact. I didn't sleep last night, so I'm a bit agitated and hyper sensitive, so bear with me. I hope to go to sleep early tonight.

I did for a short period until my external hard drive failed and I just kind of lost momentum after that. Hacks like these are the kinds of hacks that really motivate my interest in the community.

 

[godreborn]

Wii U? Boot1? Huh?

--------------------- MERGED ---------------------------

I just keep it plugged in, like my Wii

same. I have my wii plugged in. the only difference is I no longer play the wii, but it's still plugged in.

--------------------- MERGED ---------------------------

I did for a short period until my external hard drive failed and I just kind of lost momentum after that. Hacks like these are the kinds of hacks that really motivate my interest in the community.

same for me with every system but the wii u. on almost every system, including the ps4, I don't play the games. I find more interest in the hacks.

 

[jeffyTheHomebrewer]

same. I have my wii plugged in. the only difference is I no longer play the wii, but it's still plugged in.

I still boot it up from time to tie to check my WiiMail and the channels, (nintendo, news, weather, etc,.) but there isn't much new stuff yet...)

--------------------- MERGED ---------------------------

I always played the games, mostly. Plus back when I was 7 I thought that homebrew meant physically and
permanently modding the console, cause I was dumb

--------------------- MERGED ---------------------------

I always played the games, mostly. Plus back when I was 7 I thought that homebrew meant physically and
permanently modding the console, cause I was dumb

 

[dojafoja]

Hopefully this will lead to a coldboot executable with out needing to buy a DS game.

FailST already accomplishes this because its can inject a system app. But boot1 is obviously better

 

[ploggy]

This is great I saw the news earlier, Its always nice to have multiple exploits in the back pocket for when ever they are needed.
I heard Maschell was working on a new Homebrew Environment but I didn't know it was called Aroma? sounds good.

 

[linuxares]

wow nice

 

[ShadowOne333]

Yes, baby! Finally, a proper coldboot solution!

Can't to finally have a proper way to coldboot into CFW and have the beloved dark theme enabled by default with hacks!
That, and of course all the other perks of Mocha (or whichever CFW comes from this) and IOSU permissions right from coldboot

 

[wolf-snake]

Prepare for Brick City guys!