Hacking Coding vWii 3-core support - everything you need to know.

[bravest]

My friend, I was one of the original testers and still, from time to time (though it hasn't happened for a little while) load up one of the new kernels and test it. With work, kids and life in general, lately spare time has been severely lacking however. Though my Christmas vacation will be starting next week (Wed) so I'll have a couple of weeks of free time to pitch in again.

All I'm saying is that while I would love to be at the conference and would enjoy the discussion (though admittedly would likely be lost in it) I would like the information from it. They are going to be discussing it anyways so no harm in asking for something that they are going to be doing anyways. FWIW, the part I am referring to is this:

I believe the conference is generally streamed live and then uploaded on youtube, so I don't think you have to worry about missing anything.

-bravest

 

[rednekcowboy]

I believe the conference is generally streamed live and then uploaded on youtube, so I don't think you have to worry about missing anything.

-bravest

As far as the current linux project goes, maybe someone can catch me up on the progress and how it's being attempted to access hardware outside of the current vwii's sandbox.

I'll be the first to admit that this is not my strong suit, but seeing as you brought it up, maybe you can answer a couple of questions. I fail to see how getting any more juice out of a vwii linux is going to work or even possible as the hardware available from that sandbox is defined by the sandbox so loading linux inside that sandbox, you are handcuffed to what you can do.

From my understanding, it's kind of like Vmware. On a esx server, you setup VM's and define the hardware used per VM. IE, I setup Redhat on a vm and give it 1 core and 512MB ram. That linux vm can't then boot and take 4 cores and 2GB as it can't even see it to know it's there. You need to go back to the settings for that VM and change them, which is not an available option from linux but definitions set by VMware.

So in order to get 3 core linux on the vwii, would you not have to open the WiiU side/root system to have access to the definitions of the vwii's sandbox?

So likely, the WiiU has a host kernel which then drives two separate other OS's--the WiiU kernel and the vWii kernel. Without access to the host, there is not much that can be accomplished from either of the 2 other kernels? Or am I completely wrong on this?

 

[sven42]

we'll talk a lot about what else you can do in vwii mode, but that will only be interesting to other hackers and people working on embedded security. essentially "interesting things people who try to build security overlooked"
really, don't get your hopes up. the results presented will neither directly lead to wiiu homebrew nor to warez. you also won't be able to extract any keys.

A *LOT* more effort and knowledge than simply bringing up three core linux is required to go from the conference talk to wiiu keys, homebrew, whatever.
We're not gonna do any step-by-step tutorial or anything similar. The talk is for people who like to tinker with hardware at a very low level, not for your average homebrew enthusiast.

 

[uyjulian]

Okay guys, stop wasting your time begging f ck0f ck to release the exploit, it doesn't help...!
Instead, why not go to a different place other than gbatemp and do something actually useful, like learning some programming? Then when somebody releases the exploit for wii u, you will have to learn few things to program the wii u video game home console!

 

[Pogostick]

we'll talk a lot about what else you can do in vwii mode, but that will only be interesting to other hackers and people working on embedded security. essentially "interesting things people who try to build security overlooked"
really, don't get your hopes up. the results presented will neither directly lead to wiiu homebrew nor to warez. you also won't be able to extract any keys.

A *LOT* more effort and knowledge than simply bringing up three core linux is required to go from the conference talk to wiiu keys, homebrew, whatever.
We're not gonna do any step-by-step tutorial or anything similar. The talk is for people who like to tinker with hardware at a very low level, not for your average homebrew enthusiast.

Well Maxternal is interested and willing to learn as this thread is a learning experience for him. If you tell the information at 30c3 Who knows? Maxternal may be interested in it and may for a treat.

 

[rednekcowboy]

Okay guys, stop wasting your time begging f ck0f ck to release the exploit, it doesn't help...!
Instead, why not go to a different place other than gbatemp and do something actually useful, like learning some programming? Then when somebody releases the exploit for wii u, you will have to learn few things to program the wii u video game home console!

I haven't seen anyone asking them to release the exploit, we were discussing upcoming talks at the conference. If you have a problem with that, I would suggest you go somewhere else.

 

[bravest]

As far as the current linux project goes, maybe someone can catch me up on the progress and how it's being attempted to access hardware outside of the current vwii's sandbox.

I'll be the first to admit that this is not my strong suit, but seeing as you brought it up, maybe you can answer a couple of questions. I fail to see how getting any more juice out of a vwii linux is going to work or even possible as the hardware available from that sandbox is defined by the sandbox so loading linux inside that sandbox, you are handcuffed to what you can do.

From my understanding, it's kind of like Vmware. On a esx server, you setup VM's and define the hardware used per VM. IE, I setup Redhat on a vm and give it 1 core and 512MB ram. That linux vm can't then boot and take 4 cores and 2GB as it can't even see it to know it's there. You need to go back to the settings for that VM and change them, which is not an available option from linux but definitions set by VMware.

So in order to get 3 core linux on the vwii, would you not have to open the WiiU side/root system to have access to the definitions of the vwii's sandbox?

So likely, the WiiU has a host kernel which then drives two separate other OS's--the WiiU kernel and the vWii kernel. Without access to the host, there is not much that can be accomplished from either of the 2 other kernels? Or am I completely wrong on this?

The point of installing linux is to get control of the environment. Testing exploits and hack ideas when you don't have an environment is tough because when something goes wrong you don't get any meaningful output other than a black screen. From linux you can test and compile code on the machine itself and explore the new architecture without any restrictions. There are many avenues that cannot be pursued until we have a sort of "base-camp" set up.

The vWii sandboxing is done in hardware, likely using write once registers to shut down the interesting parts of the architecture. There is no concurrent higher level software running (i.e. hypervisor, vmware) underneath the vWii code. When we boot into linux we are running on the "bare-metal", although with some features disabled such as access to the full memory and the higher clock speed.

With some luck and ingenuity it might be possible to get full access. Linux is just putting our foot in the door.

-bravest

 

[rednekcowboy]

The point of installing linux is to get control of the environment. Testing exploits and hack ideas when you don't have an environment is tough because when something goes wrong you don't get any meaningful output other than a black screen. From linux you can test and compile code on the machine itself and explore the new architecture without any restrictions. There are many avenues that cannot be pursued until we have a sort of "base-camp" set up.

The vWii sandboxing is done in hardware, likely using write once registers to shut down the interesting parts of the architecture. There is no concurrent higher level software running (i.e. hypervisor, vmware) underneath the vWii code. When we boot into linux we are running on the "bare-metal", although with some features disabled such as access to the full memory and the higher clock speed.

With some luck and ingenuity it might be possible to get full access. Linux is just putting our foot in the door.

-bravest

Thanks for the explanation bravest!

 

[naxil]

who can post a image of all linux distro can be launched with wii? (not wiiU)

 

[ÐeltaResero]

who can post a image of all linux distro can be launched with wii? (not wiiU)

Your post is a bit unclear, are you asking which distributions of Linux can run on Wii consoles? If you are, then the answer would be just about any distribution that supports the PowerPC platform. Not only can PowerPC Linux distributions run natively on Wii consoles, but also any PowerPC operating system such as BSD can too (with the proper drivers). It's even technically possible to run old X86 versions of Windows (such as Windows 95) using DOSBox but that's a bit different.

 

[Maxternal]

who can post a image of all linux distro can be launched with wii? (not wiiU)

I think this thread was focused on creating the distro images for Triinux. I think the links in the OP have the images you'd need. If not, let me know and I'll see what I can hunt down.
http://gbatemp.net/threads/vwii-tri-core-linux.351024/

On a side note, am I the only one that gets a "invalid download link" when trying to download the image for Easy Wii Linux? ( http://www.fileswap.com/dl/seksXdGWeY/linux.zip.html ) The slow download button doesn't work for me.
If anyone has a mirror for that file could you please post it? I've been wanting to see if I could make a kernel that would work with it.

 

[Maxternal]

Also, I added the NAND dumper (that obcd mentioned I was working on) to the dowloads page on GoogleCode https://code.google.com/p/gbadev/ (since the code for it is also on the page) it's near the bottom in the "miscellaneous tools" section
(I'll see if I can find time to make a separate thread for it here, soon)

It creates a nand.bin file in the same format as BootMii does on the SD card (although a little bit slower) and is the first app to my knowledge to be able to do that on a Wii U.

It's safe enough that in my tests you can even pull the SD card out in mid dump and put it back in (not that I'm recommending this) and it will still finish the dump without any format problems. It also has unused (and inaccessible) code to be able to write a nand.bin back ... BUT even with that level of safety I'm debating whether to finish the NAND dump writing part since I still don't have any verification code like BootMii does NOR any protection if you were to lose power in the middle of writing.

 

[qayqaywsx]

@Maxt
Do you think that your dumper works on orig. Wii, too ?
i have both a wii and a wiiu.
For this i would love to test following :

1 dump vwii from wiiu with your dumper
2 write this dump with your dumper to Wii
3 dump this with bootmii
4 and compare the results

(afterwards flash th orig. wiis nand back to its origin)

Could this be helpful for you ?

 

[bravest]

I can't speak for Maxternal, but there's definitely no application of what you are doing other than bricking your Wii.

-bravest

 

[Pogostick]

Ah yes I have an idea that we can experiment with. We can use the most simple Linux distro that runs on PowerPC. Then we can use that to experiment on the Wii U. Also Maxternal has been working on what's the closest thing to a Wii U: a Wii. So it's okay to work with approximative machines if it's easy to get and if that's what you have for the time being. So be sure to try out my idea about using a laptop or a tablet combination with a laptop that's the closest to a Wii U (again buying those things because it's the holidays).

 

[Kargaroc]

I wonder if we can modify Dolphin PC to emulate 3 PPC cores, kinda like how f0f wrote a Starlet emulator for debugging a while back? Is that even feasible?

 

[the_randomizer]

I wonder if we can modify Dolphin to emulate 3 cores? Is that even feasible?

Why would you want to? Using a Gamecube emulator on vWii mode wouldn't be wise or feasible. A virtual machine is the way to approach it.

 

[OriginalHamster]

On a side note, am I the only one that gets a "invalid download link" when trying to download the image for Easy Wii Linux? ( http://www.fileswap.com/dl/seksXdGWeY/linux.zip.html ) The slow download button doesn't work for me.
If anyone has a mirror for that file could you please post it? I've been wanting to see if I could make a kernel that would work with it.

There you go
http://www.mediafire.com/download/141jplv5hydoyaw/EWL.rar
Boot the elf through bootmii, and leave the linux folder in the root, it contains the image.

 

[Maxternal]

@Maxt
Do you think that your dumper works on orig. Wii, too ?
i have both a wii and a wiiu.
For this i would love to test following :

1 dump vwii from wiiu with your dumper
2 write this dump with your dumper to Wii
3 dump this with bootmii
4 and compare the results

(afterwards flash th orig. wiis nand back to its origin)

Could this be helpful for you ?

Yes, the dumper works on both an original Wii and Wii U(vWii)
BUT
as Bravest said, you can neither take the same dump from one Wii to another Wii, one Wii U to another Wii U NOR a Wii to Wii U or visa versa. The dump will be console-specific. Even converting the encryption keys from one console to another with Giantpune's NAND tools there's definite differences between the IOS/system menu on a Wii and vWii and so one will not work on the other.

 

[Maxternal]

Can anyone test the following? I made some slight modifications to the payload.
Ideally it should boot into linux. Rename vmlinux to ppcboot.elf and put it in the usual place.

https://mega.co.nz/#!RVhBVSLZ!X0Ss81J3rVp6CGf8tLc-vyRBP3Q_bt5fJjdXiqW3Fe0

I'm kinda curious what exactly you changed on this.

I hope to actually get some time to test this (and some other things) this weekend since work has been killer these past couple weeks.

Just to be clear, is the boot.dol the one from our download page?
Also, is the vmlinux file the one that ends up in the root file directory when being compiled or the one from the /arch/powerpc/boot/ folder? (usually named zImage) ... I just ask because on my first few tries trying to compile Linux for this I kept using the wrong one and couldn't figure out why it wouldn't work.

I'm finally compiling a kernel based on what you suggested about the entry point for the other cores (taking a while) so I'll let you know how it goes.