iQue Player hacking possibility with ique_diag.exe?

[HNKii]

Some Random Updates about the ticket file:
I figured out the order the ticket for each game is presented: They are presented in the alphabetical order of the Pinyin of the Chinese characters, and games starting with English letters precede games starting with Chinese Names.

Order of files in ticket:
(F-Zero)Ｆ＿ＺＥＲＯＸ未来赛车
(F-Zero Manual)Ｆ＿ＺＥＲＯＸ未来赛车操作指南 ISBN 7-900381-10-4
Dong Wu Sen Lin(Animal Crossing)动物森林 ISBN 7-900427-30-9 025-2005-009 [2006]080
Ma Li Ou Ka Ding Che(Mario Kart 64)马力欧卡丁车 ISBN 7-900381-05-8
Ma Li Ou Ka Ding Che Cao Zuo Zhi Nan(Mario Kart 64 Manual)马力欧卡丁车操作指南 ISBN 7-900381-05-8
Ma Li Ou Yi Sheng(Dr. Mario 64)马力欧医生 N/A
Ma Li Ou Yi Sheng Cao Zuo Zhi Nan(Dr. Mario 64 Manual)马力欧医生操作指南 ISBN 7-900381-04-X
Ren Tian Tang Min Xing Da Luan Dou （Super Smash Bros) 任天堂明星大乱斗 ISBN 7-900381-67-8 025-2004-017 [2005]065号
Ren Tian Tang Min Xing Da Luan Dou Cao Zuo Zhi Nan (Super Smash Bros Manual)任天堂明星大乱斗操作指南 ISBN 7-900381-05-8
Sai Er Da De Chuan Shuo(Zelda OOT)塞尔达的传说 N/A
Sai Er Da De Chuan Shuo Cao Zuo Zhi Nan(Zelda OOT Manual)塞尔达的传说操作指南 ISBN 7-900381-07-4
Shen You Ma Li Ou(Super Mario 64) 神游马力欧 N/A
Shen You Ma Li Ou Cao Zuo Zhi Nan(Super Mario 64 Manual)神游马力欧操作指南 ISBN 7-900381-06-6
Shen You Zu He Ji Qi Ren (Custom Robo)神游组合机器人 ISBN 7-900381-82-1 025-2004-017 [2006]052
Shui Shang Mo Tuo (Wave Race)水上摩托 N/A
Shui Shang Mo Tuo Cao Zuo Zhi Nan(Wave Race Manual)水上摩托操作指南 ISBN 7-900381-08-2
Xing Ji Huo Hu (Star Fox 64)星际火狐 N/A
Xing Ji Huo Hu Cao Zuo Zhi Nan (Star Fox 64 Manual)星际火狐操作指南 ISBN 7-900381-09-0
Yao Xi Gu Shi(Yoshi's Story)耀西故事 ISBN 7-900381-16-3
Yao Xi Gu Shi Cao Zuo Zhi Nan(Yoshi's Story Manual)耀西故事操作指南 ISBN 7-900381-16-3
Yue Ye Mo Tuo (Excite Bike 64)越野摩托 ISBN 7-900381-62-7 025-2004-017 [2005]065号
Yue Ye Mo Tuo Cao Zuo Zhi Nan(Excite Bike 64 Manual)越野摩托操作指南 ISBN 7-900381-05-8 025-2004-017 [2005]065号
Zhi Pian Ma Li Ou (Paper Mario)纸片马力欧 ISBN 7-900381-30-9
Zhi Pian Ma Li Ou Cao Zuo Zhi Nan(Paper Mario Manual)纸片马力欧操作指南 ISBN 7-900381-30-9
Zui Yu Fa: Di Qiu De Ji Cheng Zhe (Sin And Punishment)罪与罚：地球的继承者 ISBN 7-900381-40-6
Zui Yu Fa: Di Qiu De Ji Cheng Zhe Cao Zuo Zhi Nan(Sin And Punishment Manual)罪与罚：地球的继承者操作指南 ISBN 7-900381-40-6

*Notes:
N/A Means the ISBN is not included with the ticket
*Zelda OOT's internal name 塞尔达的传说 is not the same as its official name “塞尔达传说-时光之笛- ”

I have 26 titles "purchased" on my iQue Player, yet, there are 27 chunks of non-zero data.
There is one extra chunk of data after S&P manual, and it's relatively small(Smaller than other ticket data of games/manuals), and it also has the strings "Root-CPCA00000108-CP00000110" and "Root-XSCA00000107-XS0000010b".
Maybe a ticket for System Menu, like the Nintendo Wii?

 

[Zhongtiao1]

Some Random Updates about the ticket file:
I figured out the order the ticket for each game is presented: They are presented in the alphabetical order of the Pinyin of the Chinese characters, and games starting with English letters precede games starting with Chinese Names.

Order of files in ticket:
(F-Zero)Ｆ＿ＺＥＲＯＸ未来赛车
(F-Zero Manual)Ｆ＿ＺＥＲＯＸ未来赛车操作指南 ISBN 7-900381-10-4
Dong Wu Sen Lin(Animal Crossing)动物森林 ISBN 7-900427-30-9 025-2005-009 [2006]080
Ma Li Ou Ka Ding Che(Mario Kart 64)马力欧卡丁车 ISBN 7-900381-05-8
Ma Li Ou Ka Ding Che Cao Zuo Zhi Nan(Mario Kart 64 Manual)马力欧卡丁车操作指南 ISBN 7-900381-05-8
Ma Li Ou Yi Sheng(Dr. Mario 64)马力欧医生 N/A
Ma Li Ou Yi Sheng Cao Zuo Zhi Nan(Dr. Mario 64 Manual)马力欧医生操作指南 ISBN 7-900381-04-X
Ren Tian Tang Min Xing Da Luan Dou （Super Smash Bros) 任天堂明星大乱斗 ISBN 7-900381-67-8 025-2004-017 [2005]065号
Ren Tian Tang Min Xing Da Luan Dou Cao Zuo Zhi Nan (Super Smash Bros Manual)任天堂明星大乱斗操作指南 ISBN 7-900381-05-8
Sai Er Da De Chuan Shuo(Zelda OOT)塞尔达的传说 N/A
Sai Er Da De Chuan Shuo Cao Zuo Zhi Nan(Zelda OOT Manual)塞尔达的传说操作指南 ISBN 7-900381-07-4
Shen You Ma Li Ou(Super Mario 64) 神游马力欧 N/A
Shen You Ma Li Ou Cao Zuo Zhi Nan(Super Mario 64 Manual)神游马力欧操作指南 ISBN 7-900381-06-6
Shen You Zu He Ji Qi Ren (Custom Robo)神游组合机器人 ISBN 7-900381-82-1 025-2004-017 [2006]052
Shui Shang Mo Tuo (Wave Race)水上摩托 N/A
Shui Shang Mo Tuo Cao Zuo Zhi Nan(Wave Race Manual)水上摩托操作指南 ISBN 7-900381-08-2
Xing Ji Huo Hu (Star Fox 64)星际火狐 N/A
Xing Ji Huo Hu Cao Zuo Zhi Nan (Star Fox 64 Manual)星际火狐操作指南 ISBN 7-900381-09-0
Yao Xi Gu Shi(Yoshi's Story)耀西故事 ISBN 7-900381-16-3
Yao Xi Gu Shi Cao Zuo Zhi Nan(Yoshi's Story Manual)耀西故事操作指南 ISBN 7-900381-16-3
Yue Ye Mo Tuo (Excite Bike 64)越野摩托 ISBN 7-900381-62-7 025-2004-017 [2005]065号
Yue Ye Mo Tuo Cao Zuo Zhi Nan(Excite Bike 64 Manual)越野摩托操作指南 ISBN 7-900381-05-8 025-2004-017 [2005]065号
Zhi Pian Ma Li Ou (Paper Mario)纸片马力欧 ISBN 7-900381-30-9
Zhi Pian Ma Li Ou Cao Zuo Zhi Nan(Paper Mario Manual)纸片马力欧操作指南 ISBN 7-900381-30-9
Zui Yu Fa: Di Qiu De Ji Cheng Zhe (Sin And Punishment)罪与罚：地球的继承者 ISBN 7-900381-40-6
Zui Yu Fa: Di Qiu De Ji Cheng Zhe Cao Zuo Zhi Nan(Sin And Punishment Manual)罪与罚：地球的继承者操作指南 ISBN 7-900381-40-6

*Notes:
N/A Means the ISBN is not included with the ticket
*Zelda OOT's internal name 塞尔达的传说 is not the same as its official name “塞尔达传说-时光之笛- ”

I have 26 titles "purchased" on my iQue Player, yet, there are 27 chunks of non-zero data.
There is one extra chunk of data after S&P manual, and it's relatively small(Smaller than other ticket data of games/manuals), and it also has the strings "Root-CPCA00000108-CP00000110" and "Root-XSCA00000107-XS0000010b".
Maybe a ticket for System Menu, like the Nintendo Wii?

I still believe that the mysterious game is Majoras mask, iQue could have quite easily just changed the id number. Otherwise, it could possibly be one of the Mario party games. Not really an rpg, but it's somewhat close.

 

[Sliter]

wow guys, sudden come with a huge progress on everything! XD
UI'm kinda sad I haven't looked for getting a iQue myself yet, I don't have skills to help hacking out but idk ... I even anted an iQue player since I heard of it hahah and now it's being revived! what a great thing XD

 

[KevinLSX]

Here's my IQue disc just in case there are some differences
2 files on disc are corrupted and couldn't be ripped
ISO Format
http://www.mediafire.com/file/rwfwa96xdz0whcd/IQUE+神游在线.ISO

 

[Krem Quay]

Actually doesn't seem to be different from the provided one, sorry.

 

[KevinLSX]

Actually doesn't seem to be different from the provided one, sorry.

Well at least now we know

 

[kane159]

Hey i just saw this thread ,really want to help but have no knowledge to hack or crack something....
But i have a iQue player that can connect to pc via usb cable!
If anything i can help please tell me


從我的iPhone使用Tapatalk Pro 發送

 

[Krem Quay]

@kane159

Hi thank you for trying to help us.

Here's a post you might like to read-- @emoose wants to get the BBCInit function from some dump or something: https://gbatemp.net/threads/ique-pl...with-ique_diag-exe.466906/page-9#post-7748968

 

[Sliter]

Hey i just saw this thread ,really want to help but have no knowledge to hack or crack something....
But i have a iQue player that can connect to pc via usb cable!
If anything i can help please tell me


從我的iPhone使用Tapatalk Pro 發送

how much is one of these nowadays? I rally want one too XD

 

[Zhongtiao1]

how much is one of these nowadays? I rally want one too XD

Currently $150 USD on ebay

 

[Sliter]

Currently $150 USD on ebay

oh .. I think from now its going only to rise :v

 

[emoose]

Merry Christmas everyone, hope you all have some happy holidays
Still haven't had a chance to try updating my unit since I ended up leaving earlier than I thought, should be back by Thursday or Friday though.

Man, that is sure an old version... that's quite rare.
The second option is the old iQue Club registration tool which is not available on the newer version anymore.
Since my iQue Player has the newest version pre-installed, I do not know how to do the update exactly. But I once read that the purpose of the 神游加油装 is to update iQue Player systems to the latest version without the use of a depot system(In other words, iQue@Home should be able to detect an un-updated model)

Whoa neat! I probably should have been more careful with it then, already broke off the tabs on the card trying to open it (didn't realize it had screws >.<), it was practically mint condition too...
Guess I can always swap that out with another one though.

That iQue Club is interesting, I guess you would setup your details on the device and it would upload them when you use a kiosk?
I saw some things in the PC clients which would check for the "iQue Club" string inside the tickets.sys file, maybe that means the device itself would create it's own ticket after you register your details? (gives some hope for us making our own 21061 ticket )

Yeah hopefully I@H will work to get it updated, really don't want to mess with reading the NAND manually if I don't have to.
That gives me another idea to add to DiagExtend though, a function that lets you flash your own sys-update.
AFAIK there's nothing stopping you from downgrading or anything (besides the sys-update contentid being stored in depot.sys/PrivateData)
All the code for uploading a sys-update is already there too, so should be pretty simple to setup.

Also neat that it stores tickets alphabetical, you would think it would just store newer tickets last, guess it must be recreating the whole file instead.
I also didn't notice that extra chunk in your tickets, will have to check it out later, maybe it could just be a remnant of a ticket that was removed but not nulled out?

Well at least now we know

Yeah was best to double-check really, thanks for doing it for us
Would have been cool if it was special.. that makes me wonder though, whatever happened to all the iQue kiosks in stores?
I do remember hearing in one place, that they just made the store destroy it instead of sending it back Can't remember where I heard that though, really hope it's untrue...
If one of them ever gets out I'm sure it'd be extremely useful though.

Hey i just saw this thread ,really want to help but have no knowledge to hack or crack something....
But i have a iQue player that can connect to pc via usb cable!
If anything i can help please tell me

Do you have it working with iQue@Home? You need a 32bit system or an XP virtual-machine AFAIK. Once I get back I can probably help you set it up if you like.

how much is one of these nowadays? I rally want one too XD

For mine I bought it from a seller on Taobao, using a 3rd party reshipping place in China to receive it and send it internationally to me.
Unit cost about £30, and shipping was about £30 also, so about ~£60 in total.
Not too bad I suppose, kinda wish I'd bought more and sent them over in bulk though, shipping probably would have worked out cheaper that way.
(edit: that's for a used system though, the $150 ones on ebay are all new untouched AFAIK)

 

[HNKii]

Merry Christmas everyone, hope you all have some happy holidays
Still haven't had a chance to try updating my unit since I ended up leaving earlier than I thought, should be back by Thursday or Friday though.


Whoa neat! I probably should have been more careful with it then, already broke off the tabs on the card trying to open it (didn't realize it had screws >.<), it was practically mint condition too...
Guess I can always swap that out with another one though.

That iQue Club is interesting, I guess you would setup your details on the device and it would upload them when you use a kiosk?
I saw some things in the PC clients which would check for the "iQue Club" string inside the tickets.sys file, maybe that means the device itself would create it's own ticket after you register your details? (gives some hope for us making our own 21061 ticket )

Yeah hopefully I@H will work to get it updated, really don't want to mess with reading the NAND manually if I don't have to.
That gives me another idea to add to DiagExtend though, a function that lets you flash your own sys-update.
AFAIK there's nothing stopping you from downgrading or anything (besides the sys-update contentid being stored in depot.sys/PrivateData)
All the code for uploading a sys-update is already there too, so should be pretty simple to setup.

Also neat that it stores tickets alphabetical, you would think it would just store newer tickets last, guess it must be recreating the whole file instead.
I also didn't notice that extra chunk in your tickets, will have to check it out later, maybe it could just be a remnant of a ticket that was removed but not nulled out?


Yeah was best to double-check really, thanks for doing it for us
Would have been cool if it was special.. that makes me wonder though, whatever happened to all the iQue kiosks in stores?
I do remember hearing in one place, that they just made the store destroy it instead of sending it back Can't remember where I heard that though, really hope it's untrue...
If one of them ever gets out I'm sure it'd be extremely useful though.


Do you have it working with iQue@Home? You need a 32bit system or an XP virtual-machine AFAIK. Once I get back I can probably help you set it up if you like.


For mine I bought it from a seller on Taobao, using a 3rd party reshipping place in China to receive it and send it internationally to me.
Unit cost about £30, and shipping was about £30 also, so about ~£60 in total.
Not too bad I suppose, kinda wish I'd bought more and sent them over in bulk though, shipping probably would have worked out cheaper that way.
(edit: that's for a used system though, the $150 ones on ebay are all new untouched AFAIK)

You can log in to iQue Club on the PC client just like you can do so on a browser. I am not sure what the iQue Club tickets do.
If older iQue Player models had iQue Club registration credentials, newer ones wouldn't.
P.S. I don't think iQue Players are not downgradable as the Wii isn't. I think the 10XX and 11XX contents might be the encrypted files for system menu, and that last chunk of ticket might be the ticket for system components.
As for the depot systems, I doubt they've been destroyed as each store has to pay a deposit of 15000 RMB to install it. The depot system was said to be sold at a price of 300 RMB to employees.

 

[Krem Quay]

Hey @emoose , had a good Christmas? Do you have any updates to share on the iQue Player?

 

[emoose]

You can log in to iQue Club on the PC client just like you can do so on a browser. I am not sure what the iQue Club tickets do.
If older iQue Player models had iQue Club registration credentials, newer ones wouldn't.
P.S. I don't think iQue Players are not downgradable as the Wii isn't. I think the 10XX and 11XX contents might be the encrypted files for system menu, and that last chunk of ticket might be the ticket for system components.
As for the depot systems, I doubt they've been destroyed as each store has to pay a deposit of 15000 RMB to install it. The depot system was said to be sold at a price of 300 RMB to employees.

Ah, so they basically moved the iQue Club stuff from the device itself into the iQue@Home client?
I think you're right about the 10XX/11XX being system related also, BTW if you look at 0x10000 in them they also have a sort of ticket built in (known as 'T1' in the diag exe, the area 0x0 - 0x10000 is also called 'SA1', meaning either 'system-app' or 'system-area'), there should be another ticket at 0x30000 too (called 'T2', with 0x14000 - 0x30000 being 'SA2', I think it might just a backup system menu in case the first is corrupted)
The tagSK_SIGAREA struct in my tickets.hsl file should let you read those areas.

Yeah that stuff about destroying them was just a rumour I hope, but if the kiosks did get sold to employees I really hope one of them shows up one day (maybe it'd be worth posting about this recent research into iQue on some chinese forums? )
I'm sure if we could look at a kiosk more closely we could find out much more than from the public PC clients.

Hey @emoose , had a good Christmas? Do you have any updates to share on the iQue Player?

Yeah it's been pretty fun... but almost the whole time all I've been thinking about is ways I could look into the iQue haha, too bad none of my family know anything about 14-year-old China-exclusive game consoles

No updates yet, still away atm but I should be back pretty soon.
Really hope I can get this unit upgraded though, since I think USB is probably our best bet of getting a break into the system. Even if we can just get a memory leak that'd still be really helpful.
I just hope the crypto stuff is done via software instead of hardware only, haven't got any experience with hardware cracking really, and afaik decapping a chip like the one in iQue can be pretty difficult/expensive

 

[KevinLSX]

Im going to setup a vm for windows xp 32 bit. And try to see if It can read my ique. I think the last time I tried it was on 64bit.

 

[MockyLock]

Once again, glad to see it's moving in the iQue scene
Funny thing, it's moving elsewhere too :
https://assemblergames.com/threads/ique-player-question.67885/#post-959052

 

[KevinLSX]

Once again, glad to see it's moving in the iQue scene
Funny thing, it's moving elsewhere too :
https://assemblergames.com/threads/ique-player-question.67885/#post-959052

HAHA I actually bought an Ique because of "subbie" on assembler. I saw his older post on the Ique from a couple years ago and he is the reason I bought one and am attempting to help out with the Ique hacking. Also he mentioned where to buy them.

 

[KevinLSX]

Im on a 32bit vm and this happens when attempting to read the ique in the iquediag.exe

the ique shows up on plugged in devices
not sure what to do now

 

[emoose]

Im on a 32bit vm and this happens when attempting to read the ique in the iquediag.exe

the ique shows up on plugged in devices
not sure what to do now
View attachment 109302View attachment 109303

Did you try installing the iQue@Home from the CD? That should install drivers for it I think (but not 100% on that)
Not sure if the I@H from the net has those drivers, didn't seem to install them for me anyway, you can get the CD iso from https://archive.org/details/iQuehomeCDROM