Hacking The Definitive Guide to Wii U Hacking

[wj44]

So, i've tried again - this time i used wiiu-info.fr/exploit and blocked nintendos urls behind my router. the dns settings haven't been touched again.
Here is the Video one with the Black screen - This happened to me 21 times


Here is the Video where the payload532.html doesn't finish to load - This happened 9 times


and after 30 times my wifi couldn't connect to my router... well f** yeah... need to check it if my router went rampage or if something is damaged.

What i was wondering - maybe the Version of the Browser makes some difference?
4.1.1.9601 is the Version of my Browser.

I also removed the SD-Kart and the game disc while doing those 30 trys but nothing changed...

@NWPlayer123 sorry for calling you out to this thread - maybe you have seen those 2 screens? Or do i get something totally new?

clear your Cookies, close all Tabs, restart, Type in the URL direct.

 

[Zeriel]

Any hope for 5.4? or should I go ahead and sell my Wii U and buy an older one?

 

[TotalInsanity4]

Any hope for 5.4? or should I go ahead and sell my Wii U and buy an older one?

There's hope, just be patient. It uses the same kernel exploit but needs a new Webkit exploit

 

[Zeriel]

There's hope, just be patient. It uses the same kernel exploit but needs a new Webkit exploit

Ok thanks! I just needed to confirm that it wasn't like the 3DS 9.2, anything above that and you're dead on the water

 

[A Generic User]

[/spoiler][/spoiler]

Spoiler: 3) Blocking Nintendo's servers with your router

1) Go to your router settings page

Ex: http://192.168.1.1 or http://10.0.0.1​

2) Block Nintendo's URLs or block your Wii U's MAC Address (or both) This step will vary by router manufacturer.

Note: Blocking your Wii U's MAC Address will deny your Wii U ALL access to internet besides files hosted through a local server (hence the "Hosting Files with Mongoose" section)​

3A) Nintendo URLs:

Spoiler: Nintendo URLs

nus.c.shop.nintendowifi.net
nus.cdn.c.shop.nintendowifi.net
nus.cdn.shop.wii.com
nus.cdn.wup.shop.nintendo.net
nus.wup.shop.nintendo.net​

Is there like not a way to do this on a Verizon FiOS router? No matter what I seem to try, there is no option for "URL blocking", and all guides I find on the Internet don't seem to be relevant on my end.
https://www.verizon.com/support/res.../essentials+and+extras/questionsone/98826.htm
I check this and there is no "Preferences" or "Website I want to block"....

 

[TotalInsanity4]

Ok thanks! I just needed to confirm that it wasn't like the 3DS 9.2, anything above that and you're dead on the water

Yeah, just don't update to 5.5.0, because there will probably not be anything for that for a solid 6 months just by looking at the exploit release history

 

[ldeveraux]

Is there like not a way to do this on a Verizon FiOS router? No matter what I seem to try, there is no option for "URL blocking", and all guides I find on the Internet don't seem to be relevant on my end.
https://www.verizon.com/support/res.../essentials+and+extras/questionsone/98826.htm
I check this and there is no "Preferences" or "Website I want to block"....

Yeah like it like works like on like my like Verizon like router like just like fine

 

[EpicLPer]

Guys, for everyone not being able to get Cafiine running: Long-Press the folder URL and say "Open in new tab", this works almost 100% of the time for me. When directly clicking it I was never able to run it in any way or form...

 

[EpicLPer]

I've not yet been able to run TCPGecko. However, Cafiine runs fine actually. Any tips?
Just freezes my Wii U btw.

 

[A Generic User]

Yeah like it like works like on like my like Verizon like router like just like fine

Can I get a guide

 

[ldeveraux]

Can I get a guide

there's a thread here dedicated to which sits to block. Then do that in the port forwarding section of your routers ip.

 

[fiveighteen]

I've not yet been able to run TCPGecko. However, Cafiine runs fine actually. Any tips?
Just freezes my Wii U btw.

After the gecko installer successfully completes, launch your game and get to a static menu in the game:
VC Games: Press right trigger to show the VC menu
MK8: Press - at the main menu to get to the Play Stats menu
SSB: Press A on Controls to get to the Controls menu

Haven't tested others. Then open the TCP Gecko client on your PC to connect.

 

[stsaerox]

1) on setup section: 3) Extract downloaded folders and files to "C:\WiiU\" and rename them appropriately
What do you mean by rename?

2)I'm on 5.3.2. You have two cafiine files. How Should I extract the cafiine update file for 5.3.2?

3)The first cafiine files are extracted ok or should move it contents on Wii U folder?

4)Can we have a screenshot of the final structure?

 

[stsaerox]

This guide requires your Wii U to be on:
Kernel Exploit: 2.0.0, 2.1.0, 3.0.0, 3.1.0, 4.0.0, 4.1.0, 5.0.0, 5.3.2
TCP Gecko: 4.1.0, 5.0.0, 5.3.2
Cafiine: 3.1.0, 4.1.0, 5.0.0, 5.3.2

If you are on a firmware other than those listed, TCP Gecko, and Cafiine require files altered specifically for those versions.
If you are on a firmware above 5.3.2, there is currently no way to run these files.
Disclaimer: I'm not responsible for anyone being updated past 5.3.2, bricking their console, crashing their PC, etc. Follow these instructions at your own risk. Your mileage may vary based on your operating system and computer specifications.

Spoiler: 1) Downloads

[All Firmware]
Mongoose Free 5.6
Kexploit/OSDriver by Marionumber1, et al. (post)
TCP Gecko Client by NWPlayer123 (post)
wiiu_vc_snesinject by FIX94 (post)

[5.3.2]
codehandlertcp by NWPlayer123 (headers)(post) (nastys compilation post)
Cafiine v1.2 by Chadderz, update by golden45 (post)
Cafiine v1.2 by Chadderz, updates by golden45 and FIX94 (post)

[5.0.0]
Cafiine v1.2 by Chadderz, updates by golden45 and FIX94 (post)
codehandlertcp by wj44 (post) (may not work with FSA Read)

[4.1.0]
Cafiine v1.2 by Chadderz, updates by golden45 and FIX94 (post)
codehandlertcp by wj44 (post) (may not work with FSA Read)

[3.1.0]
Cafiine v1.2 by Chadderz, updates by golden45 and FIX94 (post)
​

Spoiler: 2) Setup

1) Create a folder at "C:\WiiU\"
2) Create an exception to the "C:\WiiU\" folder in Windows Defender/Malwarebytes/your virus protection so the exploits don't get quarantined.

Note: this doesn't mean disable all antivirus!​

3) Extract downloaded folders and files to "C:\WiiU\" and rename them appropriately
4) (Optional) Create an index.html in your "C:\WiiU\" folder (Notepad will work). This will make it easier to load your files from the game pad.

Note: index.html is what gets loaded first. An index.html in your root folder will show you what options you can choose to load (OSDriver, Cafiine, TCP Gecko), while the index.html inside the osdriver, cafiine, or tcpgecko folders tell the Wii U which FW you're on and therefore which payload to execute.

<html>
<a href="osdriver\index.html">OS Driver</a>
<br><br>
<a href="cafiine\cafiine12\payload532.html">Cafiine v1.2</a>
<br><br>
<a href="codehandlertcp\codehandler532.html">TCP Gecko</a>
</html>

Note: <a href> means a hypertext reference, or simply put: a link.
Ex: <a href="osdriver\index.html">OS Driver</a> breakdown:
......<a href= : a link will follow!
......................"osdriver\ : the folder at "C:\WiiU\osdriver\"
.........................................index.html" : the file inside "C:\WiiU\osdriver\" that tells the Wii U which payload to execute. Depending on what you download, you may not have index.html but payload532.html instead, or another FW version.
...............................................................>OS Driver</a> : The text that appears on the game pad telling you what you're clicking on.
My Folder Setup
​

Once you get nice and cozy with that, you can get real fancy:

It'll only work if your background image size is small. (179KB froze. 71KB works. In between is untested.) I used a 980x513 image with 158 PPI to perfectly fit in the screen.
Game Pad Image

Spoiler: Custom Index Code

<html>
<title>Hacks</title>
<head></head>
<style type='text/css'>
    a { display: block; color:#477F38; padding:10px; margin:2px; border:1px solid; text-align:center; }
</style>
<body background="bgimage.jpg">
<table align="center" "width="100%">
  <tr>
    <td width="400px" colspan="2"><a href="osdriver\index.html">OS Driver</a></td>
  </tr>
  <tr>
    <td width="50%"><a href="cafiine\cafiine12\payload532.html">Cafiine v1.2</a></td>
    <td width="50%"><a href="codehandlertcp\codehandler532.html">TCP Gecko</a></td>
  </tr>
</table>
</body>
</html>

Spoiler: 3) Blocking Nintendo's servers with your router

1) Go to your router settings page

Ex: http://192.168.1.1 or http://10.0.0.1​

2) Block Nintendo's URLs or block your Wii U's MAC Address (or both) This step will vary by router manufacturer.

Note: Blocking your Wii U's MAC Address will deny your Wii U ALL access to internet besides files hosted through a local server (hence the "Hosting Files with Mongoose" section)​

3A) Nintendo URLs:

Spoiler: Nintendo URLs

nus.c.shop.nintendowifi.net
nus.cdn.c.shop.nintendowifi.net
nus.cdn.shop.wii.com
nus.cdn.wup.shop.nintendo.net
nus.wup.shop.nintendo.net​

3B) MAC Address:

Spoiler: MAC Address

On your Wii U, go to Wii U system menu/System Settings/Internet/View MAC Address. Type the string you see into your MAC address filter in your router settings. (Ex: b8-ae-6e-48-36-1e)

4) On your Wii U, go to Wii U Menu/System Settings/Internet/Connect to the Internet
5) Input your router's SSID and password (typically WPA2-PSK AES)
6) Input settings as follows:

IP Address: Auto-obtain
DNS: Don't Auto-obtain.
Primary DNS: 107.211.140.065 (TubeHax DNS)
Secondary DNS: 107.211.140.065 (TubeHax DNS)​

Spoiler: 4) Hosting Files with Mongoose

1) Double-click on mongoose-free-5.6.exe
2) Right click on the Mongoose icon in your status bar
3) Click "Set shared directory:"
4) Choose the "C:\WiiU\" folder
5) Right click on Mongoose again and note what the IP and Port you're using. This is what you will later type into your Wii U Browser.

Ex: "Go to my address: http://192.168.1.239:8080/"​

Spoiler: 5) Running the Kexploit

1) Load the Wii U system menu
2) Open the Internet Browser
3) Type your IP : Port from Mongoose into the URL field

Ex: http://192.168.1.239:8080
Note: It's a good idea to bookmark your server URL for easier future access
Note: If the page hangs, tap the URL and press enter. If it still hangs after a few tries, exit and restart Mongoose, or reboot the Wii U​

4) Go to "\kexploit\osdriver.html"

Note: Wii U will freeze for about 2-5 seconds, then show the home menu settings if it works. If it doesn't work, the TV will go black and the game pad will freeze, or you will get "Race Attack Failed " or "Failed to find DRVA or DRVHAX"​

5) Press Wii U Menu

Note: If you repeatedly get freezes and failures, try clearing your cookies, closing all tabs, and resetting your Wii U before trying the exploit again.​

Spoiler: 6A) Running TCP Gecko

1) Open the Internet Browser
2) Type your IP : Port from Mongoose into the URL field

Ex: http://192.168.1.239:8080
Note: If the page hangs, tap the URL and press enter. If it still hangs after a few tries, exit and restart Mongoose, or reboot the Wii U (and redo the kexploit)​

3) Go to "\codehandlertcp\codehandler532.html"

Note: Wii U will freeze for about 2-5 seconds, then show the home menu settings if it works. If it doesn't work, the TV will go black and the game pad will freeze​

4) Press Wii U Menu
5) Open your game from disc or one installed to the Wii U's hard drive
6) Get to a static menu in the game:

VC Games: Press right trigger to show the VC menu
MK8: Press - at the main menu to get to the Play Stats menu
SSB: Press A on Controls to get to the Controls menu​

Spoiler: 7A) Injecting SNES ROMs

1) Place your SNES ROMs in "C:\WiiU\wiiu_vc_snesinject\"
2) Edit the ip.txt for your Wii U's IP

Ex: 192.168.1.47​

3) Drag and drop a SNES ROM into snesinject.exe
4) Click reset in the VC menu. Black screen means the game is incompatible with your base game. Try another.

Note: If snesinject.exe just hangs, make sure the TCP Gecko Client is closed!​

Spoiler: 7B) Dumping Memory or Reading FSA with TCP Gecko

1) On your PC, open "C:\WiiU\TCPGeckoClient\Gecko dNet.exe"
2) In your router settings, find the IP of the Wii U from (under Client Status for me)
3) Type your Wii U's IP into the connection box on the TCP Gecko Client

Ex: 192.168.1.47​

4) Press Connect, hit ignore on the error

Spoiler: 5A) Dumping ROMs

1) Click the Tools tab
2) Find out how large the game you want to dump is in hex (download the ROM online)
2.1) Right-click on the downloaded ROM and go to Properties
2.2) Look at Size and take the number in bytes
3) Find out where the start of the ROM is

NES: 10502250
SNES: 10502250​

4) Find out where your ROM will end (Google 0xSTARTADDRESS + 0xYOURROMSIZE for easy calculation)
5) Change the dumping range from 01 to 10
6) Change Start to 10502250
7) Change End to what you got in Step 4.1

Optional: Change the file name to .sfc or .nes to make it playable on PC emulators​

9) Click Dump

Ex: Super Mario Kart is 512KB, or 0x80000
SNES ROM starts at 0x10502250
ROM ends at 0x10502250 + 0x80000 = 0x10582250
Put 10502250 and 10582250 in for Start and End and dump it​

Spoiler: 5B) Read FSA

1) Click the FSA tab
2) Click Read FSA

Note: Wait about 2-10 minutes for the file system to appear (will show Not Responding until then). This will vary greatly depending on your CPU specs.​

3) Extract files or folders

Spoiler: 6B) Running Cafiine v1.2

Note: Steps 1 through 3 are completely optional, but may significantly decrease the amount of time required to launch Cafiine.​

1) On your PC, open "C:\WiiU\cafiine\payload532.html" in a text editor (Notepad is fine)
2) Search for %uc0a8%u6129%u01EF or %uc0a8%u6129%u01a0 if the first string isn't found
3) Replace with a string for the numbers of your IP address in hexadecimal.

Ex: %uc0a8%u6129%u01EF is for my IP address, which is 192.168.1.239.
c0 in hex = 192 in decimal
a8 in hex = 168 in decimal
01 in hex = 1 in decimal
EF in hex = 239 in decimal

You want your IP to be replaced in that string,

Ex: for 192.168.0.17:
192 in decimal = c0 in hex
168 in decimal = a8 in hex
0 in decimal = 00 in hex
17 in decimal = 11 in hex
Your string is %uc0a8%u6129%u0011

Ex: for 10.0.0.3,
10 in decimal = 0a in hex
0 in decimal = 00 in hex
0 in decimal = 00 in hex
3 in decimal = 03 in hex
Your string is %u0a00%u6129%u0003

Open payload532.html in Notepad, or any other programming/text editor, and search for my string "%uc0a8%u6129%u01EF" and replace it with your string and then save it.

When you load Cafiine, the default IP should show your IP and you can simply continue instead of scrolling to enter it.​

4) On your PC, open "C:\WiiU\cafiine12\server\cafiine_server.exe" as administrator (right-click, Run as administrator)
5) On the Wii U, open the Internet Browser
6) Type your IP : Port from Mongoose into the URL field

Ex: http://192.168.1.239:8080
Note: If the page hangs, tap the URL and press enter. If it still hangs after a few tries, exit and restart Mongoose, or reboot the Wii U (and redo the kexploit)​

7) Go to "\Cafiine\payload532.html"
8) Set the Cafiine server IP in the application with up/down/left/right, and press A to install Cafiine (should be set to your IP already if you followed Steps 1 through 3)

Note: Wii U will freeze for about 2-5 seconds, then show the home menu settings if it works. If it doesn't work, the TV will go black and the game pad will freeze.​

9) Press Wii U Menu
10) Open your game from disc or one installed to the Wii U's hard drive
11) Cafiine should now show you the files used in the game as they load

Note: If it hangs or doesn't list all of the files as they load, make sure you're running the server as administrator, and go to "Control Panel\System and Security\Windows Firewall\Allowed" apps and make sure cafiine_server has check marks for Private and Public.​

Spoiler: 12A) Dumping Game Files

1) Create a folder in "cafiine12/server/cafiine_root" with the title_id of the game
2) Create the game folder structure for the file you want (TCP Gecko Read FSA is good for figuring out the folder structure)

Ex: 00050000-1010EC00\vol\content\driver\ for the characters in MK8​

3) Go to the last folder in the series

Ex: "\driver\"​

4) Hold Ctrl and Shift and right-click in the folder, choose Open command window here
5) Type fsutil file createnew dummyfile-request 0, where dummyfile is the name of the file you want to dump

Ex: Mario.szs for Mario in MK8
Note: You can also use dummyfile-request_slow if you want a file to dump slowly (less risk of corruption)​

6) When the game goes to load that file, it will dump it to that folder with the name and -dump

Ex: Mario.szs-dump​

Spoiler: 12B) Replacing Game Files

1) Create a folder in "cafiine12/server/cafiine_root" with the title_id of the game
2) Put your new file in the same directory as the game folder structure

Ex: 00050000-1010EC00\vol\content\driver\Mario.szs to replace Mario in MK8​

3) When the game goes to load that file, it will use your modified one instead of the one on the disk.

Spoiler: Credits

Marionumber1
NWPlayer123
Mathew_Wi
hykem
FIX94
golden45
smea
CosmoCortney
nastys
others...

1) on setup section: 3) Extract downloaded folders and files to "C:\WiiU\" and rename them appropriately
What do you mean by rename?

2)I'm on 5.3.2. You have two cafiine files. How Should I extract the cafiine update file for 5.3.2?

3)The first cafiine files are extracted ok or should move it contents on Wii U folder?

4)Can we have a screenshot of the final structure?

I'm asking because I can't see the pictures of your folder setup...

 

[stsaerox]

I'm disappointed so far. I've tried many times... I just get a black/broken screen both on gamepad and TV. I hope that it is my fault.

I've cleared cookies, erased all browser data..... and nothing happens... I'm on 5.3.2 firmware and my console is PAL bought on february 2013.

What do you mean by resetting the console? You mean along all savegames and users?

Edit: removed video

EDIT: I DID IT!!!!! I've rebooted the router, left completely free Mongoose from firewall(both incoming-outcoming connections) and also run it as administrator. Worked Perfectly.

 

[Goku Junior]

Hello!, I'm back again and now seems the kernel exploit is out (Yeah, I know I came really late), well I was wondering if someone can guide me on this, I got TCPGecko and Cafiine 1.2 (I'm in 5.3.2U System Menu), I get the OSDriver kernel exploit running however I don't know how to use Cafiine or TCPGecko, things I want to do are like (if they are currently possible):
-Force a Native Game resolution, I mean for example Watch Dogs, the native resolution in Wii U is about 648p (1152x648 if my memory doesn't fails me), would be possible to raise it to native 1280x720p? or another custom resolution?
-Dump an entire game in wud format or ISO.
-Inject a VC game (Ii know it is possible, but I don't know very well how to do it, I have Snesinject by FIX94.)
Are these possible?, I would be very happy if someone can help me with this, thanks a lot by advance .

 

[fiveighteen]

1) on setup section: 3) Extract downloaded folders and files to "C:\WiiU\" and rename them appropriately
What do you mean by rename?

2)I'm on 5.3.2. You have two cafiine files. How Should I extract the cafiine update file for 5.3.2?

3)The first cafiine files are extracted ok or should move it contents on Wii U folder?

4)Can we have a screenshot of the final structure?

I'm getting pissed at OneDrive, they apparently change links or something. I moved the images to Google Drive and fixed the OP. Hopefully those stick around for a while.

1) Renaming just depends on your setup. If you have an index.html then the folder names need to be consistent inside of it. If you just have all of the folders extracted into your root folder, you can just open them in your Wii U Browser. It's really not too picky as long as you don't have multiple payload files in your root folder.

2) Either one should work exactly the same. The one updated by FIX94 just has support for other versions as well.

3) Uhh.. what? Check out my picture of my setup. There is also a folder in there called "Cafiine Server" with the server files in it.

I'm disappointed so far. I've tried many times... I just get a black/broken screen both on gamepad and TV. I hope that it is my fault.

I've cleared cookies, erased all browser data..... and nothing happens... I'm on 5.3.2 firmware and my console is PAL bought on february 2013.

What do you mean by resetting the console? You mean along all savegames and users?

Edit: removed video

EDIT: I DID IT!!!!! I've rebooted the router, left completely free Mongoose from firewall(both incoming-outcoming connections) and also run it as administrator. Worked Perfectly.

Just have to keep trying til it works! I think you figured it out, but no I didn't mean delete savegames and users!

Congrats on finally getting it to go though.

Hello!, I'm back again and now seems the kernel exploit is out (Yeah, I know I came really late), well I was wondering if someone can guide me on this, I got TCPGecko and Cafiine 1.2 (I'm in 5.3.2U System Menu), I get the OSDriver kernel exploit running however I don't know how to use Cafiine or TCPGecko, things I want to do are like (if they are currently possible):
-Force a Native Game resolution, I mean for example Watch Dogs, the native resolution in Wii U is about 648p (1152x648 if my memory doesn't fails me), would be possible to raise it to native 1280x720p? or another custom resolution?
-Dump an entire game in wud format or ISO.
-Inject a VC game (Ii know it is possible, but I don't know very well how to do it, I have Snesinject by FIX94.)
Are these possible?, I would be very happy if someone can help me with this, thanks a lot by advance .

1) AFAIK it's not possible to force anything to another resolution.
2) Can't dump the entire thing, but you can dump the data section using TCP Gecko. Right click and extract the folders on the FSA Read tab.
3) There is a step by step guide for SNES VC injecting in the OP! Read through [N64 & DS VC game injection working on 5.3.2] for some compatibility. There are a few lists by the_randomizer, FIX94, and myself with different base games.

 

[fiveighteen]

Added the DefinitivePackage-092915.zip (password: wiiu)
Added WUP Installer section
Added FAQ to each section
Reformatted the entire guide. Should be easily searchable with Ctrl+F

@the_randomizer, it's ready for you! Haha.

 

[the_randomizer]

Added the DefinitivePackage-092915.zip (password: wiiu)
Added WUP Installer section
Added FAQ to each section
Reformatted the entire guide. Should be easily searchable with Ctrl+F

@the_randomizer, it's ready for you! Haha.

Awesome guide Once I have the host set up, I take it I just go to my IP address on the Wii U browser and call it good?

 

[fiveighteen]

Awesome guide Once I have the host set up, I take it I just go to my IP address on the Wii U browser and call it good?

Idk, what's the guide say? The only extra steps are exclusions for virus scanners and allowing the programs through your firewall.