Wii VC Hack One Step Closer

as the title says when hex editing my wii browser and wii sonici noticed

Root-CA00000001-MS00000002..........................................NG041b320c......................................................j.Ya..'L..^......4....L.P....g.g.....2..Ua.a.)....9.HNI.;..T).......................................................................yP..3.66...|..6...6.z.......u7^..tp.....|o..V]..N<...<w.................................................................Root-CA00000001-MS00000002-NG041b320c...............................AP0000000100000002..........

while a downloaded version of f-zero from a different console has this

........Root-CA00000001-MS00000002..........................................NG020c8d87......................................................j..!....'......PdUp7.8..[..e....]i...A..P..E....>...C...Fr.......................................................................[IH....>)8$y..f...AF.l|y.:=......r@..$.#.e....'.8...r..>...................................................................Root-CA00000001-MS00000002-NG020c8d87...............................AP0000000100000002..

notice the difference in the ng number

sonic and browser from my console

 NG041b320c

f-zero has a different code from mine

 NG020c8d87

i changed the code for F-zero and noticed the console no longer said this item cannot be soppied to this console, but it will start to copy and then say thats the data was not copied i suggest this is to region differences

nice to hear.
then its only find the part in a hex edit that the region part is.

y don't you try to change to code of F-Zero to the code you get from you wii and then try it on your wii
if this works all you need is a sd card and a hex editor and VC games are hacked!!

sorry did not see the last part

try to get another VC from you Region and could you tell me where to get VC from (not download with wii points)

soon as i get someone to test it with me i will do so

guess, you found the data, which holds the unique code for wii.

i can confim.

tried my version of Bomberman'93 - it's PAL Version.

Root-CA00000001-CP00000004 Root-CA00000001-MS00000002 NGxxxxxxxx Root-CA00000001-MS00000002-NGxxxxxxxx AP0000000100000002

NGxxxxxxxx (8times the x) shows the unique code.
mine is different to yours, but i'm not posting the string

this also shows, that three times the ROOT phrase is used.
first time - no code (-> perhaps init string?!?)
second time - with code
third time - with code and an appendix

i'm still working.

next guess. i figured out, that the wii does a check of this NG........ phrase.

first thing:
NG yy zzzzzz

yy = 04 (PAL), 02 (US)
zzzzzz = console ID which is checked with an algorithm, which returns a true or false
Why is that so: i only changed one letter. Tried in the Wii - and the channel doesn't appear in sd card menu!


@ nickjaco
I also have PAL system.
I tried your "1b320c" - the channel is displayed in the sd card menu.
But when i want to copy - it says sth. like...
"The file was not copied possibly." And for sure, it wasn't copied with your code.

when i change back to my normal "code" it is working and copied!

so if you need your ID code you can get it from something like ur Opra browser right or could there be a formula or something from your ID number. ??? can could you tell me where you get your VC and Hex editer?? i could try but i need VC

Hey,

@GalaxyFraulein:

Nice to hear someone makes any progress on the Wii and I'm really glad you (obviously) found the unique Wii-Code.

My guess why the simple exchange of the unique codes won't work is that I guess there is a, more or less, simple CRC Check in / at the end of the VC-File, that will give the Wii an error when you want to copy that game. I think this CRC check is the output of the mathematical combination of the unique code and some lines of the VC game, so I myself think it would be hard to modify the CRC data in a way that the game would run. (Additionally we don't even know where in the file that data is stored, prolly at the end, but who knows.)

Just my 2 cents, let me hear your thoughts about it.


LilaQ

P.S. I think it would really help if we could compare as many VC games as possible, from different users, different countries etc. so we can guess a little bit more about the single meanings in this code. Unluckily I don't own any,..

@ LilaQ
lets hope, that there is no more crc check
i hope so

@ pro2oman
hex editor from the net
vc game original download

changed my id code to id code from another wii but the other wii didnt recognize my vc game.
both wiis have same region

Originally Posted by pregi

changed my id code to id code from another wii but the other wii didnt recognize my vc game.
both wiis have same region

the game must be visible in the card menu, otherwise i guess you've made a mistake

i tried with my modified games with nickjaco numbers and also with another ntsc game. the ntsc game also shows up - but can't be copied!

Could anyone here send me a VC game so I could take a closer look at it?
Please send me a PM if you can, TIA.

this is old when the 1st time vc games was released to the net i tried takin my wii code from when i dled a game to the ones released to the net it will show up but u cant play or do anything

hmmm, am friend of mine and I have tried to check this.

i injected his code (extrated from opera browser) into my vc bomberman data.
he tried - checked the channel menu - he saw the game.
but when "Copy" was clicked, the standard message pops up.

"The file was not copied possibly." And it wasn't at all copied.

So, there must be more in the file to analyse.

I call it a day... and go to bed.
Tomorrow a new chance....

At the risk of being called arrogant I'll label this thread as amateur hacking. I'm not saying I could do better but I know this:
If it was just a matter of some trivial hex editing the VC would have been hacked a few days after launch. However, Nintendo isn't that stupid. I'm pretty sure the system uses some kind of encryption using a key that you won't find on the memory card.
For example: each Wii has a unique ID, transmits it to the server at purchase, server adds it to the game, encrypts or signs it using the private Nintendo key. When launched, the console checks if the file signed properly and refused to launch it otherwise.

Obviously this is not more than a wide guess but given that Nintendo encrypts even the content on the discs I'd be very surprised if they wouldn't encrypt the VC games.

Maybe I totally misunderstand this thread and its a huge breakthrough after all. In that case I'd gladly eat a Wiimote