Wiifuse server

wiifuse_server
General
Author(s)	dhewg, #wiidev efnet/blitzed
Type	Development resource
Links
Download
Source Included

wiifuse_server is a Wii application that responds to wiifuse requests coming over a usbgecko adapter from a remote host. This allows you to mount the Wii internal NAND filesystem with full read/write access remotely on your computer.

WARNING: watch exactly what you are doing, you can BRICK your wii with this tool. use at your own risk.

Prerequisites

• An OS capable of running wiifuse
• wiifuse package (v0.2.0 or higher), the server described here is part of it
• USBgecko adapter
• Comprehension of the Wii internals

Build

A precompiled binary is included.

To compile the included code, you will need:

• devkitPPC and libogc
  • r14 or higher

The server code resides in "./server". Run make there.

How-To

You will need an identity to authenticate against the Wii's ES subsystem. An identity describes the access rights you have on the NAND filesystem. It consists of 3 files:

• certificate chain
• TMD
• Ticket

These 3 files are, e.g. part of a Wii image. You can use wiifuse and the included shell script to copy these from a data partition to the needed location:

~/devel/wiifuse/ ./wiifuse ~/zelda-tp.iso ~/fuse
~/devel/wiifuse/ ./server/get_identity.sh ~/fuse/data zelda
found 'The_Legend_of_Zelda_Twilight_Princess' (00010000525a4450)
`/home/dhewg/fuse/data/.internals/certs' -> `/usr/local/etc/wiifuse/00010000525a4450.certs'
`/home/dhewg/fuse/data/.internals/tmd' -> `/usr/local/etc/wiifuse/00010000525a4450.tmd'
`/home/dhewg/fuse/data/.internals/ticket' -> `/usr/local/etc/wiifuse/00010000525a4450.tik'
create symbolic link `zelda.certs' to `00010000525a4450.certs'
create symbolic link `zelda.tmd' to `00010000525a4450.tmd'
create symbolic link `zelda.tik' to `00010000525a4450.tik'
done
~/devel/wiifuse/ fusermount -u ~/fuse

To mount the NAND filesystem with the zelda access rights on PC side:

~/devel/wiifuse/ make -C server upload
make: Entering directory `/home/dhewg/devel/wiifuse/server'
/usr/local/devkitpro/devkitPPC/bin/geckoupload wiifuse_server.dol
geckoupload v0.0.3
coded by dhewg, #wiidev efnet/blitzed

using /dev/ttyUSB0
sending upload request
awaiting upload ack
sending file size (0x00023cc0)
sending data...
done.
make: Leaving directory `/home/dhewg/devel/wiifuse/server'
~/devel/wiifuse/ ./wiifuse -i zelda /dev/ttyUSB0 ~/fuse
title's data path is "/title/00010000/525a4450/data"
~/devel/wiifuse/ cd ~/fuse/title/00010000/525a4450/data
~/fuse/title/00010000/525a4450/data/ ls -ln
total 90
-rw-r--r-- 0 4133 12337 29344 Jan  1  1970 banner.bin
-rw-r--r-- 0 4133 12337 46143 Jan  1  1970 loader.bin
-rw-r--r-- 0 4133 12337 16384 Jan  1  1970 zeldaTp.dat
~/fuse/title/00010000/525a4450/data/ umask
022
~/fuse/title/00010000/525a4450/data/ mkdir testdir
~/fuse/title/00010000/525a4450/data/ ls -ln
total 90
-rw-r--r-- 0 4133 12337 29344 Jan  1  1970 banner.bin
-rw-r--r-- 0 4133 12337 46143 Jan  1  1970 loader.bin
drwxr-xr-x 0 4133 12337     0 Jan  1  1970 testdir
-rw-r--r-- 0 4133 12337 16384 Jan  1  1970 zeldaTp.dat
~/fuse/title/00010000/525a4450/data/ cd testdir
~/fuse/title/00010000/525a4450/data/testdir/ umask 0
~/fuse/title/00010000/525a4450/data/testdir/ echo "could it be any more open?" > testfile
~/fuse/title/00010000/525a4450/data/testdir/ ls -ln
total 0
-rw-rw-rw- 0 4133 12337 27 Jan  1  1970 testfile
~/fuse/title/00010000/525a4450/data/testdir/ cat testfile
could it be any more open?
~/fuse/title/00010000/525a4450/data/testdir/ chmod go-rw testfile
~/fuse/title/00010000/525a4450/data/testdir/ ls -ln
total 0
-rw------- 0 4133 12337 27 Jan  1  1970 testfile
~/fuse/title/00010000/525a4450/data/testdir/ rm testfile
~/fuse/title/00010000/525a4450/data/testdir/ cd ..
~/fuse/title/00010000/525a4450/data/ rmdir testdir
~/fuse/title/00010000/525a4450/data/ ls -ln
total 90
-rw-r--r-- 0 4133 12337 29344 Jan  1  1970 banner.bin
-rw-r--r-- 0 4133 12337 46143 Jan  1  1970 loader.bin
-rw-r--r-- 0 4133 12337 16384 Jan  1  1970 zeldaTp.dat
~/fuse/title/00010000/525a4450/data/ cp loader.bin cptest
~/fuse/title/00010000/525a4450/data/ ls -ln
total 135
-rw-r--r-- 0 4133 12337 29344 Jan  1  1970 banner.bin
-rw-r--r-- 0 4133 12337 46143 Jan  1  1970 cptest
-rw-r--r-- 0 4133 12337 46143 Jan  1  1970 loader.bin
-rw-r--r-- 0 4133 12337 16384 Jan  1  1970 zeldaTp.dat
~/fuse/title/00010000/525a4450/data/ md5sum loader.bin cptest
e8bde0678cbe653a8a16152af8853be0  loader.bin
e8bde0678cbe653a8a16152af8853be0  cptest
~/fuse/title/00010000/525a4450/data/ rm cptest
~/fuse/title/00010000/525a4450/data/ cd
~/ fusermount -u fuse

notes

• don't use this if you don't understand it to 100%
• it depends on the identity which paths/files you can access and which not

Credits

• All the reversers out there. this tool just demonstrates a few new functions of libogc
• The usual suspects, without you this wouldn't be possible

wiifuse+net

• This modified version of wiifuse uses the network instead of usb gecko: http://emergent.unpy.net/01212803011