wiifuse_server

wiifuse_server
General
Author(s)	dhewg, #wiidev efnet/blitzed
Type	Development resource
Links
Download
Source Included

wiifuse_server is a wii application that responds to wiifuse requests coming over a usbgecko adapter from a remote host. this allows you to mount the wii internal nand filesystem with full read/write access remotely on your computer.

WARNING: watch exactly what you are doing, you can BRICK your wii with this tool. use at your own risk.

requirements

• an operating system capable of running wiifuse
• the wiifuse package (v0.2.0 or higher), the server described here is part of it
• a usbgecko adapter
• a brain and a good understanding of the wii internals

build

hint: a precompiled binary is included

to compile the included code, you will need devkitPPC and libogc r14 or higher

the server code resides in "./server", just run make there

howto

you will need an identity to authenticate against the wii's ES subsystem. an identity describes the access rights you have on the nand filesystem. it consists of 3 files:

• certificate chain
• tmd
• ticket

these 3 files are, for example, part of a wii image. you can use wiifuse and the included shell script to copy these from a data partition to the needed location:

~/devel/wiifuse/ ./wiifuse ~/zelda-tp.iso ~/fuse
~/devel/wiifuse/ ./server/get_identity.sh ~/fuse/data zelda
found 'The_Legend_of_Zelda_Twilight_Princess' (00010000525a4450)
`/home/dhewg/fuse/data/.internals/certs' -> `/usr/local/etc/wiifuse/00010000525a4450.certs'
`/home/dhewg/fuse/data/.internals/tmd' -> `/usr/local/etc/wiifuse/00010000525a4450.tmd'
`/home/dhewg/fuse/data/.internals/ticket' -> `/usr/local/etc/wiifuse/00010000525a4450.tik'
create symbolic link `zelda.certs' to `00010000525a4450.certs'
create symbolic link `zelda.tmd' to `00010000525a4450.tmd'
create symbolic link `zelda.tik' to `00010000525a4450.tik'
done
~/devel/wiifuse/ fusermount -u ~/fuse

to mount the nand filesystem with the zelda access rights on pc side:

~/devel/wiifuse/ make -C server upload
make: Entering directory `/home/dhewg/devel/wiifuse/server'
/usr/local/devkitpro/devkitPPC/bin/geckoupload wiifuse_server.dol
geckoupload v0.0.3
coded by dhewg, #wiidev efnet/blitzed

using /dev/ttyUSB0
sending upload request
awaiting upload ack
sending file size (0x00023cc0)
sending data...
done.
make: Leaving directory `/home/dhewg/devel/wiifuse/server'
~/devel/wiifuse/ ./wiifuse -i zelda /dev/ttyUSB0 ~/fuse
title's data path is "/title/00010000/525a4450/data"
~/devel/wiifuse/ cd ~/fuse/title/00010000/525a4450/data
~/fuse/title/00010000/525a4450/data/ ls -ln
total 90
-rw-r--r-- 0 4133 12337 29344 Jan  1  1970 banner.bin
-rw-r--r-- 0 4133 12337 46143 Jan  1  1970 loader.bin
-rw-r--r-- 0 4133 12337 16384 Jan  1  1970 zeldaTp.dat
~/fuse/title/00010000/525a4450/data/ umask
022
~/fuse/title/00010000/525a4450/data/ mkdir testdir
~/fuse/title/00010000/525a4450/data/ ls -ln
total 90
-rw-r--r-- 0 4133 12337 29344 Jan  1  1970 banner.bin
-rw-r--r-- 0 4133 12337 46143 Jan  1  1970 loader.bin
drwxr-xr-x 0 4133 12337     0 Jan  1  1970 testdir
-rw-r--r-- 0 4133 12337 16384 Jan  1  1970 zeldaTp.dat
~/fuse/title/00010000/525a4450/data/ cd testdir
~/fuse/title/00010000/525a4450/data/testdir/ umask 0
~/fuse/title/00010000/525a4450/data/testdir/ echo "could it be any more open?" > testfile
~/fuse/title/00010000/525a4450/data/testdir/ ls -ln
total 0
-rw-rw-rw- 0 4133 12337 27 Jan  1  1970 testfile
~/fuse/title/00010000/525a4450/data/testdir/ cat testfile
could it be any more open?
~/fuse/title/00010000/525a4450/data/testdir/ chmod go-rw testfile
~/fuse/title/00010000/525a4450/data/testdir/ ls -ln
total 0
-rw------- 0 4133 12337 27 Jan  1  1970 testfile
~/fuse/title/00010000/525a4450/data/testdir/ rm testfile
~/fuse/title/00010000/525a4450/data/testdir/ cd ..
~/fuse/title/00010000/525a4450/data/ rmdir testdir
~/fuse/title/00010000/525a4450/data/ ls -ln
total 90
-rw-r--r-- 0 4133 12337 29344 Jan  1  1970 banner.bin
-rw-r--r-- 0 4133 12337 46143 Jan  1  1970 loader.bin
-rw-r--r-- 0 4133 12337 16384 Jan  1  1970 zeldaTp.dat
~/fuse/title/00010000/525a4450/data/ cp loader.bin cptest
~/fuse/title/00010000/525a4450/data/ ls -ln
total 135
-rw-r--r-- 0 4133 12337 29344 Jan  1  1970 banner.bin
-rw-r--r-- 0 4133 12337 46143 Jan  1  1970 cptest
-rw-r--r-- 0 4133 12337 46143 Jan  1  1970 loader.bin
-rw-r--r-- 0 4133 12337 16384 Jan  1  1970 zeldaTp.dat
~/fuse/title/00010000/525a4450/data/ md5sum loader.bin cptest
e8bde0678cbe653a8a16152af8853be0  loader.bin
e8bde0678cbe653a8a16152af8853be0  cptest
~/fuse/title/00010000/525a4450/data/ rm cptest
~/fuse/title/00010000/525a4450/data/ cd
~/ fusermount -u fuse

notes

• don't use this if you don't understand it to 100%
• it depends on the identity which paths/files you can access and which not

thanks

• all the reversers out there. this tool just demonstrates a few new functions of libogc
• the usual suspects, without you this wouldn't be possible

wiifuse+net

• This modified version of wiifuse uses the network instead of usb gecko: http://emergent.unpy.net/01212803011