Difference between revisions of "IOS253"
Jump to navigation
Jump to search
(Page creation.) |
Hallowizer (talk | contribs) (updated info to stuff found in the code) |
||
| (2 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
{{Infobox IOS | {{Infobox IOS | ||
| version = v31337 | | version = v31337 | ||
| − | | type = Temporary IOS | + | | type = Temporary [[IOS]] |
}} | }} | ||
| − | ''' | + | '''IOS253''' is a temporary [[IOS]], created by older versions of "[[xyzzy]]", that sometimes remains in the [[NAND]]. It can be safely deleted. |
=== How it works === | === How it works === | ||
| − | The reason for the IOS being there | + | The reason for the IOS being there becomes clear when you look at how "xyzzy" used to work. The following is taken from [https://hackmii.com/2008/07/xyzzy/ hackmii.com]: |
| − | * Download IOS11 from the Nintendo Update Server | + | * Download [[IOS11]] from the Nintendo Update Server |
* Patch it to remove the MEM2 protection (so the PPC can access all 64MB of it) | * Patch it to remove the MEM2 protection (so the PPC can access all 64MB of it) | ||
* Patch it to allow it to delete itself later using ES_DeleteTitle() | * Patch it to allow it to delete itself later using ES_DeleteTitle() | ||
| − | + | * Install the hacked IOS11 into IOS253 | |
| − | * Install the hacked IOS11 | ||
* Reboot into the hacked IOS | * Reboot into the hacked IOS | ||
* Copy the private key structure from the IOS address space into MEM1 | * Copy the private key structure from the IOS address space into MEM1 | ||
Latest revision as of 09:31, 10 July 2022
| IOS253 | |
 | |
| Technical info | |
|---|---|
| Type | Temporary IOS |
IOS253 is a temporary IOS, created by older versions of "xyzzy", that sometimes remains in the NAND. It can be safely deleted.
How it works
The reason for the IOS being there becomes clear when you look at how "xyzzy" used to work. The following is taken from hackmii.com:
- Download IOS11 from the Nintendo Update Server
- Patch it to remove the MEM2 protection (so the PPC can access all 64MB of it)
- Patch it to allow it to delete itself later using ES_DeleteTitle()
- Install the hacked IOS11 into IOS253
- Reboot into the hacked IOS
- Copy the private key structure from the IOS address space into MEM1
- Reboot back into a sane IOS
- Delete the temporary, hacked IOS
- Display the keys on screen
- Try to write them to a file on the SD card — keys.txt
- Pause for 60 seconds to allow you to copy the keys down using pen and paper,if necessary
| Version | Signing bug? | STM Release Exploit? | Notes |
|---|---|---|---|
| v31337 | Yes | Yes | Temporary IOS, created by old versions of xyzzy. |
| |||||||||||||||||