5,579
edits
Changes
updated info to stuff found in the code
Line 4:
Line 4:
* '''Find an unused IOS slot (counting downward from IOS255)'''+
}}
}}
−'''IOS255''' is a temporary [[IOS]], created by older versions of "[[xyzzy]]", that sometimes remains in the [[NAND]]. It can be safely deleted.
+'''IOS253''' is a temporary [[IOS]], created by older versions of "[[xyzzy]]", that sometimes remains in the [[NAND]]. It can be safely deleted.
=== How it works ===
=== How it works ===
−The reason for the IOS being there, becomes clear when you look at how "xyzzy" used to work. The following is taken from [https://hackmii.com/2008/07/xyzzy/ hackmii.com]:
+The reason for the IOS being there becomes clear when you look at how "xyzzy" used to work. The following is taken from [https://hackmii.com/2008/07/xyzzy/ hackmii.com]:
* Download [[IOS11]] from the Nintendo Update Server
* Download [[IOS11]] from the Nintendo Update Server
* Patch it to remove the MEM2 protection (so the PPC can access all 64MB of it)
* Patch it to remove the MEM2 protection (so the PPC can access all 64MB of it)
* Patch it to allow it to delete itself later using ES_DeleteTitle()
* Patch it to allow it to delete itself later using ES_DeleteTitle()
−* Install the hacked IOS11 into IOS253
−* Install the hacked IOS11 there
* Reboot into the hacked IOS
* Reboot into the hacked IOS
* Copy the private key structure from the IOS address space into MEM1
* Copy the private key structure from the IOS address space into MEM1