Datel FreeLoader

ALL THIS INFORMATION ARE GAINED THROUGH A MODIFIED ISO WITH THE DATEL APPLOADER.

It's using the 'R' as WiiDisc_ID (like any ordinary WiiDisc) and uses the Trucha signature. Anyway it's using a custom apploader to apply the patch to the memory. I'm gonna disassemble it later. The main.dol doesn't contain anything at all, because it will never get loaded.

We might use a similar exploit later to allow homebrew to run later, but first we have to figure out exactly how it works. :)

Partition (RFLPWK):

offset:         0x50000
type:           0
TMD size:       520
TMD offset:     0x2c0
CERTS size:     2560
CERTS offset:   0x4e0
H3 offset:      0x8000
DATA size:      8388608
DATA offset:    0x20000

ticket.bin:

issuer:         Root-CA00000001-XS00000003
titlekey (E):   e086833865486bf75dd0dbbe7e3e0502
title ID (IV):  00010000524d4745

tmd.bin:

 issuer:         Root-CA00000001-CP00000004
 version:        0
 ca ver:         0
 sign ver:       0
 system version: 0000000100000021
 title id:       00010000524d4745
 title type:     1
 group id:       3031
 access:         00000000
 title version:  0000
 files count:    1
 boot index:     00000000
 file id: 0
   index: 0
   type: 3
   size: 4286316544
   hash: 46d287895176d40e69c8dee0ca162f41e2bde79d

No files are in root.

Video: http://www.youtube.com/watch?v=z4iWEtsZMvE