Line 1:
Line 1:
−
ALL THIS INFORMATION ARE GAINED THROUGH A MODIFIED ISO WITH THE DATEL APPLOADER.
+
The Datel Freeloader disc is probably a modified version of their GameCube product. The disc's header is marked as RFLP5D (for the PAL version), and it contains one encrypted partition with the ID DTLX01. It uses an unknown method to bypass signature verification, and an unknown method to frustrate attempts to dump the disc using standard methods.
−
It's using the 'R' as WiiDisc_ID (like any ordinary WiiDisc) and uses the Trucha signature. Anyway it's using a custom apploader to apply the patch to the memory. I'm gonna disassemble it later.
+
It contains a small apploader which appears to patch the system menu. There are no files in the FST, and there does not appear to be a DOL.
−
The main.dol doesn't contain anything at all, because it will never get loaded.
−
We might use a similar exploit later to allow homebrew to run later, but first we have to figure out exactly how it works. :)
+
(There is also a modified ISO floating around that was generated by patching a game ISO with the Freeloader apploader, and it has the partition ID RFLPWK. This is not the same thing.)
−
−
Partition (RFLPWK):
−
offset: 0x50000
−
type: 0
−
TMD size: 520
−
TMD offset: 0x2c0
−
CERTS size: 2560
−
CERTS offset: 0x4e0
−
H3 offset: 0x8000
−
DATA size: 8388608
−
DATA offset: 0x20000
−
−
ticket.bin:
−
issuer: Root-CA00000001-XS00000003
−
titlekey (E): e086833865486bf75dd0dbbe7e3e0502
−
title ID (IV): 00010000524d4745
−
−
tmd.bin:
−
issuer: Root-CA00000001-CP00000004
−
version: 0
−
ca ver: 0
−
sign ver: 0
−
system version: 0000000100000021
−
title id: 00010000524d4745
−
title type: 1
−
group id: 3031
−
access: 00000000
−
title version: 0000
−
files count: 1
−
boot index: 00000000
−
file id: 0
−
index: 0
−
type: 3
−
size: 4286316544
−
hash: 46d287895176d40e69c8dee0ca162f41e2bde79d
−
−
No files are in root.
Video:
Video:
http://www.youtube.com/watch?v=z4iWEtsZMvE
http://www.youtube.com/watch?v=z4iWEtsZMvE