Comments on: Putting the genie back into bottle? (MIOS)

By: shuffle2

shuffle2 — Fri, 18 Jun 2010 17:41:18 +0000

The link to the wiimpersonator log needs to have the region dir added to the url

By: Korean Wii

Korean Wii — Sat, 13 Sep 2008 22:17:28 +0000

[...] xt5 astutely noted, there is a field in the ticket structure — byte 0×1f1 — that is set to 1 in [...]

By: bushing

bushing — Thu, 10 Jul 2008 11:58:14 +0000

@Hatchhaker: Thanks for the nice summary. As for the OTP — we don’t know exactly how it’s implemented, but from the boot0 code it appears that it starts out as all zeroes and is selectively flipped to ones (so, like fuses, and opposite of PROM). If we could flip them all to zeroes, we could change boot1 as much as we want; if we flip them all to ones, I believe the device would become unusable. Nobody’s actually tested to see if it’s possible to modify that memory; feel free to be the first.

@andoba: I agree that the Chinese market is probably very tempting for Nintendo, and would also be a huge piracy concern. Unfortunately, I don’t think that changing the common key will really help anything, but … oh well.

By: andoba

andoba — Thu, 10 Jul 2008 08:57:14 +0000

Well, I have no idea about how does the Wii work, but after reading this post, my thoughts are that all the bug exploiting – bug fixing game that hackers and Nintendo are playing, could be a sandbox for releasing in China a hackfree iQue Wii, as said before.

China is a very, very potential market, many potential users if launched at the right price. Also there is a huge problem with piracy, you can buy pirate iQue DS games which are inside GBA carts; I have no idea about how do they do it, but chinese have a huge industry into piracying and possibly Nintendo want a firm ground before launching it.

By: Hatchhaker

Hatchhaker — Wed, 09 Jul 2008 17:27:33 +0000

So, to sum up there’s a bunch of possible reasons for this update:

1) if the keys for Korean wiis are different, that could stop them from getting the keys or at least for them to spread,
2) having two keys, one for old games and one for new games,
3) so that versions for future regions use a different key,
4) hoping that the keys are not widespread enough as to get “popular” (last time I checked I couldn’t find them online), so they eventually “die” after some time and noone else can retrieve them again,
5) as a message to hackers that they’re covering the holes,
6) it’s a security bug anyway; fixing it makes no harm and leaving it open is slightly more risky.

#46’s points sound fairly valid to me as well (not to maintain two separate versions, plus the possible new storage).

Now that I’m here, out of curiousity, can’t an OTP be totally zeroed (or “oned”) out? If they are like fuses, which is the concept I have of an OTP, that should be possible (without any possibility to roll back, of course.)

By: etc

etc — Tue, 01 Jul 2008 23:26:26 +0000

[...] Wii: We believe that the new Korean Wiis have a new common key, and we won’t be able to use our tweezer attack to recover it. I’d like to take a look at one and see what other avenues of attack there [...]

By: Anonymous

Anonymous — Tue, 01 Jul 2008 19:33:00 +0000

@Kieran: Well, i live in Europe, got SSBB, and did have to update.

By: Kieran

Kieran — Sun, 29 Jun 2008 06:04:12 +0000

@ linkinworm

I just got the PAL version of SSBB; it didn’t make me update anything (I have whatever is the version before 3.3).

By: bushing

bushing — Fri, 27 Jun 2008 14:07:22 +0000

I don’t think that the new common key / MIOS / whatever is related to the alledged future “storage solution”. It’s a red herring.

By: Anonymous coward

Anonymous coward — Thu, 26 Jun 2008 11:59:39 +0000

It depends if it’s proprietary or not. The problem is nobody knows what it is.

If it’s not proprietary it can’t store a key or firmware upgrade on the device itself and as it stands both the SD card slot and the USB ports are very slow and limiting for storage. Are we sure that the SD card slot is limited by hardware to 2Gb and the USB port is limited by hardware to 1.1 or can this be fixed with a system software upgrade?

If it’s proprietary then it could carry some firmware upgrade or key on the device itself which could be read by the Wii.

If the device is large enough to store an ISO, Nintendo may also want a new key in an effort to prevent ISO loaders.

They’ve also stated that it won’t be a hard drive. So this means one of the following…

a) It’s proprietary and therefore could contain some firmware or a key or both which can be read by the Wii on connecting for the first time, pairing the device to that Wii.

B) It’s an SD card which is currently limited to 2Gb unless this can be fixed with a firmware upgrade.

c) It’s a USB mass storage device with support for hard drives deliberately removed (or possibly with an artificial upper limit for storage, e.g. assuming that everything larger than e.g. 8Gb is a hard drive).

For options b) and c) it may require formatting to a non-FAT filesystem first, a filesystem which may be encrypted with a new key.

Streaming by wifi could be done via SMB but it adds a whole new support nightmare for routers, networking, etc…

These are just ideas, until we know more we can only guess.