HackMii

Notes from inside your Wii

HackMii header image 2

Introducing: LetterBomb (the letter from heaven)

August 9th, 2011 by blasty · 126 Comments

Up until now the only way to liberate your Wii console and enable the use of homebrew with System Menu 4.3 was to use a gamedisc based exploit such as “BatHaxx”, “Return of the Jodi” and others.

Today we are announcing a project that changes this completely and removes the requirement for an exploitable game.

In memory of BannerBomb, we present you with LetterBomb , a brand new System Menu exploit that will allow you to enable homebrew with the push of an envelope ;) (no stamp licking involved)

This exploit reuses (and abuses) some of some Nintendo’s Wii Messageboard functionality. :-)

You will need:

  • A Wii running System Menu 4.3 (E/U/J/K)
  • A SD(HC) card with some free space
  • Your Wii’s WiFi MAC Address (available from your Wii’s system settings). This is needed because the Wii will only accept messages addressed to its specific MAC address.
  • A few minutes of your time

For this very special occasion we have created an easy-peasy webpage that takes away some of the pain that is usually involved with getting homebrew onto your system:

http://please.hackmii.com

This webpage will ask you for some necessary information (such as your System Menu region and MAC address), and  will then return a nicely packaged ZIP file that is ready for extraction to the root of your SD card. Simple eh?

All that is missing from that point is a boot.elf/boot.dol file (that you will need to place in the root of your card), and you should be good to go. For your convenience we have an option to prepackage and bundle the HackMii Installer boot.elf (this is enabled by default).

So, how do I do this?

Simple…. once you’ve unzipped the file to your SD card (and inserted it) just navigate to the “messageboard” on your Wii and in the default view you should browse to “yesterday” (the place where you usually see yesterday’s messages) – sometimes this may be “today” or “two days ago” (this depends on the timezone you are in).

From this view you will be presented with a small envelope (that should obviously stand out against the rest of your plain old boring ones), click it, kick back, twiddle your thumbs (the Brits among you, go and make a cup of tea) cross your fingers and hope it worked. :-)

DISCLAIMER: We are aware of a similar exploit by giantpune (good work!), but as of today this has not been released. In anticipation of its release we decided to reverse engineer, hack and implement something ourselves.

Tags: Wii

126 responses so far ↓

  • 1 DanielG // Aug 9, 2011 at 10:28 am

    Woot! Way to go blasty!

  • 2 popoffka.myopenid.com/ // Aug 9, 2011 at 10:42 am

    Wow, that’s awesome!
    Are you going to release information on how this works?

  • 3 omegax.mp/ // Aug 9, 2011 at 10:42 am

    Good job!

  • 4 Memedan // Aug 9, 2011 at 11:10 am

    YEEEEEEEEEEEEEEEEES!!!!! This works for me!!!Fine! Thank you, Team Twiizers! Keep it up!
    -Memedan
    P.S.: Also waiting for the new Sudokuhax ;)

  • 5 Joel Sjogren // Aug 9, 2011 at 11:14 am

    Thank you! I can’t believe you are still working on these things

  • 6 0ld8oy // Aug 9, 2011 at 11:18 am

    reverse engineer? so are you saying someone gave you pune’s work and you “reverse engineered” it?

  • 7 mattXPO // Aug 9, 2011 at 11:26 am

    http://i51.tinypic.com/34t371j.png

    Epic low blow, but you have to admit, that without giantpune’s shared informations via IRC this would not happend.

    Who exactly from TT made this exploit? blasty and marcan?

  • 8 BluPhant // Aug 9, 2011 at 11:36 am

    This is simply awesome, and will help a good many people utilize their Wii to its fullest potential. Kudos for a job well done, very impressive.

  • 9 DCX2 // Aug 9, 2011 at 12:00 pm

    Great news. I’m curious as to what steps an exploit like this takes. Perhaps some time someone can make a hackmii post that walks through an exploit seizing control of the Wii?

  • 10 gk1799 // Aug 9, 2011 at 12:18 pm

    what if it freezes when i click the message? does that mean its not working or do i wait ?

  • 11 SifJar // Aug 9, 2011 at 1:19 pm

    Glad to see this being released without demanding donations first. No offence to pune, but that’s not how it should work IMO.

  • 12 bushing // Aug 9, 2011 at 1:27 pm

    @0ld8oy: AFAIK, blasty and tueidj saw on youtube that there was an exploitable bug in the messageboard, and then went to the System Menu code and found their own exploitable bug (possibly the same one?) and coded up an exploit. None of us have seen anything besides that youtube video.

  • 13 blasty // Aug 9, 2011 at 1:36 pm

    @0ld8oy/bushing: giantpune _did_ mention a overflow in the message body. I simply started working out the fileformat, encryption, signature, etc. (creating some useful utilities along the road, heh) in order to play with the data in these files. One thing led to another and tueidj managed to forge a crash and eventually exploit it.

  • 14 mattXPO // Aug 9, 2011 at 2:20 pm

    @blasty: That’s certainly impressive, but is tueidj a member of TT or why doesn’t he get any credit for this in the blog entry?

  • 15 lewurm // Aug 9, 2011 at 2:20 pm

    nice!

    any plans to release the source code? :)

  • 16 Anonymous // Aug 9, 2011 at 2:21 pm

    […] […]

  • 17 tueidj // Aug 9, 2011 at 2:33 pm

    @mattXPO I’m not a member. I do hacks for purpose not credit.

  • 18 mattXPO // Aug 9, 2011 at 2:45 pm

    @tueidj: Really? That’s very generously. I would be pissed off if someone else would get all the credit off my hard work.

  • 19 0ld8oy // Aug 9, 2011 at 3:00 pm

    @mattXPO: It is very generous of him isn’t it. Weird how he was working with Pune and TT though…

  • 20 gbl08ma // Aug 9, 2011 at 3:46 pm

    What I have learned with this? Next time, better wait 8 months and don’t buy a game to install homebrew.

    Anyways, GREAT work! Haven’t tried it myself, but will do so soon. This comes very handy because I have a friend that is willing to install Homebrew, and I want to have him do it “the right way” (without warez, etc.), but he doesn’t have any of the games that were necessary.

    Fortunately, games are not needed anymore. Just a SD card… great! Great!

    PS: stay tuned for System Menu 4.4! :)

  • 21 New way to exploit your Wii 4.3 // Aug 9, 2011 at 5:14 pm

    […] I use New exploit for System Menu 4.3 Coming Soon that apparently doesn't use any game discs. Introducing: LetterBomb __________________ Keith Golf GTD (170) 2010, 5 Door Wii […]

  • 22 crundy // Aug 10, 2011 at 1:45 am

    Great work, although wouldn’t it have been better to stockpile this exploit until after the next system menu release? We already have at least 4 “live” exploits, and if nintendo block all of them in the next release then we’ll have to wait for a new exploit before being able to install the HBC.

  • 23 blasty // Aug 10, 2011 at 1:47 am

    @gk1799 Can you provide some more details? Did you select the correct System Menu version when generating the ZIP file? (It really only works on 4.3x at the moment, and selecting the _correct_ region is nescessary.)

  • 24 tech3475 // Aug 10, 2011 at 7:15 am

    Good work, I thought we had seen the end of such work for the Wii (the price of the games will possibly go down now for those who just want to play them).

    I wonder if Nintendo will be bothered to fix this?

  • 25 [News] New Wii hack does not require games // Aug 10, 2011 at 7:46 am

    […] day. Now put in your SD card, and click the special message, that’s it! For more information: http://hackmii.com/2011/08/letterbomb/ Posted in […]

  • 26 winmaster // Aug 10, 2011 at 10:15 am

    Wow, and to think everyone said another system menu exploit was extremely unlikely.

    Great job TT.

  • 27 SifJar // Aug 10, 2011 at 11:10 am

    @Crundy:it is my guess they wanted to get it out before giantpune started demanding donations to release it (i believe he was planning on setting a target for donations and releasing it only once that target was hit).

  • 28 b11074481 // Aug 10, 2011 at 2:23 pm

    I just managed to get this to work. Apparently at least one message needs to be present before the SD card is updated. The wii was brand new and at first this didn’t work. I then added a memo myself and tried again: success!

  • 29 diogomota // Aug 10, 2011 at 3:22 pm

    not working here i downloaded the correct version and no message displays here i have the 4.3 E and it should work but it doesnt :( help… please

  • 30 gbl08ma // Aug 11, 2011 at 5:05 am

    I finally got time to try this. At first it didn’t work, no matter how many memos I created on various days to overtake the problem b11074481 referred, no message would appear in any day near today.
    I was using a 16GB SDHC with lots of stuff from HBC apps to official Wii Channels (which I moved to “privateold”), and also including music and videos.

    Then it came to my mind it could be because of some card incompatibility (although Wii Channels are read right). Tried with my old 512MB standard SD card (which is now on my phone and has some stuff there, like Windows Mobile apps, but has nothing Wii-related), and a very nice red envelope appeared “the day before” on the message board.

    Kudos to who created the envelope artwork!

    Clicked the message, it showed the usual exploit blah blah. And a message: it’s software licenced under GNU GPL v2.
    So, where’s the source code? This program will be in violation of the GPL until its source code is publicly available.

    BTW… if the exploit code is ever made available, it *might* be a viable way to launch any homebrew app from the System Menu. Looks much easier to setup than channel forwarders, specially because you don’t need a WAD installer, just a SD card. The only problem would be making the message stand always near the current day, because nobody’s willing to go back 3 months to launch an app from a messageboard message.

    Other thing, has anyone explored the “Start” button that is shown on certain Nintendo messages well enough? IIRC it was discussed on WiiBrew forums that the button contains specific code that is sent in message headers. Can a similar exploit be crafted to launch the boot.elf only at the click of the “Start” button at the bottom right corner of the screen? And eventually allow people to send HackMii installers to other Wii users right through WiiConnect24? (almost kidding, it would be a huge security problem and Nintendo would fix it in three steps).

    Again, thanks a lot for your great work (even although I won’t be exactly one who will find it more useful, since my Wii is already homebrewed).

  • 31 Segher // Aug 11, 2011 at 10:11 am

    “This program will be in violation of the GPL until its source code is publicly available.”

    No it’s not. We wrote all of the code, we can do with it whatever we like.

    The message is somewhat misleading of course, that’s because the loader is simply savezelda (which has source available to you just fine fwiw).

    Source code will be merged into savezelda when we have time for it (soonish).

  • 32 martijnvaandering // Aug 11, 2011 at 10:29 am

    Hi folks,

    got a black wii with firmware 4.3e and on loading letterbomb it freezes… any suggestions?

    grtz Martijn

  • 33 marteeny // Aug 11, 2011 at 12:34 pm

    Nevermind, I found the answer to this on wiihacks.com go and and delete my comments

  • 34 Tissemand // Aug 12, 2011 at 12:26 am

    Thank you once again Team Twiizers! I just finished the latest installation and everything went well. I’m not even that drunk right now, but I must say that bushing is quite dashing.

  • 35 Wii homebrew hack – no game discs required - Hack a Day // Aug 12, 2011 at 8:25 am

    […] prevent homebrew from running. Piracy concerns aside, there is a legitimate Wii homebrew scene, and a  new, easy to use tool has been released for those looking to give it a […]

  • 36 scheffsblend // Aug 12, 2011 at 10:40 am

    @Segher, sure you can do whatever you like with the code, and since people have to submit their Wii MAC address, you could also do whatever you like with that. I hope this is not the case, but there is no way to be sure that these MAC addresses are not being stored for later use. Releasing the code would at offer some transparency in what is being done with these MAC addresses.

  • 37 DCX2 // Aug 12, 2011 at 11:31 am

    There is a common misconception that GPL means “source must be distributed with binary”. It actually means “you must provide the source if asked”. And by “provide”, this can be “snail mailed a CD”.

    Regarding the idea about messages being used to launch apps, if you want to keep them on “the day before” then the exploit could just over-write its own time-stamp before passing execution to the loader. Then you will only have to scroll back as far as the last time you used the app.

  • 38 How To Hack Your Wii For Homebrew In 5 Minutes | Lifehacker Australia // Aug 12, 2011 at 1:41 pm

    […] LetterBomb [Hack Mii] Tagged:gameshackshomebrewmedia centreswii […]

  • 39 interconnect // Aug 12, 2011 at 4:13 pm

    I’m not getting the message. Am I missing something? I put in the correct MAC address and system menu version. I’ve waited about 20 minutes now.

  • 40 sbadrinarayanan // Aug 13, 2011 at 7:08 am

    Really a blessing to have got this.
    I tried this hack and it worked for me.I was able to install the HBC using this hack.

    When i proceeded to install bootm,e i got a red FAILED(-1).

    Maybe i did not give much thought about messages indicating a SD card requirement during run time.

    I will again try and prepare a new SD card {after the exploit) gets executed.And then try to install bootmii and update this forum.

    I am from India and this is great for me.
    The nearest place where i could a Hack game is in Bangalore. And the games are sold at exorbitant prices of INR3500.

    To indicate what this means a normal WII game cost around INR500.

    Having this gameless exploit is a boon for me.

    Anyway only last week i have asked my friend in US to get a ssbb original game from Amazon.

    Thanks all for the great work.

  • 41 drmr // Aug 13, 2011 at 11:33 am

    @scheffsblend: Here’s some transparency about what is being done with these MAC addresses: Besides tailoring the necessary files to your Wii so you can use it in the first place: Nothing. Absolutely nothing at all. What could we possibly do with your MAC address? Print it out as a nice wall decoration?

  • 42 brunonmoreira // Aug 13, 2011 at 3:46 pm

    I can make the letterbomb with a brend-new Wii with factory 4.3U? Sorry bad english…

  • 43 M@T // Aug 13, 2011 at 4:07 pm

    Just tried it on my already-hacked Wii : works like a charm, that’s awesome. :D

  • 44 mattXPO // Aug 13, 2011 at 4:21 pm

    So do you guys plan on releasing a pc application for self-signing the exploit? This would be ideal since if sometime this site goes down, there is no way to use this exploit anymore.

    (btw, if MAC-addresses are so useless, why collect them in the first place?)

  • 45 carmenwii // Aug 13, 2011 at 5:10 pm

    One of the requirements is to be at system menu 4.3.

    I’m only at 4.1u.

    How do I get my Wii to 4.3 so that I can apply Letterbomb?

  • 46 Hack your Wii with LetterBomb for Homebrew – How to In Five Minutes | Home Brew Town // Aug 13, 2011 at 6:26 pm

    […] LetterBomb has Done the Hack, it will tell you to press 1 to Continue, press it, so that you will be able to […]

  • 47 Wii LetterBomb hack uses the Wii Message Board | SitePole.com // Aug 13, 2011 at 10:17 pm

    […] If you’re feeling hacky this morning you’ll find all the details here. […]

  • 48 Downloaded to Log Book. // Aug 13, 2011 at 11:26 pm

    Are you guys going to ‘sploit the N3DS? Nice, exploding letter, by the way…

  • 49 Downloaded to Log Book. // Aug 13, 2011 at 11:26 pm

    Are you guys going to ‘sploit the N3DS? Nice, exploding letter, by the way…

  • 50 morielo // Aug 14, 2011 at 12:28 am

    Hello. I had an awful problem. While I was ussing Letterbomb, the power ran out in my house, so the hacking was aborted. Buth when electricity returned the wii woulnd´t even turn the red light on. Help!! Is there some way to fis it? mainly because I have a borrowed disc inside the wii and I need to take it out.

  • 51 drmr // Aug 14, 2011 at 9:25 am

    @mattXPO: I know of no plans to make a standalone application. We all feel quite comfortable with the way the hack is currently distributed. If the need arises, we can modify the hack on the fly, and in the current form it cannot be sold by the plethora of scammers. Two good things. What happens with the hack when the site goes down will be tackled if and when that happens — which won’t be for a long, very long time. Worst case you still got three other game-based hacks you can use, remember?

    (BTW, what do you mean, “collecting MAC addresses?”)

  • 52 mattXPO // Aug 14, 2011 at 10:49 am

    @drmr: Touché. I completly forgot about these scam sites.

    (I mean aren’t the MAC addresses being logged? As far as I know it is actually possible to deny a specific MAC address access to a site, more specifically access to the hbc update server. I know there is no point in doing that but people are generally seing ghosts ^_^’

  • 53 carmenwii // Aug 14, 2011 at 11:21 am

    How do I update my Wii to 4.3 so that I can apply Letterbomb?

  • 54 Ark6476 // Aug 14, 2011 at 1:19 pm

    @mattXPO
    I don’t know the internals of how the letter bomb works, but I assume they need your mac address in order to trick your Wii into thinking it has a letter.

    It’s safe to take them at their word that they aren’t logging mac addresses, since doing so would be pointless. By the time your Wii’s request reaches the hbc update server, its mac address is no longer available. A mac address is only relevant within a subnetwork. http://en.wikipedia.org/wiki/Media_access_control

  • 55 SifJar // Aug 14, 2011 at 2:29 pm

    mattXPO: MAC addresses are not being collected. They are required to properly encrypt the message so that it can actually be read by the Wii it is exploiting. That’s why they must be entered into the site. I am fairly sure they are not being saved or stored in any way.

  • 56 drmr // Aug 14, 2011 at 2:39 pm

    @mattXPO: I don’t know if MAC addresses are loggd, but even if so, there would be no use for it, they aren’t even good for any statistics.

    Also, I don’t really get it. People download the hack and implicitly trust that it doesn’t do awful things to their console when they run it … But they draw the line when it comes to providing a useless number because we could abuse it?

  • 57 Arthur // Aug 14, 2011 at 5:44 pm

    @blasty: I followed all the instruction above, but it still not work. I just wonder if I did it right?
    – Should I connect the internet when I am installing it?
    – I found the letter, clicked it then press number 1.
    Then it showed “The test results are in:….” and I pressed Continue. Then it went to Main Menu:
    +Install The Homebrew Channel
    +BootMii..
    View Copyright
    +Exit
    What should I do from this point?
    Thanks.

  • 58 |works // Aug 14, 2011 at 11:58 pm

    drmr: That is a good point, the MAC address will almost never make it outside of the LAN, so it could only be checked against a Wii that someone physically had in front of them, or has the ability to execute arbitrary on.

    Worst case scenario, if Nintendo or a game author got a hold of the list of MAC addresses that LetterBombs were created for, they would still never know which useres followed through with the installation, or if the user even entered the MAC address themselves. (Since MAC addresses are created sequentially, anyone could easily guess another Wii’s MAC address.)

    As far as trusting Team Twiizers, the Homebrew Channel logs into their servers and checks for updates, so they already know a lot more information about you than your MAC address will give away.

    Sincerely,
    00:17:AB:47:4D:B9

  • 59 sbadrinarayanan // Aug 15, 2011 at 4:25 am

    As far as trusting Team Twiizers – I trust them.

    Very Sincerely,
    8c-56-c5-ae-4d-d8

  • 60 blasty // Aug 15, 2011 at 5:06 am

    To everybody asking how to update to 4.3 .. just use Nintendo’s update functionality (can be accessed from the settings screen as far as I remember, or just go through a network connection test again and it will ask you if you want to update). This method is still safe, _for now_. ;-)

    @martijnvaandering Should work. I’ve personally tested it on black wii running 4.3E .. did you mod your wii in the past? Anything funky done to it?

  • 61 Arthur // Aug 15, 2011 at 7:01 am

    @blasty: Yes, I did mod my wii. I have tried your above instruction, but it did not work. My wii is 4.3U. Could you advice how to do? Thanks.

  • 62 bigdave // Aug 15, 2011 at 7:25 am

    I loaded the homebrew channel and all i see is bubbles??? Please help I’m running 4.3u

  • 63 blasty // Aug 15, 2011 at 8:07 am

    @bigdave That’s intended behavior. Read up on what ‘The Homebrew Channel’ actually is. (This comment thread is not the right place to discuss this)

    @Arthur All I think of at this point is that you selected the wrong region when generating the ZIP file. But if you modded your wii before, and installed any “dodgy” stuff that we normally don’t recommend (Hacked IOS’s or any other warez related utilities) I’m afraid there’s nothing much we can do. Our exploits/installers are aimed to be used on virgin/clean wii’s, they might work fine in some situations .. but there’s no way we can support the myriad of weird/botched setups, sorry.

  • 64 Arthur // Aug 15, 2011 at 11:03 am

    @blasty: after installing homebrew channel and bootmii, i exited then it showed only bubbles as bigdave mentioned above. at the bottom left of the screen, it said “the homebrew channel”. i thought something were being downloaded, i just left it like that for few hours but nothing happened. Could you advice what should i do? Many thanks.

  • 65 winmaster // Aug 15, 2011 at 12:38 pm

    @morielo

    Why did your power go out? Sounds like something got fried. AFIK, no homebrew can damage your Wii that way.

    @Arthur

    You need to put applications on your SD card. The Homebrew Channel is only a loader.

  • 66 Arthur // Aug 15, 2011 at 12:52 pm

    @winmaster: what applications do i need to put on my SD card? Please advise. Thanks.

  • 67 winmaster // Aug 16, 2011 at 8:53 am

    @Arthur

    Whatever applications you want. See here for a list:

    http://wiibrew.org/wiki/List_of_homebrew_applications

  • 68 mattXPO // Aug 16, 2011 at 9:10 am

    News about this exploit are all over the internet, even on gaming sites like gonintendo etc. Currently american Wii owners are frustrated because NoA won’t release Xenoblade Chronicles for their region and thus many are considering to homebrew their Wii and import the game.

    I’m curious how many times LetterBomb has been downloaded so far. With that being said, do you guys plan to release a download statistic for this? :)

  • 69 carmenwii // Aug 16, 2011 at 11:54 pm

    Help, I used Letterbomb and installed the homebrew channel. However, I exited before installing bootmii.

    Can I just rerun the installer to get bootmii installed or is there another way that I should proceed?

    Thank you

  • 70 winmaster // Aug 17, 2011 at 10:04 am

    @carmenwii

    Yes, just run the installer again.

  • 71 carmenwii // Aug 17, 2011 at 11:10 pm

    Thank you Winmaster. I’ve got the Homebrew channel and bootmii. I think it is installed as boot2 and iOS.

    I’m very new to this and am wondering what guide would you recommend so that I can hook up a 500GB external hard drive to the Wii.

    I have a few backup games on my XP computer in .ISO format.

    Thank you

  • 72 winmaster // Aug 18, 2011 at 9:34 am

    @carmenwii

    Piracy and/or “backups” are not supported on HackMii and associated websites.

  • 73 LaChupaCabra // Aug 18, 2011 at 9:52 pm

    so, I cant get this to work. I selected my region 4.3u, and put in my MAC address. Downloaded the file to my mac, it unzipped. I copied the “LetterBomb” folder to my sd card. Put it in my wii. And I see nothing in the message board, I looked all over, went days forwards and back, even months. Nothing.

    I have had my wii modded for years since the first zelda hack before updating to 4.3. So I have a bunch of HB apps and channels on the system and sd card, but they all don’t really work anymore since I updated obviously.

    So I put a new sd card in my wii with no files on it, to “format” it. Then put the letter bomb on that sd card. Still, nothing showed up. I double checked my mac address, and downloaded a new zipped file, and tried it on the fresh sd card again, and I see no red envelope anywhere still.

    Do I need to unplug the hdd to the system and any possible memory cards like older hacks?
    Do I need delete all the old hb stuff?
    Anyone else in a similar situation get this to work?

    Any ideas?

    thanks

  • 74 LaChupaCabra // Aug 20, 2011 at 7:45 pm

    Got it to work, but the installation instructions should be a little clearer. The instructions say to just unzip the file into the sd card. That it is all ready. But at least on a mac, when you unzip the file, everything is in a “letterbomb” folder. You have to copy the files out of that folder and put them into the sd. You cant just copy the whole folder to the root. otherwise nothing shows up in the message board.

    I had to remember this from previous hacking, but I was just trying to follow the posted instructions, first.

    Also if you have already have a ‘private’ folder on the sd card, not sure if you are supposed to replace the whole original ‘private’ folder with the new letterbomb ‘private’ folder or not.

  • 75 blasty // Aug 21, 2011 at 2:02 am

    @LaChupaCabra That sounds like an issue with your unarchiver/unzip utility — our archive does NOT contain a folder called ‘letterbomb’.

  • 76 marcan // Aug 21, 2011 at 3:08 am

    If you already have a ‘private’ folder, you can either move it out of the way temporarily or merge the LetterBomb contents with it. Most commandline unzip tools will do the latter by default, but graphical stuff can complain/ask in various ways when you attempt to unzip a folder that already exists. If in doubt, just temporarily rename the existing ‘private’ folder to something else.

  • 77 gioseb // Aug 26, 2011 at 8:11 am

    a question: after “liberating” my Wii, will i be still able to run my previous games (FIFA, Nintendo sport gmaes).. etc?

  • 78 capncrooked // Aug 27, 2011 at 11:02 pm

    Alright, so I had success loading the letterbomb, and have both the Homebrew Channel and BootMii installed.

    I can load the options menu on Homebrew, but when I select to load BootMii, the system doesn’t do anything, and my Wiimote is disabled. Attempting to turn the Wiimote back on just makes the 1/2 player buttons flash, without any other indication of working. Only way to get back to normal is to reboot the wii.

    Any ideas?

  • 79 capncrooked // Aug 27, 2011 at 11:08 pm

    Disregard that! I read that it can only be used with a GC controller.

    Thanks, you guys, seriously, for coming out with something that makes the process of modifying hardware we rightfully own so much easier.

    I really appreciate it!

  • 80 garybracket // Oct 14, 2011 at 3:28 pm

    Just a heads up for everyone who is having problems with this method that aren’t getting the message..

    99% of the time it’s because your Nintendo Wii’s Time/Date are set wrong, even if you think it’s right, check anyway. That is all.

  • 81 Isle // Oct 29, 2011 at 10:56 am

    Hey, I don’t need the entire source code, but it would be awsome if you released some of it, like how you got the custom letter image and how we can make our own text inside the letters.
    Also, any work on getting the 3ds hack3d?

  • 82 Douggieboy // Nov 4, 2011 at 9:41 pm

    This download hangs my Wii. I’ve followed the instructions precisely, and on reboot the system detects the SD card, but can’t find the elf file. It searches twice, and then says boot sequence cannot complete, and the last line at the bottom says system hanged. Removing the SD card returns all to normal, but the homebrew channel is not installed. the power button doesn’t shut it off, so the only way to get the system back is to unplug the power cord from the wall [cold boot.]

    The letterbomb email in “today” appears to work fine. It is when I click on that to open that the Wii hangs up.

    What’s wrong?

  • 83 D337z // Dec 29, 2011 at 3:38 am

    There seems to be a problem with older MAC addresses of the older Wii consoles that were originally around the time of firmware version 3.2
    The one I’m working on in particular starts with 00:1A:E4.
    I’m getting the “The exploit will only work if you enter your Wii’s MAC address” error with a valid Wii MAC address.

  • 84 tueidj // Dec 29, 2011 at 6:33 pm

    @D337z That doesn’t seem right, it’s not one of Nintendo’s registered prefixes (see http://www.coffer.com/mac_find/?string=nintendo )

  • 85 D337z // Dec 30, 2011 at 4:59 pm

    I don’t care what’s in the database. The database is wrong. I’m looking right at the MAC address and its prefix is 00:1A:E4. It can’t be misread easily as it’s in hexcode.

  • 86 D337z // Dec 30, 2011 at 5:13 pm

    If you google the error, you’ll find more people with the same problem. I don’t think it should be dependent on a database to be honest. It only causes more problems than it solves.

  • 87 tueidj // Dec 30, 2011 at 6:45 pm

    Googling for “letterbomb 00:1a:e4″ brings up nothing but this page. Post a screenshot and maybe then I’ll believe you.
    If the validity check on the MAC wasn’t done, there would be a lot more people reporting that the magic letter wasn’t showing up on their wiis because they entered the MAC incorrectly.

  • 88 D337z // Dec 30, 2011 at 7:32 pm

    I did that too thinking it to be the first thing to check. Then I googled the error I received itself and found “Please Help!!!! Letterbomb not working!!!” in which a few other people were having similar issues. Now, I’m not claiming that this Wii isn’t a unique screw-up somehow, but it’s definitely 00:1A:E4:AF:xx:xx. And I can’t seem to post links.

  • 89 D337z // Dec 31, 2011 at 3:13 pm

    In other words, I can’t post a screenshot. If you have some method of private messaging or something of that nature, I would be happy to send you a picture of the weird MAC address of this early Wii.
    Also, you may notice that the company that once owned the MAC address changed names which would cause it to become a new company entirely. I believe what may have happened was that Nintendo picked-up the prefix afterward. But I can’t say for certain.

  • 90 wiisixtyfour // Dec 31, 2011 at 8:14 pm

    @D337z
    You can sign up on the WiiBrew forums to discuss it: here
    Or you can try using html to post the link like i just did.

  • 91 D337z // Jan 1, 2012 at 9:32 pm

    Well, since Wiibrew’s PM system is down, the whole site is SQL based without any encryption what-so-ever and it would be self-defeating to post a public un-altered image (black-out the last numbers of the MAC), heck with it. I’ll just ask if you could toss together a zip for a US 00:1A:E4:AF:07:53 for me and take my chances. Please?
    And regardless of HTML code or not, the moment I type a website, it blocks my post.

  • 92 D337z // Jan 2, 2012 at 7:54 pm

    Could you, perhaps, add an “I’ve verified my MAC address is accurate” checkbox to the page just in case anything that could go wrong did? I’m sorry I’ve been a jerk lately. I don’t like jumping through hoops.

  • 93 D337z // Jan 4, 2012 at 2:52 am

    Is there any way around the MAC address prefix check in case of strange, unforeseen circumstances? Maybe I could download the original script and change a false to true or something?

  • 94 rod ramsey // Jan 4, 2012 at 4:51 am

    I commend you for your great work. I used the Letterbomb and it worked like a charm. I would like to save my original games and use a USB HDD with the wii. Please advise what I should do next…. Thank you

  • 95 jrcolonial98 // Jan 4, 2012 at 5:41 pm

    Another exploit?!?… Nintendo must be horrible programmers.

  • 96 D337z // Jan 4, 2012 at 7:22 pm

    Actually, I figure they either had to go with the MAC address or the unique Wii ID used with e-mail (most likely another exploitable method). But yeah, let’s not talk about that tid-bit yet as it requires specialized software to craft the e-mail to be sent. This SD card method works a lot easier though there are a few prefixes left out of the database.

  • 97 jaks // Feb 2, 2012 at 5:00 pm

    Do not know if I should ask this here.
    I have a Nintendo Wii with 4.3U firmware. To run the HackMii Installer
    I use the Letterbomb exploit. HackMii after the start and press 1, displays the following message:

    “This installer can NOT continue!

    There is no known vulnerable IOS installed on this Wii.
    Please note that we will not use a fakesigned IOS due to
    security reasons.”

    According to I have understood, is that no master in IOS you can use the Installer HackMii (IOS34, 58 or 61). Because of this, I installed these IOS, and, according to the SYSCHECK, these IOS are original. Then I tried using other versions of HackMii Installer, but continued to occur in all the same.
    In the file installer.log say this, that attracts my attention:
    “Launching IOS 58 for the installer …

    Launched IOS …

    IOS versions: Installer: 58, HBC: 58

    Preparations starting

    device id: NG020bdff5

    something weird happend (406)

    Preparations done!

    This installer Can not … ”

    It’s like I started well, with the IOS 58, but then comes this error.

    Sorry, but I speak Spanish and I’m using Google Translate

  • 98 google.com/accounts/o8… // Feb 6, 2012 at 1:05 am

    Brilliant! Worked perfectly on my 4.3E. No need for Lego Batman. :P

  • 99 michelinok // Feb 11, 2012 at 12:54 am

    Well, it doesn’t work for me…
    it won’t accept my mac address…
    it’s 0e:0c:7f:xx:xx:xx (of course, not xx:xx:xx :P)

    Can someone help me?

  • 100 morj2025 // Feb 20, 2012 at 7:46 pm

    Hello everybody, i just bought a Wii (model RVL-101 (USA)) running on 4.3U. Using the letterbomb, I unzip the file on the root of my SD card and when i put it in my Wii, nothing shows up in my message box. I tried again and double checked my Mac adress and it won’t work at all…

    Can somebody help me?

  • 101 hacker331 // Mar 1, 2012 at 11:17 am

    i know morj2025 mine doesn’t show up either, maybe they fixed it?

  • 102 tueidj // Mar 1, 2012 at 11:18 pm

    morj2025: Make sure the wii’s date is set correctly.

  • 103 D337z // Mar 9, 2012 at 11:20 am

    @Michelinok: Do you have an older Wii? Like one that originally shipped with the Vers 2.x system menu?

  • 104 D337z // Mar 15, 2012 at 1:18 am

    I want to note there there has been an update that runs even after 4.3 system menu is installed. I believe it MAY block this exploit. Not certain, but the exploit doesn’t appear to work on a LU75 I’m working on.

  • 105 tueidj // Mar 15, 2012 at 6:27 am

    There have been no updates since September 2010.

  • 106 Legion6789 // Mar 17, 2012 at 4:35 pm

    Is this mac address issue ever going to be resolved? Is there a downloadable program that replicates what the website does?

  • 107 marcan // Mar 18, 2012 at 5:35 pm

    What MAC address issue? The website accepts all MAC OUIs currently assigned to Nintendo.

  • 108 11rcombs // Apr 8, 2012 at 6:02 pm

    Does this pack HBC 1.1.0 now? If not, could that be updated for convenience?

  • 109 D337z // May 1, 2012 at 11:20 pm

    Legion6789, try using WilBrand via ModMii. And marcan, though true that it does accept all MAC prefixes ASSIGNED to Nintendo, that is not the same as accepting all MAC prefixes that Nintendo uses. You see, when a company has more MAC addresses available than they need for a specific prefix, they may allow other companies to utilize the rest. It would appear that some early Wii systems took advantage of this and utilized a prefix or two that was listed for another company.

  • 110 tootiki // May 7, 2012 at 5:12 am

    Like morj2025, I have tried this but not seen a messag on the message board. My date and time are correct, though I’m using the Wii in a different time zone than when purchased. Will that make a difference?
    If not, how can I get this to work?

  • 111 zamber // Jul 20, 2012 at 3:09 pm

    I had HBC and daughter crashed it by clicking update. Do I need to get old HBC stuff off the wii before I start the LetterBomb process?

  • 112 fabiomcvnha // Aug 5, 2012 at 7:20 am

    O página http://please.hackmii.com

    está fora do ar. alguem sabe quando vai voltar ou se há outro site?

  • 113 Speed // Aug 5, 2012 at 10:34 am

    The please.hackmii.com site is down. I tried generating the files by pressing the blue (left) button, then the entire site simply went down and it’s inaccessible since then…

  • 114 samingtel // Aug 5, 2012 at 4:09 pm

    http://please.hackmii.com Down :/

  • 115 Ben // Aug 6, 2012 at 8:34 pm

    Yes.. website appears down. Wonder when they will fix this issue. Please admins look into the issue. Thanks!

  • 116 eminit // Aug 7, 2012 at 11:04 am

    Same problem as “Speed” I have been trying to go to the site since Aug 3rd and it has been down. Any news when it will be up?

  • 117 marcan // Aug 7, 2012 at 11:22 am

    Guys, calm down. We know it’s down. Shit happens, hardware dies. It’ll be back soon.

  • 118 mukram // Dec 5, 2012 at 5:20 pm

    I tried the letterbomb a few times and I can’t seem to to get it to work. The message is not coming up in the letter box. I used a san disk 4g do I need a 2g please help me.

  • 119 Artlover // Dec 7, 2012 at 9:49 am

    Regarding mac addresses. The simple fact is unless these guys are in contact with Nintendo techs and have been given a white list of MAC addresses being used by them, then they do not know what MAC addresses Nintendo is using.

    Sites like these:
    http://www.coffer.com/mac_find/
    http://standards.ieee.org/develop/regauth/oui/public.html
    Are NOT complete or definitive, and were never intended to be. These lists exist as a courtesy, with no guarantees, for people hoping to find information on their queries. These lists only contain publicly listed and known at the time OUI’s that have been entered into the publicly accessible database. They do not include hidden OUI’s (which all companies can request if they want), OUI’s that just haven’t been entered in the public DB yet, or OUI’s still in the pipeline of being processed.

    That first link (one marcan posted) hasn’t been updated in nearly 3 years shows only 30 listings for Nintendo. The second list shows 43. Neither list is complete. Half the network gear I have in my house (some of it old, some of it new) doesn’t show up on either of those lists. I’m talking Netgear, Linksys, Cisco, TPLink. So yeah, just because a MAC don’t appear in a public list somewhere doesn’t mean it’s not in use.

    There is no reason why they should be trying to protect the users from themselves by limiting what mac addresses can be entered. It serves no purpose because it won’t stop anyone from entering one of the last 3 pairs wrong anyways. So for all their efforts, it won’t stop people from entering a mac that won’t work for them. ALL it does is prevents many WII owners from not being able to use this exploit at all because these guys won’t accept Nintendo is using other MAC’s besides what is on these public lists.

  • 120 Artlover // Dec 7, 2012 at 9:50 am

    That said:

    Google “w11modder”.

    Standalone tool for PC’s that accepts ANY MAC address and generates a mailbomb package accordingly.

  • 121 LetterBomb (09-08-2011) (Wii misc) - News - Wii - PDRoms - Homebrew for you! // Dec 22, 2012 at 5:42 pm

    […] More information here: http://hackmii.com/2011/08/letterbomb/ […]

  • 122 skittletron // Jan 1, 2013 at 6:10 pm

    Is there ever going to be a support for LMB-RVL-WR/Z-C4 /RVL-036 remotes?…finding a old wii remote is harder than it looks…..lol… Hopefully somebody can make my 2013 year start a happy one….

  • 123 fockerme // Jan 1, 2013 at 9:05 pm

    Can’t get the .zip from site, getting the following error: “The exploit will only work if you enter your Wii’s MAC address.” Just bought new Black Wii and verified MAC is owned by Nintendo. Can the MAC DB be updated? :D

  • 124 gravenfire45 // Dec 6, 2013 at 11:35 am

    does an adapter count as a sd card???

  • 125 thiz // Jan 15, 2014 at 2:13 pm

    Should you have an error (not seeing the red bomb), make sure the date and time is rightly set on your Wii… I hadn’t updated mine correctly, so obviously I didn’t see the red bomb letter… After configuring the date on the Wii, I found the letter immediately on the previous day as announced. From there everything worked like a charm.
    thanks !

  • 126 acrain92 // Oct 2, 2014 at 7:35 am

    i finally decide to soft-mod my wii cause my nes crapped out on me and now the letterbomb site is down lol

You must log in to post a comment.