HackMii

binary, source code

Extremely short instructions: put this savegame on your Wii (if you have one on there already that you want to keep, back it up first!), start the game, walk to the “art room” (find some walkthrough on the intertubes if you cannot find it), look at the second character, enjoy!

Kudos to “roto” for finding the original buffer overflow, and many thanks for doing lots of testing!

UPDATE: I uploaded a new zip file that fixes a packaging error and clarifies the copyright and licensing. People who are “re-hosting” this file should update, read the license, and reconsider whether they really want to host this binary themselves; whoever distributes the binary needs to distribute the source code as well (loosely speaking, read the license for the exact terms!)

Just don’t, and simply link to us, k? Best for everyone

As we probe deeper into the DSi, we come across some neat stuff. Scanlime got a new FPGA board from Sparkfun, which gives him more GPIOs and the ability to run them at the 1.8v necessary to properly talk to the RAM.

Scanlime's debugging setup with new FPGA

Sorting through the data we get from this setup is still a considerable challenge. Here’s a trace taken while the video camera is actually capturing video:

http://dl.getdropbox.com/u/1926728/dsi/camera-trace-20090914.raw.bz2

There’s some code for decoding this trace format in scanlime’s svn repo: http://svn.navi.cx/misc/trunk/nds/dsi/ram-tracer/decoder/

If you’d like to play along, see if you can distinguish between:

• Instruction fetches from RAM
• Reads/writes to RAM buffers (statically or dynamically allocated) by code running on either processor
• Reads/writes to control flags, used for e.g. synchronization between the ARM7 and ARM9
• DMA writes from the camera hardware to RAM of the video data

The video data makes up the vast majority of the data in this dump; if you’re working on homebrew code to talk to the camera, this might be helpful. For the rest of you — can you make a tool to visualize the data flows in these traces, or a tool to decode the video frames in scanlime’s dump?

There’s also a hidden message in the video =)

Some time has gone by, and we’ve made a little progress on the DSi — at least, enough for some people to notice — so maybe I should write a little bit about it.

I personally haven’t had much luck with my DSi.  I tried to dump the flash on it, and managed to blow a fuse in the process (it’s hard to keep that battery aligned with the case removed…).  I can’t run any of the savegame hacks, because there are no DSi-mode cartridge-based games for the Japanese DSi yet.  I decided to get a bit more aggressive and see if we could sniff the RAM:

bushing's DSi with RAM breakout

[Read more →]