HackMii

A faithful HackMii reader (zeldarock) spent some time with AnyTitle Deleter and tried to clean everything odd off his Wii, and used the HackMii Installer to uninstall the HBC and BootMii/boot2.  He then sent his Wii into Nintendo (of America) to try to get them to repair a noisy drive; the warranty had expired, and he just wanted to pay them to repair the drive.

After they received the Wii, they wrote him back and said that because he had unauthorized software installed (something they could not fix themselves — but more on this later), it would cost $200 for them to do any repair.  He had them just send him back the Wii, they would not work on it. They sent him back his Wii, and then he reinstalled BootMii/boot2 and dumped the NAND and sent it to us to figure out what he had missed and anything else we could gain from the image.

I have a few theories as to what they detected, based on what things he did not manage to delete — and for a while, that’s all we had to go on, and it wasn’t going to make for a very interesting article.  However, several hours with 0xED and grep and xxd paid off, and I found some traces of the disc they ran to detect “Illegal software”.   Unfortunately, I was only able to find part of the data section of the main DOL of the disc, and not the code, so I don’t have actual screenshots to share — you’ll have to use your imagination this time.  (If anyone has sent a Wii in to Nintendo for repair in the past few months, and received the same Wii back — no refurbs! — I’d love to see a NAND dump, especially if you took one right after you received it back.  I may be able to reconstruct the rest of the disc.)

[Read more →]

Now that I’ve established some context, maybe this will make some more sense. The more games we have to try to run on our SPG/unSP emulator, the easier it will be to find and fix bugs, so when I had the opportunity to do so, I picked up a V.Smile Pocket on eBay that came with 11 cartridges, and I made some hardware to dump the cartridges.

There actually aren’t many strings in these cartridge images; mostly some library ID strings like “TVSYS TVLCD1.0” (apparently the internal name for this product), “OursLib V1.2.25 generated by TV3, 2005-05-24” and build dates. This makes the few strings that do exist jump right out. One of the games (Elmo’s World – Elmo’s Big Discoveries) has a list of “bad words”, which presumably is in there to keep you from entering them in as your character name. (The Wii’s System Menu had a similar list, if I recall correctly, but we never actually found a place where it was used.) It’s a fairly short list of 101 4-letter words (in alphabetical order), and many of them are quite appropriately forbidden for a toddler’s video game. Some are pretty tame — here’s all the ones that begin with the letter ‘b’:

b.s. bare barf boff bong bonk boob bras brat bums burp bust butt

Well, whatever, it’s just some silly game, right? It might just be part of some standard library they use. (Nevermind the fact that there’s nothing like it in 9 of the other games that I looked at.)
[Read more →]

Every once in a while, you stumble upon something that nobody else seems to have paid much attention to. This all started with my investigation into a glorious product named the Vii.

I can’t really give a great justification as to why this thing was so damned interesting to me, but it seemed weird and quirky and nobody really knew much about it. I thought it might be fun to try to emulate awesome games such as “Fry Egg” on the real Wii, but didn’t really know where to begin — aside from getting my hands on one. When it finally arrived in the mail from China, I opened it up to find myself faced with a couple of epoxy blobs:

[Read more →]