Wii Взлом Wii

Lloyd Banks · 11 янв 2007

Ну а вообщем на Wii в дальнейшем я так понимаю планируються дисули двухслойные как на 360 ?

xyz · 11 янв 2007

образ зельды весит 4.18гб...

Lloyd Banks · 11 янв 2007

спасибо xyz удостоверил а то мне что-то не верилось в гиговый вес 70 часовой зельды...

xyz · 11 янв 2007

нее, я про вии версию, насчет кубовской - я хз. может итак весит...

VaaN · 11 янв 2007

Образ Wii это полный dump диска поэтому и весит 4.18 (как я и сказал), а для куба образ снимается только с нужных файлов, так что реальный вес игры 1.16гб (в архиве).

Лекс · 11 янв 2007

Lloyd Banks сказал(а):

Ну а вообщем на Wii в дальнейшем я так понимаю планируються дисули двухслойные как на 360 ?
Нажмите, чтобы раскрыть...

Совсем не обязательно. Скорее всего будут на обычных дисках.

AndraS · 11 янв 2007

да для вии 4.5 гига выше крыши

Lloyd Banks · 11 янв 2007

Тоесть там обычные диски DVD как на первом Xbox верно?

DeaD · 11 янв 2007

Lloyd Banks сказал(а): ↑

Тоесть там обычные диски DVD как на первом Xbox верно?
Нажмите, чтобы раскрыть...

Верно.

DevL · 22 янв 2007

все таки забавная ситуация - ни одного лоадера , а дампов уже немерянно, вопрос , зачем ?

Bahamut2k · 22 янв 2007

DevL сказал(а):

все таки забавная ситуация - ни одного лоадера , а дампов уже немерянно, вопрос , зачем ?
Нажмите, чтобы раскрыть...

Чисто ради спортивного интереса.

VaaN · 25 янв 2007

Вышла прога для соединения привода wii с PC, видимо взлом вопрос пары недель.

Wii DVD Drive Serial Tool
by Erant

Usage of the program:

The DVD Tool usage is fairly simple, to read from memory, type
./dvdtool -s <size here> -r <offset> <file>
So, if you wanted to read 0x40 bytes from 0x8000 (main memory start), you'd type
./dvdtool -s 0x40 -r 0x8000
The file argument is an optional argument for reading, if no valid file is specified,
the output is a formatted output to stdout. The -s argument is also an optional argument,
not specifying it will assume a default of 0x20 bytes.

To write to memory, you'd use a similar syntax

./dvdtool -s <size here> -w <offset> <file/array>

The only difference is the last argument, it can take a file or a formatted array.
In either case, the -s option is again optional, not specifying it will assume
the size of the array, or the size of the file.
An example to write an array to 0x8100:

./dvdtool -w 0x8100 "0xFF,0x0,0xFF,0x0" will write {0xFF,0x0,0xFF,0x0} to 0x8100.

The insert code command is slightly more complicated, you need a compiled and assembled
binary to insert. Code execution starts at 0x408000, which is in extra RAM. Code size limit
is estimated at roughly 8kb, so enough for pretty much anything. You need to pre-pend your code
with a NOP instruction, and append it with an 'RTS' instruction, to resume normal code execution.

An example of some code you could assemble and insert:

NOP
MOV 0xFF, D0
MOV 0x8000, A0
MOV D0, (A0)
RTS

This will write the value 0xFF to 0x8000. You can again check proper execution by performing a read operation.If the application returns a 'write error' after code injection, your code has crashed the interrupt thread of the DVD drive, and it'll need either a power cycle or reboot. Syntax of the code inject is easy enough,

./dvdtool -i code.bin

(A sample, compiled program called code.bin is included, it's source is also included. Run it, and check for 0xEA, 0xEA at 0x8001 for correct functioning).

Making the datacable

In order to make the datacable, you need only a few basic items. A DB-25 connector, two diodes, and some cable. Connect the diodes in reverse (so, PC ---|<--- Wii) to the DB-25 connector, to pins 1 and 14. Just connect some wires to pins 18 and 11, these will be the GND and output wires. The other two dioded wires are clock and input. Now, open your Wii, remove the DVD drive, and turn it over. Look for the following pattern near IC3001:
- 1 -
2 3 4
- 5 6

3 is SBO1 (Output)
4 is SBT1 (CLK)
6 is SBI1 (Input)

With the numbers being pads, and - being nothing. Now, solder the wire from pin 1 to pad 4 (CLK line). Pin 14 goes to pad 6, and pin 11 goes to pad 3. Just find a suitable place to attach the wire from pin 18, which is GND. (Placing the board so you can read the writing on IC3001, look at connector P3001, the rightmost pad is GND and the third from the right is GND). Check your solder connections with a multimeter, then close up your Wii, and issue the ./dvdtool -r 0x8000 command in root mode. If you see hexadecimal numbers, congratulations! If you don't, check the proper functioning of your cable, wether or not you're in root mode, and if the parport0 and ppdev drivers are properly installed.

dvdtool.conf

Contains only two things, the second line is the command write delay, the delay after a command is written, and should probably be left alone. The first is the bit read/write delay, the delay done after a bit is written or read. In standby mode (orange led), this is pretty safe at 50, but for ON mode (green led), should be set to 100 or higher, to avoid sync errors.

Debugging

If you're getting out of sync errors every now and again, make sure your Wii is in stand by mode (orange LED, higher transfer rates), or adjust the timing settings in dvdtool.conf, or try adding a 47pF capacitor to GND to your clock line. (At the Wii side). The code is also still fairly crude, so if you encounter any bugs, please give them to me.

Wii Disc Drive:

Chips:

IC1001 "[M]" "AN22023" "619P7002" (tqfp-48)
IC1002 "[M]" "41224" "616C5279" (probably a power switching / motor controller chip. - tqfp-65)
IC2001 "GC2-D1" "616P7300" (tqfp-144)
IC2003 "(underlined L) X9" "TDA" (6-pin package)
IC3001 Panasonic "Panasonic" "GC2R-D2A" "610U6MF7" (tqfp-100)

Ports:

P1001 Connects to laser/focus/read assembly
P1003 Connects to laser assembly movement motor
P1004 Connects to optical Disc detection subboard on "bottom" side
P2001 Connects to Wii motherboard Port P4 (via 32 pin flat cable)
P3001 Connects to Wii motherboard Port P8 (via 12-pin wire bundle cable)

Wii Mainboard Chips:

Chip listing:

U1: "(E)" "HOLLYWOOD" "(C)(M)'06Nintendo" "(ATI logo)" "(BroadOn logo)" "(NEC logo) JAPAN" "C10046F5-211-PN2-A" "0633KK01X" (video/IO chip, BGA/unknown 31x31mm)
U2: "(IBM logo)" "BROADWAY" "39X6735" "IBM9316" "BWYC-72914" "06340706V 14" "CANADA" (CPU, BGA/unknown 21x21mm)
U3: Samsung K4J52324QC-BC14 "SAMSUNG 631" "K4J52324QC-BC14" "EFEA75DX" (Memory!, BGA/unknown 14x11mm)
U3 (alternate): Quimonda "0638" "A" "HYB18H512321AFL14B" "HVV52176" (Memory chip, likely the same pinout and same/similar specs to the samsung chip)
U4: Sharp PQ070XH02Z "070XH02" "SHARP" "12H U6" (LDO voltage regulator, set at 1.8V - TO-263 package, 5 pins 10x8mm)
U5: "H8DU" (*tiny* 5-pin tsop-6 3x1.5mm)
U6: "AVE-RVL" "BU9055EKV" "629 145" (Audio/Video encoder/DAC tqfp-64 10x10mm)
U6 (alternate): "AVE-RVL A" "C8391" "0635EMM" (same package as previous chip)
U7: Mitsumi "616" "AMPAM" (Audio Amp, tsop-8 5x4mm)
U7 (alternate): No logo, "AMPAM" "6943" (same package as previous chip)
U8: MX "E062674-MG" "MX23L4005-24C1" "RTC-RVL A" "2S08802" (RTC, TSOP28 18x8mm)
U9: "JK0U" (Power-on-reset generator *tiny* 5-pin tsop-6 3x1.5mm)
U10: "JK0U" (Power-on-reset generator *tiny* 5-pin tsop-6 3x1.5mm)
U11:
U12:
U13:
U14: Samsung K9F4G08U0A "SAMSUNG 631" "K9F4G08U0A" "PCG1" "FHFL82GAU" (flash memory, tsop-48 18.5x12mm)
U14 (alternate): Hynix "KOR" KY27UF084G2M" "TPCB 647A" (flash memory, same package/pinout as samsung chip)
U15: Sanyo LV5043 "LV5043" "6SP0" (DC-DC Converter controller, ssop-30 10x5mm)
U16: Sanyo LV5043 "LV5043" "6SP0" (DC-DC Converter controller, ssop-30 10x5mm)
U17: Sanyo LV5043 "LV5043" "6SP0" (DC-DC Converter controller, ssop-30 10x5mm)
U18: "2901" "6M56" (tsop-14 5x4mm)
U19: Sharp PQ033DNA1ZPH "033DNA1" "SHARP" "H U7" (LDO regulator, 3.3V 1A, 4 pins 6x5mm)
U20:
U21:
U22: "H4" (*tiny* 5-pin tsop-6 3x1.5mm)

Ports:

P1 Gamecube memory cards port
P2 Rear fan power connector
P3 Disc slot LED port
P4 Disc drive port (see Wii console Disc Drive page)
P5 AV and "sensor bar" port
P6 Gamecube controller ports (all 4 of 'em)
P7 Battery port
P8 Disc drive port (see Wii console Disc Drive page)
P9 USB ports
P10 SD Card port. Marked "A0635D6"
P11 Power connector
P12 Bluetooth Daughtercard
P13 802.11 Wifi daughtercard

Crystals:

X1 "6373" "T 6276"
X1 (alternate) "27000" "K640Y"
X2 "32.768" "KDS0631" (32768Hz, RTC oscilator)
Нажмите, чтобы раскрыть...

Lloyd Banks · 26 янв 2007

Уря Vaan хорошие новости приносишь! респект

Mikolkin · 26 янв 2007

У меня американская Wii - притащили еще пару европейских и японских дисков - можно ли их запустить с помощью FreeLoader'a от ГеймКуба?

Есть ли вообще способы снятия региональных кодировок на ней?

VaaN · 26 янв 2007

Еще один фейк
http://www.youtube.com/watch?v=oceKNyg_g0o

Hitman666 · 26 янв 2007

http://gbatemp.net/index.php?showtopic=43162

-A- · 26 янв 2007

http://gbatemp.net/index.php?showtopic=43162
Нажмите, чтобы раскрыть...

Я так понял, что вышел чип от Ninja Team, которые известны созданием однослотовой флэшки для DS. Этот чип позволяет запускать точные копии игр от Wii. Но сохраняет региональные ограничения консоли. Короче, как с Xbox 360, только надо еще и чип ставить. Мужики с GBATemp будут тестировать его в понедельник...

Lloyd Banks · 26 янв 2007

http://www.futura-online.com/e-tien.../products_id/10527/name/wiinja+-+wii+modchip/

VaaN · 27 янв 2007

Похоже чип оказался реальным, и его уже можно купить. Говорят что скоро расковыряют программу чипа и можно будет прошивать привод wii самому.

Bahamut2k · 28 янв 2007

Я офигеваю, дорогие товарищи. И у Wii приводе дыра. Может, если покопаться, то и в прошлом поколении у всех можно найти дыры в их приводах...

В отличие от других участников рынка, Nintendo выгодно продавать Wii даже еслит на их приставки будут ставиться чипы.

Вход

Wii Взлом Wii

Lloyd Banks piu piu

xyz Well-Known Member

Lloyd Banks piu piu

xyz Well-Known Member

VaaN Stella Maris

Лекс РАЖДЁН, ШТОБ ЖРАТЬ

AndraS Well-Known Member

Lloyd Banks piu piu

DeaD -

DevL Well-Known Member

Bahamut2k shpongled

VaaN Stella Maris

Lloyd Banks piu piu

Mikolkin Well-Known Member

VaaN Stella Maris

Hitman666 Well-Known Member

-A- Well-Known Member

Lloyd Banks piu piu

VaaN Stella Maris

Bahamut2k shpongled

Вход

Wii Взлом Wii

Lloyd Banks piu piu

xyz Well-Known Member

Lloyd Banks piu piu

xyz Well-Known Member

VaaN Stella Maris

Лекс РАЖДЁН, ШТОБ ЖРАТЬ

AndraS Well-Known Member

Lloyd Banks piu piu

DeaD -

DevL Well-Known Member

Bahamut2k shpongled

VaaN Stella Maris

Lloyd Banks piu piu

Mikolkin Well-Known Member

VaaN Stella Maris

Hitman666 Well-Known Member

-A- Well-Known Member

Lloyd Banks piu piu

VaaN Stella Maris

Bahamut2k shpongled

Быстрый поиск