System calls get_kernel_flavor and get_unk_flavor do not check to ensure that the pointers passed are appropriate to write to they will write to any addresses. No sanity checks on arguments passed to get_kernel_flavor and get_unk_flavor Modifying the System Menu or System Menu IOS does not brick the system, and a custom MIOS can be loaded this way. Unlike boot1, boot2 does not check the signature of titles it launches, which means they can be freely modified. However, when boot2 is replaced through the signing bug, HW_BOOT0 is not yet cleared. When the Wii boots, boot2 clears HW_BOOT0 to unmap boot0 and prevent it from being dumped. GameCube drivechips can be slightly modified for the Wii.īoot1 verifies the signature of boot2 before booting it, however, the signing bug is present, allowing a fake boot2 to be loaded.Ī custom bootloader can be installed, such as BootMii. Instead of removing it from the Wii, Nintendo simply used a different type of port, which means Broadway commands can still be sent from the outside. The GameCube's disc drive had an unused port on the disc drive that allowed commands to be sent to the drive as if they were coming from the Gekko. Loading homebrew discs on Wii without illegal equipment.ĭisc drive UTS port was not completely blocked This was not fixed with the Wii for either GameCube or Wii discs MIOS and the System Menu do the same null byte check, which makes it still accept unauthorized discs. This was done by checking for null bytes in that region, a result of the dents, and was easily bypassed by just overwriting those areas of the disc with null bytes. GameCube discs are not signed instead, they have 6 dents in the BCA region that are carefully checked by the GameCube IPL.
No mechanism to verify markings in disc BCA by Homebrew Channel), homebrew can be used to read DVDs. However, when the Hollywood register ahbprot is disabled (e.g. This support was removed in later revisions of the disc drive. While the Wii was initially meant to support DVD playback, it was scrapped to avoid needing to pay licensing fees. However, Nintendo forgot to make this register clear-only, so simply re-enabling it allows boot0 to be dumped from 0xFFFE0000 or 0xFFFF0000 in memory.īoot0 can be obtained on consoles that do not support custom boot2 installations.ĭVD-Video support is inadequately protected To prevent boot0 from being dumped, boot2 clears register HW_BOOT0 that allows the boot0 ROM to be read.
0 kommentar(er)
