Neat copy protection scheme. Reminds me of the GC/Wii disk protection (also based on holes punched by a laser), but on read-write floppies. The obfuscation is similar to what we do for antitampering on The Homebrew Channel (but we go a bit further :P).https://www.youtube.com/watch?v=Qaq9vlfoGnA …
-
-
Under certain circumstances, HBC will show a scam warning screen and stop working. But it won't really: it lets you proceeed after one hour. Similarly, even in "crashy mode", you can get an app loaded some of the time.
Show this thread -
Basically we *hate hate hate* bricks. All of this protection is *also* to ensure the system is in a sane state for installation, so we know it'll work. We do many sanity checks too, *much* more paranoid than Nintendo's update code. We *never* want to be responsible for a brick.
Show this thread -
Switching gears, the BootMii boot2 update code contains a functional (not line-by-line) duplication of Nintendo's boot1 loader code, that it uses to confirm the exact layout and state of the existing boot2 installed on the Wii.pic.twitter.com/pUg93gyVwH
Show this thread -
We validate that the NAND has two valid, clean, working, hashed-OK, known version copies of boot2. Then we patch BootMii in (in RAM) and hash-check. We run write tests on empty boot2 blocks to ensure they are usable. Only then do we commit and write BootMii to empty blocks.pic.twitter.com/zhcU0L6uBT
Show this thread -
The installer is designed to use unused NAND blocks for the install, and, as the last step, writes a newer-generation blockmap that marks the original boot2 blocks as bad. Thus, there is zero failure window (you can power off at any time), and uninstallation = erasing blocks.pic.twitter.com/zbAI1zgivu
Show this thread -
Nintendo's boot2 update code is so terribad it writes the new bootloader before even verifying its signature (and leaves it clobbered if the sigcheck fails). Combined with a plaintext HTTP CDN, that leaves the TCP checksum as the only thing preventing a corrupted first copy.
Show this thread -
And since shit happens and the second copy could become corrupted, this is how Nintendo managed to brick a good fraction of Wiis, hacked or not, when they pushed a dummy version bump of boot2 as an attempt at uninstalling BootMii.
Show this thread -
To my knowledge, we have never bricked a Wii. Ever. With over 6 million users. The closest we came, there was a bug in the boot2 code with bad block handling. Since we'd checked that there was a working second copy, the person who hit it could still boot.
Show this thread -
Subsequent runs of the installer detected the bad state and refused to do anything. So we got a bug report, and no consoles were harmed.
Show this thread
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.