{"id":142,"date":"2008-01-30T20:45:27","date_gmt":"2008-01-30T11:45:27","guid":{"rendered":"http:\/\/nekokabu.s7.xrea.com\/blog\/2008\/01\/20080130204527.html"},"modified":"2020-05-11T02:02:24","modified_gmt":"2020-05-10T17:02:24","slug":"wii%e3%81%8c%e3%83%8f%e3%83%bc%e3%83%89%e7%9a%84%e3%81%ab%e3%83%8f%e3%83%83%e3%82%af%e3%81%95%e3%82%8c%e3%81%9f%e6%a8%a1%e6%a7%98","status":"publish","type":"post","link":"http:\/\/nekokabu.s7.xrea.com\/blog\/2008\/01\/20080130204527-142.html","title":{"rendered":"Wii\u304c\u30cf\u30fc\u30c9\u7684\u306b\u30cf\u30c3\u30af\u3055\u308c\u305f\u6a21\u69d8"},"content":{"rendered":"\n
\u30c4\u30a4\u30fc\u30c8<\/a><\/div>\n

\"wii_setup.jpg\"<\/a>
\n\u30c7\u30a3\u30b9\u30af\u30a4\u30e1\u30fc\u30b8\u306e\u5fa9\u53f7\u5316\u3001\u30bc\u30eb\u30c0\u306e\u30bb\u30fc\u30d6\u30c7\u30fc\u30bfExploit\u3068\u8a71\u984c\u304c\u7d76\u3048\u308b\u3053\u3068\u304c\u306a\u3044
\nWii\u306b\u3001\u3053\u3093\u3069\u306fGC\u306e\u30cf\u30c3\u30af\u3067\u6709\u540d\u306atmbinc\u6c0f\u304c\u3001Wii\u306e\u30cf\u30fc\u30c9\u30a6\u30a7\u30a2\u7684\u306a\u30cf\u30c3\u30af\u306b\u3088\u3063\u3066
\nWii\u3067\u81ea\u4f5c\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u3060\u3068\u767a\u8868\u3057\u307e\u3057\u305f\u3002<\/p>\n

  • debugmo.de \u00bb Wii hacked it!<\/a><\/li>\n


    \n

    \u30fbFirst thing which ever executes on the Wii is the \u201cboot0\u2033 code, which is probably stored inside the hollywood in a mask rom.
    \n\u30fbboot0 loads the first 0\u00d72F pages (\u201dboot1\u2033) from flash, decrypts them with a fixed aes key, calculates a SHA-1 hash (with some obscure bugs specialities, I still couldn\u2019t calculate it by hand), and checks that versus the expected values, read from some internal memory.
    \n\u30fbIf the hash bytes in the \u201cinternal memory\u201d is all-zero, the hash check is skipped. This is probably used for production, and maybe for devkits.
    \n\u30fbboot1 then searches a certain header in flash, where it extracts specific information where to find boot2.
    \n\u30fbAt that position, some certificate chain is checked, and finally the boot2 \u201ctmd\u201d is verified, and the hash extracted.
    \n\u30fbThe boot2 payload is load from flash, decrypted, and hash-checked (against the hash from the boot2 tmd).
    \n\u30fbboot2 will then load the firmware, or whatever. That\u2019s not my region of interest at the moment. \ud83d\ude42
    \n\u9069\u5f53\u306a\u8a33\uff08\u8aa4\u8a33\u3042\u308a\uff09
    \n\u307e\u305a\u6700\u521d\u306bWii\u306eGPU\u300chollywood \u300d\u306b\u5185\u8535\u3055\u308c\u305f\u201dboot0\u201d\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u3002
    \nboot0\u306f\u5185\u81d3\u30d5\u30e9\u30c3\u30b7\u30e5\u306e\u6700\u521d\u306e0x2F\u30da\u30fc\u30b8\u306eboot1\u3092\u8aad\u307f\u8fbc\u3093\u3067AES\u30ad\u30fc\u3092\u4f7f\u3063\u3066
    \n\u305d\u308c\u3092\u5fa9\u53f7\u5316\u3001SHA-1\u30cf\u30c3\u30b7\u30e5\u3092\u8a08\u7b97\u3057\u305d\u308c\u3089\u3092\u30c1\u30a7\u30c3\u30af\u3001\u3044\u304f\u3064\u304b\u306e\u5024\u3092\u30e1\u30e2\u30ea\u306b\u8aad\u307f\u8fbc\u3080\u3002
    \n\u3082\u3057\u5185\u90e8\u30e1\u30e2\u30ea\u306b\u3042\u308b\u30cf\u30c3\u30b7\u30e5\u306e\u5024\u304c\u3059\u3079\u30660\u3067\u3042\u308c\u3070\u30c1\u30a7\u30c3\u30af\u3092\u30b9\u30ad\u30c3\u30d7\u3059\u308b\u3002
    \n\u305f\u3076\u3093\u958b\u767a\u6a5f\u3067\u4f7f\u308f\u308c\u3066\u3044\u308b\u306e\u3067\u306f\u3002
    \nboot1\u306fboot2\u304c\u3069\u3053\u306b\u3042\u308b\u304b\u306b\u3064\u3044\u3066\u306e\u60c5\u5831\u3092\u30d5\u30e9\u30c3\u30b7\u30e5\u306e\u30d8\u30c3\u30c0\u30fc\u304b\u3089\u691c\u7d22\u3059\u308b\u3002
    \n\u3053\u3053\u3067\u3044\u304f\u3064\u304b\u306e\u8a3c\u660e\u304c\u30c1\u30a7\u30c3\u30af\u3055\u308c\u3001\u6700\u7d42\u7684\u306bboot2\u306e\u201dtmd\u201d\u306f\u30d9\u30ea\u30d5\u30a1\u30a4\u3055\u308c
    \n\u30cf\u30c3\u30b7\u30e5\u304c\u62bd\u51fa\u3055\u308c\u308b\u3002
    \nboot2\u306e\u30da\u30a4\u30ed\u30fc\u30c9(\u5b9f\u30c7\u30fc\u30bf\u90e8)\u306f\u30d5\u30e9\u30c3\u30b7\u30e5\u304b\u3089\u8aad\u307f\u8fbc\u307e\u308c\u3001\u5fa9\u53f7\u5316\u3055\u308c\u3001
    \n\u30cf\u30c3\u30b7\u30e5\u30c1\u30a7\u30c3\u30af\u3055\u308c\u308b\u3002
    \nboot2\u306f\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u3068\u304b\u305f\u3076\u3093\u306a\u3093\u3067\u3082\u8aad\u307f\u8fbc\u3080\u3002
    \n\u3057\u304b\u3057\u305d\u308c\u306f\u79c1\u306e\u77e5\u308b\u3068\u3053\u308d\u3067\u306f\u306a\u3044\uff3e\uff3e
    \n<\/BLOCKQUOTE>
    \n\u3061\u3083\u3093\u3068\u8aad\u3093\u3067\u306a\u3044\u3051\u3069boot1\u306e\u90e8\u5206\u306f\u30d0\u30b0\u3060\u3089\u3051\u307f\u305f\u3044\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

    \u30c7\u30a3\u30b9\u30af\u30a4\u30e1\u30fc\u30b8\u306e\u5fa9\u53f7\u5316\u3001\u30bc\u30eb\u30c0\u306e\u30bb\u30fc\u30d6\u30c7\u30fc\u30bfExploit\u3068\u8a71\u984c\u304c\u7d76\u3048\u308b\u3053\u3068\u304c\u306a\u3044 Wii\u306b\u3001\u3053\u3093\u3069\u306fGC\u306e\u30cf\u30c3\u30af\u3067\u6709\u540d\u306atmbinc\u6c0f\u304c\u3001Wii\u306e\u30cf\u30fc\u30c9\u30a6\u30a7\u30a2\u7684\u306a\u30cf\u30c3\u30af\u306b\u3088\u3063\u3066 Wii\u3067\u81ea\u4f5c\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd … \u7d9a\u304d\u3092\u8aad\u3080 Wii\u304c\u30cf\u30fc\u30c9\u7684\u306b\u30cf\u30c3\u30af\u3055\u308c\u305f\u6a21\u69d8<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":607,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-142","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wii"],"_links":{"self":[{"href":"http:\/\/nekokabu.s7.xrea.com\/blog\/wp-json\/wp\/v2\/posts\/142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/nekokabu.s7.xrea.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/nekokabu.s7.xrea.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/nekokabu.s7.xrea.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/nekokabu.s7.xrea.com\/blog\/wp-json\/wp\/v2\/comments?post=142"}],"version-history":[{"count":0,"href":"http:\/\/nekokabu.s7.xrea.com\/blog\/wp-json\/wp\/v2\/posts\/142\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/nekokabu.s7.xrea.com\/blog\/wp-json\/wp\/v2\/media\/607"}],"wp:attachment":[{"href":"http:\/\/nekokabu.s7.xrea.com\/blog\/wp-json\/wp\/v2\/media?parent=142"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/nekokabu.s7.xrea.com\/blog\/wp-json\/wp\/v2\/categories?post=142"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/nekokabu.s7.xrea.com\/blog\/wp-json\/wp\/v2\/tags?post=142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}