Edit Infobox Wii Homebrews: Wad2bin Wii

Free text:

wad2bin is a tool that converts installable Wii WAD packages to backup WAD packages (*.bin files) by using console-specific keydata. These converted files can be stored on an SD card and used to launch channels through the System Menu 4.0+ or used with games that save and read data in this format. ==User guide== Usage: wad2bin <keys.txt> <device.cert> <input WAD> <output dir> [<parent title ID> [--nullkey]] * Paths must not exceed 259 characters. Relative paths are supported. * The required directory tree for the *.bin file(s) will be created at the output directory. * You can set your SD card root directory as the output directory. Notes about DLC support: * Parent title ID is only required if the input WAD is a DLC. A 16 character long hex string is expected. * If "--nullkey" is set after the parent title ID, a null key will be used to encrypt DLC content data. * Some older games (like Rock Band 2) depend on this to properly load DLC data when launched via the Disc Channel. === Guidelines === *Console-specific data is required to perform the conversion. Dump it from the target console with [https://github.com/DarkMatterCore/xyzzy-mod xyzzy-mod]. ** The program expects two different files with console specific data: a text file with keydata (check <code>keys.txt.template</code> for the actual format) and <code>device.cert</code>. Both files are generated by xyzzy-mod. *** Both ticket and TMD for each converted WAD package must be installed on the target Wii console in order for this to work. *** For this matter, the program generates a bogus WAD package at the provided output directory, using the <code>&lt;title_id&gt;_bogus.wad</code> naming convention. It can be used with regular WAD Managers to install both ticket and TMD if needed. *** Bogus WAD packages don't have any encrypted content data, thus they're expected to return errors like <code>-1022</code> during installation with regular WAD Managers - this is expected behaviour, so don't panic. *** If you can't get your converted WAD package to work, try uninstalling the bogus WAD before installing it (for real). This fixes the problem most of the time. ** Channel WADs get converted to <code>content.bin</code> files, while DLC WADs get converted to <code>&lt;index&gt;.bin</code> files. *If a DLC WAD is provided, it doesn't matter if it's an uncomplete WAD with missing contents: ** A WAD with a tampered TMD that only references the packaged contents or a full WAD with all contents: all cases are supported by wad2bin. There's no need to provide any content indexes. ** DLCs can use a parent title ID that's different from the title ID from the game they belong if other games are capable of using them. That's why a parent title ID is required to convert DLCs. ** Converted DLC data can be encrypted using either a null key (used by older games) or the console-specific PRNG key (used by newer games, and also old games when launched with a cIOS). *If the WAD ticket wasn't issued for the target console, or if the WAD isn't legit (e.g. homebrew WAD), a patched IOS must be installed and used. This varies depending on the converted WAD type: ** Channels - the IOS used by the System Menu must be patched to enable the [https://wiibrew.org/wiki/Signing_bug signing bug] on it: *** Regular Wii consoles - use [https://gbatemp.net/download/simple-ios-patcher.25749 Simple IOS Patcher] to install a patched System Menu IOS (IOS60 for 4.0 and 4.1, IOS70 for 4.2 and IOS80 for 4.3). *** Wii U consoles (vWii) - use [https://gbatemp.net/threads/patched-ios80-installer-for-vwii-allows-sd-menu-custom-channels.344882 Patched IOS80 Installer for vWii] to install a patched IOS80. ** DLCs - the game must be launched using a cIOS, or its required IOS version must be patched to enable the [https://wiibrew.org/wiki/Signing_bug signing bug] on it. This greatly depends on: *** How old the game is - if it enforces the usage of a null key when launched through the Disc Channel. *** The used launch method - cIOS enforce the usage of the PRNG key, even on older games. *** Ticket/TMD signature validity - if it's not valid, or if the ticket wasn't issued for the target console, a patched IOS or a cIOS will always be necessary. ** Because of all these reasons, it's difficult to establish a clear procedure that works for every single case. Further trial and error by the user is encouraged. === Supported DLCs === Not all DLCs can be converted to <code>&lt;index&gt;.bin</code> files - this is because not all games with DLCs are capable of loading DLC data stored on the SD card. For this purpose, wad2bin holds a hardcoded DLC title ID list, in order to avoid converting a DLC WAD that simply won't work from the SD card. The title ID from the parent game must be provided as an additional command line argument, because some games can &quot;import&quot; DLC data that belongs to other games. Only the following DLCs are supported: * Rock Band 2 (<code>00010000-535A41xx</code>) (<code>SZAx</code>): ** <code>00010005-735A41xx</code> (<code>sZAx</code>). ** <code>00010005-735A42xx</code> (<code>sZBx</code>). ** <code>00010005-735A43xx</code> (<code>sZCx</code>). ** <code>00010005-735A44xx</code> (<code>sZDx</code>). ** <code>00010005-735A45xx</code> (<code>sZEx</code>). ** <code>00010005-735A46xx</code> (<code>sZFx</code>). * The Beatles: Rock Band (<code>00010000-52394Axx</code>) (<code>R9Jx</code>): ** <code>00010005-72394Axx</code> (<code>r9Jx</code>). * Rock Band 3 (<code>00010000-535A42xx</code>) (<code>SZBx</code>): ** <code>00010005-735A4Axx</code> (<code>sZJx</code>). ** <code>00010005-735A4Bxx</code> (<code>sZKx</code>). ** <code>00010005-735A4Cxx</code> (<code>sZLx</code>). ** <code>00010005-735A4Dxx</code> (<code>sZMx</code>). * Guitar Hero: World Tour (<code>00010000-535841xx</code>) (<code>SXAx</code>): ** <code>00010005-735841xx</code> (<code>sXAx</code>). ** <code>00010005-73594Fxx</code> (<code>sYOx</code>). * Guitar Hero 5 (<code>00010000-535845xx</code>) (<code>SXEx</code>): ** <code>00010005-735845xx</code> (<code>sXEx</code>). ** <code>00010005-735846xx</code> (<code>sXFx</code>). ** <code>00010005-735847xx</code> (<code>sXGx</code>). ** <code>00010005-735848xx</code> (<code>sXHx</code>). * Guitar Hero: Warriors of Rock (<code>00010000-535849xx</code>) (<code>SXIx</code>): ** <code>00010005-735849xx</code> (<code>sXIx</code>). * Just Dance 2 (<code>00010000-534432xx</code>) (<code>SD2x</code>): ** <code>00010005-734432xx</code> (<code>sD2x</code>). * Just Dance 3 (<code>00010000-534A44xx</code>) (<code>SJDx</code>): ** <code>00010005-734A44xx</code> (<code>sJDx</code>). * Just Dance 4 (<code>00010000-534A58xx</code>) (<code>SJXx</code>): ** <code>00010005-734A58xx</code> (<code>sJXx</code>). * Just Dance 2014 (<code>00010000-534A4Fxx</code>) (<code>SJOx</code>): ** <code>00010005-734A4Fxx</code> (<code>sJOx</code>). * Just Dance 2015 (<code>00010000-534533xx</code>) (<code>SE3x</code>): ** <code>00010005-734533xx</code> (<code>sE3x</code>). Any DLCs not appearing on this list will return an error if used as the input WAD package for the program. If you come across a DLC that can be loaded from the SD card and doesn't appear on this list, please contact me or open an issue and I'll gladly add it. === content.bin and &lt;index&gt;.bin === * Differences between <code>content.bin</code> files and <code>&lt;index&gt;.bin</code> files: ** <code>content.bin</code> files are used to store data from <code>00010001</code> (downloadable channels) and <code>00010004</code> (disc-based channels) titles, and get saved to <code>sd:/private/wii/title/&lt;ascii_lower_tid&gt;/content.bin</code>. ** Whilst <code>&lt;index&gt;.bin</code> files are used to store data from <code>00010005</code> (DLC) titles, and get saved to <code>sd:/private/wii/data/&lt;ascii_lower_tid&gt;/&lt;index&gt;.bin</code> - where <code>&lt;index&gt;</code> represents a specific content index from its TMD (000 - 511). ** Both <code>content.bin</code> and <code>&lt;index&gt;.bin</code> files are backup WAD packages with a &quot;Bk&quot; header block, a TMD data block and encrypted contents using AES-128-CBC with the console-specific PRNG key and the content index as their IV (followed by 14 zeroes). * However, <code>content.bin</code> files hold two leading blocks before the &quot;Bk&quot; header that are both encrypted using the SD key and the SD IV (which are not console specific): ** A 0x640 byte-long title info header, which holds data such as title ID and a copy of the IMET header from the channel's <code>opening.bnr</code> (<code>00000000.app</code>). ** A copy of the <code>/meta/icon.bin</code> file entry from the <code>opening.bnr</code> U8 archive, with a variable size. * <code>content.bin</code> files also hold a trailing certificate area placed after the encrypted contents, which contains: ** An ECDSA signature calculated over the whole backup WAD package area (using the console-specific ECC private key). ** A copy of the console-specific ECC-B233 device certificate (also known as &quot;NG&quot; cert). ** A title-issued ECC-B233 certificate (also known as &quot;AP&quot; cert), signed using the console-specific ECC private key. Its ECC public key is an ECDH shared secret generated with a custom ECC private key. The issuer title is always the System Menu (00000001-00000002). * On the other hand, while <code>&lt;index&gt;.bin</code> files don't include any of the leading and trailing blocks from <code>content.bin</code> files, they are only allowed to hold a single encrypted content at a time, which index is used as part of the filename expressed in base 10 notation (e.g. <code>000.bin</code>). === Dependencies === * [https://github.com/jbop1626/ninty-233 ninty-233] (licensed under GPLv3 or later) is used for ECDH data generation and ECDSA signing/verification. * [https://tls.mbed.org mbedtls] (licensed under Apache 2.0) is used for hash calculations, AES-CBC crypto operations and RSA signature verification. * Keydata parsing based on code from [https://github.com/SciresM/hactool hactool] (licensed under ISC). === GUI === A Python-based graphical frontend for the program is available as [https://github.com/DarkMatterCore/wad2bin/raw/master/gui.py gui.py]. Big thanks to [https://github.com/LyfeOnEdge LyfeOnEdge] for developing it. ==Screenshots== https://dlhb.gamebrew.org/wiihomebrews/wad2binwii3.png == Changelog == '''v0.8''' * Print <code>errno</code> values as part of error messages whenever possible. * Use GCC <code>format</code> function attribute on <code>utilsPrintErrorMessage()</code>. '''v0.7''' * Removed parent title ID generation for DLC WADs. This doesn't work properly with games that are capable of using DLCs from other games. ** The hardcoded DLC title ID list is still being used as a filter to know if any converted DLCs will work or not. * Added support for encrypting converted DLC data with a null key. Fixes issues with older games launched through the Disc Channel, such as <code>Rock Band 2</code>. ** Please read the guidelines from the readme! Even if a null key is used, a patched IOS is still needed if the DLC ticket wasn't issued for the target console and you intend to launch the game through the Disc Channel. * Added <code>The Beatles: Rock Band</code> DLC to the hardcoded DLC title ID list. * Written content padding is now encrypted as well. * Several fixes to the U8 archive parsing code. * Fixed a silly <code>ECSDA</code> -&gt; <code>ECDSA</code> typo. * Reworked certificate chain, ticket and TMD handling. * Implemented RSA signature verification in certificates, tickets and TMDs. ** Fixes a bug where the ticket would have been fakesigned even if it was perfectly valid. * Useful info is now displayed at the end of the conversion process. Please read it. '''v0.6''' * Added a hardcoded list with title IDs from DLCs that can be converted to the <code>&lt;index&gt;.bin</code> format. Any other DLCs will return an error. Thanks to this, it's no longer necessary to input a parent title ID. * Fixed support for WAD packages with content data bigger than <code>U32_MAX</code> (0xFFFFFFFF). '''v0.5''' *Implemented bogus installable WAD package generation (header + certificate chain + ticket + TMD), saved at the provided output directory using the <code>&lt;title_id&gt;_bogus.wad</code> naming convention. *These bogus WAD packages can be used to install both ticket and TMD if needed, using regular WAD Managers. Errors such as -1022 can be safely ignored (e.g. content data isn't available in these WADs). '''v0.4''' *Fixed seeking after a missing content is detected while unpacking a DLC WAD. '''v0.3''' *Force the user to provide the full parent title ID for DLC WADs. '''v0.2''' *Added proper support for DLC WADs, even if they're incomplete (e.g. full TMD with missing content files). '''v0.1''' *Initial release. ==External links== * GitHub - https://github.com/DarkMatterCore/wad2bin