I was informed on the Wii database that the Wii / Wii U title keys/ 3DS title key generator was leaked.
Source code outflow of Wii and 3DS / 2DS of factory software outflow continued to like, now is a mechanism to generate the title key of Wii · Wii U title keys· 3DS, that is, the outflow of the title key generation algorithm. Rather than a new leak, it seems that it is a leak that has not appeared in the table due to the leak related to Nintendo’s game machine that originated from the overseas bulletin board 4ch.
The title key is AES encrypted and resides in an encrypted file called a ticket. Games and applications are encrypted with a title key and are essential for all game and application titles to work. Therefore, the title key is different for each title. Normally, the title key cannot be extracted unless this encryption is decrypted, but since the leak this time is a mechanism to generate the title key, the title key will be known without decrypting it. Once you know the title key, you can use it by encrypting it with the already revealed Common-
Here's the tutorial for Cemu!LINK UTILI: Pagina Facebook: U Common Key: D7 B0 04 02 65 9B A2 AB D2 CB 0D B2 7F A2 B6 5. The first thing we need to do is to generate a common-key.bin. To do this, go to Tools Create Common key.Type the text it asks you to type and press OK.2. Now go to Edit Preview. A new Window will pop-up with one image of the banner of the Wad.At the bottom you can change what image of the banner/icon to preview. If you need it, click save. WiiU Common Keyを取得する方法 記事の方法を試す前や質問をするまえに必ず下記リンクを見てからにしてください！ このブログについて. The first thing we need to do is to generate a common-key.bin. To do this, go to Tools Create Common key. Type the text it asks you to type and press OK. Now go to Edit Preview. A new Window will pop-up with one image of the banner of the Wad. Wii Common Key Bin. DLCs are stored in /private/wii/data/ / as multiple.bin, where represents a specific content index value from a TMD content record, expressed as a 3-digit number in base 10 notation (e.g. Renaming the directories where these files are stored will make the Wii not recognize them anymore, as expected.
The Wii database writes, “I received a title key generation script from an anonymous person from Wii, 3DS, and Wii U, so I checked it and it was real.” In fact, the script was able to generate a Wii virtual console title, a Wii U title keys game, and a decrypted title key for the Wii disk.
You will be wondering what you can do with this. Specifically, if you know the title ID, you can decrypt all Wii / Wii U title key/ 3DS titles
It’s not just about game consoles, but being able to decrypt (decrypt) is the worst thing that can result in no security as a result of hacking. I sympathize with Nintendo when I come here.
It was added in the Wii database that it was confirmed that the DSi title could be decrypted.
Wii, DSi, 3DS and Wii U title key generation leaked
The Nintendo leaks don’t stop: After the leak of parts from IOS and Horizon, the title key generation for Wii, DSi, 3DS, and Wii-U titles has now been leaked.
The title key in the ticket encrypts the content of a game/application – it is, therefore, essential and different for each title – it is virtually impossible to brute force it.
At the salt it is the ID4 of the title, combined with a constant value.
In concrete terms, this means that almost every Wii, DSi 3DS, and Wii U title keys can now be decrypted and viewed if only the TitleID is given.
Wii U emulator “Cemu” key setting list
Software “Cemu” that emulates Wii U applications on a PC
First released on October 13, 2015 Wii U Emu
Nowadays, it is a good time for those who want to enjoy
high-quality Wii U by
emulation, such as comfortable operation even with low-spec devices and more software with high reproducibility
Actually, sometimes I start the Wii U emulation “Cemu” software
I need a soft key and I want to start the soft key
You have to look at each region and write to a text editor.
This time,
we will introduce how to check and set the “Cemu” softkey, and how to apply the update data and DLC in the Wii U title keys emulation
Wii U Title Key How to Find
As explained above in Cemu, you need the key for the software you want to start in order to start the software.
Since the title key of the software differs depending on the same software or the supported region,
you will have to enter the key that matches the region of the software you have.
To find out the title key of Wii U, volunteers from overseas searched and summarized it.
On this site, Title ID and Title Key are organized by soft region.
Enter the name of the software you want to start in the SEARCH (search field) in the upper right corner.
Since it will be an overseas site, it is recommended to search in English.
You can get the key.
Copy the software title key that matches the region of your software in the Region field.
Japan region is JPN
America region is USA
Europe region is EUR
If you make a mistake here, even if the software is the same, it will not start at all, so be careful.
Also note that
if you want to get the Type (key type) software startup key, copy from the code in the “eShop / Application” column.
If you want to get the key for the game update/update data, the code in the “Patch” column
Download content DLC If you want to get the key of the data, please get it from the code in the “DLC” column.
How to set “keys.txt”
Once you have the keycode, set up Cemu.
Wii Common Key File
Let’s start Cemu first. Then, a text file called “keys.txt” will be
created in the Cemu older, so open it with Notepad. (“Keys.txt” will be regenerated if you remove it from the folder and start Cemu again)
Get the title key you got earlier in this file.
“541b9889519b27d363cd21604b97c67a # example key (can be deleted)” at the bottom is an example of key
entry, so please write it in this form.
Since you must enter a primary key before entering the software title key
in Notepad
D7B00402659BA2ABD2CB0DB27FA2B656 # Wii U Common Key
36262B5F49C69164E3BE2BB87C9922A7 # Wii U Common Key
A851D78AB8F0A6FE1E93CFCEAF99A179 # Wii U Common Key
please by adding to write the above.
All you have to do is write the title key in the above form.
After #, it is just like writing a memo and is not affected by the program, so
please edit it so that you can understand it easily.
The Wii U emulator will automatically select the correct key, so regardless of the
order, enter the software you want to start, so add line breaks in order.
For the time being, I will list the main software in multiple regions.
Please copy it to “keys.txt” as it is.
Title database Wii U – USA Game Keys
However, the “Wii U Title Key Database” introduced earlier may have some keys that do not start in rare cases.
If you enter the start key but it does not start,
note that the region is wrong or if you type in the space between the code and # with a double-byte space, space will also be recognized.
Read more: DOLLAR SYMBOL – ITS ORIGIN AND MEANING.
.
By popular request, here’s an explanation of the different encryption keys that are used on the Wii.
AES Keys: The Wii uses 128-bit (16-byte) symmetric AES (aka AES-128-CBC) for most encryption.
- Common key (ebe42a225e8593e448d9c5457381aaf7): This is the “shared secret” that we extracted with the Tweezer Hack. This key is known by all Wiis, but is never used, directly, to encrypt anything. Instead, all titles are encrypted with a random AES key; this key is then encrypted with the Common key and then stored inside a ticket. The ticket is then transmitted along with the content — on discs, it’s part of the “certificates” found before the encrypted data starts. Thus, knowing the common key allows you to decrypt most Wii content, as long as you have the right ticket. This key is stored in the OTP area inside the Starlet ARM core inside the Hollywood package.
- SD key (ab01b9d8e1622b08afbad84dbfc2a55d): This is another shared secret — also stored on the Hollywood, but also found plenty of other places, including inside the firmware images. This key is used by the System Menu (1-2) to encrypt anything before writing it out to the SD card, and it’s used by 1-2 to decrypt anything read from the SD card. This is done mainly for the purpose of obfuscation, to keep people from examining savegames. It’s worth noting that all Wii games save their data to the internal NAND — no game supports loading or saving data directly to SD. This frees game writers from the requirement of handling this step themselves; they just write the savegame data, unencrypted and unsigned, to their title-data directory inside the NAND filesystem; the system menu then handles everything else. (The real reason for this is probably that it allowed Nintendo to make a system where they didn’t have to expose the details of this encryption — or any encryption — to their licensed game developers.) This key is also stored in OTP, and in several places in IOS (for no apparent reason). If you’re using Segher’s tools, you may also be interested in the SD IV (216712e6aa1f689f95c5a22324dc6a98) and the MD5 blanker (0e65378199be4517ab06ec22451a5793), both of which are stored inside the 1-2 binary.
- NAND key (varies): This AES key is used to encrypt the filesystem data on the actual NAND chip itself; it is probably randomly generated during manufacturing and is also stored in the OTP area of the Starlet. This key is used to prevent the contents of the NAND filesystem from being read using a flash chip reader. Nintendo may or may not actually record this key anywhere, since they (theoretically) don’t need to ever use it. In fact, in some similar systems, keys like this are generated automatically by the device itself and (theoretically) never leave it — the Wii shares some design prinicples with HSMs, but it certainly doesn’t manage to be one. This is another OTP key.
RSA keys: The Wii uses RSA-based authentication in several different places. This is fundamentally different than the AES encryption used for data-hiding, because RSA is an asymmetric cipher, meaning there are no shared secrets — nothing to be extracted from the Wii. The only RSA keys stored on the Wii are public keys, used to verify authenticity of content.
- CP: Content Protection? This key is used to sign the TMD associated with every title. The TMD contains a SHA1 hash of the contents of that title, proving that it had not been modified. My 24c3 presentation was done by injecting a new .DOL into a Lego Star Wars disc and then forging the signature on its TMD, using a flaw originally discovered by Segher. After that presentation, people eventually discovered the common key needed to decrypt update partitions, allowing others to analyze / disassemble IOS. xt5 (who I had the pleasure of meeting at 24c3) was then able to find the same flaw and implemented it in his Trucha Signer. In fact, from disassembling his code, the core part of it was almost identical to our never-released code — great minds think alike, eh?
- XS: “Access”? This is the key that signs tickets, which contain the title keys for individual titles.
- CA: Certification Authority: This key signs both the XS and CP keys.
- MS: “Master?” This key is used to sign the certificate that contains a copy of your Wii’s public ECC key. This certificate is then appended to savegames on SD cards, so that any other Wii can verify that the key was issued by Nintendo.
- Root: This is the “grand master key”, which signs the CA key. The public half of this can be found here.
ECC keys: The Wii uses Elliptic Curve Cryptography in a few select places — primarily, it uses this when it signs savegames before writing them to SD card. ECC is used in ways similar to RSA, but it’s somewhat newer and much faster to run on an embedded system.
Other: For lack of a better place to put it, there is also an HMAC key — a 20-byte value that is used in a SHA1-based HMAC of the NAND flash contents to prevent them from being tampered with. This is a commonly used scheme in embedded systems, where a device wants to “sign” something itself, for itself. There are no public vs private keys here — you need to know this value in order to verify the hash, and you need the same value to generate the hash. This isn’t appropriate for communications between two people, but is perfectly fine for letting the Wii test to see if the chip was pulled, rewritten, and resoldered.
Key storage: The public keys are stored in various places — these aren’t sensitive, so they don’t really need to be concealed (although at least one of them needs to be protected from modification, and it can then sign the others). The rest are stored in two places:
- Hollywood SEEPROM: After meeting him at 24c3, bunnie was kind enough to decap some chips for me, including a Hollywood. One of those chips is 2kbit serial EEPROM, which stores the MS signature on the the ECC key.
- One-Time Programmable Area: Inside the Starlet ARM core, there are a bunch of things:
Wii Common Key Download
- SHA1 hash of boot1
- Common key
- ECC private key
- NAND HMAC
- NAND AES key
- RNG seed
- other stuff we can’t yet decipher