wii_u_modchip

KO | EN

gitlite — search

#javascript #hacktoberfest #ai #llm #go #docker #macos #java #windows #cli #kubernetes #vue #ios #open-source

(★ 179)

A Pico-based Wii U modchip based on eFuse reset exploit

wii_u_modchip 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# wii_u_modchip

A (WIP) Wii U modchip based on de_Fuse, a flaw in the Wii U's OTP eFuse readout state machine.

## How does it work?
A full writeup is available [here](https://douevenknow.us/post/714056575412764672/defuse-the-one-true-pwn). However, the short version is as follows:

In order to accommodate eFuse-based JTAG lockout (and due to other considerations), eFuse bits must be buffered into a register file immediately following NRST, before the internal reset can be released. The eFuse sense state machine latches at a rate of 4 bits per cycle, directly off the 27MHz XTALCLK. Every other rising edge, a byte is written into the register file, starting from the least significant byte of the current u32.

An internal counter is used to keep track of the remaining bytes to be read into the register file. While the eFuse register file is reset to zero with NRST, the internal counter is not: By asserting NRST after N bytes have been read, only 0x400-N bytes will be read on the subsequent boot.

By asserting NRST just before the final byte has been read (1830 cycles), all eFuses will read entirely zero, including the JTAG lockout fuse. This allows trivial, unsigned and unencrypted boot1 execution, with no SEEPROM anti-rollback.

![NRST waveform](https://raw.githubusercontent.com/StroopwafelCFW/wii_u_modchip/main/docs/nrst_waveform.png)

wii_u_modchip

wii_u_modchip 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

wii_u_modchip

wii_u_modchip 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README