mikeisastar / szshaxx

Injects arbitrary code into Mario Kart Wii.

szsHaxx

Injects arbitrary code into Mario Kart Wii.

Explanation

In Mario Kart Wii, competition data is stored within the game's save data. The course data for competitions is compressed using a proprietary compression format (Yaz) that was developed by Nintendo. The decompression function can be exploited via meticulously crafted compressed data, resulting in an overflow of the output buffer. In this instance, the buffer overflow leads to an arbitrary write, which grants the ability to write a single word to any memory address. By writing a branch instruction to the game's exception handler, code execution can be diverted in the event of a game crash. Following the arbitrary write, a Data Storage Interrupt (DSI) exception is triggered, resulting in code execution being redirected to the payload.

Usage

1. Obtain an SD card that has a capacity of 2 gigabytes or less
2. Format the SD card to FAT16 or FAT32
3. Create the filepath sd:/private/wii/title/RMC[E|P|J|K] on the SD card. The final character should match the version of Mario Kart Wii that will be used
4. Transfer the data.bin file that corresponds to the version of Mario Kart Wii that will be used into the aforementioned folder
5. Place the boot.elf file to be executed on the root of the SD card (sd:/)
6. Enable WiiConnect24
7. Delete the save data for the version of Mario Kart Wii that will be used
8. Transfer the save data from the SD card to the Wii
9. Launch Mario Kart Wii
10. Start the competition

Prerequisites

• Python 3.7
• devkitPPC

Building

python ./build.py

Credits

Code

• Many thanks to Team Twiizers for creating Savezelda
• Many thanks segher for creating twintig

Images

• Many thanks to jay for creating the banner
• Many thanks to chillz for creating the icons

Translations

Many thanks to the individuals listed below for their help with translations.

French

• JohnP55
• pumpkintheproot

German

• ItsNiceCraft

Italian

• LNLenost

Japanese

• custard
• varemi

Korean

• juno

Media

szshaxx's Issues

works on vWii

Tested this on real hardware, just thought I'd let you know that you can execute this on a real vWii, however not tested to the fullest extent because no SD card larger than 2GB

However, since this requires modifications to allow Wiiconnect24 to be enabled, this is therefore useless

How to translate?

I would like to add italian language.

Can't tranzfer save to wii memory

Hello, if i came to the step to copy the exploit save to the wii memory i get the message to must play the game first time. But i have launched the game and all other things are enabled like internet and Wiiconnect. I using a game disc in eur on an 4.3E console. Anything i missed?

German translation

Following the instructions from issue #3, here is a German translation:

Berechtigung erteilen

Erstellt von: MikeIsAStar

Indem du auf den "Start"-Knopf drückst,
lässt du die Ausführung von
fremdem Code auf deiner Konsole zu.