frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

Open in hackernews

Wii U SDBoot1 Exploit “paid the beak”

https://consolebytes.com/wii-u-sdboot1-exploit-paid-the-beak/
85•sjuut•5h ago

Comments

shoghicp•4h ago
Mirror (site seems down) https://archive.is/92OIx
fuomag9•3h ago
This was an amazing read!
bri3d•3h ago
This reminds me a lot of the PSP Pandora's Battery: a special factory "boot from external flash" system with exploitable vulnerabilities - on PSP, the special Pandora's Battery "JigKick" serial number 0xFFFFFFFF or the factory battery challenge/response "Baryon Sweeper" on newer consoles, followed by a rather complicated exploit in the "ipl.bin" signature checking process on the external hardware. On the Wii U, the "unstable power" battery jig followed by a simple overflow in SDBoot1.

https://www.psdevwiki.com/psp/Pandora

https://github.com/khubik2/pysweeper

mjg59•2h ago
Having spent a while working in embedded and learning that this is not a lesson that's been internalised: this is why you never sign any executable that can boot on shipped hardware unless you'd be ok with everyone running it on shipped hardware. You can not promise it will not leak. You can not promise all copies will be destroyed. If it needs to run on production hardware then you should have some per-device mechanism for one-off signatures, and if it doesn't then it should either be unsigned (if fusing secure boot happens late) or have the signature invalidated as the last thing that happens before the device is put in the box.

A lot of companies do not appear to understand this. A lot of devices with silicon-level secure boot can be circumvented with signed images that have just never (officially) been distributed to the public, and anyone relying on their security is actually relying on vendors never accidentally trashing a drive containing one. In this case Nintendo (or a contractor) utterly failed to destroy media in the way they were presumably supposed to, but it would have been better to have never existed in this form in the first place.

bri3d•2h ago
I think they _might_ have thought a little farther than this; as far as I can tell this tool was _supposed_ to only boot images with the same security checks as the actual fused state of the console, and the issue was that the section header parsing code was vulnerable to a trivial attack which allowed arbitrary execution, which of course could then bypass the lifecycle state checks.

I'd extend your thesis to "you need to audit your recovery tools with the _exact same_ level of scrutiny with which you audit your production secondary bootloader, because they're effectively the same thing," which is the same concept but not _quite_ as boneheaded as you suggest.

Recently, I see this class of exploit more commonly, too: stuff like "there's a development bootloader signed with production keys" has gone away a little, replaced with "there's a recovery bootloader with signature checking that's broken in some obvious way." Baby steps, I guess...

josephcsible•1h ago
I don't like this advice because it seems like it's only useful to people who want to do tivoization in the first place. I hope people who try to do that keep failing at it, because "success" is bad for the rest of us.
dlenski•33m ago
Agreed. I'm rooting for the continued failure of everyone who locks down hardware (and software) to prevent its users from modifying or fully controlling it.
int0x29•2h ago
I've seen people exploit hardware by messing with the power supply before. I've never seen it be the intended manufacturer maintenance key.
bananaboy•1h ago
That was super interesting! Are there any details on how/where they found the sd and memory cards? It seems like you’d have to be incredibly lucky to find something like that.
Razengan•1h ago
Sort of a related tangent:

Some of the best gaming time in my life has been on handheld consoles, even when the games were available on PC or TV.

I wish there was a modern platform (not just a hobbyist Raspberry Pi kit or something) in the Switch or DS form factor, that boots straight into a coding environment like the legendary Commodore 64 and other "computer-consoles" of that era, with a central app store for indie devs to publish to for free. Add in dedicated support from a game engine like Godot, and I think something like that could spark a renaissance of solo devs/buddy teams experimenting with new game ideas and stuff.

aspenmayer•46m ago
> I wish there was a modern platform (not just a hobbyist Raspberry Pi kit or something) in the Switch or DS form factor, that boots straight into a coding environment like the legendary Commodore 64 and other "computer-consoles" of that era, with a central app store for indie devs to publish to for free.

I’m not sure if this will do what you want, but it is Linux on a DS! No active developers at the moment. They have instructions to build your own images as well as some software built for it.

https://www.dslinux.org/

How to write Rust in the Linux kernel: part 3

https://lwn.net/SubscriberLink/1026694/3413f4b43c862629/
53•chmaynard•3h ago•0 comments

Mr Browser – Macintosh Repository file downloader that runs directly on 68k Macs

https://www.macintoshrepository.org/44146-mr-browser
22•zdw•1h ago•2 comments

Asynchrony is not concurrency

https://kristoff.it/blog/asynchrony-is-not-concurrency/
176•kristoff_it•6h ago•118 comments

Debcraft – Easiest way to modify and build Debian packages

https://optimizedbyotto.com/post/debcraft-easy-debian-packaging/
16•pabs3•2h ago•1 comments

Silence Is a Commons by Ivan Illich (1983)

http://www.davidtinapple.com/illich/1983_silence_commons.html
88•entaloneralie•4h ago•12 comments

Ccusage: A CLI tool for analyzing Claude Code usage from local JSONL files

https://github.com/ryoppippi/ccusage
30•kristianp•2h ago•21 comments

Valve confirms credit card companies pressured it to delist certain adult games

https://www.pcgamer.com/software/platforms/valve-confirms-credit-card-companies-pressured-it-to-delist-certain-adult-games-from-steam/
212•freedomben•10h ago•226 comments

C++: zero-cost static initialization

https://cofault.com/zero-cost-static.html
16•oecumena•3d ago•4 comments

Meta says it wont sign Europe AI agreement, calling it growth stunting overreach

https://www.cnbc.com/2025/07/18/meta-europe-ai-code.html
115•rntn•8h ago•165 comments

Multiplatform Matrix Multiplication Kernels

https://burn.dev/blog/sota-multiplatform-matmul/
53•homarp•6h ago•19 comments

lsr: ls with io_uring

https://rockorager.dev/log/lsr-ls-but-with-io-uring/
303•mpweiher•13h ago•152 comments

Broadcom to discontinue free Bitnami Helm charts

https://github.com/bitnami/charts/issues/35164
98•mmoogle•6h ago•60 comments

Wii U SDBoot1 Exploit “paid the beak”

https://consolebytes.com/wii-u-sdboot1-exploit-paid-the-beak/
85•sjuut•5h ago•11 comments

Trying Guix: A Nixer's impressions

https://tazj.in/blog/trying-guix
144•todsacerdoti•3d ago•42 comments

The year of peak might and magic

https://www.filfre.net/2025/07/the-year-of-peak-might-and-magic/
82•cybersoyuz•8h ago•41 comments

AI capex is so big that it's affecting economic statistics

https://paulkedrosky.com/honey-ai-capex-ate-the-economy/
212•throw0101c•6h ago•228 comments

CP/M creator Gary Kildall's memoirs released as free download

https://spectrum.ieee.org/cpm-creator-gary-kildalls-memoirs-released-as-free-download
235•rbanffy•15h ago•124 comments

I'm Rebelling Against the Algorithm

https://varunraghu.com/im-rebelling-against-the-algorithm/
26•Varun08•3h ago•8 comments

Replication of Quantum Factorisation Records with a VIC-20, an Abacus, and a Dog

https://eprint.iacr.org/2025/1237
65•teddyh•6h ago•19 comments

Bun adds pnpm-style isolated installation mode

https://github.com/oven-sh/bun/pull/20440
3•nateb2022•1h ago•0 comments

Mango Health (YC W24) Is Hiring

https://www.ycombinator.com/companies/mango-health/jobs/3bjIHus-founding-engineer
1•zachgitt•7h ago

Show HN: I built library management app for those who outgrew spreadsheets

https://www.librari.io/
54•hmkoyan•6h ago•30 comments

Shutting Down Clear Linux OS

https://community.clearlinux.org/t/all-good-things-come-to-an-end-shutting-down-clear-linux-os/10716
87•todsacerdoti•2h ago•65 comments

Show HN: Molab, a cloud-hosted Marimo notebook workspace

https://molab.marimo.io/notebooks
72•akshayka•7h ago•11 comments

A New Geometry for Einstein's Theory of Relativity

https://www.quantamagazine.org/a-new-geometry-for-einsteins-theory-of-relativity-20250716/
85•jandrewrogers•10h ago•3 comments

Sage: An atomic bomb kicked off the biggest computing project in history

https://www.ibm.com/history/sage
21•rawgabbit•3d ago•4 comments

Converting Integers to Floats Using Hyperfocus (2022)

https://blog.m-ou.se/floats/
5•gus_massa•1d ago•0 comments

Cancer DNA is detectable in blood years before diagnosis

https://www.sciencenews.org/article/cancer-tumor-dna-blood-test-screening
179•bookofjoe•7h ago•103 comments

Intel Announces It's Shutting Down Clear Linux

https://www.phoronix.com/news/Intel-Ends-Clear-Linux
19•gpi•1h ago•5 comments

How I keep up with AI progress

https://blog.nilenso.com/blog/2025/06/23/how-i-keep-up-with-ai-progress/
192•itzlambda•7h ago•95 comments