Note: This is not a standalone, ready-to-use program — hence the name. If you need to ask how to use this, you’re doing it wrong.
We’ve been pretty bad about releasing source code lately, so this is my attempt to atone. I’ve been sitting on this code for a couple of months now — I wrote most of it a day or two after IOS37 was released — but I’ve been waiting for the mythical “right time” to release it in a useful form, and that hasn’t happened. So, I’m releasing it as-is, because I think that many people will find this code useful in its current form, and it can be used as a building block for more sophisticated hacks.
The idea behind PatchMii is that we should be able to replace Nintendo’s update process with one of own. The most straightforward way to do this would be to set up a “shadow” update server that would vend patched versions of Nintendo’s updates, and then patch the System Menu to talk to it instead of the official servers. However, there are some serious copyright issues with doing this, so this is the next best thing. This code should work with anything available on the Nintendo update server — IOS and channels (at least, the ones for which you can freely download a ticket).
In the example configuration provided, patchmii-core will do the following things:
Download the ticket and TMD for IOS37 from the Nintendo Update Server
Use the built-in key-management functions of IOS to decode the title key (no common key required!)
Using the TMD, download all of the encrypted contents from NUS
Verify the integrity of each content against the hashes contained in the TMD
Decrypt each content individually, look for versioning tags inside the binaries and display them
Look for the signature check, and patch it out. (I have included code that will handle all versions of IOS.)
Re-encrypt the contents. If necessary, recompute the hashes, modify the TMD.
Modify the title ID in the TMD and ticket to IOS5.
Fakesign the TMD and ticket.
Install this patched IOS37 as IOS5.
http://hackmii.com/2008/07/patchmii/#more-60
