Skip to content

Commit 558835e

Browse files
GaryOderNichtsGaryOderNichts
committed
version 3
1 parent d7195a3 commit 558835e

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+1707
-217
lines changed

‎.gitignore‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,11 @@
11
.vscode/
2-
arm_kernel_fw_launcher/build/
3-
arm_kernel_region_free/build/
4-
arm_kernel_loadfile/build
5-
arm_kernel_loadfile/mcp/build
2+
sd_kernels/out
3+
sd_kernels/sd_kernels.zip
4+
5+
**/build/
66

77
bluubomb
88
*.bin
99
*.bin.h
1010
*.elf
1111
*_syms.h
12-
*.rpx

‎Makefile‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,23 @@
1-
.PHONY: all clean arm_kernel_loadfile arm_kernel_fw_launcher arm_kernel_region_free
1+
.PHONY: all clean arm_kernel arm_user sd_kernels
22

3-
all: bluubomb arm_kernel_loadfile arm_kernel_fw_launcher arm_kernel_region_free
3+
all: arm_user arm_kernel bluubomb sd_kernels
4+
@echo All done!
45

56
clean:
7+
@$(MAKE) --no-print-directory -C arm_user clean
8+
@$(MAKE) --no-print-directory -C arm_kernel clean
69
rm -f bluubomb
7-
@$(MAKE) --no-print-directory -C arm_kernel_loadfile clean
8-
@$(MAKE) --no-print-directory -C arm_kernel_fw_launcher clean
9-
@$(MAKE) --no-print-directory -C arm_kernel_region_free clean
10+
@$(MAKE) -j1 --no-print-directory -C sd_kernels clean
1011

11-
bluubomb: bluubomb.c adapter.c bdaddr.c sdp.c
12-
gcc -std=gnu11 -Wall -o bluubomb bluubomb.c adapter.c bdaddr.c sdp.c -lbluetooth
12+
arm_user:
13+
@$(MAKE) -j1 --no-print-directory -C arm_user
1314

14-
arm_kernel_loadfile:
15-
@$(MAKE) -j1 --no-print-directory -C arm_kernel_loadfile
15+
arm_kernel:
16+
@$(MAKE) -j1 --no-print-directory -C arm_kernel
1617

17-
arm_kernel_fw_launcher:
18-
@$(MAKE) -j1 --no-print-directory -C arm_kernel_fw_launcher
18+
bluubomb: bluubomb.c adapter.c bdaddr.c sdp.c
19+
gcc -std=gnu11 -Wall -o bluubomb bluubomb.c adapter.c bdaddr.c sdp.c -lbluetooth
1920

20-
arm_kernel_region_free:
21-
@$(MAKE) -j1 --no-print-directory -C arm_kernel_region_free
21+
sd_kernels:
22+
@echo Building SD kernels...
23+
@$(MAKE) -j1 --no-print-directory -C sd_kernels

‎README.md‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12,35 +12,38 @@ Not to be confused with [BlueBomb](https://github.com/Fullmetal5/bluebomb) for t
1212
- A PC or VM running a version of Linux which is able to run the custom build of BlueZ
1313

1414
## How to use
15-
1. Run `sudo apt install build-essential libbluetooth-dev libglib2.0-dev libdbus-1-dev` to install the required dependencies.
16-
1. Clone https://github.com/rnconrad/WiimoteEmulator
15+
1. Run `sudo apt install build-essential libbluetooth-dev libglib2.0-dev libdbus-1-dev git` to install the required dependencies.
16+
1. Run `git clone https://github.com/rnconrad/WiimoteEmulator && cd WiimoteEmulator`.
1717
1. Run `source ./build-custom.sh` to build BlueZ.
18-
Don't worry if building the emulator itself fails due to missing SDL headers. Just continue with the next steps.
18+
Don't worry if building the emulator itself fails due to missing SDL headers. Just continue with the next steps.
1919
1. Stop the already running bluetooth service `sudo systemctl disable --now bluetooth`
2020
1. Run the custom built bluetoothd `sudo ./bluez-4.101/dist/sbin/bluetoothd -d -n`
21-
1. Download the `bluubomb` binary and the kernel binary of your choice from the [releases page](https://github.com/GaryOderNichts/bluubomb/releases).
21+
1. Download the `bluubomb` binary and the `sd_kernels.zip` from the [releases page](https://github.com/GaryOderNichts/bluubomb/releases).
22+
Copy a kernel binary of your choice from the `sd_kernels.zip` to the root of your SD Card and rename it to `bluu_kern.bin`.
2223
Take a look at [Kernel binaries](#kernel-binaries) for more information.
23-
1. Make the bluubomb file executable by running `chmod +x bluubomb`
24-
1. Power on the Wii U and press the sync button.
25-
1. Run `sudo ./bluubomb arm_kernel.bin` and wait for the pairing process to complete.
24+
1. Power on the Wii U, insert your SD Card and press the sync button.
25+
1. Open a new terminal and make the bluubomb file executable by running `chmod +x bluubomb`
26+
1. Run `sudo ./bluubomb` and wait for the pairing process to complete.
2627
This might take a minute.
2728
If you get a warning about Simple Pairing mode read [the Simple Pairing mode section below](#simple-pairing-mode).
2829

29-
Write down the Wii U's bd address that should be displayed after the pairing is complete.
30-
You can now run `sudo ./bluubomb arm_kernel.bin <bdaddr here>` to connect directly to the Wii U and skip the pairing process.
30+
Write down the Wii U's bluetooth device address that's displayed after the pairing is complete.
31+
You can now run `sudo ./bluubomb <bdaddr here>` to connect directly to the Wii U and skip the pairing process.
3132

3233
## Kernel binaries
3334

34-
### arm_kernel_loadfile
35+
### loadrpx.bin
3536
Launches a launch.rpx from the root of your SD card on the next application launch.
3637

37-
### arm_kernel_fw_launcher
38-
Launches a fw.img from the root of your SD card on the next OS relaunch (for example when exiting System Settings).
39-
40-
### arm_kernel_region_free
38+
### regionfree.bin
4139
Applies IOSU patches to temporarily remove region restrictions.
4240
This should be helpful if you've locked yourself out of your applications due to permanent region modifications.
4341

42+
### wupserver.bin
43+
Launches a wupserver instance directly after using bluubomb.
44+
This gets you full system access remotely via [wupclient](https://github.com/dimok789/mocha/blob/master/ios_mcp/wupclient.py) (replace the IP in line 29 with the one of your Wii U).
45+
This works without having to leave the controller pairing screen.
46+
4447
## Simple Pairing mode
4548

4649
On some devices the simple pairing mode can't be disabled by bluubomb.

arm_kernel_region_free/Makefile renamed to arm_kernel/Makefile

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,8 @@ LIBDIRS :=
6262
ifneq ($(BUILD),$(notdir $(CURDIR)))
6363
#---------------------------------------------------------------------------------
6464

65+
export TARGETNAME := $(TARGET)
66+
6567
export OUTPUT := $(CURDIR)/$(TARGET)
6668
export TOPDIR := $(CURDIR)
6769

@@ -98,7 +100,7 @@ $(BUILD):
98100
#---------------------------------------------------------------------------------
99101
clean:
100102
@echo clean ...
101-
@rm -fr $(BUILD) $(TARGET).elf $(TARGET).bin
103+
@rm -fr $(BUILD) $(TARGET).elf $(TARGET).bin $(TARGET).bin.h
102104

103105
#---------------------------------------------------------------------------------
104106
else
@@ -108,14 +110,18 @@ DEPENDS := $(OFILES:.o=.d)
108110
#---------------------------------------------------------------------------------
109111
# main targets
110112
#---------------------------------------------------------------------------------
111-
all : $(OUTPUT).bin
113+
all : $(OUTPUT).bin.h
112114

113115
$(OUTPUT).elf : $(OFILES)
114116

115117
$(OUTPUT).bin: $(OUTPUT).elf
116118
@echo "built ... $(notdir $@)"
117119
@$(OBJCOPY) -j .text -j .rodata -j .data -O binary $(OUTPUT).elf $@
118120

121+
$(OUTPUT).bin.h: $(OUTPUT).bin
122+
@raw2c $<
123+
@cp $(TARGETNAME).c $@
124+
119125
$(OFILES_SRC) : $(HFILES_BIN)
120126

121127
#-------------------------------------------------------------------------------

arm_kernel_fw_launcher/link.ld renamed to arm_kernel/link.ld

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
OUTPUT_ARCH(arm)
22

3-
SECTIONS
4-
{
3+
SECTIONS {
54
. = (0x08135000);
65

76
.text : {
@@ -14,13 +13,11 @@ SECTIONS
1413
.data : {
1514
*(.data*)
1615
}
17-
.bss : {
16+
/* .bss : {
1817
*(.bss*)
19-
*(COMMON*)
20-
}
18+
} */
2119

2220
/DISCARD/ : {
2321
*(*);
2422
}
2523
}
26-

arm_kernel_fw_launcher/source/crt0.s renamed to arm_kernel/source/crt0.s

File renamed without changes.

arm_kernel_region_free/source/imports.h renamed to arm_kernel/source/imports.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
#include <stdint.h>
44

5+
#define ALIGNAS(x, align) (((x) + ((align) - 1)) & ~((align) - 1))
6+
57
// Kernel functions
68

79
#define kernel_memcpy ((void* (*)(void*, const void*, int)) 0x08131D04)

‎arm_kernel/source/main.c‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
#include <stdlib.h>
2+
#include "imports.h"
3+
4+
#include "../../arm_user/arm_user.bin.h"
5+
6+
#define ARM_BL(addr, func) (0xEB000000 | ((((uint32_t)(func) - (uint32_t)(addr) - 8) >> 2) & 0x00FFFFFF))
7+
8+
#define SD_KERNEL_CODE_LOCATION 0x08135400
9+
10+
int kernel_syscall_0x81(void* ptr, uint32_t size)
11+
{
12+
// copy the custom kernel code
13+
kernel_memcpy((void*) SD_KERNEL_CODE_LOCATION, ptr, size);
14+
15+
// jump to it
16+
((void (*)(void)) 0x08135400)();
17+
18+
return 0;
19+
}
20+
21+
int _main()
22+
{
23+
// disable interrupts and mmu
24+
int level = kernel_disable_interrupts();
25+
uint32_t control_register = disable_mmu();
26+
27+
// patch kernel_error_handler
28+
*(volatile uint32_t*) 0x08129a24 = 0xe12fff1e; // bx lr
29+
30+
// replace the custom kernel syscall
31+
*(volatile uint32_t*) 0x0812cd2c = ARM_BL(0x0812cd2c, kernel_syscall_0x81);
32+
33+
// patch ios-pad fsa handle check to always succeed
34+
*(volatile uint32_t*) 0x11f7f418 = 0xe3a00001; // mov r0, #1
35+
*(volatile uint32_t*) 0x11f7f41c = 0xe12fff1e; // bx lr
36+
37+
// give everything full access to fsa (we need this to access the sd from ios-pad)
38+
*(volatile uint32_t*) 0x107043e4 = 0xe3e02000; // mvn r2, #0
39+
*(volatile uint32_t*) 0x107043e8 = 0xe3e03000; // mvn r3, #0
40+
41+
// load arm_user
42+
kernel_memcpy((void*) 0x11f85800, arm_user, arm_user_size);
43+
44+
// reenable mmu
45+
restore_mmu(control_register);
46+
47+
// invalidate all cache
48+
// kernel_invalidate_dcache(0x081298BC, 0x4001);
49+
kernel_invalidate_icache();
50+
51+
// restore interrupts
52+
kernel_enable_interrupts(level);
53+
54+
return 0;
55+
}

‎arm_kernel_loadfile/link.ld‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎arm_kernel_loadfile/mcp/link.ld‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

0 commit comments

Comments
 (0)