Wii U OTP access via IOSU kernel, ROP within IOS_USB

[dlevere]

Posted by CosmoCortney

Interesting news about the Wii U scene!

The first public IOSU ROP-Chain calls the shut down syscalls withing IOSU-USB.

Source: gbatemp.net/threads/rop-from-within-ios_usb-5-5-1.444369/

OTP access has also became possible. It allows you to print several keys on the screen including per console OTP region keys (public as well).

Source: gbatemp.net/threads/otp-access-via-iosu-kernel.445063/

Someone has also managed to load backups saved on a USB drive. The game image has to be patched in order to avoid any rejection from the console. You can then load it from the home menu. No USB loader needed! (has yet to be released).
You can see it's a real backup since the games appear on the home menu AND and eShop still offers you to buy them. (if a game has legibly been bought through the eShop it won't offer you to buy it)

Source: gbatemp.net/threads/a-strategy-to-load-games-off-usb-no-loader.445281/?_params=Array

[dlevere]

By CosmoCortney

We do now know how this was done. You need to download the game from NUS and put it into your SD card. You additionally need the title.tik which can be found on the corresponding disc or somewhere else, but not from NUS. Open the .tik with a hex editor and either add or subtract 2 to the value at 0x0F.
Put them on your SD card and run WUPinstaller. now you should be able to install the game on NAND or USB. Installing games from another region could cause bricks

[dlevere]

redNAND: Team WiiUBrU shares status on IOSU exploit progress for Wii U 5.5.x, releases CFW Booter

gbatemp.net/threads/how-to-load-a-fw-img-for-any-file-dumping-wiiubru-status-update.445840/

www.maxconsole.com/threads/wiiubru-official-statement-and-official-release-of-their-cfw-booter.42940/