Closed ProtoM0J0JOJO closed 6 months ago
koolkdev
commented
7 months ago The header contains 32 bit IV that is used for decryption of the rest of the filesystem. since it is 32 bit it should be possible to bruteforce it eventually but it is pretty complex to develop such a tool. especially if we don't know how much of the drive was destroyed.
koolkdev
commented
6 months ago I assume that it may be too late for you, but after thinking about it more, it should be possible to recover the /usr directory as long as no more than 16MB were overwritten. I will add a command line to do that. In the future it may be possible to write a tool that will recover the first 16MB of the disk, but only after the wfs modifying capability will be completed.
koolkdev
commented
6 months ago Completed in koolkdev/wfslib#42 and in #31 A new --dump-usr-dir flag was added to wfs-extract
Long story short:
I tried reconfiguring my wii u's external usb drive to be MBR partitioned using Windows Disk Manager, hoping to fix some irrelevant issue with dumping WUDD files. Now my wii u keeps asking me to reformat the drive and I believe I seriously botched my whole drive. At the bare minimum I'd like to recover my near 100% Splatoon save file.
Someone very knowledgeable on wii u homebrew told me that my best shot was using this tool, so I tried using wfs-extract to recover everything salvageable. However, I kept getting the same error "unexpected WPS version version, bad key?". So, I haphazardly compiled my own version of wfs-extract which "ignores" the wfs_header checks (I just commented out what I believe are the relevant portions) and got a hash error for block 0x00000000.
If it's still possible to recover the drive, I'd really appreciate a custom version of the wfs-extract tool that ignores these wfs_header checks and still produces a usable result. I have no knowledge bitwise operators or hashing, so it seems like for now I'm at a dead end.