haxchi/README.md

# haxchi

This is a ported version of the haxchi exploit created by smea and others for all sorts of different ds vc games.  
In addition to being ported it also includes a homebrew launcher loader as its payload so you can use it for a lot of things.

## install process

haxchi can be very easily installed using iosuhax's wupclient. for example, if hachihachi is installed to the MLC, it suffices to do:
```
  w.up("rom.zip", "/vol/storage_mlc01/usr/title/00050000/YOUR_GAME_TITLE_ID/content/0010/rom.zip")
```
of course, using wupclient to install haxchi permanently requires that redNAND be disabled, unless hachihachi is installed to USB, in which case it can be installed from redNAND using:
```
  w.up("rom.zip", "/vol/storage_usb01/usr/title/00050000/YOUR_GAME_TITLE_ID/content/0010/rom.zip")
```

To upload a config.txt as well you will have to do the following if the title is installed on NAND:
```
  w.up("config.txt", "/vol/storage_mlc01/usr/title/00050000/YOUR_GAME_TITLE_ID/content/config.txt")  
  w.chmod("/vol/storage_mlc01/usr/title/00050000/YOUR_GAME_TITLE_ID/content/config.txt", 0x644)  
```
and for the title being installed to USB you do the following:
```
  w.up("config.txt", "/vol/storage_usb01/usr/title/00050000/YOUR_GAME_TITLE_ID/content/config.txt")  
  w.chmod("/vol/storage_usb01/usr/title/00050000/YOUR_GAME_TITLE_ID/content/config.txt", 0x644)  
```

make sure to replace YOUR_GAME_TITLE_ID with one of the following:  

| Game | JPN | US | PAL |
|---|:---:|:---:|:---:|
|Brain Age(Traing)|10179A00|10179B00|10179C00|
|Yoshi Touch and Go|10179D00|10179E00|10179F00|
|Mario Kart DS|10195600|10195700|10195800|
|New Super Mario Bros|10195900|10195A00|10195B00|
|Yoshi's Island DS|10198800|10198900|10198A00|
|WarioWar: Touched|101A1E00|101A1F00|101A2000|
|Kirby Squeak Squad(Mouse Attack)|101A5500|101A5600|101A5700|
|Star Fox Command|101AC000|101AC100|101AC200|
|Super Mario 64 DS|101C3300|101C3400|101C3500|
|Zelda Phantom Hourglass|101C3600|101C3700|101C3800|

a config.txt can look like this for example:
```
a=fw.img
b=rednand/fw.img
x=wiiu/apps/ftpiiu/ftpiiu.elf
down=wiiu/apps/snes9x2010_libretro/snes9x2010_libretro.elf
default=wiiu/apps/homebrew_launcher/homebrew_launcher.elf
```
please note though that if you want to load a fw.img the name HAS to be named fw.img in whatever folder you use, nothing else will work.  

## contents

* hbl_loader: a loader which will load up the homebrew launcher from sd card
* haxchi_rop.s: hachihachi process ROP which will emit hbl_loader as executable
* haxchi.s: generates a malicious SRL file

## credit

smea, plutoo, yellows8, naehrwert, derrek, FIX94 and dimok