Wii Hacking Basics

[111]

With the exception of Nintendo games and SD/SDHC cards, all software listed in this guide is available for free.  If you paid for anything else listed in this guide, such as exploits (game or otherwise), the HackMii Installer, or any software that is run through the Homebrew Channel, you have been scammed!

The purpose of this guide is to cover some of the basics of Wii hacking, along with setting up Gecko/GeckoOS and patching IOS36.  In addition, I have also included instructions on how to update to the latest version of the Wii Shop Channel without updating through Nintendo.

This guide does not support unofficial System Menu updates, and it only (currently and directly) supports the patching of IOS36.

NOTE:  I am currently looking for step-by-step instructions on how to run Indiana Pwns, (possibly) Yu-Gi-OWNED!/Yu-Gi-Vah, and how to patch IOS36 with the Simple IOS Patcher.  If anyone can provide that to me, it would be greatly appreciated!

Thanks to dcx2 for instructions on how to patch IOS36!

If you see any errors in this guide, or have any suggestions, please let me know.

This guide is separated into three different posts, due to a character limit on posts.  A "table of contents" is listed below...

1.  System Menu Information

2.  Save files
        2A.  Backing up save files
        2B.  Placing save files onto the console

3.  Obtaining MAC Address

4.  Exploits
        4A.  Game Exploits
                4AA.  Smash Stack/Unofficial Japanese version
                4AB.  Indiana Pwns
                4AC.  Yu-Gi-OWNED!/Yu-Gi-Vah
        4B.  System Menu/IOS Exploits
                4BA.  Bannerbomb
                          4BAA.  System Menu 3.0 to 4.1
                          4BAB.  System Menu 4.2
                4BB.  LetterBomb

5.  HackMii Installer
        5A.  BootMii Install
        5B.  Homebrew Channel Install

6.  BootMii
        6A.  Differences between installation as boot2 and IOS
        6B.  Making a NAND backup (BootMii as boot2 and IOS)
        6C.  Restoring a NAND backup (BootMii as boot2)
        6D.  Restoring a NAND backup (BootMii as IOS)

7.  Homebrew Channel

8.  Patching IOS36

9.  Gecko/GeckoOS
        9A.  Obtaining codes
                9AA.  Accio Hacks
                9AB.  GeckoCodes.org
        9B.  Running Gecko/GeckoOS through the Homebrew Channel

10.  Update the Wii Shop Channel without updating the System Menu

System Menu Information:

Spoiler for Hiden:

See the following pages for System Menu information...

http://www.wiibrew.org/wiki/System_Menu
http://www.nintendo.com/consumer/systems/wii/en_na/systemMenuFeatures.jsp

I would recommend checking sites like these (including these forums) before updating.  Usually, newer Nintendo updates contain "anti-hacking" measures, such as patching exploits (Twilight Hack, Bannerbomb), and attempts to remove BootMii as boot2/IOS, and the Homebrew Channel.

I would personally recommend against updating.  However, it is really up to you, the reader.  You might have different intentions with the Wii than I do, so all that I am offering here is an opinion.  If the Wii does what you want it to do, then perhaps you shouldn't change anything with it.

If you want to update, I would personally recommend only updating to System Menu 4.0 or 4.1, assuming that you are currently on a System Menu lower than that.  System Menu 4.0 is the first System Menu with the SD Card Menu, and all that System Menu 4.1 does is fix a bug related to the SD Card Menu and the Wii MotionPlus video in Wii Sports Resort.  All that System Menus 4.2 and 4.3 do is attempt to block the Homebrew Channel and Bannerbomb (System Menu 4.3 has blocked Bannerbomb), and they don't really add any new features.

Games/discs which contain System Menu 4.1...

Netflix Instant Streaming Disc
New Super Mario Bros. Wii
Red Steel 2


I am not aware of any way to (officially) update to System Menu 4.0.  Unofficial methods to update the System Menu are not supported in this guide.

Save files:

Spoiler for Hiden:

Backing up save files:

Spoiler for Hiden:

Starting from the Wii Menu (what appears after the Health and Safety screen), click on the "Wii" button, which is located at the bottom left-hand corner of the Wii Menu.

On the next screen that appears, click on "Data Management."

Next, click on the "Save Data" button.

Now, click on the "Wii" button.

Locate the save file that you want to back up to an SD card, and click on it.

When asked if you want to copy to an SD card, click on "Yes."

Placing save files onto the console:

Spoiler for Hiden:

Starting from the Wii Menu (what appears after the Health and Safety screen), click on the "Wii" button, which is located at the bottom left-hand corner of the Wii Menu.

On the next screen that appears, click on "Data Management."

Next, click on the "Save Data" button.

Now, click on the "Wii" button.

Now, near the top right-hand corner of the screen, click on the "SD Card" tab, and you will see the Wii save file(s) that you currently have on your SD card.

Locate the proper file, click on it, and select "Copy," and click on "Yes" when it asks if you want to copy to the Wii System Memory.

Obtaining MAC Address:

Spoiler for Hiden:

Starting from the Wii Menu (what appears after the Health and Safety screen), click on the "Wii" button, which is located at the bottom left-hand corner of the Wii Menu.

On the next screen that appears, click on "Wii Settings."

Next, click on the arrow on the right-hand side to go to the next page.

Next, click on the "Internet" button.

Now, click on "Console Information," and you should then see your MAC Address.

[111]

Exploits:

Spoiler for Hiden:

NOTE:  For all exploits listed here, the HackMii Installer will be used as an example of what can be used as the "boot.elf" or "boot.dol" file on the root of your SD card.

NOTE 2:  I have removed the instructions for the Twilight Hack and the Homebrew Channel Installer ISO.  If you are on System Menu 4.2 or lower, then I would recommend the Bannerbomb section of this guide as a perfect substitute.  If you are on System Menu 4.3, please go to the LetterBomb section.  Both are listed under "System Menu/IOS Exploits."

If you would still like to read these sections, I have placed them on the following post...

http://wiird.l0nk.org/forum/index.php/topic,6843.msg72837.html#msg72837

Game Exploits:

Spoiler for Hiden:

Smash Stack:

Spoiler for Hiden:

Current Status:  Currently works on System Menu 3.1 and all higher versions.*

*If you have a Wii Freeloader, you may be able to use it to bypass the update partition on the disc, and not update to System Menu 3.1.  However, there is nothing too bad about System Menu 3.1, other than it blocking older GameCube Action Replays if you are on System Menu 2.2 or lower.  Also, the Wii Freeloader will not work on System Menu 3.3 or higher.

Requirements:
Super Smash Brothers Brawl
1 SD Card (SDHC is not supported by Super Smash Brothers Brawl)
A way to access the SD card from your computer.

Steps:
Insert the Super Smash Brothers Brawl disc into the Wii, and load it from the Disc Channel.

At the "Select Mode" screen, select "Vault."

From here, select "Stage Builder."

At this point, you will need to either backup or delete all custom stages that are stored on here.  The Smash Stack will not work if any custom stages are on the console.

Next, download the Smash Stack by clicking on the following link, and extract the files...

http://www.wiibrew.org/w/images/4/4e/Smashstack.zip

If a "private" folder exists on your SD card, rename it to something else, such as "privateold."

In the extracted "Smashstack" folder, you will see a folder named "private."  Copy that folder to the root of your SD card.

Next, you will need to place a "boot.elf" file on the root of your SD card.  Otherwise, the Smash Stack will not have anything to load.  As stated above, the example that I will use is the HackMii Installer.

NOTE:  A "boot.dol" file does not work.

After you have done this, the file structure of your SD card should look like this...

SD:\private\wii\app\rsbe\st\st_080805_0933.bin
SD:\boot.elf

Insert the Super Smash Brothers Brawl disc into the Wii, and load it from the Disc Channel.

At the "Select Mode" screen, select "Vault."

From here, select "Stage Builder," but before you do so, make sure that the SD card is inserted.

The Smash Stack should then load the "boot.elf" file that you placed onto the root of your SD card.

Unofficial Japanese version:

Insert the Super Smash Brothers Brawl disc into the Wii, and load it from the Disc Channel.

At the "Select Mode" screen, select "Vault."

From here, select "Stage Builder."

At this point, you will need to either backup or delete all custom stages that are stored on here.  The Smash Stack will not work if any custom stages are on the console.

Next, download this version from the link below, and extract the files...

http://www.wiibrew.org/w/images/5/56/Smash_stack_JP.zip

If a "private" folder exists on your SD card, rename it to something else, such as "privateold."

Open the extracted "Smash_stack_JP" folder, and open the next folder that you see.

At this point, you will see a "private" folder.  Copy it to the root of your SD card.

Next, you will need to place a "boot.elf" file on the root of your SD card.  Otherwise, the Smash Stack will not have anything to load.  As stated above, the example that I will use is the HackMii Installer.

NOTE:  A "boot.dol" file does not work.

After you have done this, the file structure of your SD card should look like this...

SD:\private\wii\app\RSBJ\st\st_smashstackjp.bin
SD:\boot.elf

Insert the Super Smash Brothers Brawl disc into the Wii, and load it from the Disc Channel.

At the "Select Mode" screen, select "Vault."

From here, select "Stage Builder," but before you do so, make sure that the SD card is inserted.

The Smash Stack should then load the "boot.elf" file that you placed onto the root of your SD card.

Indiana Pwns:

Spoiler for Hiden:

Current Status:  Currently works on all current System Menu versions.

Requirements:
Lego Indiana Jones: The Original Adventures
1 SD Card (SDHC is not suppported)
A way to access the SD card from your computer.

Steps:
First, backup your "Indiana Jones: The Original Adventures" save file, if you have one.  See the "Backing up save files" section of this guide to see how to do that.

If a "private" folder exists on your SD card, rename it to something else, such as "privateold."

Next, download the Indiana Pwns save file from the link below, and extract the files...

http://static.hackmii.com/indiana-pwns.zip

Open the "indiana-pwns" folder, and you will see a folder named "private."  Copy that folder to the root of your SD card.

NOTE:  Even though there is a JAP save file included with the download file, a Japanese version of LEGO Indiana Jones does not exist.  Therefore, owners of Japanese Wii consoles will need another solution, such as the unofficial Japanese version of the Smash Stack.

Next, you will need to place a "boot.elf" file on the root of your SD card.  Otherwise, the Indiana Pwns exploit will not have anything to load.  As stated above, the example that I will use is the HackMii Installer.

NOTE:  A "boot.dol" file may also work.

After you have done this, the file structure of your SD card should look like this...

SD:\private\wii\title\rlie\data.bin
SD:\private\wii\title\rlij\data.bin
SD:\private\wii\title\rlip\data.bin
SD:\boot.elf

Place the appropriate region of the Indiana Pwns save file onto your Wii console.  See the "Placing save files onto the console" section of this guide to see how to do that.

Insert the LEGO Indiana Jones disc into the console, and load it from the Disc Channel.

Unfortunately, I do not have this game, so I cannot give clear instructions on how to trigger the exploit.  If you can provide clearer instructions for this guide, please let me know!  It would be greatly appreciated.

Yu-Gi-OWNED!:

Spoiler for Hiden:

Current Status:  Currently works on all current System Menu versions.

Requirements:
PAL version of Yu-Gi-Oh! 5D's Wheelie Breakers
1 SD Card (SDHC is not suppported)
A way to access the SD card from your computer.

NOTE:  This exploit is only for PAL Wii consoles.  For a version of the exploit which supports NTSC-U and NTSC-J game discs, go to the Yu-Gi-Vah section below, which is an unofficial port of Yu-Gi-OWNED!

Steps:
First, backup your "Yu-Gi-Oh! 5D's Wheelie Breakers" save file, if you have one.  See the "Backing up save files" section of this guide to see how to do that.

If a "private" folder exists on your SD card, rename it to something else, such as "privateold."

Next, download the Yu-Gi-OWNED! save file from the link below, and extract the files...

http://wiibrew.org/w/images/f/f7/Yu-Gi-OWNED!_Beta_1.zip

Open the "Yu-Gi-OWNED!_Beta_1" folder, and you will see three folders, named "50Hz version," "60Hz version," and "For Developers Only."  You will also see a "README.txt" file.

From here, you will need to choose the appropriate folder, which is either "50Hz version," or "60Hz version."

Open the appropriate folder, and copy the "private" folder to the root of your SD card.

Next, you will need to place a "boot.elf" or "boot.dol" file on the root of your SD card.  Otherwise, the Yu-Gi-OWNED! exploit will not have anything to load.  As stated above, the example that I will use is the HackMii Installer.

After you have done this, the file structure of your SD card should look like this...

SD:\private\wii\title\ryop\data.bin
SD:\boot.elf OR SD:\boot.dol

Place the Yu-Gi-OWNED! save file onto your Wii console.  See the "Placing save files onto the console" section of this guide to see how to do that.

Insert the Yu-Gi-Oh 5D's Wheelie Breakers disc into the console, and load it from the Disc Channel.

Unfortunately, I do not have this game, so I cannot give clear instructions on how to trigger the exploit.  However, based on videos of the exploit, it seems pretty easy and straightforward.  At most, it just appears that you have to press the "A" button at least once.

If you can provide clearer instructions for this guide, please let me know!

Yu-Gi-Vah:

Requirements:
NTSC-U or NTSC-J version of Yu-Gi-Oh! 5D's Wheelie Breakers
1 SD Card (SDHC is not suppported)
A way to access the SD card from your computer.

NOTE:  This exploit is an unofficial version of Yu-Gi-OWNED!, and only works with NTSC-U and NTSC-J consoles.  For a version of the exploit which supports PAL consoles, go to the Yu-Gi-OWNED! section above.

Steps:
First, backup your "Yu-Gi-Oh! 5D's Wheelie Breakers" save file, if you have one.  See the "Backing up save files" section of this guide to see how to do that.

If a "private" folder exists on your SD card, rename it to something else, such as "privateold."

Next, download the Yu-Gi-Vah! save file from the link below, and extract the files...

http://wiibrew.org/w/images/0/0e/YuGiOh5DNTSCU.rar

Open the "YuGiOh5DNTSCU" folder, and you will see a "private" folder, and a readme.  Copy the "private" folder to the root of your SD card.

Next, you will need to place a "boot.elf" or "boot.dol" file on the root of your SD card.  Otherwise, the Yu-Gi-Vah exploit will not have anything to load.  As stated above, the example that I will use is the HackMii Installer.

After you have done this, the file structure of your SD card should look like this...

SD:\private\wii\title\RYOE\data.bin
SD:\boot.elf OR SD:\boot.dol

Place the Yu-Gi-Vah save file onto your Wii console.  See the "Placing save files onto the console" section of this guide to see how to do that.

Insert the Yu-Gi-Oh 5D's Wheelie Breakers disc into the console, and load it from the Disc Channel.

Unfortunately, I do not have this game, so I cannot give clear instructions on how to trigger the exploit.  However, based on videos of the exploit, it seems pretty easy and straightforward.  At most, it just appears that you have to press the "A" button at least once.

If you can provide clearer instructions for this guide, please let me know!

System Menu/IOS Exploits:

Spoiler for Hiden:

Bannerbomb:

Spoiler for Hiden:

Current Status:  Works on System Menu 3.0 to 4.2.

Requirements:
1 SD card, which will work on System Menu 3.0 to 4.2.  If you are on 4.0 or above, then SDHC cards will also work.
A way to access the SD card from your computer.

System Menu 3.0 to 4.1:

Spoiler for Hiden:

NOTE:  This version must be booted through the "Channels" option on "Data Management."  Booting it through the SD Card Menu will not work.

If a "private" folder exists on your SD card, rename it to something else, such as "privateold."

Next, download Bannerbomb from the link below, and extract the files...

http://bannerbomb.qoid.us/index.old.php

Open the "aad1f_v108" folder, and you will see a folder named "private."  Copy that folder to the root of your SD card.

NOTE:  If the "aad1f_v108" file does not work for you, the Bannerbomb site listed above has other versions that you can try.

Next, you will need to place a "boot.elf" or "boot.dol" file on the root of your SD card.  Otherwise, Bannerbomb will not have anything to load.  As stated above, the example that I will use is the HackMii Installer.

After you have done this, the file structure of your SD card should look like this...

SD:\private\wii\title\aktn\content.bin
SD:\boot.elf OR SD:\boot.dol

Starting from the Wii Menu, click on the "Wii" button near the bottom left-hand corner of the screen.

On the next screen, click on "Data Management," and then "Channels."

Next, click on the tab titled "SD Card," which is located at the top right-hand corner of the screen.

You should see a message which says "Load boot.dol/elf?," along with a message stating that Bannerbomb is free software.  Select yes to launch the "boot.dol/elf" file on the root of your SD card.

System Menu 4.2:

Spoiler for Hiden:

NOTE:  This version must be booted through the SD Card Menu.  Booting it through the Data Management will not work.

If a "private" folder exists on your SD card, rename it to something else, such as "privateold."

Next, download Bannerbomb from the link below, and extract the files...

http://bannerbomb.qoid.us/index.new.php

Open the "abd6a_v200" folder, and you will see a folder named "private."  Copy that folder to the root of your SD card.

NOTE:  If the "abd6a_v200" file does not work for you, the Bannerbomb site listed above has other versions that you can try.

Next, you will need to place a "boot.elf" or "boot.dol" file on the root of your SD card.  Otherwise, Bannerbomb will not have anything to load.  As stated above, the example that I will use is the HackMii Installer.

After you have done this, the file structure of your SD card should look like this...

SD:\private\wii\title\aktn\content.bin
SD:\boot.elf OR SD:\boot.dol

Starting from the Wii Menu, click on the SD Card icon (located to the right of the "Wii" button) near the bottom left-hand corner of the screen.

If this is the first time that you opened the SD Card Menu, you may see an introduction to the menu.  Proceed through the introduction by clicking on the "Next" button a few times (I believe three times), and clicking on "Close" at the end.

You should see a message which says "Load boot.dol/elf?," along with a message stating that Bannerbomb is free software.  Select yes to launch the "boot.dol/elf" file on the root of your SD card.

-  This version may also work on System Menu 4.0 and 4.1.  However, it was designed for 4.2.  (Works for me on System Menu 4.1 (SNEEK).)

LetterBomb:

Spoiler for Hiden:

Current Status:  Works on System Menu 4.3.

Requirements:
Internet access.
System Menu 4.3
1 SD or SDHC card.
A way to access the SD card from your computer.

Steps:
If a "private" folder exists on your SD card, rename it to something else, such as "privateold."

Next, go to the following link...

http://please.hackmii.com

Next, select the 4.3 System Menu region that you are currently on.

You will now need to know your MAC Address.  See the "Obtaining MAC Address" portion of this guide for instructions on how to obtain it.

If you do not want the HackMii Installer bundled with the file, click the checkmark next to "Bundle the HackMii Installer for me!"  The box is checked by default, and for the purposes of this guide, it will be assumed that you chose to have the HackMii Installer bundled with LetterBomb.

After you have selected your System Menu region and entered your MAC Address, enter the correct answer to the captcha, and click on either "Cut the red wire" or "Cut the blue wire" to download "LetterBomb.zip."  After you have downloaded it, extract the files.

Open the "LetterBomb" folder, and you will see a folder named "private," and files named "boot.elf," "CREDITS.txt," "LICENSE.txt," "README.txt," "README-BootMii.txt," and "README-HBC.txt."  Copy the "private" folder, and those other files to the root of your SD card.

After you have done this, the file structure of your SD card should look like this...

SD:\private\wii\title\HAEA\xxxxxxxx\xxxxxxxx\YEAR\xx\xx\xx\xx\HABA_#1\txt\xxxxxxxx.000

SD:\boot.elf OR SD:\boot.dol
SD:\CREDITS.txt
SD:\LICENSE.txt
SD:\README.txt
SD:\README-BootMii.txt
SD:\README-HBC.txt

NOTE:  Since this exploit must be generated for each individual Wii, I cannot say exactly how the structure in your "private" folder will look.  I believe the part that I marked "YEAR" shows the current year, since both files that I generated showed 2011, which is the current year at the time of this addition.  However, I cannot say for certain.  Everything else was the same in both files, but I can't say if that will ever change either.  For the parts marked with x's, I cannot say what it will be for you.

Next, insert the SD card into your Wii, and start the Wii, if you haven't already.

When the Wii System Menu loads, click on the Envelope icon in the bottom right-hand corner.

Browse to yesterday, as this should be where most people will see the LetterBomb icon.  However, sometimes it may show under "today" or "two days ago."

Click on the LetterBomb icon, and the LetterBomb exploit should then execute.

- This exploit currently only works on System Menu 4.3.  From my experience, if you try it on any other System Menu, the Wii will freeze.  The same will probably happen if you use the wrong region.

- The file that you generate will only work on your Wii console.  If you wish to use LetterBomb on another Wii console, you will need to use the LetterBomb website to generate another file.

- If you are on System Menu 4.2 or lower, and are looking for an exploit that doesn't require a game, then please refer to the "Bannerbomb" portion of this guide, which is right above the instructions listed here.

[111]

HackMii Installer:

Spoiler for Hiden:

NOTE:  Starting with version 0.7 of the HackMii Installer, BootMii as IOS is now installed by default.  If you don't want it, you will have to uninstall it after you are done with everything else.  Once you uninstall BootMii as IOS, the HackMii Installer will automatically exit.

Download the HackMii Installer from the following site, and extract the files... http://www.bootmii.org/download/

When first starting the HackMii Installer, you will see a screen which states that the HackMii Installer is free software, and that you have been scammed if you paid for it.  After a few seconds, it should say "Press 1 to continue" at the bottom of the screen.  Press 1 on the Wii Remote (or A on the GameCube controller) to continue.

On the next screen, it will tell you whether or not the Homebrew Channel and BootMii can be installed.  If either one can be installed, you should be able to proceed to the next page by selecting "Continue."  See below for BootMii and Homebrew Channel instructions.

BootMii Install:

Spoiler for Hiden:

On the "Main menu," select the option titled "BootMii..."

If you can install BootMii as boot2, I would recommend doing so by selecting "Install BootMii as boot2."

If you can only install BootMii as an IOS, and you would like to keep it, then select "Prepare a SD card," and on the next screen, select "Yes, continue," and BootMii files will be written to your SD card.  These are required to use BootMii as boot2 and/or IOS.  The file structure will look like this...

SD:\bootmii\armboot.bin
SD:\bootmii\bootmii.ini
SD:\bootmii\ppcboot.elf

If you want to make sure that you have the most recent version of BootMii as IOS, then select "Install BootMii as IOS," and select "Yes, continue."

It will try to create the files for your SD card again.  Once again, click on "Yes, continue" when asked to "Install BootMii/IOS now?"

When it is done installing, select "Continue," and then select "Return to the main menu."

If you still need to install the Homebrew Channel, see below.  Otherwise, select "Exit" on the main menu, and it should either take you to the Homebrew Channel (if you installed it), or return you to the System Menu.

-  BootMii as boot2 install is the same process as BootMii as IOS install.

Homebrew Channel Install:

Spoiler for Hiden:

On the "Main menu," select the option titled "Install The Homebrew Channel."

On the next screen, select "Yes, continue."

When it is done, select "Continue," and you can then select "Exit" if you are done with the HackMii Installer.  This will take you to the Homebrew Channel.

BootMii:

Spoiler for Hiden:

BootMii was created by Team Twiizers, and it allows for low-level control of the Wii, without relying on Nintendo IOS.  Basically, no Nintendo code is used at this point.

NOTE:  The Wii Remote does not work when using BootMii.  You will need to either use a GameCube controller to navigate BootMii, or you will need to press the Power button to scroll through the options, and then the Reset button to select the option that you want to use.

Differences between installation as boot2 and IOS:

Spoiler for Hiden:

The main difference between the boot2 and IOS versions is that the boot2 version basically allows for maximum brick protection.  BootMii as IOS is basically used to run certain homebrew applications designed for BootMii, although few exist at this time.  To read some of the differences, see the link below...

http://www.hackmii.com/2009/02/bootmii-and-the-new-boot1/

Unfortunately, newer Wii consoles prevent a boot2 install.  However, I would still recommend installing BootMii as an IOS, and making a NAND backup (see below).  If you can install as boot2, I would definitely recommend that, as it would essentially allow you to recover from almost any brick.

Making a NAND backup (BootMii as boot2 and IOS):

Spoiler for Hiden:

NOTE:  I would recommend having at least 600MB of free space available on your SD card.  If you do not have enough space, you will be unable to make a NAND backup.

NOTE 2:  If you make a NAND backup with 3.3 or lower, you likely have/had "boot2v2," and if you updated to System Menu 4.2 or higher, you may have "boot2v4."  System Menu 3.3 or lower may not work properly with boot2v4 installed.  Anytime you decide to update the System Menu, I would recommend making a NAND backup.

First, starting from the BootMii screen, navigate (by either using a GameCube controller or by using the Power button on the Wii console) to the button that is closest to the right side of the screen, or to the right of the SD card button, and press A (on GameCube controller) or Select (on Wii console).

On the next screen, select the option closest to the left, and follow the instructions to make a NAND backup.

When the NAND backup is completed, two new files will have been created on your SD card.  They will be named "nand.bin," and "keys.bin."  Make sure to save/backup these files.

Restoring a NAND backup (BootMii as boot2):

Spoiler for Hiden:

First, starting from the BootMii screen, navigate (by either using a GameCube controller or by using the Power button on the Wii console) to the button that is closest to the right side of the screen, or to the right of the SD card button, and press A (on GameCube controller) or Select (on Wii console).

On the next screen, select the second option, or the one directly to the left with the "i" in a circle, and follow the instructions to restore a NAND backup.

Restoring a NAND backup (BootMii as IOS):

Spoiler for Hiden:

First, please note that there is no "safety net" when restoring a NAND backup with BootMii as IOS, like there is with a boot2 install.  Therefore, this might want to be considered as a last resort to a problem, since if you can access BootMii as IOS, you should probably be able to fix the problem anyway.  Do not needlessly attempt to restore NAND backups if you only have BootMii installed as IOS.  BootMii NAND restore never writes to boot2, so a boot2 NAND restore should always have a "safety net."

First, starting from the BootMii screen, navigate (by either using a GameCube controller or by using the Power button on the Wii console) to the button that is closest to the right side of the screen, or to the right of the SD card button, and press A (on GameCube controller) or Select (on Wii console).

On the next screen, select the second option, or the one directly to the left with the "i" in a circle, and follow the instructions to restore a NAND backup.

At some point, you will be asked to enter the Konami Code.  Only enter this code if you are absolutely sure of what you are doing.

Homebrew Channel:

Spoiler for Hiden:

The Homebrew Channel is a channel that can be installed to the Wii, and it allows you to run homebrew applications directly through it.  This gives an obvious convenience over the numerous save game exploits, since you do not have to load a game each time.  In many cases, it is quicker than Bannerbomb, as well.

NOTE:  If a homebrew application uses the HW_AHBPROT feature, you must have at least version 1.0.7 of the Homebrew Channel installer in order to utilize it.

NOTE 2:  The Homebrew Channel can support SD cards, SDHC cards, USB devices, USB Gecko, SD Gecko, and wireless.

NOTE 3:  If you install IOS58 prior to installing the Homebrew Channel, the Homebrew Channel will then use IOS58.  This will give you USB 2.0 speeds when loading homebrew applications through USB devices.  If you do not install IOS58 before installing the Homebrew Channel, USB will be limited to 1.1 speeds.  IOS58 can be installed using the IOS58 installer.  If you are on System Menu 4.3 or higher, then you already have IOS58.

Patching IOS36:

Spoiler for Hiden:

NOTE:  This method requires that you at least have version 1.0.7 of the Homebrew Channel installed.  This application uses the HW_AHBPROT feature to patch IOS36, which is not available on the Homebrew Channel version 1.0.6 and lower.

NOTE 2:  If you are on System Menu "3.3v1" or lower, then patching IOS36 should not be required.

First, download the Simple IOS Patcher by clicking on the following link, and extract the files... http://www.wii-homebrew.com/download/nintendo-wii-downloads/wii-tools/simple-ios-patcher/download?m=0

Click on the extracted "simple_ios_patcher_v1.0" folder, click on "apps," and you should then see a folder named "Simple IOS Patcher."

Copy the "Simple IOS Patcher" into the "apps" folder on the root of your SD card, and boot it through the Homebrew Channel.  The file structure of your SD card will look like the following...

SD:\apps\Simple IOS Patcher\boot.dol
SD:\apps\Simple IOS Patcher\icon.png
SD:\apps\Simple IOS Patcher\meta.xml

Use NUS Downloader to download v3351 of IOS36, if you do not have an internet connection for the Wii.  If you do, then you can skip this step.  Place it into a "wad" folder on the root of your SD card.

After booting the Simple IOS Patcher through the Homebrew Channel, you will be asked what IOS you want to patch.  Scroll through the list until you see "IOS36."

On the next screen, make sure that "yes" is selected next to "Patch ES_Identify," and select "Install patched IOS36."  The other patches are not necessary.

Select where you want to get IOS36 from (online, offline), and press A twice to install it.

After this has been done, you should have the channel and Rebooter options on Gecko/GeckoOS.

NOTE:  The "meta.xml" file is required.  Without that file, the HW_AHBPROT feature will not be in use.

Gecko/GeckoOS:

Spoiler for Hiden:

NOTE:  To use the Rebooter and Channel cheats, you may need to patch IOS36.  Please see the "Patching IOS36" option of this guide for instructions on how to do it.

Obtaining codes:

Spoiler for Hiden:

Accio Hacks:

Spoiler for Hiden:

Requirements:
1 SD or SDHC card
Internet connection on the Wii

Steps:
Download Accio Hacks from the link below, and extract the files...

http://www.geckocodes.org/AH.php?dl

Open the "AHv1.0.0" folder, and you will see a folder named "AccioHacks."  Copy that folder into the "apps" folder on your SD card.

The file structure of your SD card should look like the following...

SD:\apps\AccioHacks\boot.dol
SD:\apps\AccioHacks\icon.png
SD:\apps\AccioHacks\meta.xml
SD:\apps\AccioHacks\Readme.txt

Load Accio Hacks through the Homebrew Channel.

On the first screen, select "Accio Hacks/Manage Codes."

Next, select what you want codes for (Wii, Virtual Console, WiiWare, etc.)

On the next screen, select the beginning letter of the game that you want.  For example, if I want codes for Super Smash Brothers Brawl, I would select "S."

Next, select "Accio Hacks."

On the next screen, either select "Any/All Regions," or select the region of the game that you are using.

The list will be generated.  After it has been generated, select the game from the list.

After you select the game, read the information that appears on the screen.

The TXT file will be downloaded to your SD card.  After this has been done, press "Back" twice, and select the TXT file.

On the next screen, you will see a list of codes.  Select the codes that you want to use.

Press the back button once, and select "Yes, Save and Create gct."  The GCT file will then be created on your SD card.

The file structure on your SD card should look like the following (once again, the game example is Super Smash Brothers Brawl)...

SD:\codes\RSBE01.gct
SD:\codes\R\S\RSBE01.txt

Next, load Gecko/GeckoOS from the Homebrew Channel, and select "Launch Channel" or "Launch Game," depending on what you are looking to use codes on.

GeckoCodes.org:

Spoiler for Hiden:

First, if you have not done so already, create a folder named "codes" on the root of your SD card.

Use the following site for codes... http://www.geckocodes.org

Navigate to the game that you want.  For this example, I am going to use the following page, which is for the NTSC version of Twilight Princess... http://www.geckocodes.org/index.php?c=RZDP01

Near the top of that page, you will see an option named "GCT."  Click on that option.

On the next page, select "Add Codes," and select the codes that you want to use.

When you are done, click on the "Download GCT" option, and you will see an option to download the cheat/GCT file.

Save the cheat file to the "codes" folder on the root of your SD card.

For example, assuming that you created a GCT file for Super Smash Brothers Brawl, the file structure of your SD card would look like the following...

SD:\codes\RSBE01.gct

Running Gecko/GeckoOS through the Homebrew Channel:

Spoiler for Hiden:

Download the latest version of Gecko, which is 1.9.3.1, by clicking on the following link...  http://wiird.l0nk.org/projectfiles/Gecko1931.zip

Extract the file, and then open the extracted "Gecko1931" file.

Click on the "Gecko1931" folder two more times (you will see it on the next screen, along with "docs" and a text file named "Gecko1931").

Click on "HBC," and you will see a "Gecko1931" folder in it, along with a "Readme" file.  Copy that "Gecko1931" folder into the "apps" folder on the root of your SD card.

The file structure of your SD card should look like the following...

SD:\apps\Gecko1931\boot.elf
SD:\apps\Gecko1931\icon.png
SD:\apps\Gecko1931\meta.xml

Load Gecko 1.9.3.1 through the Homebrew Channel.

When Gecko 1.9.3.1 is loaded, simply select "Launch Game."  SD codes should be on by default.

If you are using channel cheats, select "Launch Channel."  As stated above, you might need to patch IOS36 in order to use this.

Update the Wii Shop Channel without updating the System Menu:

Spoiler for Hiden:

First, download NUS Downloader and wadImport, and extract the files.

Next, open the "wadImport_v0.2-cred" folder that you just extracted, and you will see a file named "wadImport.dol.dol."  Rename it to "boot.dol."

Assuming that you are using the Homebrew Channel, place the "wadImport_v0.2-cred" into the "apps" folder on the root of your SD card.

Next, create a folder called "wad" on the root of your SD card.

Download the file named "WiiShopUpdate.nus," which can be found at the bottom as an attachment to this guide.  Save it in the "NUSD_v15aBeta" folder that you just extracted.

Open the "NUSD_v15aBeta" folder on your computer, and click on "NUS Downloader."

When NUS Downloader opens, the first thing you need to do is place a checkmark next to the "Pack -> WAD" option.  This option is directly under the "Wii" symbol, which should also be selected.

Now, click on "Extras...," which is located near the top of the NUS Downloader screen, and click on "Load NUS Script."

Select the "WiiShopUpdate.nus" script, which you should already see, and NUS Downloader will then download the correct files.  If you do not see it, make sure that you are in the "NUSD_v15aBeta" folder, assuming that you saved the "WiiShopUpdate.nus" file there.

When it has finished downloading, NUS Downloader will display a message saying "Script completed!", and you will see two new folders in the "NUSD_v15aBeta" directory, named "0001000248414241v20" and "0000000100000038v5662."

Open the "0001000248414241v20" folder, and you should see a file named "Shopping Channel-NUS-v20.wad."  Copy and place this file into the "wad" folder on your SD card.

Open the "0000000100000038v5662" folder, and you should see a file named "IOS56-64-v5662.wad."  Copy and place this file into the "wad" folder on your SD card.

After you have done this, the file structure of your SD card should look like the following...

SD:\apps\wadImport_v0.2-cred\boot.dol
SD:\wad\Shopping Channel-NUS-v20.wad
SD:\wad\IOS56-64-v5662.wad

Start wadImport through the Homebrew Channel, and install those two files.  The order of installation should not matter, but if it does, try installing the "IOS56-64-v5662.wad" file first.

You should now be able to access the Wii Shop Channel.

Attachments:

Shop Channel NUS Script - Right-click on this link, and select "Save Link As...," or possibly "Save Target As...," if you are using Internet Explorer.

[dcx2]

You, sir, are awesome.

BTW, in 8A, you may want to plug AccioHacks.  It's a homebrew app that James0x57 wrote which simplifies the process of getting codes onto the Wii.  http://wiird.l0nk.org/forum/index.php/topic,6432.0.html

[Nuke]

Yu-Gi-OWNED? *chuckle*

I am out the loop on exploits, does this work the same as Zelda etc?

[dcx2]

Nuke - yeah, these basically work the same.  Deliver a payload through a corrupted save file, convince the game to trigger the payload, win 

I would offer my assistance with the IOS36 patching, but a proper test would require a fresh install on a 4.3, and I'm on 4.1 and I would like to stay there.  However, if need be, I can at least try it on mine, so you have the instructions (click here, then there, etc).

[111]

You, sir, are awesome.

BTW, in 8A, you may want to plug AccioHacks.  It's a homebrew app that James0x57 wrote which simplifies the process of getting codes onto the Wii.  http://wiird.l0nk.org/forum/index.php/topic,6432.0.html

I was going to add that, but forgot all about it, since I had never used it before.  I have some instructions for it that I will add shortly.

Very nice guide!

There is just one thing i am not certain of though.

Games/discs which contain System Menu 4.1...

Netflix Instant Streaming Disc
New Super Mario Bros. Wii
Red Steel 2

I thought NSMB wii had 4.2 on it. It was released Novemeber 2009.

Very good guide though.

Thanks.   

No, New Super Mario Brothers Wii has System Menu 4.1, not 4.2.  I "updated" with it on UNEEK, and Wiibrew says the same thing...

http://www.wiibrew.org/wiki/Disc_based_games
http://www.wiibrew.org/wiki/System_Menu

On the first link, "WiiSystemmenu-v449" is listed under "New Super Mario Bros. Wii."  According to the second link, 449 is System Menu 4.1U.

Super Mario Galaxy 2 has System Menu 4.2, though.

[Crystal Jinjo]

I cant see the attatchment to the file WiiShopUpdate.nus which I need to download to help update the shop channel.

[justin28]

How do i go about getting a wad" folder

[Bully@Wiiplaza]

won´t there be instructions for installing cios?
I personally don´t need the steps though...
I guess that people here only need to get gecko os and the homebrew channel running and to be against piracy (cios enables this option), that´s why it´s not posted right?

[justin28]

I am having real problems with installing the rebooter i keep getting this error when trying to install it:  Could not open file: sd:/ios36-64-v3351.wad.And this error as well

 Could not open file: sd:/ios36-64-v3351.wad.out.wad really need urgent help as i really want the rebooter option for wiiware cheats back again

[111]

I cant see the attatchment to the file WiiShopUpdate.nus which I need to download to help update the shop channel.

Sorry, the "WiiShopUpdate.nus" didn't post as an attachment when I made the thread, and I never noticed (apparently, attachments are not allowed on this forum).  Download the following file by right-clicking on the link below, and select "Save Link As..." or "Save Target As...," if you are using Internet Explorer...

http://111x.webs.com/WiiShopUpdate.nus

When you download that, follow the instructions to run it on the NUS Downloader, and it will download the files that you need.

won´t there be instructions for installing cios?
I personally don´t need the steps though...
I guess that people here only need to get gecko os and the homebrew channel running and to be against piracy (cios enables this option), that´s why it´s not posted right?

I wasn't planning on adding instructions to install Custom IOS files, since yes, this guide was created so there were some main instructions on getting Gecko/GeckoOS and Rebooter working on all System Menu versions.  Most homebrew programs now use the HW_AHBPROT feature, so a Custom IOS is not needed.  A patched IOS36 (for Rebooter/Channel cheats) is technically a Custom IOS, however.

How do i go about getting a wad" folder

Just create a folder named "wad" on the root of your SD card/USB Device.

I am having real problems with installing the rebooter i keep getting this error when trying to install it:  Could not open file: sd:/ios36-64-v3351.wad.And this error as well

 Could not open file: sd:/ios36-64-v3351.wad.out.wad really need urgent help as i really want the rebooter option for wiiware cheats back again

Did you download v3351 of IOS36 from NUS downloader?  Also, are you using the Simple IOS Patcher that I linked to in that portion of the guide?

[justin28]

Yes i did

[justin28]

I am using my internet connection to download the files 3351 but the thing just hangs their and dosent download

[111]

Are you trying to download IOS36v3351 with the NUS Downloader, or with the Simple IOS Patcher?  It seems to download fine for me with the NUS Downloader.  If your Wii is connected to the internet, try downloading IOS36v3351 with the Simple IOS Patcher, and see if it might work that way, if you are not already trying that.

Also, with NUS Downloader, make sure to pack IOS36 into a WAD file.

If you still cannot get it to work, run the HackMii Installer, and a file named "installer.log" will be placed on your SD card.  Post that file here.