Yaya48/dolphin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record HackMii installer milestone

Browse Source 
Document the validated unmodified LetterBomb and HackMii v1.2 path through IOS58 reload, preparation, Wii Remote input and the interactive installer menu.
This commit is contained in:
Yaya48
2026-08-25 17:55:43 +02:00
parent a77c156bc8
commit 08c9886169
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Wii_IOS_LLE.md
+13 -6
View File
@@ -273,6 +273,12 @@ An isolated boot probe using the local, mutually matching dumps has executed thi
initialized `/dev/usb/oh0`, `/dev/usb/ehc`, `/dev/usb/usb`, and `/dev/usb/ven`, then released
Broadway into the channel. HBC rendered its normal interface at 59.94 FPS without modifying its
executable or bypassing the reload.
19. LetterBomb loaded an unmodified HackMii Installer v1.2 from the virtual SD card. The installer
enumerated the NAND titles, selected and launched IOS58 revision `0x1820`, completed its
preparation and signature-checking work, displayed `Press 1 to continue`, accepted the emulated
Wii Remote input, and opened the HackMii installation menu. No HackMii binary, timer, syscall, or
detection check was patched. Its preparation phase is currently much slower than on hardware
because ARM-heavy IOS transients still run through the Starlet interpreter.
The probe never prints ROM, NAND, key, or firmware instruction bytes. The committed unit suite
covers ARM-to-Thumb loads into PC, high Starlet exception vectors, privileged `LDM ... ^` user-bank
@@ -294,12 +300,13 @@ the three pre-existing bad-ECC pages in the source dump, a valid EXI reset vecto
`HW_RESETS == 0xffffffff`.
The current end-to-end boundary is a rendered, controller-connected and post-health-screen System
Menu with its populated channel grid, followed by a successful original IOS80-to-IOS58 reload and
a rendered Homebrew Channel. The path sustains PPC-to-original-IOS filesystem, DI, Bluetooth HID,
SDIO/Wi-Fi and network-service traffic. The stabilized Menu has been measured at 59.91 FPS and HBC
at 59.94 FPS. It proves the emulated first Wii Remote's pairing, L2CAP setup, command exchange and
input-report path, but not every extension, multiple-controller scenario, reconnection edge case,
packet-level networking, resource manager, or timing-sensitive exploit.
Menu with its populated channel grid, followed by a successful original IOS80-to-IOS58 reload, a
rendered Homebrew Channel, and LetterBomb reaching the interactive HackMii Installer menu. The path
sustains PPC-to-original-IOS filesystem, DI, Bluetooth HID, SDIO/Wi-Fi and network-service traffic.
The stabilized Menu has been measured at 59.91 FPS and HBC at 59.94 FPS. It proves the emulated
first Wii Remote's pairing, L2CAP setup, command exchange and input-report path, but not every
extension, multiple-controller scenario, reconnection edge case, packet-level networking, resource
manager, or timing-sensitive exploit.
## Remaining blockers