Browse Source

new index and readme

stable
c? 1 year ago
parent
commit
bf0d5c43b9
2 changed files with 74 additions and 7 deletions
  1. 71
    2
      README.md
  2. 3
    5
      index.html

+ 71
- 2
README.md View File

@@ -1,3 +1,72 @@
this is the code in use on http://u.drg.li/ and http://stupiid.ovh/
# stUpiidhax: Wii U 5.5.2 browser pwn

you can download and host it on your own if you want, but you'll require an nginx server with SSI enabled.
This is the git repository for stUpiidhax, a very popular homebrew
entrypoint access gate for the Wii U's 5.5.2 firmware.

- Hosted access gate urls:
- http://stupiid.ovh/
- http://u.drg.li/

## JSTypeHax

This is based on the JumpCallPop JSTypeHax (aka WiiUTest) exploit.
Unfortunately, JumpCallPop's GitHub account was removed, leaving this
repo.

The latest changes to upstream are available in this repo under the
`fast` branch. While these changes do make the exploit much faster, they
also make it far less reliable. The most reliable version of the exploit
available is on the `stable` branch, which is also the version actively
hosted on my servers.

## SSI

Both the `stable` and `fast` branches have changes to make them
compatible with SSI, or Server Side Includes, an Nginx feature that
allows the server to generate certain parts of pages without requiring
PHP or something similar. A version of `stable` with the SSI
requirements removed is available under the `nossi` branch.

## The cg Method

The so-called `cg` method was used to improve reliability with some
older versions of the exploit. I no longer believe that this is
nesessary as the current `stable` exploit is quite reliable, but I
figure it's worth documenting anyway.

With an old version of the exploit, it seemed more effective than
placebo to run the access gate behind a very specific server
configuration. We accidentally discovered that it seemed to help if the
access gate was specifically hosted on GitHub Pages, but proxied
behind Cloudflare's POPs. We tried Cloudflare's POPs in front of a
normal server as well as GitHub Pages without Cloudflare's POPs, all
to no avail. It seems something specific about running the gate on
GitHub Pages and putting Cloudflare's DDOS protection service in front
of it would cause the exploit to become more reliable.

Once again, I no longer believe this is nessesary or even useful with
the current `stable` version, but I still believe that it's worth
noting.

The cg method was accidentally discovered by
[Creation_](https://twitter.com/CreaTion_DG) and researched extensively
by myself.

## Self-hosting

Self-hosting the exploit can help improve the reliability if you have a
slow internet connection. You can checkout the `nossi` branch of this
repo and host it with any old webserver, or you can checkout the
`stable` branch and host it with Nginx, assuming SSI is enabled (simply
put `ssi on;` in the config file). More detailed instructions for
self-hosting may be posted soon.

## And Finally, Credits

Once again, all credit for the exploit itself goes to JumpCallPop and
everyone else who helped him get this working. I just made a nice gateway,
helped lots of people get it working, and compiled all this information.

- [Original GBAtemp thread](https://gbatemp.net/threads/webhack-on-5-5-2-jstypehax.480938/)

- [ColtonDRG's Twitter](https://twitter.com/ColtonDRG)

+ 3
- 5
index.html View File

@@ -1,4 +1,4 @@
<title>stUpiidhax</title>
<title>stUpiidhax stable</title>
<style>
.align{text-align:center;}
body{background:#222;color:#fff;}
@@ -14,9 +14,7 @@ a{color:009ac7;}
<a href="payload/exploit.html?delta=3">3</a>
<a href="payload/exploit.html?delta=4">4</a>
</h2>
<a href="/fast/">Go here if you want to try a new faster version</a><br/>
<br/>
If you're getting really demoralized and want another gateway to try, <a href="http://cg.stupiid.ovh/">give the cg version a shot</a> at cg.stupiid.ovh<br/>
If you're in Europe and it's not working, try <a href="http://eur.stupiid.ovh/">this European gateway</a> at eur.stupiid.ovh<br/>
Remember to purchase and download your Haxchi compatible VC to the internal storage before doing the exploit if you want to install Haxchi. It would suck if it finally worked but you couldn't install Haxchi.<br/>
Try the big exploit button a few times first. Clearing your browser save data or choosing another delta might also help. The important thing is to <b><i>just keep trying</i></b>!
@@ -24,7 +22,7 @@ Try the big exploit button a few times first. Clearing your browser save data or
<br/>
<br/>
<br/>
This service provided by <a href="https://twitter.com/ColtonDRG">ColtonDRG</a> | <a href="https://github.com/coltondrg/stupiidhax">Source for this site</a><br/>
This uses the <a href="https://github.com/JumpCallPop/JSTypeHax">JSTypeHax exploit by JumpCallPop</a><br/>
Service provided by <a href="https://twitter.com/ColtonDRG">ColtonDRG</a> | <a href="https://git.drg.li/ColtonDRG/stUpiidhax">Source for this site</a><br/>
This uses the JSTypeHax exploit by JumpCallPop<br/>
git commit <!--#include file="commit.html" -->
</div>

Loading…
Cancel
Save