r3dux.org

I caught just one of these doubles on my first pass… stupid brain!

Update: The below process definitely works, but I understand that there’s now a much simpler way of rooting your Android phone by using a piece of software called Unrevoked which’ll work on an Evo, Hero, Aria and Incredible as well as the HTC Desire – so it might well be worth you checking that out before going to all the effort of rooting the phone through this method!

The HTC Desire is a beautiful phone that, at the time of writing, only has official firmware going up to Android 2.1 – which is a great OS, but it’s not the latest and greatest bleeding-edge Android 2.2 which comes with the ability to make your phone act as a wireless hotspot and lets you install apps to your SD card rather than the phone memory (hence, more apps can be installed) amongst other neat features – so, why not root your Desire and install newer, unofficial 2.2 stuff? Well, because you might not really need it, and you might brick your phone in the process for starters – but that’s no fun! Have at it and don’t settle for the easiest route of just making do! Sweet, sweet Android 2.2 goodness is a mere hour or two away! So let’s get it on!

Tools needed:

• A non-64 bit Windows PC, or Linux PC with a copy of VirtualBox running a non-64 bit version of Windows XP or later (Note: 64-bit Windows not recommended for reasons I’ll describe later on. 64-bit Linux host for the VirtualBox side of things is fine if that’s the route you’re taking.)
• An Internet connection
• A HTC Desire with a bootloader at version 0.80 or earlier (you can check this by turning off your phone, then turning it back on whilst holding down the Back button – the second line will say HBOOT-x.xx.xxxx – this needs be 0.80.0000 or lower for the process to work)
  
• A spare (i.e. not the one you intend using with the phone), small microSD card (512MB or larger is fine, Kingston brand preferred for reasons I’ll also go into later, but I used a Samsung brand 2GB microSD with no problems)
• A microSD to normal-SD adapter card or some other way to access the microSD card in your PC
• The ability to follow instructions to the letter.

Once you’ve got all this together, it’s just a case of following the instructions step-by-step, and in less than an hour (assuming everything goes smoothly – to figure all this out and get it working properly took me several hours!) you’ll have a de-branded, fully rooted HTC Desire running Android 2.1, but from which you can install Android 2.2, which I’ll write up in a separate article shortly.

Final Warning: It’s very, very unlikely that anything bad will happen during this rooting process, and the phone can always be restored to normal, un-rooted status should you wish – but the final responsibility for this lies with you. If you turn your phone into a paper-weight, it’s not my fault, okay? But saying that – I’ve successfully managed to root my phone and it all works perfectly, so if you follow these instructions carefully you can do the exact same thing.

Okay, enough preamble – let’s get on with the show!

Step 1 – Get the Android SDK

We’re going to be creating what’s called a Goldcard, which is just a specially modified microSD card which can be used to gain root access to the phone. Each Goldcard is unique to the phone you’re using it with, so for example, I’ve created a Goldcard for when I rooted my phone, but this card wouldn’t work to root your phone, because it has to be individually tailored to match up with the unique ID of your phone.

To get the details we need to kick off the Goldcard process, we need the Android SDK (Software Development Kit), so click this link and get the SDK for your platform of choice: Android SDK Download

Note: I did this section of the process using Windows 7 64-bit without issues.

Once that’s downloaded, extract it to a location of your choice, I’d suggest something like C:\HTC so the full path to it once extracted would be C:\HTC\android-sdk-windows.

We’ll come back to using the SDK in a little bit, but for now we need to set up some USB drivers, so lets get that out of the way.

Step 2 – Install Proper USB Drivers

You can connect to your phone as a hard drive just by connecting it to your PC, but we need to be able to access the phone in a kind of special way through the Android adb service, so to do this we need better drivers than just the standard ones.

Thankfully, these drivers come as part of the HTC Sync application, so head on over to this link and get yourself a copy of HTC Sync for Windows: HTC Sync Download

Note: I haven’t been able to find a Linux version of HTC Sync, so you really do seem to need a copy of Windows for this bit. Again, Windows 7 64-bit worked fine for me.

Once you’ve downloaded the application, double click on it to install it and follow the standard Next | Next | Finish prompts.

Step 3 – Enable USB Debugging Mode on your Phone

For this to all work properly, we need to have our phone connect via USB in USB debugging mode, which can be accomplished by simply going to Settings | Applications | Development | USB debugging

Step 4 – Get the Phone ID Details

With the Android SDK in place, HTC Sync installed, and the phone in USB debugging mode, it’s time to get the phone details, so using a USB cable connect your phone to your Windows PC – if the phone asks, it wants to connect in hard drive mode, and not Charge only or anything.

Once you’ve connected your phone, Windows will thrash around a bit setting up drivers, and bring up a window showing that you can connect to the phone which should show four ways of connecting, one of which should be ADB service or such, and all four options should have a green tick after them.

With the phone connected, on your Windows PC go to Start | Run and enter cmd followed by the enter key to open up a command-line window (if you don’t have Run enabled as a Start-menu option, just go Start | All Programs | Accessories | Command Prompt).

In the command line window, navigate to the android sdk by entering:

cd \HTC\android-windows-sdk\tools

Then, check that the SDK can see your phone by entering:

adb devices

If everything’s going according to plan, you should see the HTC detected and showing your phone’s serial number in output similar to the following (Note: This is not my real HTC serial number in case you were planning any shenanigans ):

C:\HTC\android-sdk-windows\tools>adb devices
adb server is out of date.  killing...
* daemon started successfully *
List of devices attached
HT076R317015    device

If you get “no devices found” type output at this stage then head on over to this post on setting up adb connectivity for assistance.

Assuming you can see your phone, the next step is to get (what I think is) the microSD card ID by typing the following at the command prompt:

C:\HTC\android-sdk-windows\tools>adb shell
$

When you see the $ prompt like above, enter the following:

cat /sys/class/mmc_host/mmc1/mmc1:*/cid

You should then see output like this:

cat /sys/class/mmc_host/mmc1/mmc1:*/cid
1d254d3040404030102a80143440a2a0

If you get an error at this point I’ve read that some people have changed the 1′s to 0′s to have it work, which would make the line:

$ cat /sys/class/mmc_host/mmc0/mmc0:*/cid

Once you’ve got the number, either write it down carefully or copy and paste it into a text file, notepad or such will do just fine.

Step 5 – Reverse the MicroSD Hex ID

We need to perform some voodoo on the number we generated on the last step, which is as simple as going to a web page, entering number or pasting it in, then clicking submit. I’d imagine they’re doing something like this – but I’ve not tested it at the time of writing – all I know is that it works!

Reverse yer number here: Soaa’s Hex Reverse for Goldcard Creation (Thanks, Soaa!)

Once you have your reversed hexadecimal ID number, copy and paste it into a text file for later use!

Step 6 – Get your Goldcard image

The Goldcard image is just a tiny (a few hundred bytes) disk image file (think like an ISO image) that contains some voodoo generated from your reversed hexadecimal ID. To get this image file emailed to you, head over to this link and fill in all the details: http://psas.revskills.de/?q=goldcard

Step 7 – Format your Spare microSD Card

In this stage we’re going to be wiping all data from the microSD card, so make sure there’s nothing on it you want to keep.

The easiest way to format the card in the correct format is via your phone, so turn it off, take off the back casing, remove the battery (so the microSD card can be inserted), put the card in the phone, then boot the phone and select Settings | SD & phone storage followed first by Unmount SD card and then Format SD card.

Once this is done, turn off your phone, remove the microSD card and place it into a microSD to normal SD card adapter or whatever adapter you’re using and plug it into your Windows PC.

Step 8 – Make your microSD card into a Goldcard

For this step we need a hex editor, the one recommended in the guides I read is called HxD and is available here: http://mh-nexus.de/en/downloads.php?product=HxD (the english version is about half-way down the page).

Once you’ve downloaded a version, extract the zip file and fire up HxD.exe, remembering to Right Click on it and choose Open as Administrator if using Vista or Windows 7.

Now, from the file menu in HxD, select Extra | Open Disk, then from the disk selection window that comes up first untick the Open Read-Only checkbox, and then click on your SD card under Physical Disk (this is important!) to select it followed by hitting the [OK] button.

In HxD, Open the SD card as a Physical Disk with Write access allowed

HxD is an editor that uses tabs, so we’re now going to open the goldcard.img file that you were emailed in Step 6 by selecting Extra | Open Disk Image and then navigating to and opening your goldcard.img file. At this point you’ll have two tabs open, and the next thing we need to do is simply copy all the data from the goldcard image directly to the SD card in a kind of raw mode, so we’re not copying files – just some data.

To do this:

1. With the goldcard.img tab selected, go to the menu and choose Edit | Select All followed by Edit | Copy
   
   

   Open a second HxD tab, this time opening the goldcard.img Disk Image

   

   From the Goldcard tab, select all the data and copy it to the clipboard like you'd copy some text

2. Click on the Removable Disk 1 tab, and look at the first column of data which says Offset(h) – what you need to do is Highlight (i.e. Select – just like you would use to copy and paste text) ALL THE DATA from offset 00000000 to 00000170, and once you’ve got all that selected (I found it easier to find the 00000170 row, go to the far right of it, then Left-click and hold and drag up and to the far left of the very first 00000000 row) go to the menu and choose Edit | Paste write.
   
   

   This is important - select the 00000000 to 00000170 region of your SD card, and then paste the goldcard data OVER this selected region (i.e. the data from the goldcard replaces whatever was in the region you've now selected on the SD card)

3. Now you can save the changes to your SD card by hitting Ctrl+S or File | Save or whatever you want and close down HxD.

At this point you want to be able to eject the SD card and put it back in without Windows moaning. If Windows pops up a message saying that the card isn’t formatted correctly and would you like to format it now, you’ve either done one of the above steps wrong, or you’ve got an incompatible microSD card. If it were me (and believe me, from the less than crystal clear instructions I read it was me – three times!), I’d reformat the card and go again, slowly and carefully. When you’ve done it right and you eject then re-insert the card without Windows saying anything other than just mounting the card, then you’ve got yourself a Goldcard! Phew!

If you have any problems, I got my set of instructions from here: http://android.modaco.com/content/general-discussion/305672/creating-a-goldcard/

Step 9 – Get the Rooted Firmware and Install It

Okay – we’re nearly there! This is the stage that I DO NOT recommend using 64-bit Windows for, as when I tried it, it simply didn’t work, and I gave myself a minor panic when my phone wouldn’t boot and was stuck halfway between flashing it – BUT this could well have been because I got the wrong firmware for the phone! I got the normal firmware, whilst the Telstra A8183 models need the alt firmware (second link below).

Either way, I ended up using Linux 64-bit (Ubuntu 10.04) to do this final bit – so just be aware that you might run into problems on 64-bit Windows, and consider using something else – probably even a Linux live CD would do the job if you don’t have multiple OS’s available to you.

So to get the rooted firmware:
- If you have a bootloader version 0.75.xxxx or below AND a current ROM of 1.15.xxx.x or below – DOWNLOAD (MediaFire) / MIRROR (ROMraid / CoBlitz) – MD5: 28dd5acc4104bb49bd4b292cc8e8437c

- ONLY if the above download is not suitable – if you have a bootloader version 0.80.xxxx or below AND a current ROM of 1.21.xxx.x or below – DOWNLOAD (MediaFire) / MIRROR (ROMraid / CoBlitz) – MD5: eb2ed5bca1334cacd70e4720f5b29960

For my phone model (Telstra branded A8183 model HTC Desire – even though it showed bootloader version 0.75.xxxx before being rooted) I went with the the second set of firmware above (r6-desire-root-alt.zip).

Now, once the firmware is downloaded:

• Unzip the file you downloaded to a directory, then open a command prompt / terminal window at that directory.
• Copy the ‘update.zip’ file (which is part of the firmware download zip) to your microSD. Do NOT rename it.
• Turn off your HTC Desire, then turn it back on with the Back button held down. You’ll see FASTBOOT written on the screen in a red box. Connect the phone to the computer.
• In the terminal window, enter either ‘step1-windows.bat’, ‘./step1-mac.sh’ or ‘./step1-linux.sh’ as appropriate.
• Navigate to the BOOTLOADER and then the RECOVERY option on the menu, using the volume buttons to move and the power button to select.
• When a black screen appears with a red triangle (don’t worry, you’ll know it when you see it), press and hold the Volume Up button on your phone and then tap the Power button.
• Your device should now be at the ‘recovery’ screen. Select the wipe data/factory reset option, then select the option to Apply sdcard:update.zip. This will take a little while, so go make a nice cup of tea. When the flash has finished, reboot, and you are DONE!

My information for this section came from this guide should you run into any trouble: r6 riskfreeroot – HTC Desire Rooting Guide

Conclusion

With all this done, you will be the proud owner of a de-branded, rooted HTC Desire with no more branded unremovable bloatware apps hogging up your application list, a new Superuser Permissions application (which I have, as yet, no idea what it does – but it proves the phone’s rooted!), and the ability to flash custom firmware to the phone like DeFroST or DJ DROID Android 2.2 (froyo) stuff, with all the lovely, bleeding edge goodness that provides, as well as over-clocked and under-volted kernels so speed up your phone and lower the power consumption!

To be perfectly honest, I haven’t as yet installed any of that cool stuff – but I’m pretty sure that I’ve done the hard part with the rooting process, and when I get the time to install some 2.2 goodness, I’ll document it to the hilt, too.

Cheers!

Update: (23/10/2010) – It’s been a while since I wrote this article, during which time I’ve installed a whole heap of different firmwares for my Desire – and once you’ve done the initial root it’s an absolute doddle to do through ROM Manager. I used to install the latest T-Mod releases because they’re tailored specifically for the Telstra HTC Desires, but now I just install a standard LeeDrOiD ROM (which T-Mod is based on anyway), then update the APN details to a configuration that works for me (Name: telstra.wap, Proxy: 10.1.1.181, Port: 80, Authentication: CHAP) and that’s it – everything works beautifully.

Thanks: Shouts out to the Android community for all their good work, from the devs and hackers to the pioneers and bit-players, without whom none of this would be possible! And of course many thanks to the people writing guides whose work I based this guide on in an effort to plainly state and illustrate the process with minimal ambiguity.

Assuming you’ve got a soft-modded Wii, most games will work fine with USBLoaderGX, however some newer games just won’t work with your standard Waninkoko cIOS 249 using cIOS 38 rev 14 (GH5, RB2, Band Hero, Mercury Meltdown Revolution etc.). To fix this you need to install Hermes’ cIOS 222 in 38 merged with 37 mode, and then tell USBLoaderGX to use IOS 222 to launch the game.

Here’s how I did it when I was fixing up my Wii:

1.) Grab a copy of Hermes’ CIOS 222 v4 from here and extract it.

2.) Connect your SD card or USB drive (wherever you store your homebrew apps) to your PC and copy the folder cios_installer (found in wherever you extracted the above archive/apps ) to the apps folder on your SD card or USB drive.

3.) Fire up your Wii and launch the app from the Homebrew Channel

4.) In Hermes’ cIOS 222 installer app choose:
- Use IOS249 to perform the install

- Select to install cIOS 222

- Select to install it in IOS 38 merged with IOS 37 mode

5.) Let the download and install process complete

Now, when you want to run something like Rock Band 2, just use USBLoaderGX as normal, but when you select the game, select Game Load from the game settings and choose to use IOS 222 instead of the default IOS 249. Save the setting and the game will always use IOS 222, and always work.

That’s it – job done

On top of installing CIOS 222, I’ve read that some folk will run CIOS 222 installer again, this time using IOS 249 to install IOS 223 with the option IOS 60 merged with 38 – which gives you the option of using IOS 223 to try to get games working which might be particularly stubborn, but I didn’t bother doing this additional step as I don’t have anything that won’t run anymore! Worth bearing in mind in case sometime down the road some software does get narky about using 249 or 222 though…

Post last updated: 12th August 2011

So you’ve got your Wii soft-modded and you can run homebrew and stuff (you haven’t? Well, ya could..) – what next? Well, you can install a whole heap of WiiWare, Virtual Console games and applications, but the Wii can only store a couple of hundred MB of stuff on its internal memory before it’s full. When this happens it’s like your drive’s full – you’re going to have to uninstall some things to install others.

Or… you could use NAND emulation to install as much stuff as you want! Sound more like it? Let’s get it on!

Intial prep

The Wii has 512MB of flash (i.e. NAND) memory, much like a USB stick – and it uses it to store the Wii operating system, save games, channels/WiiWare/VC stuff etc. When you soft-mod your Wii you’ve (hopefully!) backed up the system memory so you can restore it to default, in case you want to. If you’ve backed up your NAND system memory using BootMii, this is all well and good, but it’s not what we’re going to be using as the basis for our NAND emulation (i.e. the backed up nand.bin file) – we’re going to strip out just what we need to get a bare-bones NAND image (really, just a set of directories) and then use that to install our stuff.

To begin with, we’ve got two options:

• We can use a SD card to store our installed apps/games/channels (or SDHC card if your firmware is > 4.0, previous version of firmware don’t support SDHC cards), or
• We can use a compatible USB hard-drive

In this guide I’m going to set things up on a SD card, if you want to use a hard drive you’ll need it partitioned to have TWO partitions (each of which needs to be assigned a drive letter – not sure how? Try this): One large partition for your Wii ISOs which you’ll want to format using something like WBFS Manager, and the other smaller partition you can leave as standard FAT32, just like you’d have on your SD card or a USB stick.

On an SD card we can just use whatever space is available on the card, for hard drives you’re going to have to decide on how big the partition you want to use for NAND emulation is going to be (a couple of GB should do it plenty), assign the rest to the other partition for your WBFS ISOs. I’ve got a 640GB USB drive, so I’d prolly assign around 20 to 25GB for emulation so I’d have stacks of space for ROMs etc. – remember – there are no tools to resize WBFS partitions at the moment – so pick your sizes and get it right first time! =D

Okay, with that out of the way – let’s kick off with the emulation steps:

Step 1 – Get a copy of our Wii’s NAND in usable format

For this we’re going to use Simple FileSystem Dumper 0.2. Download it, create a folder for it in on your SD card under the apps folder, rename the .dol file to boot.dol and launch it through the Homebrew Channel.

Once you’ve run Simple FileSystem Dumper 0.2 you’re going to have a bunch of extra folders on the root of your SD card (or hard-drive, depending) – the new directories are these:

Make a copy of all these “blank” folders! Later on you can delete the folders off your SD card or HD and copy these “blank” folders back to effectively uninstall any installed WADs. You can prolly use WAD Manager etc. to just uninstall specific WADs, but I haven’t tried it out as yet. The folders are useful and only around 180MB in total, so it’s worth holding on to pristine copies.

Step 2 – [If neccessary] Update CIOS 38 to Revision 14

To use NAND emulation you absolutely need CIOS Revision 14 or higher. My Wii was on Revision 13b or something, so I used Waninkoko’s CIOS Updater and a net connection to get it up to Revision 14. You can find a copy like this…

Step 3 – Preparing the WADs for your emulated NAND

From what I’ve read you can install your WiiWare/Virtual Console WAD files to the emulated NAND using any of the following methods:

• By using WAD Manager 1.5 or higher.
• By using NeoGamma R6 or higher.
• Manually.

Because I formatted my USB Hard drive as a single partition in WBFS format (and I can’t be bothered to fix it up to have two partitions quite yet), and because you must have different source and destination locations at present to install WADs using NAND emulation (that is, SD to HD or HD to SD, not SD to SD or HD to HD) – I’m going to show you how to go with the manual method of installing stuff to your emulated NAND. And for this we’re going to need a little win32 application called wad2NAND.

The way it works is:

1. Download wad2nand
2. Extract the zip file
3. Create a batch file called ConvertWADs.bat in the folder you extracted wad2nand to. Put the following in the batch file:

   @echo off
   for %%x in (.\Convert\*.wad) do start /w wad2nand.exe "%%x"

   Then:

4. Create a folder called Convert inside the folder where you extracted the wad2nand zip
5. Copy a bunch of WAD files (As many as you like! Woo-hoo! Or as many as you have space on your emulated NAND location for, really!) into that Convert folder and run your ConvertWADs.bat batch file
6. Give it a minute to extract all the wads to two folders: ticket and title which will appear in the folder where you extracted wad2nand – remember these folders from earlier?

   

Update: Although the title and ticket folders hold the core content for games or apps or whatnot, I’ve read that the additional folders hold things like Miis and high-scores and things, so none of the folders are cruft or anything, and if you’re finicky about such things you’re best to hold on to them.

Step 4 – Actually install the extracted WAD files to your emulated NAND

After running wad2nand, the ticket and title folders will contain the installed version of the files to play whatever WADs you’ve converted. You now need to copy these two folders over the top of the “blank” nand folders on the root of your SD card or hard drive. Select [Yes to all] to overwrite things if there are duplicate files – just merge ‘em all together. Almost there!

Step 5 – Launch the NAND emulation installed WADs

To do this, I’m going to use an application called Triiforce beta 7. Grab it and launch from the Homebrew Channel, then select your source (SD / HD / Wherever you’ve installed the extracted WADs).

Updated Note: TriiForce beta 7 is now available, at the time of writing TriiForce beta 5 was the latest version available, so that’s what you’ll see in the below screenshots.

By selecting the second from top option in TriiForce (showing a WAD version of Backup Launcher in the screenshot above) you can press left and right on the D-Pad of the Wiimote to select which WAD to run, and then just select the Start option above to launch it!

All done! Unlimited installs FTW!

Post last updated: 19th of August 2011, but before that it was February 2010. If the screenshots don’t exactly match up (i.e. says to install WAD Manager v1.5 mod3, screenshots have v1.4 etc) – don’t panic, I’ve just updated the article but not the screenshots. Also, I’ve added mention to using LetterBomb instead of BannerBomb, but I don’t have step by step directions for it – google is your friend.

Anything? Well, how about homebrew (user created apps/games), downloaded games (i.e. wad files) and downloaded ISOs? Sounds good? Read on!

You will need:
- A Wii (hopefully with firmware 3.XE or 3.XU, where X is 1, 2 or 3)
- A Wii-mote
- (if you’re hacking a new [2008 and onwards] Wii and want to back up the system memory) A Gamecube controller
- A SD card [NOT a SDHC card, as you need 4.0 firmware or higher to use those]. The SD card must be formatted in FAT format and at least 1GB in size.
- An internet connection your Wii can use
- An hour or two to get it all sorted

You will NOT need:
- A copy of Zelda: Twilight Princess

Optionally can be used to control BootMii option selection & fix a bricked Wii:
- A Gamecube controller

Please Note: I’ve put together ALL the files I used to hack the Wii as a single zip which you can find here – please read the included readme.txt for usage instructions. Also, as this post ages there might be newer version of files, so you might want to get each bit yourself to have the latest versions. The Wii hacking files have been updated on 10th January 2010 to include latest revisions of cIOS installers + apps (WadManager v1.5 mod 3, Hermes CIOS 222 v4, Trucha Bug Restorer v1.1, USB Loader GX r815, BootMii 0.60 beta, Preloader 0.30 etc).

Also, instead of just following this guide step by step as you go along, I’d -STRONGLY- recommend reading through the entire thing so you’re pre-warned about bits and pieces and -THEN- going through it step by step, looking ahead occasionally so you’ve got the right files on your SD card for the step, and maybe the step ahead.

FINAL WARNING(S): In the highly unlikely event that you brick your Wii – it’s not my fault. Also, never remove a SD card from a powered on Wii – it can (and will) corrupt the partition on the card and you’ll need to reformat it (not quick-format). If your SD card suddenly becomes read-only and you haven’t accidentally slid the lock/unlock slider to lock – this is exactly what you’ve done.

With that out of the way – let’s get this show on the road! =D

Step 1 – Get a suitable exploit

Go to http://bannerbomb.qoid.us/ and get the BannerBomb hack. Get the first file (aad1f_v108.zip), extract it, and move the folder named private to the root of your SD card.

Update: If you have a recent Wii with stock firmware of 4.3 or later then you need to use the LetterBomb exploiter, and not BannerBomb. Substitute as appropriate for the rest of the article.

Step 2 – Get a boot agent

Go to http://bootmii.org/download/ and download HackMii Beta 2. Extract it, rename the “Installer.elf” file to “boot.elf” and place it in the root of your SD card.

Step 3 – Prime your Wii

Make sure your Wii is able to connect to the Internet, turn the Wii off, insert the SD card, then boot up the Wii.

Step 4 – Prep the exploit

Go to the Wii button (bottom left at the system menu), then Data Management | Channels | SD Card. A box will pop up saying Load boot.dol/boot.elf – click [Yes]

Step 5 – Run the exploit

Update: If you’re using LetterBomb instead of BannerBomb, use your own common sense with the following instructions.

Press the 1 button to install the BannerBomb exploit. If your Wii freezes with a black and white memory dump, or just plain freezes for a couple of minutes at this point you need to go get the next recommended version of the BannerBomb exploit in the list provided in step 1, replace the private folder on your SD card with the one extracted from the different BannerBomb exploit zip (aad20_v108.zip), and try again from Step 4. If this doesn’t work either, pick the next BannerBomb exploit zip and wash/rinse/repeat.

Step 6 – Install useful software

Once HackMii is running, it will offer you the opportunity to install The Homebrew Channel, DVDX and BootMii – install them all! Note: When you install BootMii, I’d recommend installing it as boot2 instead of an IOS file – it just means that it’ll be available should you somehow manage (however unlikely) to mess up your Wii, and you’ll be able to recover things to a clean state.

Updated Note: Newer Wiis (2008 and newer) come configured so that you cannot install HackMii as boot2 – you have to install as IOS. Don’t worry though, we can still back up your system memory, and later, get preloader installed for recovery (should we ever need it) after we’ve restored the Trucha Bug. From the BootMii.org site:

What does “The installed boot1 version prevents a boot2 install mean? Are you going to fix it?
No, it can’t be fixed. Installing as boot2 is the most useful way to install BootMii, but it requires that we exploit a particularly silly bug in a part of the system that can not be changed under any circumstances. Nintendo finally fixed this bug in new Wiis that were released sometime in 2008. We have looked for a suitable replacement for this exploit, but have not found one, and it does not seem likely that anyone ever will.

Step 7 – Backup your original (stock) system

Now you have BootMii installed, restart your Wii and you’ll be greeted with the BootMii screen with 4 icons – at this point you can either use a Gamecube controller to navigate, or use the Power button to move to the next selection, then the Reset buttom to select an option. Navigate until the the far right Settings icon is selected, then push the A button on Gamecube controller (or the Reset button on the Wii) and you’ll see options depicting writing from a chip (on left) and writing to a chip (2nd from left) – pick the left one to back up the system memory of your Wii so you’ve got it available in case something wonky happens w/ your Wii. It’ll take about 10-15 mins to back up the system memory to a file called nand.bin on your SD card. Once this is done, go back to the top BootMii menu and load the System Menu as normal – you’ll see the Homebrew channel there with lovely bubbles for you to pop. Hurray! =D

Updated Note: When hacking a new Wii where BootMii had to be installed as an IOS instead of boot2, I wasn’t able to use the buttons on the Wii to navigate the BootMii menu to backup the system memory, instead I had to use a Gamecube controller, which worked fine. You should be able to use the Power button to change selections, then the Reset button to actually select your option, on one Wii I hacked this didn’t seem to work so I just used a Gamecube controller, but it could have been I’d just forgotten you need to hit the Power button to change selections, as it’s a pretty un-intuitive thing to do…

Step 7.5 – Re-introduce exploits

Newer Wiis come with the Trucha bug (i.e. fakesign) fixed – but we need it to softmod our Wii properly, so we’re going to have to re-introduce the bug by installing older IOS files using Trucha Bug Restorer. Grab yourself a copy, place it in a folder in your “apps” folder on your SD card with the .dol file renamed to boot.dol, watch this video on how to use it, and follow along until you’ve successfully restored the Trucha bug, so you can install custom firmware in step 8 below.

Updated Note: When I used Trucha Bug Restorer, after downgrading IOS 15 as shown in the video the Wii wouldn’t connect to the network to download the older version of IOS 36 to patch, so I ended up using NUS Downloader to get a copy of IOS36-64-v3351.wad which I placed on the root of my SD card and then pointed TBR at that instead of using the network connection, it then updated fine and I restored IOS 15 via network connection as per the video instructions.

Step 8 – Install custom IOS’

Get and run Waninkoko’s cIOS 38 Rev 17 Installer as an app (i.e. create a folder on SD card called “apps”, inside this create a folder like “cIOS38-Installer”), place the file in this folder and rename it to boot.dol. Run the installer through the Homebrew Channel and it’ll install and patch a bunch of IOS files, including IOS 249 which is needed to run loads of stuff.

Updated Note: If you get error = -2011 during the install process of this, you need to go back to step 7.5 above and make sure the version of IOS 36 installed is the hacked cIOS version with the Trucha bug.

Step 9 – Update the firmware

Now we’re going to update the firmware to a custom version of 4.0 that leaves the trucha (fakesign) exploit open for us (in my experience you HAVE to install 4.0 before 4.1 otherwise you’ll get a ret = -1036 error if you try to go directly to 4.1), so, grab Wanninkoko’s Firmware 4.0 Updater, rename the extracted file to boot.dol, create a folder for it in the apps folder on your SD card and run the app through the Homebrew Channel

You’ll know you’re on the 4.0 firmware not only because it’ll say so on the first page of the Wii Settings channel, but because you’ll have a SD icon in the System Menu as shown below…

Step 10 – Update the firmware

We’re getting there… Do just like Step 9 but with Waninkoko’s  4.1 Firmware Updater

Step 11 – Add some useful channels

Okay – we now have the latest custom 4.1 firmware and the Homebrew Channel, but we need a couple of more bits and pieces to get us to the finish line. For this you need some knowledge: Wii virtual console games (that is, SNES games, Genesis games, etc.) come as .WAD files, which need to be installed to the Wii system memory or NAND emulated system memory to play. For this, we use a program called Wad Manager – so we’re going to install a custom version of Wad Manager that comes as a channel and has other nice goodies like directory support. To install this wad manager, we need a wad manager! So to get a copy of WAD Manager 1.5 mod3 as an application AND as a channel, head on over to here. Extract the rar file, and place the .dol on your SD card in the apps folder in its own folder (making sure the .dol file is renamed to boot.dol) and run it through the Homebrew Channel, -NOW- from the WAD manager we’re running as an app, install the WAD Manager 1.5 mod3 channel

Step 12 – Add a disc launcher

To run ISOs downloaded from t’internets, you need backup launcher. Install Backup Launcher 0.3 gamma with #002 fix from (link now broken & removed) – then, when that’s installed as a channel (through the WAD Manager channel we installed in Step 11 above) you’ll be able to insert the burnt ISO DVDs and launch ‘em through the Backup Launcher channel.

Step 13 – Add a hard-drive launcher

[OPTIONAL] If you want to run games from a hard-drive, you’ll want to get a copy of USB Loader GX – find a version that installs as a channel (i.e. a wad not an app) and install this if you want. I’m not going to go into too much WBFS (Wii Backup File System) stuff here – the easiest way is to just get a compatible USB hard-drive, plug it into the leftmost of the two USB sockets on the back of the Wii (leftmost when you’re looking at the front of the Wii), let USB Loader GX Format it for you, then you’re good to go.

Updated Note: If you plan on using a USB hard drive with your Wii, which really is the way to go, make two primary partitions – one FAT32 partition for Wads/NAND Emulation (have a look at my article on it here if you’re interested) and one for your ripped Wii ISOs (format doesn’t matter – USB Loader GX will reformat it anyway). My setup, on a 320GB drive is 20GB for Wads/NAND, 280GB-ish for ISOs.

Another updated note: USB Launcher is functional, but WiiFlow is downright sexy – google it!

Step 14 – Final tweaks

Almost done! At the moment, it’s possible that each time the Wii boots, BootMii will come up and we have to press the Reset button on the Wii to go to the system menu – although to be fair I haven’t seen this behaviour on anything but the first Wii I modded. If this occurs you can just rename the “bootmii” folder on the root of your SD card to something like “GET-RID-OF-THESE-CAPS-TO-ENABLEbootmii“. Now, get a copy preloader 0.30 final (it’s an app, not a wad) – make a folder for it in the apps folder of your sd card, copy it in again making sure the .dol file is called boot.dol (starting to see a pattern?). Before you install the app, you might want to get a copy of the 4.1 version of hacks.ini from here and place it in the root of your SD card. Launch the preloader 0.30 app through the Homebrew Channel and install. In Preloader, navigate to System Hacks and feel free to change some options (disable background music, disable standby mode, region-free everything etc.).

You can choose to boot the Wii to preloader, or straight to the System Menu (which I prefer) – if you ever want to get Preloader back up to change any settings, recover the Wii or what-not, just turn the Wii off, then turn it back on and hold down the RESET button while it’s booting – voila! Preloader is there for you to launch things, go straight to the Homebrew Chan, change system hacks etc.

Updated Note: Preloader 0.30 is the newest version as of the 8th December 2009 – the screenshots below are from when I installed Preloader 0.29 – it’s gonna be pretty much the same thing if you’re installing newer. When you use the systemhacks in preloader, make sure that you you set the Block Disc Updates and Block Online Updates to enabled so you keep your custom firmware if you insert an original disc of a game with a never firmware version than you’re currently running! However, if you want to play your original Beatles: Rock Band or some of the other, newer rhythm-music games you’ll need to do a little bit of extra patching, which I’ve written about here.

Step 15 – Make it easy to get apps

[OPTIONAL] Install the Homebrew Browser Channel, if you want…

Step 16 – EnJoY!

That’s it! Sit back! Relax! Install and launch wads! Play backup games! (through Backup Launcher, not the standard Disc Channel). Have a beer!

Final Wrap-Up Notes:

-  You might want to edit bootmii.ini in the bootmii folder on your SD card, where you can change the autoboot setting to system menu, and change the delay in seconds (0 if you don’t want to see bootmii at all).

- Once you’ve got custom firmware on your Wii, DO NOT install stock Nintendo firmware. If you buy a new game which needs newer firmware, use the preloader “skip disc update check” option to avoid having to install any updates to play or rip the disc and run WiiScrubber on it to remove the firmware.

- If you decide to play imports FOR THE LOVE OF BOD do NOT install Japanese firmware on a non-Japanese Wii – it will brick your Wii. No, really. With any luck you could get BootMii going and restore your nand.bin to get the system back, but don’t tempt fate.

Anyways, Happy Wii-Modding!, and if you have any problems or questions, feel free to sling ‘em in the comments below and I’ll have a gander.

Cheers!