This short article will outline the steps needed to install all the software required to play a backup version of any game you own and explain ‘homebrew’ and how to use it.
If you don’t own a copy of the game then obviously you will be breaking the law if you play a version that someone has kindly backed up for you and uploaded to a newsgroup somewhere
Before you can do anything you will need the following hardware:
2 GB or less SD Card – not SCHC for the initial steps but once the homebrew is loaded SDHC is fine.
A copy of Zelda – Twilight Princes
An SD card reader of some kind if your PC/Laptop doesn’t have a native on.
A nice cheap SD card that will work:
http://www.amazon.co.uk/Sandisk-2GB-Sec … 422&sr=8-4
And a nice cheap SD Card reader:
http://www.amazon.co.uk/Integral-One-SD … 473&sr=1-1
Or for the ultra cheap, market place sellers will sell the following combination for less than buying them separate:
http://www.amazon.co.uk/2GB-Integral-SD … 473&sr=1-3
There are many adaptors around, such as mini-SD to SD etc – these will not work, only 2 GB or less SD card will work.
Also, at this point you should check that your Wii has internet connectivity and it will need to download files from the Internet to complte the process.
Ok, now you have the hardware, a brief outline of what homebrew is and how it is used.
Homebrew is simply software written by normal non-commercial folks for the Wii (can be for other stuff too but this concentrates on the Wii) that is not released or supported by Nintendo and comes with no warranty at all – homebrew application are free and should never be sold commercialy – if someone tries to sell you a homebrew app, they are ripping you off.
Homebrew encompasses a wide range of applications, from games, emulators, text editors, MP3 players, DVD players and even a Metronome.
Most of the source code is also available along with the applications.
To facilitate the loading of all these homebrew applications, there is a Homebrew Channel; which can be thought of as a framework for collating the homebrew applications, downloading them in a structured manner and launching them.
Within the Homebrew channel there is a utility called the Homebrew Browser, which is used to automatically download and extract the Homebrew application from the internet – this make life a lot easier.
A common misconception is that once you have installed the Homebrew Channel you will be able to play backed up games – this is not true, remember the Homebrew channel is just a framework for the application; you will still need the relevant applications to allow you to play backed up games.
(HOMEBREW IS FREE SO PLEASE DO NOT USE THE MANY WEB SITES THAT TRY TO CHARGE YOU FOR THE SOFTWARE AND A NICE INSTRUCTION BOOK ON HOW TO INSTALL IT. THRE ARE A MULTITUDE OF GUIDES FLOATING AROUND FOR FREE THAT WILL WALK YOU THROUGH DOING IT)
INSTALLING THE HOMEBRW CHANNEL:
Obviously Nintendo don’t include functionality to make a few API calls and installs any software a user wants to, so we need to exploit a buffer overflow within a game to allow us to execute the source code for the Homebrew channel and install it.
To do this you will need Zelda Twilight Princess as this is what is exploited to install the code. At the time of this writing this is the only game than can be used to my knowledge but doubtless other games will be found in due course that can also be used. (If you absolutely can’t do this, another option may be to update your Wii to version 4.0 and follow the BannerBomb instructions at the bottom of this post)
To start off with you will need to determine what version IOS your Wii is running. To do this simply start the Wii up, click on the Wii button on the bottom left of the screen, and go to
Wii Settings. One the resulting screen in the very top right hand side you will see the version number – if it is 3.3 or 3.4 (there may be a letter after it but ignore this for now) you will need to download something called the Twilight Hack (named after the Zelda game strongly enough). This can be obtained from here:
As the web page says, you will need a different version depending on what version your Wii is running at:
3.3 and earlier: twilight-hack-v0.1-beta1.zip
If you have version 4 then this method will not work but it is still possible – see the bottom of this post for instructions.
So create a folder on your desktop called Wii, in this create a folder called TL, then copy the relevant twilight hack and extract it to the TL folder. You can name the folders anything you want this post will presume you are following the naming standard.
Depending on where in the world you are, you will need a different version of the hack (they are all included in the download). Take a look at your game disc; look on the underside of it and around the centre of the disk (on the shiny bit ) is some very small writing, such as RVL-RZDP-0A-0 JPN. Make a note of this before you put the disc in the Wii as it will become very important when you chose the version of the twilight hack to use later on.
Now we need to get the Homebrew software, so go here http://hbc.hackmii.com/download/ and download the Homebrew-Channel.tgz file – marked (DOL (For usage with Twilight Hack & other booting methods))
Copy this to your Wii folder and extract it to Wii\home_channel.
You should now have the twilight hack and the homebrew channel software downloaded.
To play backed-up games you will need a few more homebrew apps – there are a few circulating that will work but for this I will use Backup Auto Launcher 3.0beta by a guy called Wiigator.
(Update, Backup Launcher 3.0gamma is now out – can be download from here: http://atkinx.com/files/backuplauncher0.3_gamma.zip – the instalation and usage is exactly the same as for the beta one)
Download this and extract it to Wii\Backup.
This should be all the files needed to initially set everything up.
The twilight hack uses a buffer overflow within the Zelda game to obtain arbitrary code execution. It does this by naming the horse with an overly long name.
What does this mean: If you don’t care, skip this part – if you do read on.
All computers and game consoles read program code from memory, this works by the console first reading the code form the disk, placing it into memory and then the CPU executes this code as required.
At the beginning of the Zelda game you are prompted to name the horse – by doing this a little piece of the console memory is allocated to store the horse’s name that you supply (called a buffer)– should you supply a name that is longer than the piece of memory allocated to hold it, then the name will ‘spill’ over into other parts of the memory, known as a buffer overflow.
The console does not know that this extra data is the horses name and tries to execute it as it would any other code that makes up the game. If the code is invalid, then the console will crash as it won’t know what to do with it – however if it is valid code it will execute it and do what it is told – they guys who come up with the twilight hack, use a saved game that has an overly long horses name in it to cause this overflow and have the Wii execute code that they have supplied – namely to install the Homebrew channel.
All the user has to do, is get to a point of the game where it tries to read the horses name and display it to the screen, as soon as it tries this, the overflow occurs and we get the third party code executed – fortunately this is right at the start of the game, so other than having to sit through the long, depressing and hideously boring start to Zelda you won’t have to do much more.
Now we need to get the folders copied to the SD card.
Insert the card and (assuming you are using Windows) browse to My Computer, click once on the SD card and look at the information bar of the right of the Window – if it says File System FAT then you are OK to continue (SD cards should be FAT by default). If it says anything else, right click the icon, select ‘format’ , chose FAT from the drop down menu and click start – after a few seconds it should finish and you are free to continue.
Go to the Wii \TL folder and copy the directory called “private” to the SD card. Now go to the Wii\Home_channel folder and copy the boot.dol file and the folder named wiiload and also copy these to the SD card. Whilst you are in the SD card window, also create a directory called “apps”.
Your SD card should now look like this:
So once the SD card is ready, insert the Zelda game disk and start the game, play it for a while and make sure you save the game once – this is imperative or the hack won’t work.
Once you are sure you have a saved game, exit it and come back to the main Wii menu. Insert the SD card and click on the Wii button in the bottom left of the main screen, select Data Management, Save Data, Wii.
Locate the Zelda saved file, click it and erase it (if you have been playing the game for a while you will want to back this up first as otherwise you will lose all of your saved game data). Once this is deleted, click on the SD Card tab in the top right and you will see a few Twilight Hack files.
Copy across the relevant version of the twilight hack for you Wii system version to the Wii memory.
If you have Wii version 3.4 it is important that you do not turn off the system or you will have to start the whole process all over again.
Come back to the main menu and Insert the Zelda game disk, start the game and when prompted to load your save file chose one of the following:
Depending on the writing that was on the underside of your disk select the right save game slot as per this:
RVL-RZDP-0A-0 JPN -> Twilight Hack
RVL-RZDJ-0A-0 JPN -> Twilight Hack
RVL-RZDE-0A-0 JPN -> TwilightHack0
RVL-RZDE-0A-0 USA -> TwilightHack0
RVL-RZDE-0A-2 USA -> TwilightHack2
Select the relevant one and continue the game, once it loads up walk up to the man in front of you and once he starts talking the buffer overflow will occur.
This is where the Homebrew channel will be installed – if you don’t install this, you will have to go through the twilight hack every time you want to run homebrew.
The installation of the Homebrew channel is very simple and will prompt you with on screen instructions – just follow these steps until it is complete.
You should now have the Homebrew channel installed. To verify it, reset the Wii and in the main window you should have a new channel called The Homebrew Channel, select this and click Start.
Once loaded select the Homebrew Browser – this will connect to the Internet and download a list of the latest homebrew applications, feel free to poke around and install what you want.
Once you get board of this, come out of the homebrew channel, back to the main menu and take out the D card and put in back in your laptop/PC. In the Wii\Backup folder there should be three folders and a read me – copy the cIOS_Installer and Backup_Launcher folder in to the ‘apps’ directory on the SD card.
(This is the easiest way to install and further homebrew applications that cannot be downloaded via the homebrew browser, just put them in a folder within the app folder and if necessary rename the .dol file to be boot.dol – if you don’t do this it will not work)
Now insert the SD card into the Wii and go back to the homebrew channel. You should now see two new icons called cIOS and Backup Launcher – first select the cIOS one and follow the prompts to install it, when it has finished, reset the Wii and go back to the homebrew channel, now select the backup loader application and install this – reset the Wii, insert your copied erm I mean backed up game, go to the homebrew channel, select the Backup Loader application and load your game.
Sometimes you may have issues, if you do go to the config option in the backup loader and change the ‘hook’ to be ‘GC Controller’ and try again.
If you want to have the backup loader be available in a channel box on the main Wii menu you will need to install a WAD Manager and download the Backup Launcher WAD file.
To do this, first get the WAD Manager .wad file from http://gbatemp.net/index.php?download=3587
But don’t follow the instruction include within the readme or on that site with the method of using homebrew.
Extract the file, and in the ‘apps’ folder on the SD card create a new folder call wad – copy across the WAD-Manager-1.3.dol file in to the apps\wad directory and rename it to boot.dol (as mentioned before this is the way to run other homebrew apps). Now in the root of the SD card create a folder called wad and download this version of Backup Launcher that has been
modified by someone else: http://www.mediafire.com/file/jzgimmixm … er_0.3.rar (which can be read about here http://vettacossx.wordpress.com/2008/10 … bout-that/ )
Copy the file called HB-BackupLaucner.dol.wad into the wad directory you create in the root of the SD card (not the apps\wad directory).
Once this is done, insert the SD card and get to the homebrew channel, you should have a new option now called /apps/wad/boot.dol (you can alter this via an XML file if you really want to), select this and the application will go to the wad file that is in the root of the SD card and ask you if you want to install any of the WAD there. (If you want to install subsequent wad files, just drop them in here and run the WAD Manager), at the moment there is only one so press the + button on the Wii remote and wait for it to be installed.
When it is finished, reset the Wii and now in the main Wii menu you will have a new channel for the Backup Launcher.
* A lot of people seem to think DVDx is required for this method to work, this is not true, you do not need it to play backed up games via Backup Lancher*
Insert the disk and select this to play.
A word of warning about updates installed on games – if you buy a new gamed (or old one) some of them come packaged with updates for the Wii – obviously we don’t want this to be installed (likewise do not download any updates from Nintendo from now). If you have an ISO and are worried it may have an update, download BrickBlocker from
This is very simple to do, just run the WiiBrickBlocker.exe file and give it the path to your ISO image – it will automatically remove any system updates from the image for you.
Depending on where you got the ISO from you may also need to convert it to be compatible with the soft-mod – for this you will need a program called backup-creator.exe. This is a application that will modify the ISO for you; however, it was not meant to be made public yet by the author (waninkoko) and was leaked to the general public – as such the author is no longer working on the project. The download liks come and go constantly as some places take it down out of respect for the author etc – give it a Google and you will be able to find a download link somewhere – current it can be obtained from here:
http://rapidlibrary.com/index.php?q=bac … or+exe+wii (This is not were I got it from, so I can’t vouch for the authenticity of the tool).
Once you hae downloaded it, simply run the exe file from a command prompt and give it the name of the ISO, after a short while it will spit out a new ISO named partition.iso – this is the patched game that you will need to burn.
Now either burn the ISO to a DVD or copy it to a USB hard drive (which ever method you are using) and play as normal.
I HAVE WII SYSTEM VERSION 4:
You can still do the above but you will not be able to use the twilight hack you will need to use BannerBomb exploit from here http://wiibrew.org/wiki/Bannerbomb
I have not done this myself as I don’t have this version Wii but the instructions seem simple enough – the below instructions are copied from the above site and included here for completness:
1.If your SD card has a private directory, rename it temporarily, e.g. to “privateold”. Having other saved channels on the same card will screw it up. (Also, if you don’t have any channels on the SD card already, it’s possible to skip this step so you can keep saves on your SD card)
2.Copy the Bannerbomb “private” folder to the root of your SD card.
3.Take your Wii executable, name it “boot.dol” or “boot.elf” if it isn’t already, and save it in the root directory of your SD card.
4.Put your SD card in your Wii and turn it on.
5.Go into Wii Options –> Data Management –> Channels –> SD Card.
6.A message should appear asking to “load boot.dol/.elf”. If it freezes or does not appear, download the next .zip file from the Bannerbomb website (http://bannerbomb.qoid.us/) and start over.
7.The homebrew on your SD card will load. Enjoy!
8.(Optional) Fill out Comex’s survey on the Bannerbomb website.
The downside to this is that a large portion of the app do not currently work properly with version 4.0 – the backup launcher does not; however, once you have the homebrew channel installed you can downgrade the IOS version of the Wii to 3.3 – I have not had to do that so you’ll have to Google around for some tutorials on this.
I can’t cover many troubleshooting steps and most things went OK for me.
Some issues I did come across though:
Sometimes the game would load via Backup Launcher – upgrade to the gamma version if necessary (just remove the cIOS_Installer and Backup_Installer files from the SD card and replace them with the new ones – reinstall the cIOS, then in the backup loader options menu, set the Force PAL / NTSC that is relevant for your country (America and/or American games will be NTSC, UK and most of Europe will be PAL – I use PAL60), change the hook type to GC Pad, exit out to main backup launcher menu and press B. This will reboot the Wii and make the relevant hooks, now go back to the backup launcher menu and launch the game as normal.
If you still have issues try only changing on option at a time.
If you have burnt your own ISO, try reburning it at the lowest possible speed.
Backup Launcher should play decrypted and normal Wii games, so there is no need to use the backup-creator.exe on the ISO, if you have try reburning the original ISO, and if you didn’t use it you could try reburning a patched ISO.
If you still have issues and all the software is installed correctly and updated, then it is 99% certain that the problem will be the media you are using. Cheap disc’s may not be read correctly, different formats of DVD can cause issues, i.e DVD-R, DVD+R, DVD-RW, DVD+RW etc, so if you are able to, try using another format and see if the problem goes away. I use DVD-R mainly but some games I have don’t work on this format but run fine on DVD+R so it is trial and error and no one format is the right one…
Some games just simply do no work. There is a regulary updated compatibility chart here: http://wiki.gbatemp.net/wiki/index.php/Backup_Launcher
If you use it, please contribute back and update it with any games you try.
ORIGINALLY POSTED BY HARRY FOR THETAZZONE/TAZFORUM HERE
Do not use, republish, in whole or in part, without the consent of the Author. TheTAZZone policy is that Authors retain the rights to the work they submit and/or post…we do not sell, publish, transmit, or have the right to give permission for such…TheTAZZone merely retains the right to use, retain, and publish submitted work within it’s Network