Game Save Exploits

Note for vWii: if one of these exploits is planned to be used, it is recommended to update the Homebrew Channel afterwards using a WAD manager because it provides some fixes specific to the vWii. Additionally, Bootmii is not supported on the vWii, so the NAND would either have to be dumped via the WiiU NAND Dumper, or Dump Mii NAND on the vWii.

This page will cover game save based Wii exploits, please note that those exploits are heavily outdated and should be considered a fallback option in case you can’t do the exploits here for some reason

Requirements for all exploits

1. SD card (<= 2GB, not SDHC) formatted as FAT16 or FAT32. (The Wii System Menu, which is used to copy the save, only reads SD cards, not SDHC)
2. A PC capable of reading SD cards
3. HackMii installer on the root of the SD card
4. A copy of the game you want to use to exploit your system
5. The exploited save file copied onto your Wii(Backup your previous saves onto another memory card if any, you’ll lose them during this process)

Twilight Hack

• This was the first method to hack a Wii without hardware modification, discovered by team Twiizers in 2008
• Nintendo patched this exploit in system version 3.4, therefore you can’t use it on anything newer

Instructions:

• Get the exploited save data for twilight princess from here (WiiBrew) and copy the Private dictionary onto your SD card
• Once you load the save file, either walk backwards or talk to the man in front of you, this should load HackMii, enjoy

Smash Stack

• Smash Stack is an exploit from Comex that uses a flaw in the custom stages in Super Smash Bros. Brawl to load unauthorized code on the Wii. It was released on August 20, 2009. It works for all System Menu versions

Instructions:

1. Go to the stage builder, move any existing custom stages on Brawl to your SD card, and exit the stage builder. Smash Stack will not work if the console has any custom stages on it, even the three samples that come with a new file or the stages from the Smash service
2. Copy the "private" folder from the Smash Stack download to the root of the SD card.
3. Grab the HackMii installer and put that in the root of the SD card.
4. Insert the SD card into the Wii.
5. Go back to the stage builder and the .elf file will load.

Indiana Pwns

• The Indiana Pwns was created by fail0verflow with reused code from the Twilight Hack. It works on all system versions up to 4.3.

Instructions:

1. Get the hacked save file from here (HackMii).
2. Extract the ZIP archive to an empty folder.
3. Copy the "private" directory from the Indiana Pwns download to the root of your SD card.
4. Eject and insert your SD card in your Wii and turn it on.
5. Go into Wii Options -> Data Management -> Save Data -> Wii
6. Select the "Indiana Pwns" save that corresponds to your game region, and copy the save to the Wii's system memory.
7. When the game loads, you will be in "Barnett College". Walk to the "Art Room" through the "Courtyard" and approach the left character on the podium. When the character zooms in, use the switch to select the two Lego silhouettes with an arrow pointing between them.

Bathaxx

• Bathaxx is achieved by playing a hacked game save for LEGO Batman which executes a homebrew application from an external SD card, The bathaxx was created by Team Twiizers and Lewrum. It works on all system versions up to 4.3.

Instructions:

1. Download the Bathaxx exploited save data from here.
2. Extract the ZIP archive to an empty folder.
3. Copy the "private" directory from the Bathaxx download to the root of your SD card.
4. Eject and insert your SD card in your Wii and turn it on.
5. Go into Wii Options -> Data Management -> Save Data -> Wii
6. Go to SD card and select the "Bathaxx" save data that corresponds to your game region and copy that to your Wii's system memory
7. Launch "LEGO Batman" from the Disc Channel and load the saved game you just copied to the Wii.
8. Inside the "Batcave", take the elevator on the right side, and in the "Trophy Room", go to the upper-left corner and go through the door in order to enter the "Wayne Manor".
9. When selecting a character, choose the last enabled one in the lowest row, that being the 47th character.

Return of the Jodi

• Return of the Jodi is achieved by playing a hacked game save for "Lego Star Wars: The Complete Saga" which executes the HackMii loader, It was created by Team Twiizers and roto, It works on all system versions
• This works on all Star Wars games Wars game as well as the newer (1.01) release (NTSC and PAL) all through one masterfully crafted save.

Instructions:

1. get the hacked save for the game from here here(HackMii)
2. Copy the "private" directory from the Bathaxx download to the root of your SD card
3. Put your SD card in your Wii and turn it on
4. Go into Wii Options -> Data Management -> Save Data -> Wii
5. Go to SD card and select the "Return of the Jodi" savegame that corresponds to your game region and copy that to your Wii
6. Load the saved game you just copied to the Wii
7. Using either the Nunchuck Control Stick or the Wiimote D-Pad, go to the bar on the right and choose the character named "Return of Jodi" and press "A", Enjoy

Eri HaKawai

• Eri HaKawai is achieved by playing a hacked game save for "Tales of Symphonia: Dawn of the New World", HaKawai was created by delroth for PAL consoles and ported to NTSC by giantpune

Instructions:

1. Copy the "private" directory from the Bathaxx download to the root of your SD card
2. Put your SD card in your Wii and turn it on
3. Go into Wii Options -> Data Management -> Save Data -> Wii
4. Go to SD card and select the "Eri HaKawai" savegame that corresponds to your game region and copy that to your Wii
5. Start the game and load the first save.
6. Press the PLUS button to enter the game menu.
7. Scroll to the STATUS button and press A.
8. Scroll to the monster named "Eri HaKawai" (NTSC version: "Giantpune") and press A.

Yu-Gi-Oh games

• This is a modified save game (savegame exploit) of Yu-Gi-Oh 5D's Wheelie Breakers, based on Team Twiizers Indiana Pwns and Twilight Hack source code. It uses a buffer overflow, found by ichfly, to run unsigned code on a Wii console
• If you have the NTSC version, Use The Yu-Gi-Vah (WiiBrew) save file, If you have the PAL version use the Yu-Gi-OWNED!(WiiBrew)save file

Instructions:

1. Copy the "private" directory from the Bathaxx download to the root of your SD card
2. Put your SD card in your Wii and turn it on
3. Go into Wii Options -> Data Management -> Save Data -> Wii
4. Go to SD card and select the Yu-Gi-Vah/OWNED! savegame depending on your game region and copy that to your Wii
5. Insert the Yu-Gi-OH 5D's Wheelie Breakers disc, go to Disc Channel, and start it.
6. Press Wiimote A Button and wait until the title menu shows up.
7. Press Wiimote A Button and you will see a loading screen. Wait a couple of seconds and your homebrew will be executed,Enjoy

SzsHaxx (Wii only)

• Overflows the Mario Kart Wii competition data output buffer, resulting in the ability to execute arbitrary code, Created by Team Twiizers and MikeIsAStar

Instructions:

1. Get the .Zip file from here (Github)
2. Create the filepath sd:/private/wii/title/RMC[E|P|J|K] on the SD card. The final character should match the version of Mario Kart Wii that will be used
3. Transfer the data.bin file that corresponds to the version of Mario Kart Wii that will be used into the aforementioned folder
4. Place the boot.elf file to be executed on the root of the SD card (sd:/)
5. Enable WiiConnect24
6. Delete the save data for the version of Mario Kart Wii that will be used
7. Transfer the save data from the SD card to the Wii
8. Launch Mario Kart Wii
9. Start the competition