Wii Download Ticket Codes 2021 Coupons, Promo Codes 08-2021. Great offers from www.couponupto.com When you buy the microphone, packed inside the box is a 16-digit 'Wii Download Ticket' code that allows you to download the 'Wii Speak Channel' to your Wii Channels menu. To redeem a Wii Download Ticket number, such as for the Wii Speak Channel,. Download Wii Ticket Codes Codes and Scripts Downloads Free. The code is even faster than the mex version, Tool for managing patch codes for the Nintendo Wii. Get FREE Wii Point Codes today with our brand new Wii Code Generator! The only place too get FREE Wii Codes! Wii Download Ticket Code Free Codes and Scripts Downloads Free. Phoca Download Button Plugin is a Joomla. Get sick and tired of report coding.
Tickets are found in many encrypted files used by the Wii (e.g. WAD Files or Wii Discs). Tickets for NAND titles are stored in /ticket, while tickets for discs are stored on the disc itself. Tickets contain the encrypted AES 'title key' and the Title ID of the data and are signed by a certificate from a certificate chain (which usually is the same for all titles and stored somewhere on the NAND). So far only tickets with RSA-2048 signatures have been seen. Discs will only work with those signatures because the size of partition ticket is always 0x2a4.
While all Wii titles are available on NUS, most are encrypted with a key found in the ticket; this key is what is purchased with the Wii Shop Channel. Deleting a title using the data management feature of the System Menu leaves the ticket intact; this is responsible for allowing software to be redownloaded. However, tools such as AnyTitle Deleter delete tickets when they delete titles, which removes all traces of the title.
File structure
| Start | End | Length | Description |
|---|---|---|---|
| 0x000 | 0x003 | 0x004 | Signature type (always 0x10001 for RSA-2048) |
| 0x004 | 0x103 | 0x100 | Signature of ticket view by a certificate's key |
| 0x104 | 0x2A3 | 0x19F | Ticket view |
Ticket view
Free Wii Gift Ticket Codes
| Start | End | Length | Description |
|---|---|---|---|
| 0x000 | 0x03B | 0x03C | Padding (Always 0 - everything after this field is covered by the above signature) |
| 0x03C | 0x07B | 0x040 | Signature issuer |
| 0x07B | 0x0B7 | 0x03C | ECDH data, used to generate one-time key during install of console specific titles |
| 0x0B7 | 0x0BA | 0x003 | Unused/Padding |
| 0x0BA | 0x0CA | 0x010 | Title Key, encrypted by Common Key |
| 0x0CA | 0x0CA | 0x001 | Unknown |
| 0x0CA | 0x0D2 | 0x008 | ticket_id (used as IV for title key decryption of console specific titles) |
| 0x0D2 | 0x0D6 | 0x004 | Console ID |
| 0x0D6 | 0x0DE | 0x008 | Title ID / Initialization Vector (IV) used for AES-CBC encryption |
| 0x0DE | 0x0E0 | 0x002 | Unknown, mostly 0xFFFF |
| 0x0E0 | 0x0E2 | 0x002 | Ticket title version |
| 0x0E2 | 0x0E4 | 0x002 | Permitted Titles Mask |
| 0x0E4 | 0x0E8 | 0x004 | Permit mask. The current disc title is ANDed with the inverse of this mask to see if the result matches the Permitted Titles Mask. |
| 0x0E8 | 0x0E9 | 0x001 | Title Export allowed using PRNG key (1 = allowed, 0 = not allowed) |
| 0x0E9 | 0x0EA | 0x001 | Common Key index (2 = Wii U Wii mode, 1 = Korean Common key, 0 = 'normal' Common key) |
| 0x0EB | 0x11B | 0x030 | Unknown. Is all 0 for non-VC, for VC, all 0 except last byte is 1. |
| 0x11B | 0x15B | 0x040 | Content access permissions (one bit for each content) |
| 0x15B | 0x15D | 0x002 | Padding (Always 0) |
| 0x15D | 0x161 | 0x004 | Enable time limit (1 = Enabled, 0 = Disabled) |
| 0x161 | 0x165 | 0x004 | Time limit (Seconds) |
| 0x165 | 0x19D | 0x038 | 7 more time_limit structs as above ({int enable, seconds}) |
To get the title key decrypt the 16 bytes at offset 0x1bf with the Common Key using the Title ID (offset 0x1dc) as the initialization vector (the last 8 bytes of the IV should be zero).