Hacking Successfully dumped WiiU EMMC nand with hardmod.

[Leeful]

UPDATE: It is now possible to fully UNBRICK the WiiU using a hardmod, teensy and WiiU Nand Tools.

I have tried a new approach to dumping the Emmc nand and it has worked. With this method I was able to dump the nand to an img file on the PC and then successfully write the img file back to the WiiU.

The trick was to disconnect the CLK signal to the nand on the motherboard and then the pc was able to read the nand. After you have dumped / wrote your nand.img make sure to reconnect the CKL with a jumper.



Dumping the nand was the same procedure as with the 3DS hardmod using Win32DiskImager.

First connect the SD card to your card reader on your PC.
Press the power button on the WiiU.
A popup message should appear on the PC saying you need to format the drive. CLICK CANCEL. DO NOT FORMAT THE DRIVE!!!! remember what drive letter it says.

Open Win32DiskImager and make sure the Drive letter on the right is the same as the one that popped up!
Select where you want to save the .img file and click read.

The dump size was 29.7gb and took around 2 hours at 5.7MB/sec

If when you click read and it says "Lock Error" keep trying. it could do it on the first attemp or the third or the twentieth. This was exactly the same with the 3DS. To try and eliminate this problem make sure there are no explorer windows open or anything else that might be trying to read the drive.


When the read is complete close Win32DiskImager and safely eject the drive using "Safely Remove Hardware and Eject Media"
Hold the power button on the WiiU to turn off the console and don't forget to insert the jumper so that the wiiU can boot normally again.


PLEASE NOTE this is not a proper step by step tutorial (yet). I'm ony posting my findings and what I did to successfully read and write the nand.

If someone wants to write up a more detailed tutorial later please feel free (just give me a mention

I WILL NOT BE RESPONSIBLE FOR ANY BRICKS. ONLY ATTEMPT THIS IF YOU KNOW WHAT YOU ARE DOING!!!

Even though this by itself cannot UNbrick a bricked system. Its a start.

The next thing to try is the TSOP NAND and then anyone with a backup of BOTH the eMMC and TSOP nands should be able to fully UNbrick their WiiU if anything goes wrong..

UPDATE:
Not all Card Readers will work. Here is a list of confirmed Working & non Working Readers:
Transcend TS-RDP8K - WORKED
ALL IN 1 HDD Docking Station Model:875 - WORKED
Logilink Cr0001b - Confirmed WORKING. Thanks @Tommy084
Anker USB 3.0 AR200 - DID NOT WORK (would not detect drive?)
Kingwin 5.25 inch bay mounted fan controller/multi card reader - NOT WORKING. Thanks @DocAmes1980

UPDATE 2:
I've been playing around with this some more and if you also connect the other 3 DAT lines the read rate goes up to 18.4MB/sec (write rate 10MB/sec) so a full 32GB nand can now be dumped in around 30 minutes instead of 2 hours!


UPDATE 3:
Here is a video of it working.


UPDATE 4:
I can confirm that the mlc backup made with dimoks' sdio_nand_manager works with the hardmod.
I created a new rednand, dumped the nand images with sdio_nand_manager then straight away made a mlc dump with the hardmod and the SHA256 hashes form both mlc dumps match.

UPDATE 5:
Thanks to @DocAmes1980 & @Tommy084 for trying it out and confirming the mod works.

 

[DocAmes1980]

I just completed the mod. I used a three way switch to direct the clock signal. One position sends it to the fake SD for read/write mode and the other sends it to the Wii U so the sucker actually boots and plays games. All the continuity checks out but it didn't work in the two readers I tried. One was a SD card reader built in to my laptop. The other was a Kingwin 5.25 inch bay mounted fan controller/multi card reader connected to a internal USB 2.0 header. I might try that transcend reader and report back.

Pictures:

https://filetrip.net/view?WIoGQq27MF

https://filetrip.net/view?dtmauNR2Cp

 

[DocAmes1980]

ignore

 

[Jayro]

[ img] your_image_url.jpg [ /img]

 

[DocAmes1980]

[ img] your_image_url.jpg [ /img]

Thanks. No Joy. I think filetrip.net is just fucked up. Even following a direct link just takes me to the home page.

Edit: URL is valid but it shows as a broken link. Don't understand why. Oh well.

 

[ddurdle]

great work and great progress! A solid contribution to the community.

 

[DeadlyFoez]

Good job. I really should get to doing this. I already can read and write the nand chip without any issues, I just haven't jumped into the eMMC yet.

 

[Leeful]

I just completed the mod. I used a three way switch to direct the clock signal. One position sends it to the fake SD for read/write mode and the other sends it to the Wii U so the sucker actually boots and plays games. All the continuity checks out but it didn't work in the two readers I tried. One was a SD card reader built in to my laptop. The other was a Kingwin 5.25 inch bay mounted fan controller/multi card reader connected to a internal USB 2.0 header. I might try that transcend reader and report back.

Pictures:

https://filetrip.net/view?WIoGQq27MF

https://filetrip.net/view?dtmauNR2Cp

Sorry to hear you couldn't get it working yet. It probably is the card reader that is giving you the trouble.
Another thing to try is to shorten the length of the wires to try and minimise any interference. (people were always mentioning this with the 3DS but I dont know if it makes any great difference)

Can you confirm that the switch is working like the image below and that the clk track is definately cut:



What happens when you turn on the WiiU in read/write mode?(it doesn't have to be plugged into a reader)

On mine when the power button is pressed you can hear the DVD drive make a noise as normal but the wiiU does not boot up. There is no picture sent to the TV and the gamepad will not connect if turned on. (this is handy because when dumping the nand you only need the power cable plugged in so you can easily move the WiiU near a PC.) To turn off, the power button must be held in. When the WiiU boots the next time the warning comes on screen about not shutting down properly like when a crash happens.

When you checked the continuity did you test between the contacts of the sd card and the resistors on the motherboard? It may sound obvious but I'm just trying to think of any thing that can help.

Hope you can get it working.

Good job. I really should get to doing this. I already can read and write the nand chip without any issues, I just haven't jumped into the eMMC yet.

This is good to hear. I have ordered a teensy, 3.3v regulator, pins, wires e.t.c so I'm planning to tackle the tsop nand next.

Do you have any advice that could help? Does the nand need an external power source or can it be powered by the teensy? Have you posted a tutorial anywhere?

 

[DocAmes1980]

Sorry to hear you couldn't get it working yet. It probably is the card reader that is giving you the trouble.
Another thing to try is to shorten the length of the wires to try and minimise any interference. (people were always mentioning this with the 3DS but I dont know if it makes any great difference)

Thank you for your response. I'm also guessing that it is the readers that are the issue. I've only read a little bit about the 3DS hard mod but it seems that built in card readers either don't work or are very unlikely to work. Perhaps my wires are too long. They are a little longer than yours because I was hoping I could use the built in readers of my laptop or desktop. I will try a known good reader before making any adjustments.

Can you confirm that the switch is working like the image below and that the clk track is definately cut:
View attachment 76052

Yes, the switch is working exactly as you have labeled. Pin 2 is the clock signal from the eMMC. Pin 1 goes back into the Wii U and jumps the cut trace. Pin 3 goes to the fake SD card. The trace is definitely cut. I checked to confirm there was no continuity between the two points. After wiring up the switch I confirmed that there was continuity between the points when the switch was in position "A". When in position "B" the clock signal has continuity with the appropriate pin on the fake SD card.

What happens when you turn on the WiiU in read/write mode?(it doesn't have to be plugged into a reader)

On mine when the power button is pressed you can hear the DVD drive make a noise as normal but the wiiU does not boot up. There is no picture sent to the TV and the gamepad will not connect if turned on. (this is handy because when dumping the nand you only need the power cable plugged in so you can easily move the WiiU near a PC.) To turn off, the power button must be held in. When the WiiU boots the next time the warning comes on screen about not shutting down properly like when a crash happens.

Yes, sir. Exactly as you described. DVD drive does it's usual thing. No signal is sent to the TV. Gamepad doesn't do anything. Holding the power button shuts off the system and upon reboot it gives me the nag screen.

When you checked the continuity did you test between the contacts of the sd card and the resistors on the motherboard? It may sound obvious but I'm just trying to think of any thing that can help.

Yes, I checked from the resistors to the pads of the fake SD card. I also tested the switch in both positions to ensure that it was functioning as expected. Also, you might notice that the solder joints on DAT0 and GND in the picture I uploaded are shitty. They still checked out for continuity but I resoldered them. All joints looked good when I reassembled (ok, the JMP point is ugly but it's solid as the Wii U boots). I'll try a known good reader at some point and see if I get joy. If you find any other readers are working please update.

Thanks for your help,

Andy

 

[Derpncheez]

This is awesome work! I'm so terrified of bricking my console by installing CFW. Is it safe to say to wait before messing with that? Again, thanks for your contributution!

 

[wolf_]

This is awesome work! I'm so terrified of bricking my console by installing CFW. Is it safe to say to wait before messing with that? Again, thanks for your contributution!

if your not worried about coldboot then there is no brick chance

 

[Derpncheez]

if your not worried about coldboot then there is no brick chance

I was also thinking of installing RedNand+Mocha, which could lead to a possible brick, no? or maybe I read wrong.

 

[DeadlyFoez]

I personally use an infectus to read and write the nand chip. I remove the nand chip from the mother board.

I used to repair a real lot of wii's back in the day.

 

[DocAmes1980]

I was also thinking of installing RedNand+Mocha, which could lead to a possible brick, no? or maybe I read wrong.

As far as I know, the only way that you will brick your system while using redNAND is if you update redNAND. It seems unlikely that Nintendo will push out another Wii U update but it's possible. Also, you can block updates to prevent this. That being said, forget redNAND. It is 100% useless for the end user. Not only is it useless but it wastes 32GB of SD card space (only 8GB if it's an 8GB Wii U). Also it can be a pain to deal with. Many threads have been started because a user encountered problems related to redNAND. Sometimes there is junk data that can't be deleted, sometimes redNAND corrupts itself so you lose everything since the last dump. Many users on this forum will violently disagree with me. They say redNAND is great to use because it protects you against bricks. The thing is that using homebrew, CFW, and running backups doesn't expose you to any brick risks. If you look at the list of known bricks only one of them could have been prevented by using redNAND. In that case it was a dev experimenting with some custom shit that bricked his system. Pretty much every other brick that I'm aware of was from the user failing to follow instruction during or after installing coldboothax/CBHC. These type of brick can't be prevented with redNAND because coldboothax/CBHC is applied to sysNAND and screwing up causes the console to fail to boot the Wii U menu. One guy bricked by messing up a hardware mod. Another claims he bricked by installing an update. With the latter there has to be more to the story or maybe his hardware failed and the last thing he did was install an update so he blamed that.

Even if you decide to install CBHC you'll be fine if you can follow instructions. So far every brick has been 100% user error.

 

[TyrelProudpappyD]

Gateway for SysNAND CFW? Nice!

 

[C0mm4nd_]

if your not worried about coldboot then there is no brick chance

And restoring eMMC NAND can't fix a coldboothax brick

 

[naddel81]

And restoring eMMC NAND can't fix a coldboothax brick

how come? I thought everything was saved on NAND?!

 

[C0mm4nd_]

how come? I thought everything was saved on NAND?!

Wii U has 2 NANDs
eMMC(with userdata,games,ecc... like the 3DS) TSOP(with sys files like system.xml)

And for dumping TSOP NAND ehm... you'll need a Teensy and other things, it's more difficoult

--------------------- MERGED ---------------------------

It can fix only if you delete the title/format and you did a NAND bak

 

[tvall]

how come? I thought everything was saved on NAND?!

the use of nand there is a little confusing.

so the wiiu has multiple flash chips, the large emmc, and a slc nand (which is actually two, one part for for the vwii mode too).

the only thing being talked about much here is the emmc. and most of the coldboot bricks involve broken stuff on the slc nand. which also is the one thats more work to flash. mess of data and address pins instead of just clk, cmd, and dat

edit: ninja'd

 

[DocAmes1980]

the use of nand there is a little confusing.

so the wiiu has multiple flash chips, the large emmc, and a slc nand (which is actually two, one part for for the vwii mode too).

the only thing being talked about much here is the emmc. and most of the coldboot bricks involve broken stuff on the slc nand. which also is the one thats more work to flash. mess of data and address pins instead of just clk, cmd, and dat

edit: ninja'd

Actually I would say most of the coldboothax bricks are because the user deleted the Haxchi title or formatted the system. Since CBHC I believe all coldboothax bricks have been from one of these two causes. That being said this mod really doesn't do much for you. I just thought it would be fun. I don't even want to spend the $10 on a card reader to confirm that the mod is working since I have no practical use for dumping/restoring the eMMC. I suppose I have to now so I can feel special as one of the few people to risk ruining a perfectly good Wii U to perform a hard mod that I have little to no use for.

Soldering is fun.