Hacking HELP! WiiU with errors on vWii, can't update the system

[rockmann]

@JoostinOnline posted a .elf, so I was able to syscheck!

The result is awful thought...

(sorry that it is in spanish)

Spoiler

SysCheck HDE v2.4.0 HacksDen Edition por JoostinOnline, Double_A, R2-D2199, y Nano
...ejecutado en IOS36 (rev 3864).

Region: NTSC-U
Menu de Sistema 4.3U (v609)

No se ha podido detectar la fecha de la unidad!
El Canal Homebrew no esta instalado

Hollywood v0x0
ID de consola: 609457453
Tipo de consola: Wii
Pais del Canal Tienda: United States (49)
Boot2 v0
55 titulos encontrados.
Se encontraron 43 IOS en esta consola. 0 de ellos son stubs.

IOS9 (rev 1290): Sin Parches
IOS12 (rev 782): Sin Parches
IOS13 (rev 1288): Sin Parches
IOS14 (rev 1288): Sin Parches
IOS15 (rev 1288): Sin Parches
IOS17 (rev 1288): Sin Parches
IOS21 (rev 1295): Sin Parches
IOS22 (rev 1550): Sin Parches
IOS28 (rev 2036): Sin Parches
IOS31 (rev 3864): Sin Parches
IOS33 (rev 3864): Sin Parches
IOS34 (rev 3864): Sin Parches
IOS35 (rev 3864): Sin Parches
IOS36 (rev 3864): Sin Parches
IOS37 (rev 5919): Sin Parches
IOS38 (rev 4380): Sin Parches
IOS41 (rev 3863): Sin Parches
IOS43 (rev 3863): Sin Parches
IOS45 (rev 3863): Sin Parches
IOS46 (rev 3863): Sin Parches
IOS48 (rev 4380): Sin Parches
IOS53 (rev 5919): Sin Parches
IOS55 (rev 5919): Sin Parches
IOS56 (rev 5918): Sin Parches
IOS57 (rev 6175): Sin Parches
xxx IOS58 skipped
IOS59 (rev 9249): Sin Parches
IOS62 (rev 6942): Sin Parches
IOS80 (rev 7200): Sin Parches
xxx IOS202 skipped
xxx IOS222 skipped
xxx IOS223 skipped
xxx IOS224 skipped
xxx IOS245 skipped
xxx IOS246 skipped
xxx IOS247 skipped
xxx IOS248 skipped
xxx IOS249 skipped
xxx IOS250 skipped
xxx IOS251 skipped
xxx IOS252 skipped
BC V6
MIOS V10
vIOS512 (rev 7): Sin Parches
vIOS413 (rev 1): Sin Parches
Reporte generado el 03/04/2017.

The ones I marked as "skipped" were causing an "error to initialize the fat system" and stopping the syscheck, so I had to get one by one.

 

[JoostinOnline]

@Cyan Sorry, I didn't realize you'd tagged me until now.

@JoostinOnline posted a .elf, so I was able to syscheck!

The result is awful thought...

(sorry that it is in spanish)

Spoiler

SysCheck HDE v2.4.0 HacksDen Edition por JoostinOnline, Double_A, R2-D2199, y Nano
...ejecutado en IOS36 (rev 3864).

Region: NTSC-U
Menu de Sistema 4.3U (v609)

No se ha podido detectar la fecha de la unidad!
El Canal Homebrew no esta instalado

Hollywood v0x0
ID de consola: 609457453
Tipo de consola: Wii
Pais del Canal Tienda: United States (49)
Boot2 v0
55 titulos encontrados.
Se encontraron 43 IOS en esta consola. 0 de ellos son stubs.

IOS9 (rev 1290): Sin Parches
IOS12 (rev 782): Sin Parches
IOS13 (rev 1288): Sin Parches
IOS14 (rev 1288): Sin Parches
IOS15 (rev 1288): Sin Parches
IOS17 (rev 1288): Sin Parches
IOS21 (rev 1295): Sin Parches
IOS22 (rev 1550): Sin Parches
IOS28 (rev 2036): Sin Parches
IOS31 (rev 3864): Sin Parches
IOS33 (rev 3864): Sin Parches
IOS34 (rev 3864): Sin Parches
IOS35 (rev 3864): Sin Parches
IOS36 (rev 3864): Sin Parches
IOS37 (rev 5919): Sin Parches
IOS38 (rev 4380): Sin Parches
IOS41 (rev 3863): Sin Parches
IOS43 (rev 3863): Sin Parches
IOS45 (rev 3863): Sin Parches
IOS46 (rev 3863): Sin Parches
IOS48 (rev 4380): Sin Parches
IOS53 (rev 5919): Sin Parches
IOS55 (rev 5919): Sin Parches
IOS56 (rev 5918): Sin Parches
IOS57 (rev 6175): Sin Parches
xxx IOS58 skipped
IOS59 (rev 9249): Sin Parches
IOS62 (rev 6942): Sin Parches
IOS80 (rev 7200): Sin Parches
xxx IOS202 skipped
xxx IOS222 skipped
xxx IOS223 skipped
xxx IOS224 skipped
xxx IOS245 skipped
xxx IOS246 skipped
xxx IOS247 skipped
xxx IOS248 skipped
xxx IOS249 skipped
xxx IOS250 skipped
xxx IOS251 skipped
xxx IOS252 skipped
BC V6
MIOS V10
vIOS512 (rev 7): Sin Parches
vIOS413 (rev 1): Sin Parches
Reporte generado el 03/04/2017.

The ones I marked as "skipped" were causing an "error to initialize the fat system" and stopping the syscheck, so I had to get one by one.

Does it crash when you run a full scan? It should still show the results on screen, despite not being able to mount your SD card.

This should force it to English, and might fix the FAT error.

Btw, the reason the arguments don't work is because you aren't running it from a loader that supports it. It's also why there isn't a way to detect if it's a vIOS, or that you're running a Wii U.

 

[rockmann]

Does it crash when you run a full scan? It should still show the results on screen, despite not being able to mount your SD card.

It disconnect the wiimote on this screen on a full scan or a single scan of any of the ios I marked before, I need to disconnect the power socket to turn off the wiiu afterwards:

Btw, the reason the arguments don't work is because you aren't running it from a loader that supports it. It's also why there isn't a way to detect if it's a vIOS, or that you're running a Wii U.

But the 512 and 513 (it is 513, no 413, it was a typo, sorry!) are listed as vIOS. Is that right?


I'm will run the new one and report back soon. Thanks!

 

[JoostinOnline]

But the 512 and 513 (it is 513, no 413, it was a typo, sorry!) are listed as vIOS. Is that right?

That's hard-coded into the system, as they only exist on the Wii U and can't be properly scanned anyway.

 

[rockmann]

That's hard-coded into the system, as they only exist on the Wii U and can't be properly scanned anyway.

Understood.

The new one you sent forced the english but does not solved the fat error. It crashes on the same place.

 

[JoostinOnline]

Understood.

The new one you sent forced the english but does not solved the fat error. It crashes on the same place.

I totally removed the mounting code in this one. If it works, just take a couple pictures of the SysCheck.

 

[rockmann]

I totally removed the mounting code in this one. If it works, just take a couple pictures of the SysCheck.

It crashes on this screen:

 

[JoostinOnline]

It crashes on this screen:

Lol why can't this be simple?

Run this. I've added a few messages to see where it's crashing. It will probably still crash, but on a different message. I'm going to sleep as it's 3AM, but I'll make sure to check it out tomorrow (assuming nothing pressing comes up).

 

[Cyan]

Hi,
I thought the notification didn't work because I edited it later. But don't worry, you found that thread anyway
Thanks for still providing modded version to help him.

I don't know if he will be able to fix the vWii, I might have miss something (I hope for him).

 

[rockmann]

Lol why can't this be simple?

Run this. I've added a few messages to see where it's crashing. It will probably still crash, but on a different message. I'm going to sleep as it's 3AM, but I'll make sure to check it out tomorrow (assuming nothing pressing comes up).

Thanks, I went to sleep too, I will try it later today.

The step "1" which is an old CFW method consist in patching the firmware on the computer and load that patched file with a firmware booter.
I still think this might be a solution for old 5.3.2 bricked consoles.
If you can get the 5.3.2 firmware from NUS (if nintendo didn't remove it) then you could patch it with the same features : IOSU hack and SLC.

the issue is that all devs updated their consoles to 5.5.x and won't be able to help find the required addresses and values to patch to get IOSU hack on these firmware.

What is required to look for this besides the 5.3.2 firm? If no special hardware is needed maybe I can try to find the addresses with some help (I barely code -microcontrollers for simple things- but I have electronic background).

 

[rockmann]

I almost forgot to add this.
I made and interesting discovery regarding Breath of the Wild (maybe someone already discover it, but I haven't found any post about it). I strongly suspect that what is missing on 5.3.2 vs. 5.5.x is a new or upgraded video codec.
The first crash is when the game tries to reproduce a video on the first shrine cutscene.
So I dumped the save file, pass that cutscene on CEMU, and re inject it. I was able to continue on the wiiu.

Later it happened again after

Spoiler

the king reveals himself cutscene

and when

Spoiler

you first visit Impa.

So, in a convoluted way I was able to continue dumping, passing the cutscene on cemu (it also cannot reproduce the video correctly, but does not crash), re injecting. I hope there are not much movies left! (You can watch the cutscenes on a let's play on youtube at least...)

 

[rockmann]

Sorry for the triple post (!).

@JoostinOnline here's the message where it crashes:

(Displaying Report)

 

[JoostinOnline]

Sorry for the triple post (!).

@JoostinOnline here's the message where it crashes:

(Displaying Report)

Well that's just all kinds of interesting. It probably won't work, but ideally this will display the report and scroll through it even without a connected remote.
@Cyan It's freezing AFTER the WPAD_Init line.

 

[rockmann]

Well that's just all kinds of interesting. It probably won't work, but ideally this will display the report and scroll through it even without a connected remote.
@Cyan It's freezing AFTER the WPAD_Init line.

Sorry, have you added a new file to try? (I'm reading it like yes on "this" but I can't find any link on your message)

 

[JoostinOnline]

Sorry, have you added a new file to try? (I'm reading it like yes on "this" but I can't find any link on your message)

Weird, it didn't add it the first time. I definitely entered it though. Anyway, it's edited, but just in case: http://s000.tinyupload.com/index.php?file_id=04448736518962216886

 

[rockmann]

Weird, it didn't add it the first time. I definitely entered it though. Anyway, it's edited, but just in case: http://s000.tinyupload.com/index.php?file_id=04448736518962216886

It worked!

Spoiler

ios58 is wrong, right? But there's no entrypoint to change it, thought

 

[Cyan]

latest IOS58 is v6432 (that's the vWii version)
I don't know nor compared all the other IOS version, but without a vWii cIOS you can't fix it from vWii side.
From WiiU side, you might be able to do it, but you'll have to create a IOSU hack for 5.3.2
I don't know if anyone will be willing to help, or take the time to explain how they did with 5.5.x

Dimok and Fix94 (and other users, like Maschell worked on dynamic lib) worked on it. Dimok is busy with his work, he will be back in few weeks/months.
https://gbatemp.net/threads/libiosuhax-ppc-ipc-library-for-communication-to-dev-iosuhax.449296/
If you want to research and try it yourself, you'll have to read a few things, and look at sources.
IOSUHax from Smealum, I think it was released before 5.5.x was even available. Then dimok based it off his work.
Then you might have to look how to create a CFW (fix94 made a nice guide to compile it) but I dont remember if the cfw booter require 5.5.x

There are always users and developers who take time to work on a brick fixer.
Someone recently worked on a NAND edition and restoration tool, but you need 5.5.1 to get otp.

maybe all you need is a way to dump otp from 5.3.2, no need of all other features like NAND access, as it will be done on a hardware flasher.
Again, I don't know if it's possible. you might have to ask Fix94, he should know if it's possible.

But like you said, there might be few users in the same case than you, and having a way to fix these console would be nice for a lot of people.

 

[rockmann]

But like you said, there might be few users in the same case than you, and having a way to fix these console would be nice for a lot of people.

I was able to play BOTW, it was the reason I tried to update to 5.5.1, but now it is personal. I have a grudge against the assholes scammers that sell bricked consoles without a warning, so I will keep going and contact Fix94 and etc.

Thanks for all the info, I appreciated a lot.

If someone else have anything to add I'm all ears.

 

[JoostinOnline]

latest IOS58 is v6432 (that's the vWii version)
I don't know nor compared all the other IOS version, but without a vWii cIOS you can't fix it from vWii side.
From WiiU side, you might be able to do it, but you'll have to create a IOSU hack for 5.3.2
I don't know if anyone will be willing to help, or take the time to explain how they did with 5.5.x

Dimok and Fix94 (and other users, like Maschell worked on dynamic lib) worked on it. Dimok is busy with his work, he will be back in few weeks/months.
https://gbatemp.net/threads/libiosuhax-ppc-ipc-library-for-communication-to-dev-iosuhax.449296/
If you want to research and try it yourself, you'll have to read a few things, and look at sources.
IOSUHax from Smealum, I think it was released before 5.5.x was even available. Then dimok based it off his work.
Then you might have to look how to create a CFW (fix94 made a nice guide to compile it) but I dont remember if the cfw booter require 5.5.x

There are always users and developers who take time to work on a brick fixer.
Someone recently worked on a NAND edition and restoration tool, but you need 5.5.1 to get otp.

maybe all you need is a way to dump otp from 5.3.2, no need of all other features like NAND access, as it will be done on a hardware flasher.
Again, I don't know if it's possible. you might have to ask Fix94, he should know if it's possible.

But like you said, there might be few users in the same case than you, and having a way to fix these console would be nice for a lot of people.

Can you install a newer version of an IOS on vWii without special permissions? It's been a long time. Other than for Breath of the Wild, I haven't used my Wii U in over a year, and it's been even longer since I installed anything on it.

 

[rockmann]

Can you install a newer version of an IOS on vWii without special permissions? It's been a long time. Other than for Breath of the Wild, I haven't used my Wii U in over a year, and it's been even longer since I installed anything on it.

I was trying to do that with IOS58 (but idk if the one I have is clean) with YAWMM, but it justs keep throwing a -1017 error, as it runs on... IOS58. Maybe if there's a way to run it from IOS36?

Or maybe I can try the IOS236 installer? But that one is only on .dol, I need the .elf. (I need to check who made it)

I'm paraphrasing here, I'm not sure if any of this is doable, so far I read once you don't have any valid IOS to work from you are screwed. But again, as my IOS58 seems to be the only one with invalid version, it is possible to run Hackmii from another IOS, like 36?

UPDATE: The IOS236 installer v8 was made by Fix94.
UPDATE2: Maybe someone can send me a IOS58 that is certified to not be fakesigned to try?