​

The Wii U was truly the black sheep of the main Nintendo consoles, but in terms of homebrew capabilities, it was but a diamond in the rough. While the Wii U is way past its heyday by almost a decade, the homebrew community still continues to thrive and develop great things for the system.

One of these developers, @shinyquagsire23, has made some research and advancements towards creating a modchip for the Wii U, which he titled "de_Fuse". The modchip started when Shiny Quasire started looking at the then unhacked Wii Mini console, in an attempt to glitch boot0 on it, and while getting curious if it could work on Wii U, he found that a similar exploit could be attempted for it, with the only downsides being OTP dumps being impossible due it being all 00s and the driver for boot0 being limited to SDHC cards.

While the necessity of having a modchip for the Wii U is not a must since Wii U already has coldboot exploits and many other things like Aroma that could serve a similar purpose, the main purpose of this modchip is to allow booting a Wii U console straight from the SD card, without having to rely on the Wii U's internal eMMC chip to boot into the console. This due to the recent news about some Wii U consoles bricking entirely due to failures in the eMMC chip, so giving players the option to boot from SD card would be a relief to this delicate issue that plagues the console.

​

The rest of the information is highly technical and dives into the eFuses, OTP, boot0, boot1 and SRAM of the console, so those interested in a more in-depth and detailed information regarding the process can read it in Shiny Quagsire's own article about de_Fuse on his webpage.

The modchip is currently in early stages of development, and it currently requires an FPGA of sorts, but it hasn't been standardized in terms of schematics or parts. However, Shiny Quagsire is trying to aim for a $25-$35 dlls range when its finished (or lower), based on RP2040 chip. Those interested and willing to collaborate and help out throughout its development can do so through Shiny Quagsire's GitHub repository for the modchip, where he keeps all of the coding and research for it open source.

de_Fuse, the One True Pwn article
GitHub Repository

 

[SDIO]

I guess that is because of the modules on the SLC being to old for your fw.
But we should be able to fix it, in the worst case we just install the lastest titles through stroopwafel. But I want to try a more targeted approach first.
Boot without defuse again, wait a little on the black screen and then dump logs and send us the logs. Then we might see where it fails with the installed OSv10.
Also it would be helpful if you could also extract the MLC on the PC and send us the versions of the system titles. But do the logs first

Post automatically merged: Jul 5, 2023

Do you have the Wii / Wii U Ethernet adapter or can borrow one? If so try connecting that

 

[gorgyrip]

I guess that is because of the modules on the SLC being to old for your fw.
But we should be able to fix it, in the worst case we just install the lastest titles through stroopwafel. But I want to try a more targeted approach first.
Boot without defuse again, wait a little on the black screen and then dump logs and send us the logs. Then we might see where it fails with the installed OSv10.
Also it would be helpful if you could also extract the MLC on the PC and send us the versions of the system titles. But do the logs first

Post automatically merged: Jul 5, 2023

Do you have the Wii / Wii U Ethernet adapter or can borrow one? If so try connecting that

Booted the console without defuse and went for a smoke.
Connected defuse and started display crash log:

Reading SMC crash buffer...
Exception registers:
R0-R3: 90000b66 34600a85 50088ec4 90a4004a
R4-R7: 812438e4 1466a208 1d402841 022149c9
R8-R11: 982c5811 26471e20 1115400a c0300a55
R12-R15: 524d380e 0234ba02 9012c097 34392744

I will dump de mlc.
I have never seen an ethernet adapter and i don't know anyone with one.

 

[SDIO]

I meant the syslogs. I don't know if minute has an option to extract them. In the worst case you have to dump the slc and extract them.

Post automatically merged: Jul 5, 2023

btw the command for injecting the system.xml would be

fileInjector SLC.RAW system.xml /sys/config/system.xml

But now that IOSU boots far enough to mount the mlc you always have to carry the state of the slc forward and can never go back.
This means as soon as you do a boot attempt, all your old SLC backups become invalid. If you want to change the system.xml you first have to get a fresh dump and you are not allowed to boot IOSU again until you flashed it back.

Also another thing we could try would be to change the default os to 00050010100040ff, which should boot the updater os.

 

[gorgyrip]

I dumped the slc again, and now the logs folder is empty.
Thank you for the command line. i will try it on a fresh slc dump and change it to 00050010100040ff
First I want to try UDPIH, maybe it works now, since the default is now OS10

 

[SDIO]

I think udpih won't work with the IOSU, which is installed, but it should work with the 5.5 one, which you can start with defuse from the sd

 

[gorgyrip]

I think udpih won't work with the IOSU, which is installed, but it should work with the 5.5 one, which you can start with defuse from the sd

Thank you for the tip!

I tried without defuse and no luck.
I used defuse to boot OS10, the drive makes 2 noises, pause and again 2 noises. i inserted the pico. switched to hdmi and....
I can see the UDPIH menu!!!
what should i do next? i don't have 64gb card to dump the mlc.
Also the background is red, the text white and the link to the github is yellow. I remember it looked different.

EDIT: I celebrated too fast. i can't select any option, i think the console is frozen.

 

[SDIO]

Can you share a picture?
You probably should get a 64GB sdcard and make a backup first, especially if we now start messing with it.

You can try to dump logs again with the recovery menu. I am really hesitant making any changes without a full backup.
Do you have a 32GB sdcard?

 

[gorgyrip]

Can you share a picture?
You probably should get a 64GB sdcard and make a backup first, especially if we now start messing with it.

You can try to dump logs again with the recovery menu. I am really hesitant making any changes without a full backup.
Do you have a 32GB sdcard?

You missed my edit
The recovery menu is frozen. can't select anything. I can only hold the power button to power off the console.
yes, i have a few 32gb sd cards.

EDIT: maybe it freezes because the recovery menu is on the same sd card as minute?

 

[SDIO]

Then try again, it probably crashes after some time.

EDIT: If it crashes too fast, we can give you a stroopwafel, which disables crashing

 

[gorgyrip]

Then try again, it probably crashes after some time.

EDIT: If it crashes too fast, we can give you a stroopwafel, which disables crashing

i've tried about 10 times and the result is the same.
I will gladly try stroopwafel.

 

[Lazr1026]

@gorgyrip use this minute_minute and stroopwafel. place the "wafel_core.ipx" in "sd:/wiiu/ios_plugins". replace the fw.img on the sd card with this one

this has the kernel panic disabled, as requested by SDIO

 

[gorgyrip]

@gorgyrip use this minute_minute and stroopwafel. place the "wafel_core.ipx" in "sd:/wiiu/ios_plugins". replace the fw.img on the sd card with this one

this has the kernel panic disabled, as requested by SDIO

It worked. Thank you! Now i can navigate the menu.
I dumped the logs, but the folder is still empty.
I paired a gamepad. It said paired, the gamepad restarted and: could not connect to the console.

 

[SDIO]

Hm if it isn't producing logs, we can't debug the old OS.

You could try to let the IOSU from the SD just boot without launching the recovery. Maybe it goes further with the patch that disables crashing.

You with the recovery you can also reinstall OSv9 and then change the default os back to the OSv9 title. Now that you have the recovery menu running you can start a wupserver and use wupclient to change the system.xml (so you don't have to flash the whole slc image).

You could also try to boot the updater OS, like I suggested ealier, now that you have a fast way to change the system.xml

But I start to think the easiest thing to do now would be to just install the latest system titles to bring the system to a consistent state (like @Lazr1026 already suggested to me)
Maybe start with just updating the OSv10 to a 5.5.x version.

 

[gorgyrip]

Ok. it took a while but i managed to get a connection with wupserver. Don't know what commands to use, but i found a gui, so i'll use it tomorrow.

Post automatically merged: Jul 6, 2023

SDIO,​

I changed the default title to the updater. now without defuse, I can see the wii u logo and after that an error

 

[Valery0p]

I'm glad to see your console coming back to life, step by step

 

[gorgyrip]

I'm glad to see your console coming back to life, step by step

Yes. Little by little. Now i'm trying to update OS10, but i'm confused. Should I delete the folder from the slc and paste the new one? Or should I overwrite the files? And what about title.tmd and title.fst?
Title.tmd seems to be the file tmd.15848 that you get with Uwizard when you download a title.
I can't find title.fst Should i use it from another console with the same version of OS10?

 

[SDIO]

Maybe first try to reinstall OSv9 and see what happens. You can do that with the Install option in the recovery menu. Or you can replace the two broken files by hand with the wupclient. Whatever you prefer

 

[gorgyrip]

I'm struggling for a few hours to install os9 with install wup and all i get is : Querying install info...
I have the install folder on the sd card. in there i've placed the encrypted files. I've also tried the decrypted files (app) and nothing works.

 

[SDIO]

Then try to just upload these two broken files with wupserver

 

[gorgyrip]

Just did that. i read the files back and there's no corruption.
i hope that other files didn't get corrupted.
I set the default title to os9 and now there's a guy walking over my screen )))
Gamepad cannot be synced. maybe because i don't have the antennas connected, or the module moved.
The wii remote can be synced.
Thank you for all the help!