Hacking Dumping Wii U NAND via SD card adapter

[loco365]

Well it could be possible, I prefer wait to homebrew NAND dump, because that could be risky and you need a 32GB or 64GB SD Card to dump all the NAND of Wii U (the basic owners have only 8GB so it's easier), if we have a Wii U NAND Dumper, I hope it bring USB support to dumping the 32GB NAND because I don't have a very big SD card...

That, or else dump it over WiFi, although that'd take hours upon hours. RAM dumps take long enough as is.

 

[Goku Junior]

That, or else dump it over WiFi, although that'd take hours upon hours. RAM dumps take long enough as is.

Well, I didn't think that, but you're right, I was copying a GameCube ISO (1.35GB) with filezilla to my SD Card in Wii U, and I had to cancel because it took a lot of time...

 

[mixelpixx]

Ok. It's probably pretty easy since it's a eMMC. Looks like you could easily use a SDcard reader and WinHex to do it. At least based off my reading.

https://www.dropbox.com/s/ln33bajdgzkpsha/CoronaV2_free-for-all_Hack_GT.pdf

Applies to the NANDs in the Wii U. I guess now I need to find another Wii U to tear apart.

For reference purposes on eMMc standards..

http://rere.qmqm.pl/~mirq/JESD84-A44.pdf

And for those concerned about speed, I believe you can use an SPI to read/write. here is one in particular:

https://sites.google.com/site/rghnandflasher/download/usb-spi-nand-flasher

a lot of the work done for Xbox360 seems to overlap, at least in the NAND department.

 

[officialjunk]

... I guess now I need to find another Wii U to tear apart.

There's a techbargains deal for a used deluxe wii u for $169 on cowboom using coupon "Wii5081414" http://www.techbargains.com/wii-u-deals
I've never purchased anything from cowboom, nor do I know where exactly you enter the coupon code, but since it's owned by best buy it seems like a trustworthy site.

 

[Goku Junior]

And for those concerned about speed, I believe you can use an SPI to read/write. here is one in particular:

https://sites.google.com/site/rghnandflasher/download/usb-spi-nand-flasher

a lot of the work done for Xbox360 seems to overlap, at least in the NAND department.

Please, stop making a lot of multi-post, edit the first one and add all of the others things.

 

[hundshamer]

And for those concerned about speed, I believe you can use an SPI to read/write. here is one in particular:

https://sites.google.com/site/rghnandflasher/download/usb-spi-nand-flasher

a lot of the work done for Xbox360 seems to overlap, at least in the NAND department.

I was thinking the same thing. My theory is use the 4GB NAND reader on the 8/32GB one on top and a demon/cygnos to read the one on the bottom.

I found the pinout for the 512MB nand on the bottom.

 

[WulfyStylez]

Just to be entirely clear, you can't use a 360 NAND flasher to flash anything but a 360. Those are designed to dump and flash NAND over the 360's JTAG port and with a proprietary protocol. Unless you're talking about swapping out NAND chips? Kind of a roundabout way to do things. Plus you might end up killing your NAND before you even get a chance to read it.

 

[hundshamer]

Just to be entirely clear, you can't use a 360 NAND flasher to flash anything but a 360. Those are designed to dump and flash NAND over the 360's JTAG port and with a proprietary protocol. Unless you're talking about swapping out NAND chips? Kind of a roundabout way to do things. Plus you might end up killing your NAND before you even get a chance to read it.

The 4GB flasher is actually an eMMc reader. A demon/cygnos connect to the actual NAND points (D0-D7, WP, WE, ALE, CLE, CE, RE, and RB) and neither use the jtag points that normal read/write solutions do (NANDx, J-R Programmer, USB SPI reader). I think the problem would be there's RB 1 and 2 as well as a CE 1 and 2.
EDIT: Looking at some progskeet diagrams, they use CE1 and RB1 as CE and RB.

 

[mixelpixx]

I was talking about flashing via SPI / ISP / JTAG or whatever ports/pins could be discovered. but after doing some reading on eMMc devices, they all comply with the same standard for communication. There may be vendor specific code or maybe to write to it you have to do the CMD62 CMD64 etc.. in a specific order.

But since it's a standard device, well documented.

I will put this stuff into the first post, and explain some of the other stuffs relevance. In most cases Xbox and Wii would have nothing to do with one another, but as far a com protocols and talking to devices, there is much overlap since it's done in a standardized fashion these days. These chips are used in Sat receivers, Tablets, phones, etc. So there is no reason to reinvent the wheel, just choose the right one.

 

[WulfyStylez]

I was talking about flashing via SPI / ISP / JTAG or whatever ports/pins could be discovered. but after doing some reading on eMMc devices, they all comply with the same standard for communication. There may be vendor specific code or maybe to write to it you have to do the CMD62 CMD64 etc.. in a specific order.

But since it's a standard device, well documented.

I will put this stuff into the first post, and explain some of the other stuffs relevance. In most cases Xbox and Wii would have nothing to do with one another, but as far a com protocols and talking to devices, there is much overlap since it's done in a standardized fashion these days. These chips are used in Sat receivers, Tablets, phones, etc. So there is no reason to reinvent the wheel, just choose the right one.

Well yeah, it's a given that eMMC is MMC. The real issue for most people is reading out the other flash chip. It's probably possible to do it via a 360 reader, but you'd have to play around a lot to get a proper dump with existing tools.

 

[pasc]

I wish this was as simple as a 3DS nand backup.

Then I could finally update my Wii U and stop it from nagging me to update each power cycle.

 

[obcd]

One of the chips (the BGA) is a 8 Gig or 32 Gig EMMC. It's connections are available on the resistors nearby.
The other one is a simple 1Gig nand flash chip. Half of it is used in vwii mode as nand flash chip equivalent to the wii.
The other half probably contains the ios equivalents of wiiu arm code.
Nobody knows if there are any buildin protections against firmware downgrading.
It's also possible to protect eMMC partitions with a password against readout.

 

[Razor83]

The system NAND is 1GB (2x512MB) not 512MB.
Surprised nobody has linked to this yet:-
https://fail0verflow.com/blog/2014/console-hacking-2013-omake.html

NAND
Everyone knows that vWii mode has the same old NAND flash storage as always, a dedicated 512MB of NAND just like on the old Wii, on a dedicated NAND Flash chip, containing the same old filesystem (but not boot1 or boot2, since they don’t need those in vWii mode, as cafe2wii boots it straight into IOS). What most people don’t know is that the “dedicated” part is a lie: Cafe OS also boots from and uses SLC NAND flash in addition to the 8GB or 32GB of eMMC storage. But there’s only one NAND flash chip. Is there? Kind of: there’s one NAND flash chip, but it has two NAND flash dies inside: 2x512MB, one for vWii mode, one for Wii U mode. There’s a separate chip enable pin for each. This is actually a pretty common arrangement for a NAND flash chip, though using each bank for a totally different OS is cute. This was confusing to figure out at first because the Samsung NAND flash datasheet for this part also applies to the single-bank 512MB version and others, and it is rather unclear about the specific layout of each particular part number (even iFixit got it wrong and listed it as 512MB, while in fact the specific part used is 1GB - or 8Gbit, hence the “08” in K9K8G08U1D).

 

[Deleted User]

Could not get drive letter assigned after wiring everything up. I get the usb plugged in sound but that's it. Tried 50k resistor inline. Anyone have any solid schematics?

 

[obcd]

To my knowledge, windows only assigns one or more drive letters when it finds valid partitions on the device. You could check in disk manager if you have a new drive connected to your system. There is a free windows program winhex that also can show you all available drives. You can even use it to backup and restore a drive.

 

[Deleted User]

To my knowledge, windows only assigns one or more drive letters when it finds valid partitions on the device. You could check in disk manager if you have a new drive connected to your system. There is a free windows program winhex that also can show you all available drives. You can even use it to backup and restore a drive.

Got a drive letter assigned. WinHex gives error Device Not Ready. Gonna keep trying. Win disk does not assign drive letter.

 

[Deleted User]

Could not get drive letter assigned after wiring everything up. I get the usb plugged in sound but that's it. Tried 50k resistor inline. Anyone have any solid schematics?

You do know you just bumped a 1 year old thread.

 

[spett]

Got a drive letter assigned. WinHex gives error Device Not Ready. Gonna keep trying. Win disk does not assign drive letter.

Let us know what you find out. I'm in the same boat as you right now.

 

[Deleted User]

You do know you just bumped a 1 year old thread.

Yep just got back into modding.

Let us know what you find out. I'm in the same boat as you right now.

Will def do. Anyone have any tips for resistor solder points.

 

[Deleted User]

yep just got back into modding.

Ah, That's nice. Welcome back!