Hacking Homebrew Help - how to identify legacy CFW to install Tiramisu?

[Lock_Key_Doctor]

Happy new year everyone!

I recent got a used Wii U to mod with Tiramisu. When I turned it on, I found out it was previously modded. It has "the homebrew launcher" and "WUP installer GX2" channels . Both give me a 199-999 error, so I'm not sure what to do next? Is there a way to find out what CFW mod was installed previously? I would like to have a clean install based on the instructions from https://wiiu.hacks.guide/

If you have an existing legacy CFW setup:

• For CBHC users: go to the Uninstall CBHC page to uninstall CBHC.
• For Haxchi users: uninstall the Haxchi app from Data Management in the System Settings app.
• For Mocha CFW (Indexiine) users: go to the Uninstall Indexiine page to uninstall Indexiine.
• For Mocha CFW (Online Exploit) users: you do not need to do anything before following this guide

Some information:

• System settings shows 5.5.6 U
• Currently not connected to the internet
• It does not have the "DO NOT USE" channel
• Mii maker doesn't do anything special
• Health and Safety (holding X or Y) doesn't prompt anything
• Brower last tab was "u.wiidb.de"
• Settings>Data Management:
  • Homebrew launcher 5376KB
  • WUP Installer GX2 5376KB
• Daily Logs (software records)
  • Webhax 1.0 first used May 2020
  • WUP Installer GX2 first used November 2020

Googled "Webhax" as I wasn't familiar with this method and found this youtube video

Interesting enough they use some browser exploit (screenshot 1) and IOSUHAX based on the image at the beginning of the video (a guess as I don't speak Spanish).

I'm concerned about bricking the Wii U by uninstalling the Homebrew launcher/WUP Installer GX2, or installing Tiramisu if it causes conflicts with a legacy CFW.
I don't think I have Tiramisu and would like to have a proper install with Bloopair and Homebrew Appstore. What's the best next steps?

Much appreciated!

 

[CMDreamer]

Watching this thread as I'm also interested on this matter.

Sorry I can't be of help, but my WiiU wasn't modded when I got it, so I just followed the instructions on your given link long ago.

Hope someone enlighten us on this.

 

[godreborn]

Happy new year everyone!

I recent got a used Wii U to mod with Tiramisu. When I turned it on, I found out it was previously modded. It has "the homebrew launcher" and "WUP installer GX2" channels . Both give me a 199-999 error, so I'm not sure what to do next? Is there a way to find out what CFW mod was installed previously? I would like to have a clean install based on the instructions from https://wiiu.hacks.guide/

If you have an existing legacy CFW setup:

• For CBHC users: go to the Uninstall CBHC page to uninstall CBHC.
• For Haxchi users: uninstall the Haxchi app from Data Management in the System Settings app.
• For Mocha CFW (Indexiine) users: go to the Uninstall Indexiine page to uninstall Indexiine.
• For Mocha CFW (Online Exploit) users: you do not need to do anything before following this guide

Some information:

• System settings shows 5.5.6 U
• Currently not connected to the internet
• It does not have the "DO NOT USE" channel
• Mii maker doesn't do anything special
• Health and Safety (holding X or Y) doesn't prompt anything
• Brower last tab was "u.wiidb.de"
• Settings>Data Management:
  • Homebrew launcher 5376KB
  • WUP Installer GX2 5376KB
• Daily Logs (software records)
  • Webhax 1.0 first used May 2020
  • WUP Installer GX2 first used November 2020

Googled "Webhax" as I wasn't familiar with this method and found this youtube video

Interesting enough they use some browser exploit (screenshot 1) and IOSUHAX based on the image at the beginning of the video (a guess as I don't speak Spanish).

I'm concerned about bricking the Wii U by uninstalling the Homebrew launcher/WUP Installer GX2, or installing Tiramisu if it causes conflicts with a legacy CFW.
I don't think I

Is there a fw.img on the sd card?

 

[V10lator]

The 199-9999 error suggests that no CFW is running. Is the Wii U saying "Autobooting..." while booting and/or does it have an app called "DO NOT TOUCH" installed to NAND? In case the answer to both questions is no go ahead and install Tiramisu.

 

[Lock_Key_Doctor]

Is there a fw.img on the sd card?

Unfortunately it didn't come with an SD card, so no fw.img available

Post automatically merged: Jan 2, 2023

The 199-9999 error suggests that no CFW is running. Is the Wii U saying "Autobooting..." while booting and/or does it have an app called "DO NOT TOUCH" installed to NAND? In case the answer to both questions is no go ahead and install Tiramisu.

No I haven't see the words "Autobooting" - When I push the power button the screen turns white with the "Wii U" logo then goes to the main menu. It's my first time using a Wii but it looks like a normal boot sequence.

No apps called "Do not touch" (I checked all the screens). It just has some preloaded games plus Homebrew launcher + WUP installer.

Should I uninstall/delete the homebrew launcher before trying Tiramisu?

 

[Deleted member 571007]

No I haven't see the words "Autobooting" - When I push the power button the screen turns white with the "Wii U" logo then goes to the main menu. It's my first time using a Wii but it looks like a normal boot sequence.

That's a standard boot, so there's no CBHC, further enforced by the fact that the "Don't Touch Me!" app isn't there. My guess? The Wii U either had standard Haxchi, but it was deleted later down the line, or they only used the Web Browser exploit. So it's (most likely) safe to just proceed with Tiramisu as there's no active CFW upon boot, or anything else.

Should I uninstall/delete the homebrew launcher before trying Tiramisu?

Lack of an SD Card also means that if they did use the Web Browser exploit, then there's no remnants of the exploit left except for the apps installed on the main menu. So you can either leave, or delete them. Either way, no real harm.

Edit :

Brower last tab was "u.wiidb.de"

Didn't see this part before. This basically just confirms that they only used a Web Exploit. This doesn't cause any conflicts with installing Tiramisu as it installs literally nothing to the Wii U and is done almost exclusively off of the contents of the SD Card. You're most likely safe to proceed. Without an SD Card, a Wii U that used the Web Exploit is essentially just a stock Wii U.

 

[V10lator]

Should I uninstall/delete the homebrew launcher before trying Tiramisu?

I would even do a complete factory reset to remove any leftovers from the previous owner / start with a fresh and clean system but as Korozin said: Choice is yours.

 

[Lock_Key_Doctor]

That's a standard boot, so there's no CBHC, further enforced by the fact that the "Don't Touch Me!" app isn't there. My guess? The Wii U either had standard Haxchi, but it was deleted later down the line, or they only used the Web Browser exploit. So it's (most likely) safe to just proceed with Tiramisu as there's no active CFW upon boot, or anything else.



Lack of an SD Card also means that if they did use the Web Browser exploit, then there's no remnants of the exploit left except for the apps installed on the main menu. So you can either leave, or delete them. Either way, no real harm.

Edit :



Didn't see this part before. This basically just confirms that they only used a Web Exploit. This doesn't cause any conflicts with installing Tiramisu as it installs literally nothing to the Wii U and is done almost exclusively off of the contents of the SD Card. You're most likely safe to proceed. Without an SD Card, a Wii U that used the Web Exploit is essentially just a stock Wii U.

Really good to know about the boot. Thanks for confirming. I read a lot about Tiramisu but its harder to find relevant information on legacy methods (e.g. 5 year old youtube videos etc). Would there be a possibility that they used the Mocha CFW?

I'm going through this list and crossing each one off to double check:

• For CBHC users: go to the Uninstall CBHC page to uninstall CBHC. No autoboot screen
• For Haxchi users: uninstall the Haxchi app from Data Management in the System Settings app. No Haxchi app, but can remove Homebrew Channel and WUP installer GX
• For Mocha CFW (Indexiine) users: go to the Uninstall Indexiine page to uninstall Indexiine.
• For Mocha CFW (Online Exploit) users: you do not need to do anything before following this guide

I watched this video and it looks like they used something called "payload.elf" is this housed on the (non-existant) SD card and doesn't get installed on the NAND? I know we use "Payload" to get into an Environment loader but didn't want to confuse the two.

 

[V10lator]

Would there be a possibility that they used the Mocha CFW?

Yea, a high chance that they launched Mocha via the browser exploit as Korozin explained earlier:

This basically just confirms that they only used a Web Exploit. This doesn't cause any conflicts with installing Tiramisu as it installs literally nothing to the Wii U and is done almost exclusively off of the contents of the SD Card. You're most likely safe to proceed. Without an SD Card, a Wii U that used the Web Exploit is essentially just a stock Wii U.

//EDIT: To quote yourself:

• For Mocha CFW (Online Exploit) users: you do not need to do anything before following this guide

 

[godreborn]

I guess it's possible the person used the browser to exploit the system. the iosu screen is a known boot screen. I had it on my haxchi. I don't remember too much about the browser exploit, except we originally had to use a race attack, like it with the ps4 and probably 5, which was like 75% reliable, but now it's near 100%, and you don't even need to do that anymore.

 

[Lock_Key_Doctor]

I would even do a complete factory reset to remove any leftovers from the previous owner / start with a fresh and clean system but as Korozin said: Choice is yours.

I would love to do that! I think it's always a good idea to start with a clean system Would that mean I lose all the games installed on the hard drive (I assume so). I have Mario Bros, Mario Kart, and Pikmin. I'm not sure how the previous owner got these on - maybe eshop or other means? Is there a way to do a backup of the games?

Would it be recommended that I do a Nand Backup (first step in Tiramisu) before doing a factory reset? Just in case?? I read online of horror stories of someone doing a factory reset with a Wii U and bricking it (probably stuck in a CBHC boot loop) but I thought I would double check just in case.

Also I was just adding up my system memory:
13gb - Mario Bro + Luigi
4.7gb - Mario Kart
4.2gb - Pikmin
5mb - legacy homebrew/WUP
2.5gb - free
7.5 gb - Wii System OS?
32gb total

Does that roughly make sense? that the Wii system software would be about 7.5gb? I'm just wondering if there are other "bloat" or stuff that previous owner may have installed or done.

Post automatically merged: Jan 2, 2023

I just wanted to say a big THANK YOU to everyone. The community has been very helpful and patient helping me understand the old method and the new method

 

[godreborn]

btw, fyi, the iosu hax I remember were booting the original cfw or rednand. it used a file called fw.img, which is an important file in the system software. I don't know what it does on the actual system, but it redirects the system elsewhere. that's why I thought you had it, due to the iosu hax screen.

 

[V10lator]

Would that mean I lose all the games installed on the hard drive (I assume so). I have Mario Bros, Mario Kart, and Pikmin. I'm not sure how the previous owner got these on - maybe eshop or other means? Is there a way to do a backup of the games?

Yes, the HDD content will be lost as well as the account which purchased them (if they where purchased in the first place).
Backuping is possible but either damn slow or damn compilcated and the restore process is slow. Better to just redownload the games (with i.E. NUSspli).

Would it be recommended that I do a Nand Backup (first step in Tiramisu) before doing a factory reset? Just in case??

Yes, do that. Then do another one after installing Tiramisu.

Does that roughly make sense? that the Wii system software would be about 7.5gb?

Yes, makes sense: https://en-americas-support.nintend...wii-u-internal-storage-space-information#s1q1 ... 32 - 25 = 7. As Nintendo gives just rough Numbers + that information is old the 0.5 GB left might just be part of it.

 

[CMDreamer]

Mind to try this:

Do the browser exploit -if possible- then try to load the apps that result in an error message when launched.

Can you confirm they work correctly or not?

Thanks in advance

 

[V10lator]

@CMDreamer The previous owner kept the SD card. So the OP would have to setup anything for the exploit from scratch which would invalidate the test / prove nothing more than that the browser exploit works on a Wii U.

//EDIT: Anyway, we already checked for all possible coldboot exploits (and even slightly more). As long as no coldboot exploit it's save to install Tiramisu (and even if there's a coldboot exploit Tiramisu should just refuse to install... If you trust that protection which I don't do as I saw the installer bricking a console cause of false detection and correction one time).

//EDIT²: @Lock_Key_Doctor please ignore this post of me. It's way more technical than it sounds on first glance and nothing for a beginner. Just keep installing Tiramisu (in case you didn't do already).

//EDIT³: And yes, it's also save to factory-reset as long as there's no coldboot... In fact this will safely remove any none-coldboot hack (except Tiramisu/Aroma, these are designed to more or less survive a factory reset without bricking the console, so you can even factory reset while coldbooting one of these two). Again: Just ignore this post, it might confuse you more than it helps.

 

[CMDreamer]

@CMDreamer The previous owner kept the SD card. So the OP would have to setup anything for the exploit from scratch which would invalidate the test / prove nothing more than that the browser exploit works on a Wii U.

//EDIT: Anyway, we already checked for all possible coldboot exploits (and even slightly more). As long as no coldboot exploit it's save to install Tiramisu (and even if there's a coldboot exploit Tiramisu should just refuse to install... If you trust that protection which I don't do as I saw the installer bricking a console cause of false detection and correction one time).

//EDIT²: @Lock_Key_Doctor please ignore this post of me. It's way more technical than it sounds on first glance and nothing for a beginner. Just keep installing Tiramisu (in case you didn't do already).

//EDIT³: And yes, it's also save to factory-reset as long as there's no coldboot... In fact this will safely remove any none-coldboot hack (except Tiramisu/Aroma, these are designed to more or less survive a factory reset without bricking the console, so you can even factory reset while coldbooting one of these two). Again: Just ignore this post, it might confuse you more than it helps.

Thanks for making it clear.

I just wanted to know what would happen if done, but it's OK, I trust your point of view, but your experience even more than anything else.

Hope the OP keeps us informed about how it went.

 

[Lock_Key_Doctor]

Yes, the HDD content will be lost as well as the account which purchased them (if they where purchased in the first place).
Backuping is possible but either damn slow or damn compilcated and the restore process is slow. Better to just redownload the games (with i.E. NUSspli).

Yes, do that. Then do another one after installing Tiramisu.

Yes, makes sense: https://en-americas-support.nintend...wii-u-internal-storage-space-information#s1q1 ... 32 - 25 = 7. As Nintendo gives just rough Numbers + that information is old the 0.5 GB left might just be part of it.

Again much thanks for helping me check for all possible coldboot exploits, this process has definitely made me feel more comfortable about the process. It's one of those things where the process is simple if the instructions are followed however dealing with a second hand Wii U had to do a bit more checks and investigation

I'm really impress by NUSspli and thank you for noting it. I was thinking of the "old" method of downloading the roms on the computer, transferring on to the SD to be installed. I guess I am really lucky to have one of the developers respond to my inquiry! Sorry just one quick question but what is a fake/title.tik? My last console was an N64 and snes emulator... looks like technology has advanced a lot!

Post automatically merged: Jan 3, 2023

Thanks for making it clear.

I just wanted to know what would happen if done, but it's OK, I trust your point of view, but your experience even more than anything else.

Hope the OP keeps us informed about how it went.

@CMDreamer The previous owner kept the SD card. So the OP would have to setup anything for the exploit from scratch which would invalidate the test / prove nothing more than that the browser exploit works on a Wii U.

//EDIT: Anyway, we already checked for all possible coldboot exploits (and even slightly more). As long as no coldboot exploit it's save to install Tiramisu (and even if there's a coldboot exploit Tiramisu should just refuse to install... If you trust that protection which I don't do as I saw the installer bricking a console cause of false detection and correction one time).

//EDIT²: @Lock_Key_Doctor please ignore this post of me. It's way more technical than it sounds on first glance and nothing for a beginner. Just keep installing Tiramisu (in case you didn't do already).

//EDIT³: And yes, it's also save to factory-reset as long as there's no coldboot... In fact this will safely remove any none-coldboot hack (except Tiramisu/Aroma, these are designed to more or less survive a factory reset without bricking the console, so you can even factory reset while coldbooting one of these two). Again: Just ignore this post, it might confuse you more than it helps.

I love the discussions, it's definitely given me a lot more exposure into the modding world than I originally anticipated. I enjoy every bit of it although there is a lot to learn.

I will definitely keep the group updated on my progress. I think I may have underestimated the file size of the games and the 32GB so now need to look into a dual Y USB cable for the HDD. I have a WD 750gb HDD that I'm thinking about using. Can I try connecting it to the Wii to see if there is enough power through one USB port? Will the Wii indicate a warning if there's not enough power supply or better not to risk it a something may get corrupt?

For now I will review the guide again and start downloading the appropriate files!

 

[lwiz]

Sorry just one quick question but what is a fake/title.tik? My last console was an N64 and snes emulator... looks like technology has advanced a lot!

Tickets are part of making certain the conslole is allowed to run a game. Fake ticket...

I will definitely keep the group updated on my progress. I think I may have underestimated the file size of the games and the 32GB so now need to look into a dual Y USB cable for the HDD. I have a WD 750gb HDD that I'm thinking about using. Can I try connecting it to the Wii to see if there is enough power through one USB port? Will the Wii indicate a warning if there's not enough power supply or better not to risk it a something may get corrupt?

WiiU won't give any warnings so Y-cable, or better yet an external drive with it's own power supply, which is the best solution. Least strain to WiiU USB or power brick.

 

[V10lator]

what is a fake/title.tik?

The files downloaded by Nintendo are encrypted. Simplified said the title.tik file contains the decryption key needed to install the content. it also contains some things that are needed to launch the game (crypto stuff, the so called signatures).

Nintendo disallows to download the title.tik file without authentication (read: Purchasing the game before. Ofc. this is true for paid content only, no need to create fake tickets for free stuff like game updates) but the rest of the files one can simply download. This is what NUSspli does: It simply downloads the encrypted files from Nintendo.
As it can't download the title.tik file NUSspli calculates the key (the algorithm for that had been leaked around one to two years ago) from the title ID and creates a ticket containing this. The rest of the crypto stuff is filled with random data as a CFW doesn't check it anyway (signature patches) and we don't know how to calculate these yet.

So a game with a fake ticket runs on a CFW only but not on stock firmware. Don't worry about that through: When you follow the official guide you'll end up with Tiramisu + signature patches.

The reason that NUSspli has an option to create such a fake ticket without downloading anything is that some (most?) other downloading solutions don't create a fake ticket but leave that up to the user. So when you are like "damn, I used downloader XYZ and now I can't install the downloaded content cause the ticket is missing" NUSspli will be your saver.

I was thinking of the "old" method of downloading the roms on the computer, transferring on to the SD to be installed.

That ofc. works, too, but I wouldn't recommend the old tools but https://github.com/Xpl0itU/WiiUDownloader (this knows about all titles available on Nintendos servers (uses the database of NUSspli) while other downloaders have been frozen in time years ago, is cross-plattform and so on. Also it does create fake tickets).

I think I may have underestimated the file size of the games

That's what all people do, so don't worry.

Can I try connecting it to the Wii to see if there is enough power through one USB port? Will the Wii indicate a warning if there's not enough power supply or better not to risk it a something may get corrupt?

The Wii U will just cut power to the USB port when the device tries to draw more than 500mA. This might corrupt the data on the HDD but shouldn't harm the hardware (no guarantee through). A HDD will draw more than 500mA for sure at some point in time, so better to just get a Y cable.

Anyway, attaching a HDD is a mid-term goal, installing Tiramisu the short-term, right? So how's that going?

 

[Lock_Key_Doctor]

The files downloaded by Nintendo are encrypted. Simplified said the title.tik file contains the decryption key needed to install the content. it also contains some things that are needed to launch the game (crypto stuff, the so called signatures).

Nintendo disallows to download the title.tik file without authentication (read: Purchasing the game before. Ofc. this is true for paid content only, no need to create fake tickets for free stuff like game updates) but the rest of the files one can simply download. This is what NUSspli does: It simply downloads the encrypted files from Nintendo.
As it can't download the title.tik file NUSspli calculates the key (the algorithm for that had been leaked around one to two years ago) from the title ID and creates a ticket containing this. The rest of the crypto stuff is filled with random data as a CFW doesn't check it anyway (signature patches) and we don't know how to calculate these yet.

So a game with a fake ticket runs on a CFW only but not on stock firmware. Don't worry about that through: When you follow the official guide you'll end up with Tiramisu + signature patches.

The reason that NUSspli has an option to create such a fake ticket without downloading anything is that some (most?) other downloading solutions don't create a fake ticket but leave that up to the user. So when you are like "damn, I used downloader XYZ and now I can't install the downloaded content cause the ticket is missing" NUSspli will be your saver.


That ofc. works, too, but I wouldn't recommend the old tools but https://github.com/Xpl0itU/WiiUDownloader (this knows about all titles available on Nintendos servers (uses the database of NUSspli) while other downloaders have been frozen in time years ago, is cross-plattform and so on. Also it does create fake tickets).


That's what all people do, so don't worry.


The Wii U will just cut power to the USB port when the device tries to draw more than 500mA. This might corrupt the data on the HDD but shouldn't harm the hardware (no guarantee through). A HDD will draw more than 500mA for sure at some point in time, so better to just get a Y cable.

Anyway, attaching a HDD is a mid-term goal, installing Tiramisu the short-term, right? So how's that going?

Apologies for the late reply, I just finished a 12 hour shift yesterday and was absolutely exhausted. I have the correct files saved. I loaded them to the root folder of a 32gb microSD card. Nand dumper backup seemed to be working: SLC and SLCCMPT successful but when it go to MLC (I know it's optional but thought it would be nice to backup the games), i think the process got stuck half way because the Wii U restarted (I didn't see personally as I was in the other room). When I took out the SD card to copy on to my computer, I noticed it was full and got an error on mlc.bin.part14. I assume the file SD card became full and it stopped the process?

I found a 128gb microSD card, used GUIformatter to format it as FAT32. Copied the basic files over to try to do another NAND backup. This time when entering the payloader, I got an error saying the SD card wasn't formatted correctly. I wasn't able to power off the Wii using the gamepad, so I used the power button on the machine.

Would there be another option to format the 128gb? is the NAND just to big for a 32gb?

as always much thanks! i'm almost there!