Hacking [RELEASE] Wii U NAND Tools

[godreborn]

question - please be gentle (didn't read every post), but do I need to use the homebrew version if I've used the fw.img version and fixed the missing bytes? or, is this just for those who wish to dump their NAND who may not have used the fw.img version?

 

[Leeful]

Oh, I misread it before as 38000/40000 after an hour.
Wow, that is EXTREMELY slow. It took me maybe 4 minutes to get to 6000...
Can you try this release? see if it is better? What is the size of your SD?

EDIT: I think that it depends on the SD card. Now I used bigger sd card, with 64KB allocation unit, and it took me 3 minutes to dump slc.bin...

Same here. Reformatted my (64GB SD, 64k) 3 mins for SLC, SLCCMPT a bit longer at 13 minutes.
I'm pretty sure I selected NO for SLCCMPT but it dumped it anyway.

Does it verify what it has written to the SD card?
I got some errors running it through nandbincheck

** nandBinCheck : Wii nand info tool **
   from giantpune
   built: Mar 24 2017 23:49:06
NAND Type: SLC (WiiU)
checking boot1...
Boot1 hash: "3806d41a5c5f139f5b09bbe5b74a5ec45e0f5507"
Boot1 OK!
checking for lost clusters...
found 0 lost clusters
UNK ( 0xffff ) 7e (f66, f67, f88, f89, f8a, f8b, f8c, f8d, f8e, f8f,
951, 1952, 1953, 1954, 1955, 1956, 1957, 1958, 1959, 195a, 195b, 195c
a42, 1a43, 1a44, 1a45, 1a46, 1a47, 1a50, 1a51, 1a52, 1a53, 1a54, 1a55
free            4936
verifying ecc...
2 out of 897664 pages had incorrect ecc.
they were spread through 1 clusters in 1 blocks:
 (3627)
1 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 368 files
hmac bad (3)
"fw.img" is dfd200 bytes ( 380 ) clusters

00000000  ffb0dbee 7521075a aa3bb74c 6b52a8fa  ....u!.Z.;.LkR..
00000010  a923a847 47b0dbee 7521075a aa3bb74c  .#.GG...u!.Z.;.L
00000020  6b000000 00000000 00000000 00000000  k...............
00000030  eb01140e f8090706 00040004 63066306  ............c.c.

00000000  ffb0dbee 7521075a aa3bb74c 6b52a8fa  ....u!.Z.;.LkR..
00000010  a923a847 47b0dbee 7521075a aa3bb74c  .#.GG...u!.Z.;.L
00000020  6b000000 00000000 00000000 00000000  k...............
00000030  89098909 230f230f 9d0f9d0f de05210a  ....#.#.......!.

00000000  b0dbee75 21075aaa 3bb74c6b 52a8faa9  ...u!.Z.;.LkR...
00000010  23a84747                             #.GG
bad HMAC for "/sys/title/00050010/1000400a/code/fw.img"
hmac bad (1)
"scfm.img" is 8004000 bytes ( 2001 ) clusters

00000000  ff000000 00000000 00000000 00000000  ................
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ff000000 00000000 00000000 00000000  ................
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 06060606 9c039c03  ................

00000000  dd3f3a60 80e6878a 7d6150dc 831561a4  .?:`....}aP...a.
00000010  73a524f3                             s.$.
bad HMAC for "/scfm.img"
2 files had bad HMAC data
checking HMAC for superclusters...
0 superClusters had bad HMAC data

UPDATE: It definately still dumps the slccmpt even if you selected 'no'.

 

[EyeKey]

Same here. Reformatted my (64GB SD, 64k) 3 mins for SLC, SLCCMPT a bit longer at 13 minutes.
I'm pretty sure I selected NO for SLCCMPT but it dumped it anyway.

Does it verify what it has written to the SD card?
I got some errors running it through nandbincheck

** nandBinCheck : Wii nand info tool **
   from giantpune
   built: Mar 24 2017 23:49:06
NAND Type: SLC (WiiU)
checking boot1...
Boot1 hash: "3806d41a5c5f139f5b09bbe5b74a5ec45e0f5507"
Boot1 OK!
checking for lost clusters...
found 0 lost clusters
UNK ( 0xffff ) 7e (f66, f67, f88, f89, f8a, f8b, f8c, f8d, f8e, f8f,
951, 1952, 1953, 1954, 1955, 1956, 1957, 1958, 1959, 195a, 195b, 195c
a42, 1a43, 1a44, 1a45, 1a46, 1a47, 1a50, 1a51, 1a52, 1a53, 1a54, 1a55
free            4936
verifying ecc...
2 out of 897664 pages had incorrect ecc.
they were spread through 1 clusters in 1 blocks:
 (3627)
1 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 368 files
hmac bad (3)
"fw.img" is dfd200 bytes ( 380 ) clusters

00000000  ffb0dbee 7521075a aa3bb74c 6b52a8fa  ....u!.Z.;.LkR..
00000010  a923a847 47b0dbee 7521075a aa3bb74c  .#.GG...u!.Z.;.L
00000020  6b000000 00000000 00000000 00000000  k...............
00000030  eb01140e f8090706 00040004 63066306  ............c.c.

00000000  ffb0dbee 7521075a aa3bb74c 6b52a8fa  ....u!.Z.;.LkR..
00000010  a923a847 47b0dbee 7521075a aa3bb74c  .#.GG...u!.Z.;.L
00000020  6b000000 00000000 00000000 00000000  k...............
00000030  89098909 230f230f 9d0f9d0f de05210a  ....#.#.......!.

00000000  b0dbee75 21075aaa 3bb74c6b 52a8faa9  ...u!.Z.;.LkR...
00000010  23a84747                             #.GG
bad HMAC for "/sys/title/00050010/1000400a/code/fw.img"
hmac bad (1)
"scfm.img" is 8004000 bytes ( 2001 ) clusters

00000000  ff000000 00000000 00000000 00000000  ................
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ff000000 00000000 00000000 00000000  ................
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 06060606 9c039c03  ................

00000000  dd3f3a60 80e6878a 7d6150dc 831561a4  .?:`....}aP...a.
00000010  73a524f3                             s.$.
bad HMAC for "/scfm.img"
2 files had bad HMAC data
checking HMAC for superclusters...
0 superClusters had bad HMAC data

UPDATE: It definately still dumps the slccmpt even if you selected 'no'.

Yes I noticed that the menu is ignored. It is a bug. I will fix it.

And I don't verify the dump. But i can write the hash of it.

And about your output, the error on scfm.img is fine, I already pointed out that this file isn't hashed. Probably because it is a cache. We just didn't have a real dump before. That is the only error I had in my dump.

About fw.img, that is wired... The hash is right, but the spare data is duplicated between the 7th and the 8th blocks, but the 8th block should only have the last 8 bytes of the hash, I wonder how that happened..... Anyway this file will still work since one of those hashes is redundant.

And both of the ECC errors are in the same cluster, so not really sure what happened there. Did you try to dump again? And how is your SLCCMPT dump?

 

[Leeful]

I think my actual nand chip might be dying. I did a hardmod dump to check that with nandbincheck and this had a lot of errors.

** nandBinCheck : Wii nand info tool **
   from giantpune
   built: Mar 24 2017 23:49:06
NAND Type: SLC (WiiU)
checking boot1...
Boot1 hash: "3806d41a5c5f139f5b09bbe5b74a5ec45e0f5507"
Boot1 OK!
checking for lost clusters...
found 0 lost clusters
UNK ( 0xffff ) 6 (5c2, 5c3, 5c4, 5c5, 5c6, 5c7)
free            49af
verifying ecc...
92 out of 889920 pages had incorrect ecc.
they were spread through 90 clusters in 86 blocks:
 (127, 375, 511, 616, 656, 665, 930, 943, 960, 976, 999, 1013, 1062, 1082, 1090, 1144, 1155, 1194, 1196, 1208, 1243, 126
0, 2897, 2959, 3137, 3143, 3145, 3149, 3157, 3186, 3197, 3602, 3604, 3608, 3613, 3627, 3851, 3880, 3884, 3885, 3893, 393
70 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 367 files
hmac bad (1)
"fw.img" is 77b200 bytes ( 1df ) clusters

00000000  ff3cfd02 86163f96 96479b89 89775f29  .<....?..G...w_)
00000010  4931e5f3 643cfd02 86163f96 96479b89  I1..d<....?..G..
00000020  89000000 00000000 00000000 00000000  ................
00000030  4704b80b 05020502 a606a606 a1005e0f  G.............^.

00000000  ff775f29 4931e5f3 64000000 00000000  .w_)I1..d.......
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  e5001a0f 8e097106 150cea03 51085108  ......q.....Q.Q.

00000000  02dc7c45 1b15a0a3 e1d277da 296290f0  ..|E......w.)b..
00000010  bab7aa94                             ....
bad HMAC for "/sys/title/00050010/10004009/code/fw.img"
hmac bad (1)
"nn_ac.rpl" is 14600 bytes ( 6 ) clusters

00000000  ff68ae8b 688849d3 efce1acd 5eaac081  .h..h.I.....^...
00000010  ce95ef41 0968ae8b 688849d3 efce1acd  ...A.h..h.I.....
00000020  5e000000 00000000 00000000 00000000  ^...............
00000030  0300fc0f d204d204 c00cc00c 390f390f  ............9.9.

00000000  ffaac081 ce95ef41 09000000 00000000  .......A........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  25022502 eb0beb0b 8d01720e bf0b4004  %.%.......r...@.

00000000  4746978a e9b3ba93 76301a53 2ea98bfb  GF......v0.S....
00000010  944e9d3d                             .N.=
bad HMAC for "/sys/title/00050010/10004009/code/nn_ac.rpl"
hmac bad (1)
"root.rpx" is 1b4e80 bytes ( 6e ) clusters

00000000  ff46cdb0 3543c4be 04a0974c 4f265612  .F..5C.....LO&V.
00000010  359de497 1846cdb0 3543c4be 04a0974c  5....F..5C.....L
00000020  4f000000 00000000 00000000 00000000  O...............
00000030  f50af50a 390ac605 5801a70e af07af07  ....9...X.......

00000000  ff265612 359de497 18000000 00000000  .&V.5...........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  fc04fc04 28082808 4a0c4a0c 16001600  ....(.(.J.J.....

00000000  385686c5 011266db 6db2f592 a62af700  8V....f.m....*..
00000010  ef6ce191                             .l..
bad HMAC for "/sys/title/00050010/10004009/code/root.rpx"
hmac bad (1)
"fw.img" is adc200 bytes ( 2b8 ) clusters

00000000  ff798fba a2777207 79ef9377 280c2b7c  .y...wr.y..w(.+|
00000010  03b0ce97 9a798fba a2777207 79ef9377  .....y...wr.y..w
00000020  28000000 00000000 00000000 00000000  (...............
00000030  5c0fa300 e5001a0f a007a007 d403d403  \...............

00000000  ff0c2b7c 03b0ce97 9a000000 00000000  ..+|............
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  6d0a9205 370e370e 9a059a05 e20f1d00  m...7.7.........

00000000  73b3e594 64f66d18 f74beea0 d8154bd0  s...d.m..K....K.
00000010  72f831a5                             r.1.
bad HMAC for "/sys/title/00050010/100040ff/code/fw.img"
hmac bad (1)
"gx2.rpl" is 42a80 bytes ( 11 ) clusters

00000000  ff457ea1 090ac074 3fb57143 e7fa4df7  .E~....t?.qC..M.
00000010  85f27826 26457ea1 090ac074 3fb57143  ..x&&E~....t?.qC
00000020  e7000000 00000000 00000000 00000000  ................
00000030  5109ae06 78087808 2b0ad405 e80ee80e  Q...x.x.+.......

00000000  fffa4df7 85f27826 26000000 00000000  ..M...x&&.......
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  8c0c8c0c ae01ae01 c40bc40b ed02120d  ................

00000000  3a4b0a6d ada77b77 1868f5a8 fdba50d6  :K.m..{w.h....P.
00000010  f27c43f2                             .|C.
bad HMAC for "/sys/title/00050010/100040ff/code/gx2.rpl"
hmac bad (1)
"root.rpx" is 1a3b80 bytes ( 69 ) clusters

00000000  ff6d2778 cb3cb3d7 ebd32026 95554ad2  .m'x.<.... &.UJ.
00000010  8d6b250d 476d2778 cb3cb3d7 ebd32026  .k%.Gm'x.<.... &
00000020  95000000 00000000 00000000 00000000  ................
00000030  5606a909 4903b60c 1a03e50c 790a8605  V...I.......y...

00000000  ff554ad2 8d6b250d 47000000 00000000  .UJ..k%.G.......
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  3103ce0c da0f2500 0a0df502 8e0c8e0c  1.....%.........

00000000  42e238c3 1d0583ab 132e190d f852cdb7  B.8..........R..
00000010  12183580                             ..5.
bad HMAC for "/sys/title/00050010/100040ff/code/root.rpx"
hmac bad (3)
"fw.img" is dfd200 bytes ( 380 ) clusters

00000000  ffb0dbee 7521075a aa3bb74c 6b52a8fa  ....u!.Z.;.LkR..
00000010  a923a847 47b0dbee 7521075a aa3bb74c  .#.GG...u!.Z.;.L
00000020  6b52a8fa a923a847 47000000 00000000  kR...#.GG.......
00000030  eb01140e f8090706 00040004 63066306  ............c.c.

00000000  ffb0dbee 7521075a aa3bb74c 6b52a8fa  ....u!.Z.;.LkR..
00000010  a923a847 47b0dbee 7521075a aa3bb74c  .#.GG...u!.Z.;.L
00000020  6b52a8fa a923a847 47000000 00000000  kR...#.GG.......
00000030  89098909 230f230f 9d0f9d0f de05210a  ....#.#.......!.

00000000  b0dbee75 21075aaa 3bb74c6b 52a8faa9  ...u!.Z.;.LkR...
00000010  23a84747                             #.GG
bad HMAC for "/sys/title/00050010/1000400a/code/fw.img"
hmac bad (1)
"gx2.rpl" is 43400 bytes ( 11 ) clusters

00000000  ff82b332 015f844e 7498afdd 9672de1c  ...2._.Nt....r..
00000010  4a266623 a582b332 015f844e 7498afdd  J&f#...2._.Nt...
00000020  96000000 00000000 00000000 00000000  ................
00000030  ce03310c 870d870d a204a204 b700b700  ..1.............

00000000  ff72de1c 4a266623 a5000000 00000000  .r..J&f#........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  3804c70b 2002df0d 4100be0f 810f7e00  8... ...A.....~.

00000000  a8af331b 38537d92 4b34f2b9 345c5868  ..3.8S}.K4..4\Xh
00000010  acc36e3a                             ..n:
bad HMAC for "/sys/title/00050010/1000400a/code/gx2.rpl"
hmac bad (1)
"kernel.img" is 11e100 bytes ( 48 ) clusters

00000000  ff933c7a 216ec32b 4c7fe57b 56b06e9e  ..<z!n.+L..{V.n.
00000010  eb9b3a09 8d933c7a 216ec32b 4c7fe57b  ..:...<z!n.+L..{
00000020  56000000 00000000 00000000 00000000  V...............
00000030  ce093106 c802c802 6c079308 d50e2a01  ..1.....l.....*.

00000000  ffb06e9e eb9b3a09 8d000000 00000000  ..n...:.........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  4c07b308 41044104 8e008e00 7e068109  L...A.A.....~...

00000000  91a7a8f6 f49adaf0 55bb8c81 574cef13  ........U...WL..
00000010  db421466                             .B.f
bad HMAC for "/sys/title/00050010/1000400a/code/kernel.img"
hmac bad (1)
"nn_act.rpl" is 93c0 bytes ( 3 ) clusters

00000000  ff7d20fa 19b67c34 373f82f3 a3c1417e  .} ...|47?....A~
00000010  70b92fbc 217d20fa 19b67c34 373f82f3  p./.!} ...|47?..
00000020  a3000000 00000000 00000000 00000000  ................
00000030  f3070c08 4f04b00b d608d608 e80ce80c  ....O...........

00000000  ffc1417e 70b92fbc 21000000 00000000  ..A~p./.!.......
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  d10a2e05 c705380a 67086708 e805e805  ......8.g.g.....

00000000  52004c9e eaf0766a 58820b7f adf144a3  R.L...vjX.....D.
00000010  b7f50e10                             ....
bad HMAC for "/sys/title/00050010/1000400a/code/nn_act.rpl"
hmac bad (1)
"scfm.img" is 8004000 bytes ( 2001 ) clusters

00000000  ff000000 00000000 00000000 00000000  ................
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ff000000 00000000 00000000 00000000  ................
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 cb00340f 97039703  ..........4.....

00000000  a8784819 8e9ec06b fd700a96 49b940b2  .xH....k.p..I.@.
00000010  a053ffa1                             .S..
bad HMAC for "/scfm.img"
11 files had bad HMAC data
checking HMAC for superclusters...
hmac bad (1)
supercluster 7c00

00000000  ff806291 dc5a8576 113fb78e a7b03465  ..b..Z.v.?....4e
00000010  9203d4af a2806291 dc5a8576 113fb78e  ......b..Z.v.?..
00000020  a7000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ffb03465 9203d4af a2000000 00000000  ..4e............
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  1e1ca017 16194552 dfd24423 868eac3c  ......ER..D#...<
00000010  94db29d8                             ..).
hmac bad (1)
supercluster 7c60

00000000  ff13c1df afdcb368 ac0a0010 e6dfaf99  .......h........
00000010  2f142814 e413c1df afdcb368 ac0a0010  /.(........h....
00000020  e6000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ffdfaf99 2f142814 e4000000 00000000  ..../.(.........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  4a9a351a 984e6bf1 2ee6606d ea1c03f8  J.5..Nk...`m....
00000010  bd61053b                             .a.;
hmac bad (1)
supercluster 7d00

00000000  ff996011 1a6a62fe 6bca70a0 ed5a2c73  ..`..jb.k.p..Z,s
00000010  8b5e02d3 25996011 1a6a62fe 6bca70a0  .^..%.`..jb.k.p.
00000020  ed000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ff5a2c73 8b5e02d3 25000000 00000000  .Z,s.^..%.......
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  42d7ae19 6948591d bc3c4967 e61e498b  B...iHY..<Ig..I.
00000010  e6018727                             ...'
hmac bad (1)
supercluster 7d50

00000000  ff4c80e3 dcbe8d10 0ad513d1 51b9d2f6  .L..........Q...
00000010  72e27b5a 984c80e3 dcbe8d10 0ad513d1  r.{Z.L..........
00000020  51000000 00000000 00000000 00000000  Q...............
00000030  00000000 00000000 00000000 00000000  ................

00000000  ffb9d2f6 72e27b5a 98000000 00000000  ....r.{Z........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  7e6c445a 6218dfb3 d2a893f0 92f7076a  ~lDZb..........j
00000010  3fe533f3                             ?.3.
hmac bad (3)
supercluster 7d60

00000000  ffc736e8 fc63d05e ae7518ff 33e95f44  ..6..c.^.u..3._D
00000010  e9f1a418 d2c736e8 fc63d05e ae7518ff  ......6..c.^.u..
00000020  33e95f44 e9f1a418 d2000000 00000000  3._D............
00000030  00000000 00000000 00000000 00000000  ................

00000000  ffc736e8 fc63d05e ae7518ff 33e95f44  ..6..c.^.u..3._D
00000010  e9f1a418 d2c736e8 fc63d05e ae7518ff  ......6..c.^.u..
00000020  33e95f44 e9f1a418 d2000000 00000000  3._D............
00000030  00000000 00000000 00000000 00000000  ................

00000000  c736e8fc 63d05eae 7518ff33 e95f44e9  .6..c.^.u..3._D.
00000010  f1a418d2                             ....
hmac bad (1)
supercluster 7de0

00000000  fff283ac 86d31889 32cae52e d2fd35ca  ........2.....5.
00000010  0deb7de6 21f283ac 86d31889 32cae52e  ..}.!.......2...
00000020  d2000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  fffd35ca 0deb7de6 21000000 00000000  ..5...}.!.......
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  e7c63f25 6ac4852c 071fd783 1664d7d3  ..?%j..,.....d..
00000010  ececf2c9                             ....
hmac bad (1)
supercluster 7e50

00000000  ff81d57e 332aee9f def891d2 ed7eb650  ...~3*.......~.P
00000010  c644440a 3e81d57e 332aee9f def891d2  .DD.>..~3*......
00000020  ed000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ff7eb650 c644440a 3e000000 00000000  .~.P.DD.>.......
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  349b1ec9 93b47009 f5e81b80 09e55969  4.....p.......Yi
00000010  705e55d6                             p^U.
hmac bad (1)
supercluster 7e60

00000000  ff4a1e27 ef4860c0 a44006ba 329ab2cb  .J.'.H`[email protected]...
00000010  b2bd6c43 604a1e27 ef4860c0 a44006ba  ..lC`J.'.H`..@..
00000020  32000000 00000000 00000000 00000000  2...............
00000030  00000000 00000000 00000000 00000000  ................

00000000  ff9ab2cb b2bd6c43 60000000 00000000  ......lC`.......
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  e117235f abd73d2c 5fd840ea cc8103da  ..#_..=,_.@.....
00000010  6a817989                             j.y.
hmac bad (1)
supercluster 7e70

00000000  ff733c13 0367f794 b7191941 05fafc3f  .s<..g.....A...?
00000010  1272ab7f 6e733c13 0367f794 b7191941  .r..ns<..g.....A
00000020  05000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  fffafc3f 1272ab7f 6e000000 00000000  ...?.r..n.......
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  13e2faa9 c9d43a47 4f299d7c de6dea0e  ......:GO).|.m..
00000010  aa88120e                             ....
hmac bad (1)
supercluster 7e90

00000000  ff9ee796 e18c70ad 1e77adfa fc6f71cd  ......p..w...oq.
00000010  7d24bf61 769ee796 e18c70ad 1e77adfa  }$.av.....p..w..
00000020  fc000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ff6f71cd 7d24bf61 76000000 00000000  .oq.}$.av.......
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  2a08e8ec 421729d3 a2e9c6dd 9159837c  *...B.)......Y.|
00000010  b03a56e1                             .:V.
hmac bad (1)
supercluster 7ed0

00000000  ff1d4ae3 4b7dd391 cd437bde b7b5e9bd  ..J.K}...C{.....
00000010  a244d7c4 be1d4ae3 4b7dd391 cd437bde  .D....J.K}...C{.
00000020  b7000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ffb5e9bd a244d7c4 be000000 00000000  .....D..........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  6a634fd1 160e1e9c 499c47e2 b975eaf1  jcO.....I.G..u..
00000010  0b0ff6e9                             ....
hmac bad (1)
supercluster 7ee0

00000000  ff895c27 02183b88 dcc672c3 92d793ec  ..\'..;...r.....
00000010  e543037f 8a895c27 02183b88 dcc672c3  .C....\'..;...r.
00000020  92000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ffd793ec e543037f 8a000000 00000000  .....C..........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  2b227696 931511ae b23c7f21 4edccecb  +"v......<.!N...
00000010  005315a3                             .S..
hmac bad (1)
supercluster 7f00

00000000  ff07dedb 672f1566 4231e88e 3b279aa5  ....g/.fB1..;'..
00000010  c8315744 9c07dedb 672f1566 4231e88e  .1WD....g/.fB1..
00000020  3b000000 00000000 00000000 00000000  ;...............
00000030  00000000 00000000 00000000 00000000  ................

00000000  ff279aa5 c8315744 9c000000 00000000  .'...1WD........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  449316be 8075ea1f 04b4d4af df4f8568  D....u.......O.h
00000010  a6f53224                             ..2$
hmac bad (1)
supercluster 7f30

00000000  ff40dad6 045415cb a76eba49 b3fd51db  [email protected].
00000010  570bda7e cf40dad6 045415cb a76eba49  [email protected]
00000020  b3000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  fffd51db 570bda7e cf000000 00000000  ..Q.W..~........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  c31f736f 84e09998 d13749ab 37b5ab47  ..so.....7I.7..G
00000010  250839d0                             %.9.
hmac bad (1)
supercluster 7f80

00000000  fff6b108 1866bfad 04a9c93f 1ae11381  .....f.....?....
00000010  9178fb4d 00f6b108 1866bfad 04a9c93f  .x.M.....f.....?
00000020  1a000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  e1e11381 9178fb4d 00000000 00000000  .....x.M........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  d4a269d8 02e29f20 35ba5ef5 151ef7c5  ..i.... 5.^.....
00000010  54ee10bb                             T...
hmac bad (1)
supercluster 7fb0

00000000  fff66ebd 78547ebf 1ef46c1f 56e1db69  ..n.xT~...l.V..i
00000010  f9259483 74f66ebd 78547ebf 1ef46c1f  .%..t.n.xT~...l.
00000020  56000000 00000000 00000000 00000000  V...............
00000030  00000000 00000000 00000000 00000000  ................

00000000  ffe1db69 f9259483 74000000 00000000  ...i.%..t.......
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  2e2da214 17b1bd56 e59e3940 068f9ed3  .-.....V..9@....
00000010  f7f96569                             ..ei
hmac bad (1)
supercluster 7fd0

00000000  ffb2dfa5 40c3a9e2 a69330b4 375c024e  [email protected]\.N
00000010  0c8dcc7e abb2dfa5 40c3a9e2 a69330b4  [email protected].
00000020  37000000 00000000 00000000 00000000  7...............
00000030  00000000 00000000 00000000 00000000  ................

00000000  ff5c024e 0c8dcc7e ab000000 00000000  .\.N...~........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  37d8bb8e 5edd8041 6d4f9111 ad2e3153  7...^..AmO....1S
00000010  daed0e3c                             ...<
17 superClusters had bad HMAC data
(31744, 31840, 32000, 32080, 32096, 32224, 32336, 32352, 32368, 32400, 32464, 32480, 32512, 32560, 32640, 32688, 32720)

The Wiiu still booted so I thought I'd test all the installed programs. system settings worked but then I tried mii maker and that froze the console on exit. When I tried to start the wiiU again I got a system memory error! Tried again and this time it would not boot at all.

Anyway, I flashed back the original fixed dump but noticed that there were about 40 block verification errors. (usually there were only between 2 -10 max) I re-wrote the bad blocks back one by one and then booted again.

It booted up fine but when I tried mi maker again the same brick happened all over again.

In the past month I must have wrote back to the nand at least 30 times. do you think that the nand chip is physically dammaged?

 

[EyeKey]

Hmm I don't know. The software dump didn't seem so bad... Only one cluster had 2 ECC errors, and the other errors weren't because issue with the band. It seems that the hard-mod is less reaible now.

And mii maker is on the MLC, no? so that is weird.

 

[Deleted User]

Maybe somebody could try dumping his own Mii Maker copy?
[Wouldn't ddd work for that?]

 

[EyeKey]

Maybe somebody could try dumping his own Mii Maker copy?
[Wouldn't ddd work for that?]

Would downloading it with nus grabber and installing it with wup installer work?
But I am not sure that it is the issue... If the code of it was corrupted it wouldn't run at all because of code signing (unless he run custom CFW). It seems that something else is corrupted.

 

[Deleted User]

Would downloading it with nus grabber and installing it with wup installer work?
But I am not sure that it is the issue... If the code of it was corrupted it wouldn't run at all because of code signing (unless he run custom CFW). It seems that something else is corrupted.

Wup Installer might install it but it still might not work, or just brick Wii U again.
Manually putting Mii Maker in Wii U's MLC dump might fix that i think...

Does anything else run for him? If not then probably something is corrupted.

 

[EyeKey]

@Leeful I found the cause of the performance issue... for each new CLUSTER it would search from the beginning of the FAT for a free cluster, checking cluster by cluster...... Anyway I optimized it with a simple change and now it is MUCH better. (This is why it worked fast on my empty sd, but got slower as it wrote more data...)

 

[asper]

What is scfm.img file ? I have bad hmac in that one...

EDIT: just found out, it is a cache file as stated by EyeKey so nothing important

 

[leerz]

So after the recent development with the Wii U, and the growing number of bricks, it is about time that we will finally have tools for the Wii U NAND. It isn't very different from the Wii NAND.

(This thread is about the 512MB SLC, not the 8GB/32GB MLC)

If you want to take proper dumps of your NAND, check out this homebrew:
https://gbatemp.net/threads/nand-dumper-create-full-dumps-of-the-nand.465680/


Wii U NAND Extractor:
View attachment 82154
Download (Source)
Modified Wii NAND Extractor by parannoyed. Now supports Wii/vWii/WiiU (Full dump/redNAND dump/..)
Place otp.bin in the directory of this program and load the dump.

WiiUQt - Collection of Qt NAND Tools:
Download (experimental) (Source)
Collections of tools based on the WiiQt for the Wii.

Note: To use those tools, you must have otp.bin in the directory of your dump.

nandBinCheck - Verify integrity of NAND backups:
Usage: nandBinCheck.exe <path to dump> <options>
Run it without arguments for list of options.

nandFixer - Fixing partial dumps (Making redNAND dump flashable):
This tool add important missing metadata to the dump. Can be used to flash redNAND dump to SLC.
Usage: nandFixer.exe <input rednand dump> <output dump>
It is recommended to verify the newly created dump with nandBinCheck.exe <output dump> -all

nandCbhcRemover - Fixing CBHC bricks:
Note: Backup your nand and verify it with nandBinCheck before using this tool!
This tool restore the backed up system.xml. Can be used to fix CBHC brick.
Usage: nandCbhcRemover.exe <full slc dump>
It is recommended to verify the updated dump with nandBinCheck.exe <output dump> -all

Thanks to @Leeful that verified that both nandFixer and nandCbhcRemover can be used for unbricking!

If you want to follow the efforts to unbrick Wii U, and for more info about Wii U hardmod, visit this thread.

Just curious, do you think we can implement something like this for the 3ds for those black screen of death units?

 

[EyeKey]

What is scfm.img file ? I have bad hmac in that one...

EDIT: just found out, it is a cache file as stated by EyeKey so nothing important

Yeah that is how it suppose to be. I should ignore this file in the check.

Just curious, do you think we can implement something like this for the 3ds for those black screen of death units?

EDIT: NVM. With the otp I think that it is possible to do CTR NAND transfer with hard-mod, but I don't know the specific of the 3DS

 

[brunormalmeida]

@eteles maybe you should look this thread...

 

[Cyan]

Thank you for releasing your NAND dumper homebrew. OTP and SEEPROM and it will be a complete dump tool.
I added your homebrew and your tools to our wiki (in case someone really read it...)

I also set "official" tag to your homebrew thread.

 

[eteles]

Hello guys... I don't have OTP keys for fixing my bricked Wii U with hardware mod... But I do remember backing up vWii nand back when only the vWii mode was hackable... Is there a chance of having the needed keys extracted from there?

Another question: do you think extracting OTP keys using hardware mod, as it was done with XBOX 360 DVD drive key will ever be possible for the Wii U?

Thanks again for your help!

 

[EyeKey]

Thank you for releasing your NAND dumper homebrew. OTP and SEEPROM and it will be a complete dump tool.
I added your homebrew and your tools to our wiki (in case someone really read it...)

I also set "official" tag to your homebrew thread.

Thanks. Now it has OTP and SEEPROM dumping too.

Hello guys... I don't have OTP keys for fixing my bricked Wii U with hardware mod... But I do remember backing up vWii nand back when only the vWii mode was hackable... Is there a chance of having the needed keys extracted from there?

Another question: do you think extracting OTP keys using hardware mod, as it was done with XBOX 360 DVD drive key will ever be possible for the Wii U?

Thanks again for your help!

No, it only has the vWii keys inside.

And for your second question, probably not. It will require boot0 exploit, which probably doesn't exists (well it is proven to be possible with cpu fault injections, so....).

 

[fille]

dumped just all with your app,nice work EyeKey.

 

[eteles]

So, it's probably possible to dump the keys using hardware, but the method doesn't exist yet. Is that right? If so, is anyone working on something like this or planning to do so, or should I just throw my console in the trash? @EyeKey

 

[QuarkTheAwesome]

Another question: do you think extracting OTP keys using hardware mod, as it was done with XBOX 360 DVD drive key will ever be possible for the Wii U?

Doable, but tough. You'd be looking at either boot0 fault injection (not for the faint-hearted) or an eventual boot1 exploit; once you have early code exec you can just dump it without issue.

As for when that's happening, I think everyone wants to go for boot1. I recently bought a trash system expressly for that reason; I know people like Hexkyz have been working on it, there's always the slight chance we'll get the key out of derrek... It's not easy though, and it's possible none of us will come up with anything. I'd reccomend keeping the system lying around unless you can sell it for cash or something; costs you nothing to keep it in a cupboard and you never know when an exploit will turn up.

 

[EyeKey]

Doable, but tough. You'd be looking at either boot0 fault injection (not for the faint-hearted) or an eventual boot1 exploit; once you have early code exec you can just dump it without issue.

As for when that's happening, I think everyone wants to go for boot1. I recently bought a trash system expressly for that reason; I know people like Hexkyz have been working on it, there's always the slight chance we'll get the key out of derrek... It's not easy though, and it's possible none of us will come up with anything. I'd reccomend keeping the system lying around unless you can sell it for cash or something; costs you nothing to keep it in a cupboard and you never know when an exploit will turn up.

boot1 exploit will need otp too, because the file system that it reads is encrypted and hashed with hmac.... it can't be modified without the otp.

@eteles, there is a way, but there never be a method to do it. you need a lot of knowledge and a -really- complex setup, only one group did it. And they the only one who did similar thing to the 3ds. Anyway, the community want what they found, and still no one did it.