It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

• A Wii U
• One of the devices listed below
  Note: Any other linux device capable of USB device emulation should work as well.
  Prebuilt releases are only available for the Pico and Zero.
  I will add more devices below which are confirmed to work.

Supported devices:​

• A Raspberry Pi Pico or Zero
• A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

• Download the latest udpih.uf2 from the releases page.
• Hold down the BOOTSEL button on the board and connect the Pico to your PC.
  Your PC will detect the Pi as a storage device.
• Copy the .uf2 file to the Pico. It will disconnect after a few seconds.

The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

• Install the required dependencies:
  

  sudo apt install build-essential raspberrypi-kernel-headers

• Clone the repo:

• git clone https://github.com/GaryOderNichts/udpih.git
  cd udpih

• Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
• Now build the kernel module:

• cd linux
  make

• You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.

The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB Devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
  This timing is important. If you're already in the menu, the exploit won't work..
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[Augusta]

So...does this work for Wii U's that boot straight into "delete all content and settings" format window?

I had the system memory prompt screen as well and then made the mistake of formatting where the Wii U boots into the format window then freezes 15 seconds later.

Any hope for this Wii U?

 

[Danook28]

So...does this work for Wii U's that boot straight into "delete all content and settings" format window?

I had the system memory prompt screen as well and then made the mistake of formatting where the Wii U boots into the format window then freezes 15 seconds later.

Any hope for this Wii U?

You have pic, or video???

 

[V10lator]

While I haven't looked through the logs yet,

No logs, no service. Really, Grab the logs before you break even more.

 

[Danook28]

If you had read what I wrote, you should have hopefully concluded that I already tried that and it did not fix the issue.

Send me pic of your console secreen bro... To help you.

 

[Augusta]

You have pic, or video???

boot > wii u > goes straight to delete content and settings > hangs after 15seconds

 

[patopatato]

Hello, could this solve my problem? when formatting the console (JAP 5.5.5), it rebooted and got stuck in this window, the console was never modified

 

[Augusta]

Hello, could this solve my problem? when formatting the console (JAP 5.5.5), it rebooted and got stuck in this window, the console was never modified

This is exactly my issue. Hangs after about 15 seconds.
Doesn't recognize the gamepad either?

I've ordered a Raspberry Pi Pico but won't be able to pick it up until tomorrow so I will do some troubleshooting to see if I can get past this and report back.

Hoping others who may have experienced this dreaded screen can chime in also.

 

[V10lator]

I've ordered a Raspberry Pi Pico but won't be able to pick it up until tomorrow so I will do some troubleshooting to see if I can get past this and report back.

Don't try anything but grab the logs and upload them to here.

//EDIT:

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

 

[2tailedfox]

No logs, no service. Really, Grab the logs before you break even more.

That's fair. I had already 'grabbed' them.
Tried looking at then this morning. I've attached them.

A quick look seems like maybe it is having trouble creating/reading the EULA?

 

[Augusta]

Don't try anything but grab the logs and upload them to here.

//EDIT:
View attachment 358657

Duly noted. Will do. Thanks
Should I be mindful of any information before uploading logs (personal info I should delete, etc)?

 

[Evgen_89]

Hi, guys! Help pls! After the recovery menu opens, tthe navigation works for a couple of seconds after it freezes. Has anyone encountered this? Sorry for English)

 

[lolorlofl]

boot > wii u > goes straight to delete content and settings > hangs after 15seconds

I have one that does the same thing, but hangs quicker than that. However it doesn't create a log file that I can grab from Recovery Menu. Not sure if there's something I'm doing wrong but I thought it was odd.

 

[Evgen_89]

Hello! I figured out the freezing of the recovery menu. But the restoration failed. If it's not difficult, look at the logs. I would be very grateful!)

 

[BanjoKazooieFan]

Hey, dumb question. Flashed the file to the rasperry pico and put the recovery on the SD Card.
After starting the wii u and instantly inserting the rasperry to the wii u, the wii u turns off .
Any solutions?

Post automatically merged: Mar 14, 2023

Hey, dumb question. Flashed the file to the rasperry pico and put the recovery on the SD Card.
After starting the wii u and instantly inserting the rasperry to the wii u, the wii u turns off .
Any solutions?

Nevermind it worked! Thank you!

 

[wiiu20603]

@GaryOderNichts
I have a Cat-R here with devmenu 2.06.03 installed.
The system takes 15 seconds to boot to the devmenu. The Wii U logo appears on the TV screen less than two seconds before dropping me into the text based devmenu.
I have a Pi Pico with UDPIH on it that I can consistently run on my retail console, but it won't boot on the cat-r. I have used a timer and booted the system multiple times, inserting the Pi Pico at incrementing 1 second intervals in an attempt to catch the right time, but nothing works. The system will boot into the devmenu every time.

There does not seem to be any other menus installed. When I go to the 'switch modes' menu, I can only select 'devmenu'. There's nothing else on the list.

There's some content on the system I'm trying to preserve with wupserver, but I need a way to boot into the UDPIH menu.

Do you have any ideas? Not just for booting UDPIH, but any way to preserve the content. I would even hardmod, but there's no point since I can't dump the OTP.

 

[Jap-noy17]

Debug system Region not working here.

 

[patopatato]

Don't try anything but grab the logs and upload them to here.

//EDIT:
View attachment 358657

here are my log

 

[GaryOderNichts]

Sorry for the long wait. I finally had the time to go through all the logs today. Here you go:

I managed to use WUP client and restore MLC files to the defaults but I'm still getting the same 160 01 01 error, please help me understand what to, I´m sharing the logs

</menu>00:00:23:836: "00:00:23:836: [ACP]ERROR:LoadMetaXmlFromPath:1179: Unsupported meta.xml. Failed to load meta.xml from /vol/storage_mlc01/sys/title/00050010/10040000/meta/meta.xml.
00:00:23:836: [ACP]ERROR:CreateSaveDirInternalEx:2077: Cannot load meta.xml

The meta.xml from your Wii U menu is corrupted, make sure to reinstall it or restore the original meta files.

Question, I managed to get into the recovery menu on a bricked wii u I got a hold of, I set the cold boot title to US and when I restart it I keep getting the same error (Error Code - 160-0101), I won't boot up. Is there another option I have to choose in order to get it to boot up?

My guess is this wii u was soft modded and reset without knowing what would happen. Any help would be greatly appreciated.
I did attach the logs.

00:00:14:060: mmc_core card err: idx=3, lba=30609920, blks=256, xfer=0x1, ret=0x00200b40
00:00:14:114: mmc_core card err: idx=3, lba=30609920, blks=256, xfer=0x1, ret=0x00200b40
00:00:14:114: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:14:156: mmc_core card err: idx=3, lba=30609920, blks=256, xfer=0x1, ret=0x00200b40
00:00:14:204: mmc_core card err: idx=3, lba=30609920, blks=256, xfer=0x1, ret=0x00200b40
00:00:14:204: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:14:204: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:26, path:/usr/boss
00:00:14:205: [ACP]ERROR:FlushQuota:770: Failed to flush quota "/vol/storage_mlc01/usr/boss/" (status: -196673)

Unfortunately this looks like eMMC failure. Not much you can do there as of now.

That's fair. I had already 'grabbed' them.
Tried looking at then this morning. I've attached them.

A quick look seems like maybe it is having trouble creating/reading the EULA?

Hmm don't see anything wrong here, what is the issue you were having? Also make sure that all the logs have been dumped.

Hello! I figured out the freezing of the recovery menu. But the restoration failed. If it's not difficult, look at the logs. I would be very grateful!)

00;00;11;633: [barista-Process] Product {:program=>37529, :message=>42751, :programProj=>38946, :root=>38946, :sead=>37528, :resource=>38945}
00;00;11;633: [barista-Process] Cafe OS SDK Version 2.12.11 Build 66642 Branch

00;00;11;721: WPAD: Application Init
00;00;12;069:
OSPanic in "D:/home/Cafe/Barista_SdkUpdate/Library/Sead/engine/library/modules/src/basis/cafe/seadAssertCafe.cpp" at line 23 o

Your Wii U menu is failing an assert. Did you do any modifications to the system before that?

here are my log

Your logs also aren't complete. The only thing out of the ordinary would be this though:

00;00;10;149: Read SysConfig Error code: category:32,code:-21
00;00;10;149: TVEReadRawEDID fail returns -17

Did you modify any xml files on the SLC?

 

[2tailedfox]

Sorry for the long wait. I finally had the time to go through all the logs today. Here you go:

</menu>00:00:23:836: "00:00:23:836: [ACP]ERROR:LoadMetaXmlFromPath:1179: Unsupported meta.xml. Failed to load meta.xml from /vol/storage_mlc01/sys/title/00050010/10040000/meta/meta.xml.
00:00:23:836: [ACP]ERROR:CreateSaveDirInternalEx:2077: Cannot load meta.xml

The meta.xml from your Wii U menu is corrupted, make sure to reinstall it or restore the original meta files.

00:00:14:060: mmc_core card err: idx=3, lba=30609920, blks=256, xfer=0x1, ret=0x00200b40
00:00:14:114: mmc_core card err: idx=3, lba=30609920, blks=256, xfer=0x1, ret=0x00200b40
00:00:14:114: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:14:156: mmc_core card err: idx=3, lba=30609920, blks=256, xfer=0x1, ret=0x00200b40
00:00:14:204: mmc_core card err: idx=3, lba=30609920, blks=256, xfer=0x1, ret=0x00200b40
00:00:14:204: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:14:204: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:26, path:/usr/boss
00:00:14:205: [ACP]ERROR:FlushQuota:770: Failed to flush quota "/vol/storage_mlc01/usr/boss/" (status: -196673)

Unfortunately this looks like eMMC failure. Not much you can do there as of now.

Hmm don't see anything wrong here, what is the issue you were having? Also make sure that all the logs have been dumped.

00;00;11;633: [barista-Process] Product {:program=>37529, :message=>42751, :programProj=>38946, :root=>38946, :sead=>37528, :resource=>38945}
00;00;11;633: [barista-Process] Cafe OS SDK Version 2.12.11 Build 66642 Branch

00;00;11;721: WPAD: Application Init
00;00;12;069:
OSPanic in "D:/home/Cafe/Barista_SdkUpdate/Library/Sead/engine/library/modules/src/basis/cafe/seadAssertCafe.cpp" at line 23 o

Your Wii U menu is failing an assert. Did you do any modifications to the system before that?


Your logs also aren't complete. The only thing out of the ordinary would be this though:

00;00;10;149: Read SysConfig Error code: category:32,code:-21
00;00;10;149: TVEReadRawEDID fail returns -17

Did you modify any xml files on the SLC?

Thank you for your time looking at these.
Aside from the 2 .bin files made in the other step, this is all that was created.

What happens is that it was factory reset and is asking me to login with or create a user. When it gets to the part where it goes to create/register a mii it goes to the 160-0103 error screen.

When I looked at the logs, 13 I think it was, I recall seeing it start generating errors when it logs that it is trying to generate the EULA.

Hopefully that just means there is a wup I can install to rewrite that corrupt/missing file. If not. I can solder, just not bga stuff.

 

[V10lator]

To the ones who got the "logs seem to be incomplete" statement: Please try to dump them again but this time wait for a minute after the process finished and only turn the Wii U off after this waiting time.