It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

• A Wii U
• One of the devices listed below
  Note: Any other linux device capable of USB device emulation should work as well.
  Prebuilt releases are only available for the Pico and Zero.
  I will add more devices below which are confirmed to work.

Supported devices:​

• A Raspberry Pi Pico or Zero
• A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

• Download the latest udpih.uf2 from the releases page.
• Hold down the BOOTSEL button on the board and connect the Pico to your PC.
  Your PC will detect the Pi as a storage device.
• Copy the .uf2 file to the Pico. It will disconnect after a few seconds.

The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

• Install the required dependencies:
  

  sudo apt install build-essential raspberrypi-kernel-headers

• Clone the repo:

• git clone https://github.com/GaryOderNichts/udpih.git
  cd udpih

• Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
• Now build the kernel module:

• cd linux
  make

• You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.

The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB Devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
  This timing is important. If you're already in the menu, the exploit won't work..
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[SDIO]

How did the font corrupt? Is the eMMC failing? Did you replace it?

Also you didn't do a flush before you resetted it hard

 

[sirjman]

Any way to grab the controller pairing Pin without being able to see the screen? Ideally through the dumps? I can blind dump, but can't find any way to get the Pin to pair a new controller. Dead HDMI.

 

[SDIO]

I think the recovery writes it to the SD when you go to the pair gamepad option

 

[sirjman]

I think the recovery writes it to the SD when you go to the pair gamepad option

That would be perfect, I'll take a look tonight when I try again.

Post automatically merged: Oct 23, 2023

I think the recovery writes it to the SD when you go to the pair gamepad option

I was able to test on a console that does have a working output, and it doesn't dump the pin to the SD. Looks like brute forcing might be the only way

 

[Supercharlie25]

Hi, I have a hackable Switch laying around, but it's vanilla. Do I have to fully mod it (emuMMC...etc) or can I just boot UDPIH payload from TegraRcmGUI when on RCM mode?

Thanks in advance.

 

[BaamAlex]

Hi, I have a hackable Switch laying around, but it's vanilla. Do I have to fully mod it (emuMMC...etc) or can I just boot UDPIH payload from TegraRcmGUI when on RCM mode?

Thanks in advance.

Yep. You can run the udpih payload via rcm for example. There is no need to setup an emummc for this.

 

[WesMods]

Just have to say thanks so much for this, I've rescued so many WiiUs with this tool, great work and thank you for sharing

 

[SDIO]

I was able to test on a console that does have a working output, and it doesn't dump the pin to the SD. Looks like brute forcing might be the only way

You are right, it isn't in the main branch.

I compiled it here, so it dumps the pin directly on loading the recovery, so you don't have to press any buttons

 

[sirjman]

You are right, it isn't in the main branch.

I compiled it here, so it dumps the pin directly on loading the recovery, so you don't have to press any buttons

Awesome, I'll try that one when I go home next week. Thanks!

 

[Supercharlie25]

I just came to say thank you, for real. I'm so grateful for this tool. You saved my Wii U which had been in its box for 2 years, since it gave 160-0103 error for no apparent reason . I even bought a second Wii U.

Thank you so much man, thank you.

 

[buckchow]

It would require a lot of adjustments to work on old firmware versions. Only 5.5.X is supported for now.

Can you please provide an update on if support for old FW may be a possibility in the future? The quoted post is from July 2022 and looking through the entire thread your last mention of old/outdated/incompatible firmware was in January 2023 (#518).

In addition to the other people in this thread with known or suspected old FW on their consoles I personally have a couple labeled as having "2.x" and "3.x" firmware. I'm at least hoping to get OTP dumps in order to decrypt MLC dumps from NAND-AID. de_Fuse is apparently an alternative, but that looks like a last resort.

Thanks!

 

[sirjman]

Is this kind of error recoverable? Just hangs and hangs.

 

[Ysecond]

Is this kind of error recoverable? Just hangs and hangs.

View attachment 402222

Take a look at here:
https://gbatemp.net/threads/using-n...emmc-fix-160-0103-system-memory-error.636361/
or
https://gbatemp.net/threads/how-to-upgrading-rebuilding-wii-u-internal-memory-mlc.636309/
or
https://gbatemp.net/threads/fixing-...ng-rednand-with-isfshax.642268/#post-10280585

 

[Evamdro]

I have a friend that bricked his Wii u on the first ever launch day update. Think there's going to be a way to unbrick it?

 

[SDIO]

I have I friend that bricked his Wii u on the first ever launch day update. Think there's going to be a way to unbrick it?

Yes that can be fixed, but you need to defuse, which requires a little soldering and a pico: https://github.com/shinyquagsire23/wii_u_modchip/blob/main/pico_defuse/README.md

Also what is ti doing now?

 

[fvig2001]

Hi.

What do I install to get Wii menu (not really urgent since it's on Warawara plaza) and Load disc menu back? This was a result of rednand + minute + region change.

 

[Ylzen]

Hello i have this error code 160-1710 and i can boot with UDPIH and set cold boot title but after reboot same error code anyone know how to fix? My console is MLC

 

[grandosegood]

Hi there, would anyone be able to provide links to the raspberry pi pico or zero for purchase? also, is there a preference between the two for wii u purposes?

 

[Blythe93]

Hi there, would anyone be able to provide links to the raspberry pi pico or zero for purchase? also, is there a preference between the two for wii u purposes?

If it's Raspberry Pi Pico you're looking for, I've personally purchased one linked here (one from AliExpress, in fact) for setting up my GameCube's Picoboot. It's one of the ways to support the Picoboot developer and it's pretty cheap as well (provided shipping costs aren't ridiculously high for you for one reason or another).

 

[SDIO]

160-1710

That's neither the error code for eMMC corruption, nor is it the CBHC error code (so changing the CB title won't help)
Maybe it is SLC corruption, I don't know the error code for that from the top of my head. Please dump and upload the logs.
From the logs we can probably see what's wrong.