Wii-U NAND-AID - eMMC Recovery and Replacement Interposer Public Test

[Nandster]

That dump doens't look to bad. annoying thing is that one corrupted folder

Error: Failed to dump folder /"usr\\title\\00050000\\10128c00\\content"

I think you can go ahead and write the Image to a 32GB SD and replace the eMMC with it.

Super, thanks again. Will I fire you off a PM to sort out details for buying a nand-aid from you?

Also thanks to you too @V10lator, I think the info you gave me there will be a big help later on when I get a nand-aid

 

[SDIO]

No, the dump is through FSA, so the SLC cache isn't responsible for that.

EDIT: yeah sure, send me your details and I can send you a NAND-AID. Shipping shouldn't be that expensive. So 8€ for the set (PCB, SD Slot, cap) would be fine

 

[Nandster]

Is that an important folder? (usr\\title\\00050000\\10128c00\\content)

Quick look on WiiUBrew says it's Tank Tank Tank!, but perhaps it signifies something else?

 

[SDIO]

The problem is, that we won't be able to get rid of that folder. We can move it somewhere else, but I you would ever attempt a factory reset, it would make it hang.

The only way to truly get rid of corrupted folders is to format the MLC. But thats a lot of work and everything has to go exactly right. Also you would need to be prepared to unbrick it, which would include flashing the SLC, ine case it would go wrong. So I don't think it it worth for you to go through this trouble and just remember to not do a factory reset.

 

[Nandster]

The problem is, that we won't be able to get rid of that folder. We can move it somewhere else, but I you would ever attempt a factory reset, it would make it hang.

The only way to truly get rid of corrupted folders is to format the MLC. But thats a lot of work and everything has to go exactly right. Also you would need to be prepared to unbrick it, which would include flashing the SLC, ine case it would go wrong. So I don't think it it worth for you to go through this trouble and just remember to not do a factory reset.

Sounds like a headache I can live without! Thanks so much

Post automatically merged: Jun 24, 2023

Before you start the dump, please dump the syslogs.

Here is the menu, which has the new option. You would use "Dump SLC clone MLC".

I thought you already have 32GB sd cards. You can probably also use one of them for the MLC replacement. (Or switch later to a Max Endurance).
Let's first figure out if the eMMC even needs replacement.

I still didn't have the chance to test it. If anyone else could test the new function I would appreciate it.

Sorry @SDIO I'm just reading through the entire thread here to fully get up to speed on what to do when the nand-aid arrives to me. I notice here in your above quote, you asked me to dump SLC and Clone MLC....i didn't actually select clone mlc, and instead, I hit dump slc+mlc....

Is that ok? I also realised I never listed the contents of mlc.log either....tbough I did post the errors or the NAND extraction attempt.

 

[SDIO]

The clone was in case you didn't have a 64gb SD. The dump is fine

 

[Nandster]

Hi folks, so the nand-aid arrived to me safe and sound (thanks so much @SDIO) and I'll be ready in a few days to sit down and tackle all of this. Can I just run through what I think are the next steps, and I've a few questions too if it's ok to ask before I get started.

The Background:
Black 32GB Wii U bought on Launch Day. Consoles appears to work fine, but when I go to perform a nand-dump via the browser exploit, the console immediately errors out with a 160-0103.

The Story So Far:
I've used a Pi Pico to enter the recover menu/UDPIH and dumped the otp, seeprom, syslogs, and then slc_mlc in that order. After slc+mlc dump was done, I pressed Eject when prompted which returned me to the Recovery Menu, and then I pulled the power cable. Some pics here. I then merged the nand parts with the appropriate command, and then tried to extract the nand which resulted in the expected errors. Error log here.

The Next Steps:
Ok, from what I've read here, and with the help of several users here, here's what I think are the next steps...

1) Burn my faulty dumped nand image to a matching microsd card (sandisk extreme 32GB) - Do I need to format the card in any particular file system first? Or will burning the image take care of any file system questions?

2) Disassemble the Wii U, and if the unrequired capacitor which blocks the nand-aid is present, remove it.

3) Cut CLK line between jumper pads

4) Install Nand-Aid, reflow the ground via first and then solder the nand-aid to this pad first, then the resistor pads, then the micro-sd slot, then capacitor, then 3v wire.

5) Bridge the DIS jumper

6) Insert SD Card & boot to Recovery Menu via Pico again

7) Use wupserver to remove the broken games and broken update - how is this done? Is there an option to remove faulty files or do I manually look though the error logs I linked to above and remove ID's of anything that shows an error? I'd appreciate a bit of guidance on this.

^^ @V10lator you seemed to have some good info on this

8) Remove the folder usr/packages/title/0000000000000016 - Same question as above, how is this done?

9) Reinstall Mii Maker through install wup option - Same question again really, will there be a direct option to reinstall this?

10) From logs I linked to above - "Error: Failed to dump folder /"usr\\title\\00050000\\10128c00\\content"" - @SDIO mentioned moving this folder somewhere else - how is this done safely?

If I get all of this done, is that basically it then? Should I try to take a nand-dump via the browser exploit to verify that everything is fixed?

I know there's a few questions there, but I'd really appreciate the help as I don't want to mess this up at this stage! Many thanks all

 

[V10lator]

1) You're "burning" a filesystem image. So no, there doesn't need to be any filesystem on the SD but you need some tool writing low-level.

4) + 5) It should be possible to bridge the DIS jumper before installing the NAND_AID which might make it a bit more simple. For the rest you seem to be right witht the ordering.

7) 8) 10) You start wupclient in interactive mode, so pyhton -i wupclient.py. This should give you a prompt. At that prompt you can enter delete_title("/path/to/the/title", 0), so for example delete_title("/vol/storage_mlc01/usr/title/00050000/10128c00", 0) (bad example as this will fail thanks to the corrupted folder, you'll have to move that away first), w.mv("src", "dst"), w.rm("/path/to/the/file"), w.rmdir("/path/to/the/folder") and more. Also it's highly recommended to do a flush_mlc() after you did anything.
For the broken folder something like this should work: w.mv("/vol/storage_mlc01/usr/title/00050000/10128c00/content", "/vol/storage_mlc01/corrupted"). Note that I didn't check quotas yet, so in case it doesn't work just tell and I'll have a deeper look.
Also have a look at this wupclient fork:
Lastly don't forget to use the recovery menus start network option before starting wupserver.

9) Yes there is a wupclient option but that is a bit buggy. Just use the recovery menus "Install WUP" option instead.

Should I try to take a nand-dump via the browser exploit to verify that everything is fixed?

Yes and no. Having a good NAND dump is a good idea but you shouldn't use it to verify the corruptions, esp not a dump not taken through FSA. One of SDIOs recovery menu forks has a "Check MLC" option, use that to verify. In case there are no more corruptions beside that one folder you moved away use the same recovery menu fork you used to take the slc+mlc dumps before to take new ones.

BTW: Also have a look at https://gbatemp.net/threads/wii-u-internal-storage-upgrades-are-possible.635629 - It's not ready for end users yet but with reformatting the MLC we're theoretically able to remove that corrupted folder, too. You will loose anything on MLC + USB (a firmware reset is needed) through.

//EDIT: Also make sure to exchange the IP inside of wupclient (line 30 at my fork) with the IP of your Wii U. Don't change the port through.

 

[Nandster]

Ok @V10lator, thank you so much for that very detailed response, and all the great info within. I've got some more questions though unfortunately!

I'm with you all the way up to 7), 8), & 10). If I'm reading your post right, I use the Pico to enter the Recovery Menu that @SDIO sent me, and from there, I first make sure to hit Start Network, and then I hit Start Wupserver. The thing is, my Recovery Menu has no Start Network option, but it does have Load Network Configuration....is that the same thing?

Ok, once I have the Wii U running wupserver, I presume it's sitting then in a state that I can push commands to it via my pc using wupclient?

Ok so say I then download that to my pc and run it via cmd prompt (using "python -i wupclient.py") So I've the Wii U waiting for commands, and I've the client running on my pc to issue commands....does wupserver tell me the Wii U's IP address that I can edit into the above python file? If not, I assume I'll just grab the IP from my router or something.

Ok, for the commands then. Based on these errors, and using your template delete_title("/path/to/the/title", 0)

e.g....
Error: Failed to read /"usr\\packages\\title\\0000000000000016\\0005000e10144e00\\00000004.app"
Error: Failed to read /"usr\\packages\\title\\0000000000000016\\0005000e10144e00\\00000007.app"
Error: Failed to read /"usr\\packages\\title\\0000000000000016\\0005000e10144e00\\00000011.app"

^^ would my command be:

"delete_title("/vol/storage_mlc01/usr/packages//0000000000000016", 0)" - thereby deleting the whole 0000000000000016 location?

or

"delete_title("/vol/storage_mlc01/usr/packages//0000000000000016//0005000e10144e00", 0)" - thereby deleting the whole 0005000e10144e00 location?

or

"delete_title("/vol/storage_mlc01/usr/packages//0000000000000016//0005000e10144e00//00000004.app", 0)" - thereby deleting the faulty file itself 00000004.app?


If I'm just deleting the individual files, I presume I just go down through the list of files which have errors in the log and delete them?

Looking at the log there, I'm just really confused as to what to actually be deleting...

/"usr\\title\\00050000\\10132100\\code\\libcrypto_rpl.rpl"
/"usr\\title\\00050000\\10128c00\\meta\\Manual.bfma"

^^ there's loads of entries like that, so if I delete them, how do they get restored??

Sorry for all of the questions, I know they seem basic, I really just don't want to delete something that I shouldn't...

 

[V10lator]

Start Network option, but it does have Load Network Configuration....is that the same thing?

Yes. You might need a .txt file on your SD card, not sure if it falls back to the Wii Us network settings. See https://github.com/GaryOderNichts/recovery_menu#load-network-configuration for more information.

Ok so say I then download that to my pc and run it via cmd prompt (using "python -i wupclient.py") So I've the Wii U waiting for commands, and I've the client running on my pc to issue commands

The client connects as soon as you start it and keeps a connection open untill you close it (with exit()) but yea, that's basically how it works.

does wupserver tell me the Wii U's IP address that I can edit into the above python file?

IIRC yes it does but don't count me on that.

delete_title("/vol/storage_mlc01/usr/packages//0000000000000016", 0)

That won't work. delete_title is for installed titles (the ones in /usr/title/) but that package dir seems to be what the eShop downloaded _before_ installing. So for that you will need to remove the files by hand but this is also minor, so I would suggest to not do it with wupclient (no recursive deletion there) but with FTP after you fixed anything other.

Looking at the log there, I'm just really confused as to what to actually be deleting...

/"usr\\title\\00050000\\10132100\\code\\libcrypto_rpl.rpl"
/"usr\\title\\00050000\\10128c00\\meta\\Manual.bfma"

delete_title("/vol/storage_mlc01/usr/title/00050000/10132100", 0)
and
delete_title("/vol/storage_mlc01/usr/title/00050000/10128c00", 0)
Hope this helps, else I can compile a complete list of commands based on your logs ( https://gbatemp.net/threads/wii-u-n...oser-public-test.630798/page-10#post-10191329 ) later or tomorrow.

how do they get restored??

These are just games, DLC and stuff like that. You can look them up at http://wiiubrew.org/wiki/Title_database , like at "usr\\title\\00050000\\10132100\\code\\libcrypto_rpl.rpl" the important part is 00050000\\10132100. Just replace \\ with - so it becomes 00050000-10132100, then search for that on the linked database and you'll find "Wii Street U powered by Google". Just reinstall it with the eShop in case you really need that (purchases won't get deleted, you will be able to redownload anything).

Whatever you do DON'T DELETE TITLES AT /sys/title/ as these are important system titles. In case you have a corruption there (like Mii Maker) this needs to be fixed differently (reinstalling the title might work but most likely you will have to delete the title, then reinstall it right after it: A reboot in between might brick the console).

//EDIT: In case you can't find a title on the database it was most likely some inject or homebrew channel/forwarder.

//EDIT²: For Mii Maker I would also suggest to not fix it with wupclient but fix anything else first, then use NUSspli to reinstall. No need to uninstall/delete with NUSspli, it will take care of anything for itself.

 

[Nandster]

Ok I think I'm starting to understand.

So the files located at "/"usr\\packages\\title\\0000000000000016\\" are downloads, which are left over from before the contents were installed. I can then delete all of these via FTP at a later stage?

I use wupclient then to delete all of the listed files manually and individually, which are located in "/"usr\\title\\00050000\\" With regard to these files, there are various different types like lzss files, rpl files, jpg, tga, dat files, szs files, and so on. I'm definitely just deleting these individual files, and NOT the directory they are in correct?

The two files mentioned at "/"sys\\title\\00050010\\1004a200\\" are the faulty Mii Maker files. These need to be deleted, and then immediately I need to reinstall the Mii Maker wup via the wupinstaller in the recovery menu. Rebooting between deleting these files and reinstalling the wup could be a disaster. In terms of sourcing the Mii Maker installation file, I know I can't be linked to it, but are there any concerns with regional mismatching here, ie, do I need a PAL EU version? Also, say I found a Mii Maker system application dump, and it's in three folders (code, content, and meta), how exactly is it installed?

I won't be able to delete the "/"usr\\title\\00050000\\10128c00\\content"" files, because the folder is corrupted, and will need to be moved elsewhere. Can I ask, is it important where this is moved to, and do I create a new directory to move it into?

Again, thanks so much for the help!

Post automatically merged: Jul 6, 2023

//EDIT: In case you can't find a title on the database it was most likely some inject or homebrew channel/forwarder.

//EDIT²: For Mii Maker I would also suggest to not fix it with wupclient but fix anything else first, then use NUSspli to reinstall. No need to uninstall/delete with NUSspli, it will take care of anything for itself.

On Edit 1 - This console is fully stock, so hopefully there should be no surprised like that.

On Edit 2 - Ok brilliant, I will take a look at NUSspli and learn how to use it! Cheers!

 

[V10lator]

So the files located at "/"usr\\packages\\title\\0000000000000016\\" are downloads, which are left over from before the contents were installed. I can then delete all of these via FTP at a later stage?

Yes.

I use wupclient then to delete all of the listed files manually and individually, which are located in "/"usr\\title\\00050000\\" With regard to these files, there are various different types like lzss files, rpl files, jpg, tga, dat files, szs files, and so on. I'm definitely just deleting these individual files, and NOT the directory they are in correct?

Not correct. You just delete the whole title (delete_title("/vol/storage_mlc01/usr/title/00050000/10132100", 0), for example), then reinstall it later if needed. This will be way more simple than deleting all the files by hand and after that delete the whole title as it won't work without these files anyway.

The two files mentioned at "/"sys\\title\\00050010\\1004a200\\" are the faulty Mii Maker files. These need to be deleted, and then immediately I need to reinstall the Mii Maker wup via the wupinstaller in the recovery menu. Rebooting between deleting these files and reinstalling the wup could be a disaster.

You probably overlooked my edit at the post above:

//EDIT²: For Mii Maker I would also suggest to not fix it with wupclient but fix anything else first, then use NUSspli to reinstall. No need to uninstall/delete with NUSspli, it will take care of anything for itself.

are there any concerns with regional mismatching here

Yes. You need to use the same region your console is.

is it important where this is moved to

Not really but some spots might be bad. Just moving it to the root is what we normally do as there it won't interrupt anything except a factory reset (and maybe a console transfair, not sure anybody tried that yet).

do I create a new directory to move it into?

With multiple corrupted folders I would suggest to make a new directory but with just one, like in your case, this seems unimportant.

On Edit 1 - This console is fully stock, so hopefully there should be no surprised like that.

On Edit 2 - Ok brilliant, I will take a look at NUSspli and learn how to use it! Cheers!

NUSspli won't work on a stock console and you can't really use Tiramisu with broken Mii Maker. So maybe we need to fix it from the recovery_menu, too, but let's fix anything else first, then get back to that.

 

[Nandster]

@V10lator I owe you a drink for all your help. No doubt I'll be back to you with more questions when I sit down to do this. One final question for now, apart from uninstalling and reinstalling Mii Maker (back to doing this via wupinstaller due to it being a stock console), are there any points in this where rebooting and powering off will cause me issues? Am I able to boot up into the recovery menu now and power off again without any concerns? That's my big concern for the moment, because of what I read about things needing to work first time otherwise there will be an SLC mismatch etc...is that a concern with with the stock emmc clk jumper cut?

 

[SDIO]

Mii Maker isn't required for the recovery menu to work. The console can boot without it, so I wouldn't be too worried about that. I didn't look at the error log yet, but if it doesn't have broken directories and no title.* Files are corrupted, you should be able to just install over it without deleting it first.
I am on the phone rn so can't have a good look at the error logs.
But did you run MLC checker to see what's really broken?

 

[Nandster]

Mii Maker isn't required for the recovery menu to work. The console can boot without it, so I wouldn't be too worried about that. I didn't look at the error log yet, but if it doesn't have broken directories and no title.* Files are corrupted, you should be able to just install over it without deleting it first.
I am on the phone rn so can't have a good look at the error logs.
But did you run MLC checker to see what's really broken?

Pretty sure you looked at my error logs previously in the thread, you spotted the initial Mii Maker corrupted files. I just linked them above to save anyone from having to manually find them again.

I didn't run mlc checker no, there didn't seem to be an option for that in the modified recovery menu you sent me...

 

[V10lator]

I didn't run mlc checker no

Just go with the log from extracting for now. Then after the fixes we'll link you the one with the checker.

 

[Nandster]

Just go with the log from extracting for now. Then after the fixes we'll link you the one with the checker.

Sounds like a plan, cheers. Once the nand-aid is in place, am I ok from there on to turn the Wii U on/off only entering the recovery menu?

 

[V10lator]

Once the nand-aid is in place, am I ok from there on to turn the Wii U on/off only entering the recovery menu?

When the SD is also in place: Yes. Just make sure to never ever boot from the original eMMC again, else your SLC cache will break.

 

[Nandster]

When the SD is also in place: Yes. Just make sure to never ever boot from the original eMMC again, else your SLC cache will break.

Perfect, that's more or less what I thought, just wanted to double check. Say worst case and the SD Card fails after some time, I assume then that once the CLK connection is cut, that takes care of the eMMC ever being booted etc?

Post automatically merged: Jul 7, 2023

delete_title("/vol/storage_mlc01/usr/title/00050000/10132100", 0)
and
delete_title("/vol/storage_mlc01/usr/title/00050000/10128c00", 0)
Hope this helps, else I can compile a complete list of commands based on your logs ( https://gbatemp.net/threads/wii-u-n...oser-public-test.630798/page-10#post-10191329 ) later or tomorrow.

Hey @V10lator, good news. I managed to get the basic install of the nand-aid done and finished today, and finished off by setting up wupserver, and punching in those two commands you gave me. I think it worked? See pics below.

So from here, assuming it's working as intended, I'm ready to start getting to work with wupserver/client. You mention above you might be able to compile a list of commands based on my logs....I'd HUGELY appreciate that, not because I'm lazy, but because I'm much more comfortable with a soldering iron than I am poking around critical files

Lastly, I'll very likely keep this console stock, as I have a White 8GB model running CFW already, so there's no need having both modded. Given that, I obviously won't be able to use FTP to remove the post-installation file remnants....I don't mind nuking those manually by hand though either. So if I could even get a template for one of those commands, I can take it from there too. I know I'm asking a lot of questions....so in return, I took a LOT of pictures that I'll be able to put together on a thread elsewhere, which may help someone even a little bit in the future. Thanks guys

 

[SDIO]

The second delete failed, as it has a non zero return value. But that's just a game, so it shouldn't keep the wii u from booting.
I attached you the recovery_menu with the MLC-Checker