Hacking Hardware Homebrew Wii U Unbricking Help

[Bman3990wx]

Hello

I recently got a Wii U without the gamepad and when I turn it on, it displays the Wii U logo and locks up after that with no startup music. I have tried the UDPIH method and it has weird results. The LED turns a dark purple for about 1 second then I can't tell if it is going back to a very light purple or the blue (It looks like the blue, but I can't really tell). The TV screen doesn't change. I also tried poking around with the eject and power buttons to see if it was just working without showing anything on the TV, but I cannot seem to use the shutdown option (as a test) so I doubt it's working at all.

Moving on from that, I took the PI Pico and installed the de_fuse mod. Turning this on gives me the minute menu and I was able to dump a working slc.raw, slccmpt.raw, and an OTP.bin (I was able to successfully decrypt and extract the SLC dump with the OTP.bin using the Nand extract software on pc). I also made a rednand from the minute menu. At this point I am kinda lost on what if anything I can do with this system to get it working?

I can't tell if I'm missing anything or if the Homebrew tools need more time to mature, but I don't seem to be able to get a straight MLC dump (outside the rednand creation, but even with that I can't figure out a way of retrieving an MLC dump with the partition it made. It seems the only thing I can do with it at this time is dump the entire SD card it made for safe keeping). It also doesn't seem like I can do much with the SLC dumps that I have as I don't seem to be able to modify them and re-inject them into the system (if that would even help?).

Would you all happen to know anything else I could do to get this system back up and running? Or do I just need to shelf this for a few months and let the Homebrew get better?

 

[SDIO]

you can extract the logs from the SLC and post them. Then we can see whats wrong.

 

[Bman3990wx]

Oh yea sorry. Here they are.

 

[SDIO]

The meta.bin is missing.

But it looks like a faulty eMMC:

00:00:01:859: mmc_core card err: idx=3, lba=54658928, blks=16, xfer=0x1, ret=0x00200b40
00:00:01:860: ISFS: fs_ops.c(3733)Can not change the owner Id of a non-empty file
00:00:01:860: ISFS: fs_ops.c(6719)Could not set attribute, rc=-524312
00:00:01:878: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050010/10048100/code/app.xml

and

00:00:04:392: mmc_core card err: idx=3, lba=55641088, blks=1024, xfer=0x1, ret=0x00200b40
00:00:04:429: mmc_core card err: idx=3, lba=55641088, blks=1024, xfer=0x1, ret=0x00200b40
00:00:04:429: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:04:501: [WD]>>>> Linkup msg from Net
00:00:04:510: wlc_mlme_join_cmd called with Command 0x3 Length 0x21
00:00:04:739: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00:00:04:739: failed to read file /vol/storage_mlc01/sys/title/0005001b/10042400/content/CafeCn.ttf, err -196673
00;00;04;620: ***LoadShared - WaitLoadComplete(0,8388608) failed with error -196673 on file "CafeCn.ttf".

and

00:00:05:727: mmc_core card err: idx=3, lba=54545152, blks=128, xfer=0x1, ret=0x00200b40
00;00;05;616: OSSetting_SynchronousPrinting DISABLED
00;00;05;620: OSSetting_CrashDumpType 0, MINI dump after crash
00:00:05:745: mmc_core card err: idx=3, lba=54545152, blks=128, xfer=0x1, ret=0x00200b40
00:00:05:745: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:05:746: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00;00;05;623: TCL(1): init DONE
00:00:05:824: mmc_core card err: idx=3, lba=54545152, blks=128, xfer=0x1, ret=0x00200b40
00:00:05:842: mmc_core card err: idx=3, lba=54545152, blks=128, xfer=0x1, ret=0x00200b40
00:00:05:842: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:05:843: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)

in 0.log, 99.log looks similar.

You first need to replace the eMMC, you cain either do it with a new eMMC, but that requires good soldering skills as the eMMC is a BGA package or you can replace it with an SD card. You still need to soldar for that, but there a normal soldering iron is enough, as you don't need to remove the old eMMC.

Also see this: https://gbatemp.net/threads/how-i-fixed-160-0103-system-memory-error.626448/
and this: https://gbatemp.net/threads/wii-u-n...nd-replacement-interposer-public-test.630798/

 

[Bman3990wx]

yeaaaa that's about what I thought. I was reading about the SD card replacement solution. Is it possible to do that without a proper MLC backup per my case or do I need to read into doing mlc backups on a raspberry pi? Also with the Nand being out, how does recovering that to an sd card work when in theory, the backup would be just as corrupt?

 

[SDIO]

You would read the eMMC using a Pi or a Cardreader and write it to an SD. Then we use udpih to replace the broken files. From the logs it should be able to run the recovery menu. In the worst case it should be able to run a modified IOSU from minute minute from where we could fix the broken files but we should be able to find a way.

 

[Bman3990wx]

Just an update, last night I ordered the things I need to make an sd card adapter. I'm gonna try and do the more DIY route and repurpose an sd to micro sd card adapter instead of getting a PCB made. Just waiting on some better wire, a capacitor, and I figured I could cut up one of those micro sd to full size sd card adapters for the MLC dump. Hopefully I can give it a shot tomorrow after work.

 

[Ysecond]

Just an update, last night I ordered the things I need to make an sd card adapter. I'm gonna try and do the more DIY route and repurpose an sd to micro sd card adapter instead of getting a PCB made. Just waiting on some better wire, a capacitor, and I figured I could cut up one of those micro sd to full size sd card adapters for the MLC dump. Hopefully I can give it a shot tomorrow after work.

hey man！What step have you taken?

 

[Bman3990wx]

Sorry for the lack of updates, but I finally got the sd card replacement working this morning. I was running into trouble with it due to a Walmart 32gb MicroSD card that was slightly to small for the dump I got from the Wii U and a bad solder joint that I made trying to wire up the adapter. As of a few mins ago, I found and corrected the solder joint and the SD card replacement is working great

Now onto repairing the MLC....... does anyone have any advice on that? It also turns out that the USB recovery menu is working just not updating the screen if that helps (before I was pressing the buttons the wrong number of times). And I still do have the de_fuse mod installed.

 

[SDIO]

Use this recovery_menu. it has "MLC CHecker" as the first option. Run it, and it will produce a mlc_checker.txt on the SD card. Every line that doesnt end with -00000000 indicates an error.

Share the log, then we can decide how we tackle it.

 

[Bman3990wx]

Ok awesome! I went ahead and ran it produced the attached.

 

[SDIO]

Oh that looks bad, there is a lot of broken files, also in /sys. The worst thing is there are also broken directories, even in /sys, that could make reinstalling them much harder.

If have to go trough it and see with which title we start. For now we ignore the errors in /usr

EDIT: looking at the logs we should probably start with 0005001b-10042400 and 00050010-10048100. But for 00050010-10048100 the whole directory is coruppted and needs to be moved first. So I would suggest we start with 0005001b-10042400 and see if that helps.

You can download it as encrypted with the JNUS tool and then try to install it through the offical recovery menu fro Gary.

 

[Bman3990wx]

So I couldn't figure out how to get system titles to appear in JNUS so I used: https://github.com/Xpl0itU/WiiUDownloader/releases

I have no experience with these recovery menus, so at this point I am using modded Wii U so I can figure out how all the menus work and then trying it on the dead one (keep in mind the recovery menu does not appear on the dead Wii U I have to do it blind). Even on the working Wii U it recognizes the title and attempts to install it, but errors out with a failed to install fffbf442 error. Since the tool allows encrypted and unencrypted downloads, I tried both and I cannot seem to get any better results.....

Not sure if I'm missing something

 

[SDIO]

You need the encrypted one. I am not if WiiUDownloader also downloads the ticket. Does it have a title.tik? For the system titles you have to use the command line. There you can specify the title and that it should be downloaded encrypted.

java -jar JNUSTool.jar 0005001b10042400 -dlEncrypted

 

[Bman3990wx]

Ok so. Hopefully good news. After you mentioned that I had to use CLI, I found an article explaining the commands and was able to get an encrypted file from JNUS. I then tried it on the modded Wii U and it worked without issue. I then installed it on the dead Wii U and now when I turn it on, instead of the Wii U logo, I am getting "an error has occurred" screen with error code 160-2215.

Post automatically merged: May 14, 2023

oh and more good news, the recovery menu is now visible!

 

[SDIO]

Nice, then please dump the logs again, you can do it through the recovery menu and send them to me (Including the meta.bin).

I also expect that we will need the WUP server, so you can start working on getting that setup

 

[Bman3990wx]

way ahead of you on wup server. I thought I was going to need it before now, so I looked up the documentation on it. I connected to the wii u and got the syslog dump. I put it in the .zip incase it would be helpful.

 

[SDIO]

Ok we are now at 17.log and it crashes because of /vol/storage_mlc01/sys/title/00050010/10040100/content/Common/Package/Men.pack
So it's crashing because of title 00050010-10040100, which is the System Menu. Just reinstall it likte the previous title

00:00:13:596: MCP: loaded and parsed 'preload.txt' at '/vol/storage_mlc01/sys/title/00050010/10040100/code'
00:00:13:596: MCP: Preparing men.rpx
00:00:13:604: MCP: Mapping /vol/content to /vol/storage_mlc01/sys/title/00050010/10040100/content
00:00:13:605: MCP: Warning title:0x0005001010040100 does not have ramdisk read capability (forcing)
00;00;13;480: DIAG:Result PrepareTitle(0x0005001010040100) came back with cosxml(0x0005001010040100)
00:00:13:625: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
00:00:13:625: MCP: Failed copying file:/vol/storage_mlc01/sys/title/00050010/10040100/content/Common/Package/Men.pack to ramdisk:/vol/system_ram/proc/cache/Men.pack, err:-196635
00:00:13:627: MCP: 0005001010040100 is not a demo title, skip increment demo launch count
00:00:13:627: MCP: Mapping /vol/content to /vol/storage_mlc01/sys/title/00050010/10040100/content
00;00;13;508: TitleId 0x0005001010040100 Version 0x000000D5 Built On SDK 21211
00;00;13;508: ------------------PROCESS 1 LOST FOREGROUND--------------------
00;00;13;508: DIAG: PhysAlloc(2, 0x40000000, 0x00000000, 0x00000000, 0x02300000, 0x00000001)
00;00;13;508: DIAG: InitAddrSpace
00;00;13;509: DIAG: Switch(New)
00;00;13;509: DIAG:+Loader(1, 7)
00;00;13;509: DIAG:+KiRPLLoaderSetup
00;00;13;509: DIAG:-KiRPLLoaderSetup: before no-return call to KiLoadContext (0xEFE09400) (0x01003FFC)
00;00;13;509: Title Loc is 0
00:00:13:710: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
00:00:13:711: failed to read file /vol/storage_mlc01/sys/title/00050010/10040100/code/men.rpx, err -196635
00;00;13;591: ***IOP-IPC FAILED reading men.rpx with a fatal error code to LiWaitIopComplete. Fatal err = (3,-27).
00:00:13:713: MCP: PID 14 requested to enable power transitions
00;00;13;593: ***LiLoadForPrep() failed with err=-196635.

 

[Bman3990wx]

So after writing, I get the wii u logo and then a cut to error 160-0103.

 

[SDIO]

this is now after reinstalling the system menu? If so, send me the new logs again or take a look yourself, where it is crashing. The meta.bin contains the number of the log in binary. You have to do modulo 100 to get the name of the logfile