Hacking Wiiu Nand Dump

Adr990

To boldly go where no man has gone before!
Member
Joined
Apr 22, 2007
Messages
1,567
Trophies
0
Location
The Netherlands
Website
www.hyrule.net
XP
737
Country
Netherlands
A video is a bit much...
I mean it is as simple as using glue..

Even easier because tin kinda goes and sits in the right spot where the solder points are if you're off a little, in terms of accuracy. hah

Just go to IFixIt for a Wii U dissasambly, and they'll show you the on board components.

Marcan has posted a great tip if you are gonna disassemble you're WiiU more often:
https://twitter.com/marcan42/status/288432629118799872

I use it, along with my eMMC chip shield cut out. Makes life easy. :)
 

hundshamer

Well-Known Member
Member
Joined
May 22, 2009
Messages
1,810
Trophies
0
XP
924
Country
United States
I don't know anything of the 3ds,I don't have one 3ds!!
Google is your friend. The pinout is the same. If your looking for soldering methods, I would suggest starting with something easier as a first project. I'm not trying to be mean, but these points aren't the best place to start learning. I'm trying to save you from a $300 mistake (or the hassle of a gutswap for the shadier types LOL). I would suggest practicing on an old 360 mobo. They're much cheaper to replace. As far as the SD card, cut it open at the seams with a box cutter, and try not to loose the write protect tab.
 

shinyquagsire23

SALT/Sm4sh Leak Guy
Member
Joined
Nov 18, 2012
Messages
1,977
Trophies
2
Age
26
Location
Las Vegas
XP
3,765
Country
United States
No, hold up. :P

Read this:
http://wiiubrew.org/wiki/TSOP_NAND
Someone via IRC did this recently, and documented it to that page.

The Wii U NAND and vWii NAND are the same chip. Just two different banks in the chip.
You can use something like an Teensy++ 2.0 with NANDway, as described on the TSOP_NAND page.

The eMMC chip, which we indeed should be able to dumped via an SD Card reader, is solely used for Wii U Storage. So downgrading with that alone wouldn't even be possible, let alone do any good without the actual NAND dump.
That would be me. Fair warning though; For one, it's possible that there *might* be some sort of downgrade prevention, a la the Wii's boot2 downgrade prevention. I personally find it unlikely, but keep that in mind. Second, I already managed to brick a Wii U with the teensy set up (black screen of death where the blue light powers on but the screen and gamepad never connect), and it's not just a temporary brick, I completely unwired my Teensy and it still does not boot. The Wii U is extremely fragile when it comes to the hardware. I'm not sure how it happened, but it happened while I was putting it back together with the Teensy sticking out the side. My guess is one of my magnet wires had the insulation cut and exposed and somehow caught on a ground, possibly screwing over the NAND. Luckily it's within it's store warranty so I can probably call it a defect and get another one.

Also for what it's worth, I believe the only method of dumping which will work is having the Teensy powered by USB and converted to 3.3v and the NAND powered externally (without the actual Wii U's power supply in). While the Wii U was on I could not get a proper dump (IOSU was probably using it quite a bit), and while it was off on standby I only got 0xFFs from it (I don't believe it was powered at all tbh). It was also suggested in #wiiubrew that the Wii U side of the NAND is probably dumpable from vWii if you mess with one of the NAND registers, so maybe a vWii-only downgrading method could be used? Could be risky to test without a hardware setup to flash it back, and we need to know if NAND downgrading even works in the first place.
 

Adr990

To boldly go where no man has gone before!
Member
Joined
Apr 22, 2007
Messages
1,567
Trophies
0
Location
The Netherlands
Website
www.hyrule.net
XP
737
Country
Netherlands
That would be ... the first place.
Thanks for elaborating on this!
I was talking to someone about this and the Boot2 tempering prevention came up too.

I guess that if it is also present on the WiiU, we could just flash the original backup dump back and the checksum or whatever should give it a green light again.
Too bad we can't make sure if such prevention system is in use any other way...

On a PS3 wiki I read something about the powering of the NAND externally too:
http://www.psdevwiki.com/ps3/Hardware_flashing

300px-Ext_PSU_on_PS3_2.jpg

"Progskeet wired to NANDs of a COK-002 board, injecting 3.3V with external PSU"


And my Wii U has "died" many times the last few hours. (Same issue's you described) Redoing/removing the wires or cleaning the test points seemed to work for me so far.
It runs fine at the moment with all the wires installed. Just like the 3DS BlueScreen of Death, it is a extremely sensitive matter...
 

shinyquagsire23

SALT/Sm4sh Leak Guy
Member
Joined
Nov 18, 2012
Messages
1,977
Trophies
2
Age
26
Location
Las Vegas
XP
3,765
Country
United States
Thanks for elaborating on this!
I was talking to someone about this and the Boot2 tempering prevention came up too.

I guess that if it is also present on the WiiU, we could just flash the original backup dump back and the checksum or whatever should give it a green light again.
Too bad we can't make sure if such prevention system is in use any other way...

On a PS3 wiki I read something about the powering of the NAND externally too:
http://www.psdevwiki.com/ps3/Hardware_flashing

300px-Ext_PSU_on_PS3_2.jpg

"Progskeet wired to NANDs of a COK-002 board, injecting 3.3V with external PSU"


And my Wii U has "died" many times the last few hours. (Same issue's you described) Redoing/removing the wires or cleaning the test points seemed to work for me so far.
It runs fine at the moment with all the wires installed. Just like the 3DS BlueScreen of Death, it is a extremely sensitive matter...
Really? I cleaned up the NAND resistor spots the best I could with some copper weave but they still have a bit of leftover flux on them. Any suggestions on possibly getting it back up and running? It's save me a trip to return it, that's for sure.
 

Adr990

To boldly go where no man has gone before!
Member
Joined
Apr 22, 2007
Messages
1,567
Trophies
0
Location
The Netherlands
Website
www.hyrule.net
XP
737
Country
Netherlands
Really? I cleaned up the NAND resistor spots the best I could with some copper weave but they still have a bit of leftover flux on them. Any suggestions on possibly getting it back up and running? It's save me a trip to return it, that's for sure.
Yea, I had these issue's:

1: WiiU turns on and after a little turns off.

2: WiiU turns on and stays on, but no TV or GamePad visual. (GamePad cannot connect either, but it can turn the WiiU on)

3: Same as 2 but the Gamepad cannot turn the WiiU on. Only the power button can.


I used S-39 as flux, but I also used it to clean everything up, with a cloth. I applied some of it to the board, waited a little and dapped it and then wiped everything off again to make sure. (No idea if it actually cleaned or helped)
I also had some Aluminum Wool, the non dense one, the one with which you clean your Soldering Tip with too. I rubbed that along on the board too. (This definitely had no effect, I'm sure? xD )

But re-heating/soldering everything, and with your nail (or carefully with a flathead) cutting the flux sticky residue between the resistors and the testpoints seems to have done magic.

Make sure the Power button/Eject and Drive are connected. Maybe leave the WiiU for a few minutes before powering it through the wall socket again.
Disconnecting everything (like you've done) and try if that works.. (And then don't take no for an answer and do it again anyways xD yep)

I could have been incredibly lucky.
I thought I ruined my (old)3DS when I attempted the Hardmod (Bluescreen), but after a few months in the drawer, with the Hardmod still set up and emptying the battery, as I was able to make a proper dump, it booted just fine! :P
 
  • Like
Reactions: hashcheck1

shinyquagsire23

SALT/Sm4sh Leak Guy
Member
Joined
Nov 18, 2012
Messages
1,977
Trophies
2
Age
26
Location
Las Vegas
XP
3,765
Country
United States
Yea, I had these issue's:

1: WiiU turns on and after a little turns off.

2: WiiU turns on and stays on, but no TV or GamePad visual. (GamePad cannot connect either, but it can turn the WiiU on)

3: Same as 2 but the Gamepad cannot turn the WiiU on. Only the power button can.


I used S-39 as flux, but I also used it to clean everything up, with a cloth. I applied some of it to the board, waited a little and dapped it and then wiped everything off again to make sure. (No idea if it actually cleaned or helped)
I also had some Aluminum Wool, the non dense one, the one with which you clean your Soldering Tip with too. I rubbed that along on the board too. (This definitely had no effect, I'm sure? xD )

But re-heating/soldering everything, and with your nail (or carefully with a flathead) cutting the flux sticky residue between the resistors and the testpoints seems to have done magic.

Make sure the Power button/Eject and Drive are connected. Maybe leave the WiiU for a few minutes before powering it through the wall socket again.
Disconnecting everything (like you've done) and try if that works.. (And then don't take no for an answer and do it again anyways xD yep)

I could have been incredibly lucky.
I thought I ruined my (old)3DS when I attempted the Hardmod (Bluescreen), but after a few months in the drawer, with the Hardmod still set up and emptying the battery, as I was able to make a proper dump, it booted just fine! :P
Hm, it seems despite my efforts and cleaning the system still will not boot at all. I have a feeling I shorted something out somewhere and killed a resistor, especially since it was booting before I started to put my Wii U together, but not after (and even when I stripped it to just the board and my Teensy it failed, with the same solder job it had while it worked). Kinda sucky but I might have to just take it in and call it good.

While I was cleaning it up and doing sanity checks by checking resistances, I happened to find the test pad used to power the NAND with 3.3v. TP163 is right next to the chip and correlates with the VCC pin on it. So if you're doing external powering, that'll be where you want to hook up to.
 

FaTaL_ErRoR

AKA ŦƕƎ ƠṀƐƝ
Member
Joined
Mar 9, 2014
Messages
491
Trophies
0
XP
443
Country
United States
Yea, I had these issue's:

1: WiiU turns on and after a little turns off.

2: WiiU turns on and stays on, but no TV or GamePad visual. (GamePad cannot connect either, but it can turn the WiiU on)

3: Same as 2 but the Gamepad cannot turn the WiiU on. Only the power button can.


I used S-39 as flux, but I also used it to clean everything up, with a cloth. I applied some of it to the board, waited a little and dapped it and then wiped everything off again to make sure. (No idea if it actually cleaned or helped)
I also had some Aluminum Wool, the non dense one, the one with which you clean your Soldering Tip with too. I rubbed that along on the board too. (This definitely had no effect, I'm sure? xD )

But re-heating/soldering everything, and with your nail (or carefully with a flathead) cutting the flux sticky residue between the resistors and the testpoints seems to have done magic.

Make sure the Power button/Eject and Drive are connected. Maybe leave the WiiU for a few minutes before powering it through the wall socket again.
Disconnecting everything (like you've done) and try if that works.. (And then don't take no for an answer and do it again anyways xD yep)

I could have been incredibly lucky.
I thought I ruined my (old)3DS when I attempted the Hardmod (Bluescreen), but after a few months in the drawer, with the Hardmod still set up and emptying the battery, as I was able to make a proper dump, it booted just fine! :P
So have you successfully backed up your nand on the wii u?
If so do you happen to have a JP version? I am in need of a JP nand backup.

I really need a JP backup and will pay for it. (only wii u backup nand) Also I need it in current firmware not interested in old firmware.
And this method of dumping the nand is really funny. I have always been a chip off guy myself. This actually may have potential though.
Also, ever seen this done?
http://hackaday.com/2010/12/24/reading-nand-flash-chips-without-removing-them/
I have never tried this method before but looks like fun as well.
 

nastys

ナースティス
Member
Joined
Aug 5, 2014
Messages
1,730
Trophies
0
Age
26
Location
Earth
XP
1,794
Country
Italy
So have you successfully backed up your nand on the wii u?
If so do you happen to have a JP version? I am in need of a JP nand backup.

I really need a JP backup and will pay for it. (only wii u backup nand) Also I need it in current firmware not interested in old firmware.
And this method of dumping the nand is really funny. I have always been a chip off guy myself. This actually may have potential though.
Also, ever seen this done?
http://hackaday.com/2010/12/24/reading-nand-flash-chips-without-removing-them/
I have never tried this method before but looks like fun as well.
You can't restore a backup of another console, because the backup is encrypted with console-specific keys.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    DinohScene @ DinohScene: ahh nothing beats a coffee disaronno at work