Unable to dump OTP.bin with de_fuse

[SDIO]

So maybe the SEEPROM is just bad. In that case we have no way to dump the otp. Your only way to use the console would be with defuse and a donated otp. Also we would need to add SEEPROM redirection to stroopwafel. I had planned implementing that some time but there wasn't much demand. Now we would have a usecase.

 

[MarcoC]

Just to be clear this is the content of the SEEPROM after a reboot

If you need a usecase I could support Thanks!
So the PIco should remain inside the WiiU otherwise the Wiiu will not boot?

 

[Lazr1026]

oh it wont restore without a otp. at least the seeprom key is the same between all retail systems

 

[MarcoC]

oh it wont restore without a otp. at least the seeprom key is the same between all retail systems

you were right in minute there is a check

printf("Verifying seeprom.bin...\n");
if (!crypto_decrypt_verify_seeprom_ptr(&crypt_verify, &to_write)) {
printf("\nSEEPROM failed to verify!\n");
printf("(A valid otp.bin is required)\n");
goto ret;
}

so I tried using an OTP from a different WiiU but doesn't work

Restoring SEEPROM from `sdmc:/seeprom.bin`...
Verifying seeprom.bin...
Everything verified!

Last chance: Are you sure you want to write SEEPROM?
If you write an invalid SEEPROM and then fail to backup
otp.bin, you will NOT be able to recover your Wii U!

A missing otp.bin can ONLY be recovered with a valid
seeprom.bin from the SAME Wii U, and a missing seeprom.bin
can ONLY be partially recovered (enough to boot) with a
valid otp.bin from the SAME Wii U!

If you lose BOTH otp.bin and seeprom.bin, you will be FORCED to
use a donor copy from another Wii U.
This *may* mean forfeiting the ability to play online!
This WILL mean saves stored on NAND or USBs will be unrecoverable!
This WILL mean your disk drive will no longer be usable!

This is like, the one limitation of de_Fuse lol.
You probably don't want to be here unless you're a developer
and know what you're doing.

Write sdmc:/seeprom.bin to SEEPROM?
Please enter the Konami code to continue.
[POWER/Q] Abort

WARNING: SEEPROM boot1 version v46434 does not match NAND version v8377!
Continue writing sdmc:/seeprom.bin to SEEPROM?
[POWER/Q] No | [EJECT/P] Yes...
SEEPROM write failed!
Readback did not match!
SEEPROM failed to verify!
(Check your otp.bin?)

 

[Lazr1026]

can you get pics of the entire board? super weird that a WUP-50 is having these weird issues

 

[MarcoC]

Here the 2 layers

 

[SDIO]

Sorry I didn't find time yet to implement the SEEPROM redirection. But I didn't forget and sometime before Christmas I should find time.

But I found that there is a erase command for the seeprom. I don't think that it will help in your case, but you can still try if you want.

You do the restore like normal and it will try to erase the seeprom before restoring it. Try it at your own risk of course.

 

[MarcoC]

Sorry I didn't find time yet to implement the SEEPROM redirection. But I didn't forget and sometime before Christmas I should find time.

But I found that there is a erase command for the seeprom. I don't think that it will help in your case, but you can still try if you want.

You do the restore like normal and it will try to erase the seeprom before restoring it. Try it at your own risk of course.

no problem at all and thank you for your help.

I have tried this special minute but didn't work...

!!!!!!!SPECIAL MINUTE VERSION ERASES SEEPROM!!!!!!!!!!!

Write sdmc:/seeprom.bin to SEEPROM?
Please enter the Konami code to continue.
[POWER/Q] Abort
[^ ^ v v < > < > B A ENTER] Continue...
^ ^ v v < > < > B A ENTER WARNING: SEEPROM boot1 version v46434 does not match NAND version v8377!
Continue writing sdmc:/seeprom.bin to SEEPROM?
[POWER/Q] No | [EJECT/P] Yes...
SEEPROM write failed!
Readback did not match!
SEEPROM failed to verify!
(Check your otp.bin?)
Hardware params         calc: 8bd01ae7 stored: ec76e40f
Primary boot1 params    calc: 8bd01ae7 stored: ad4a949d
Secondary boot1 params  calc: 8bd01ae7 stored: ad4a949d
Decrypted boot1 versions: v44362 (ad4a) and v44362 (ad4a)
Decrypted boot1 sectors: 0x949d and 0x949d
SEEPROM CRC32s failed to verify!
This unit might not boot up without de_Fuse now...

Boot0 error code
0xC3 SEEPROM CRC32 mismatch from data at offset 0x1C0

Post automatically merged: Nov 29, 2024

Found existing entry: boot_info, data: 10008000, size: 00000058, is_set: 80000000
prsh: checksum header: old=9254f7bf new=8f14dbd2
prsh: checksum prst: old=505276c9 new=505276c9
Guessing key based on boot1 header type 2
  --> prod key
Dumping OTP using boot1 prod v8377 (slot0=v8377, slot1=v8377), and offset 0x0d40ac6d...

WARNING: SEEPROM slot0 boot1 version v5135 does not match NAND version v8377!
         Exploit might not work!


WARNING: SEEPROM slot1 boot1 version v5135 does not match NAND version v8377!
         Exploit might not work!

If this is the first time you're dumping otp.bin, ignore this message.
However, if you reflashed boot1, you might have to guess which boot1
version was originally on NAND and will match the SEEPROM version.

this is the log when I try to dump OTP via PRSHhax

 

[SDIO]

Finally I found time implementing it. I haven't tested it yet myself, but you can have a go...

On a working working Wii U, use the format redNAND option, to prepare the SD card for redNAND.
Then rename the otp.bin to redotp.bin and the seeprom.bin to redseeprom.bin.

Use the attached files to try to boot the redNAND on the console with the broken seeprom.

EDIT: updated minute and rednand.ini in the zip

 

[SDIO]

The previous didn't work. I attached a fixed one, which should work

 

[MarcoC]

Thanks @SDIO tomorrow I will try to install it

 

[MarcoC]

The previous didn't work. I attached a fixed one, which should work

Finally, I had time to test, but it doesn't work. From the Pico console, it seems there is an error: "iosPanic(): Thread 85, owned by IOS-FS(5), has corrupted stack 0x115e9d08 of size 2048!"

The working WiiU I have is not the same model as this failed WiiU. Could that be the issue?

I've attached the log file in case it might be useful.

 

[SDIO]

Did you make sure to use the latest zip I sent you, the 4?

 

[MarcoC]

Yes I was using the last zip you post.

I tried to add the "wafel_isfshax_patch.ipx" to the plugins since I have ISFSHax installed in the working wiiu and now... it is booting!

On the Wiiu HDMI I can see now the error code 160-1400, maybe because the dvd drive is not attached, should I attach exactly the WiiU drive of the working wiiu, or I can use another one?

 

[SDIO]

Neither disc drive won't work, since it is using the drive key from the real seeprom, which is bad in your case. You could hex edit your seeprom to disable the disc drive (setting offset 0x5a to 2)

 

[MarcoC]

I tried to change the sataDEvice config to 2 but won't boot anymore... maybe CRC fails
Is there any tool to change seeprom value and recalculate CRC ?

 

[SDIO]

Minute can do it, but only on the real one.

 

[Lazr1026]

Is there any tool to change seeprom value and recalculate CRC ?

Can you send the seeprom? I can manually fix the CRCs in the file

 

[MarcoC]

I was able to calculate the CRC using to code from minute, and now is booting!!
Thanks @SDIO

Is is possible to use just redOTP and redSEEPROM and write SLC/MLC to the nand HW?

 

[SDIO]

Yes that should work. You can also just restore the SLC and rebuild the mlc.

Post automatically merged: Dec 25, 2024

And if you made the CRC fix into its own program, you might want to publish it for others to use.

Post automatically merged: Dec 25, 2024

EDIT: make sure you have a good backup slccmpt, I think we need to have the original for that an need a composite otp which has the original vWii part and the donor Wii U part