Hacking Dumping Wii U NAND via SD card adapter

[pelago]

Is it possible to dump the Wii U NAND (not the vWii NAND) using a soldered SD card adapter, just as is possible on 3DS? See http://gbatemp.net/threads/nand-flash-dump-3ds-xl.350668/ and http://gbatemp.net/threads/nand-flash-dump-3ds.353263/

I realise that there's no hack for the Wii U yet, but I still like the idea of backing up the current firmware now so that the console could later be downgraded, just in case.

 

[jammybudga777]

Is it possible to dump the Wii U NAND (not the vWii NAND) using a soldered SD card adapter, just as is possible on 3DS? See http://gbatemp.net/threads/nand-flash-dump-3ds-xl.350668/ and http://gbatemp.net/threads/nand-flash-dump-3ds.353263/

I realise that there's no hack for the Wii U yet, but I still like the idea of backing up the current firmware now so that the console could later be downgraded, just in case.

definatly an interesting theory. would be interesting to find out

 

[Ray Lewis]

Is it possible to dump the Wii U NAND (not the vWii NAND) using a soldered SD card adapter, just as is possible on 3DS? See http://gbatemp.net/threads/nand-flash-dump-3ds-xl.350668/ and http://gbatemp.net/threads/nand-flash-dump-3ds.353263/

I realise that there's no hack for the Wii U yet, but I still like the idea of backing up the current firmware now so that the console could later be downgraded, just in case.

I've started a thread with more links and nobody cared. Maybe because it is somebody else this may get attention. Don't hold your breath though;-)

 

[Duo8]

Appearantly this has been done before.

 

[pasc]

Really ? Instruction ?

 

[raulpica]

3DS uses eMMC, that's why you can do that. As long as the WiiU uses eMMC too, you can do that.

 

[Ray Lewis]

It does use emmc. My thread had many links and diagrams. No tri wing screwdriver so I wanted to see if people had or would try it...like the 3ds.

 

[Spzjulien]

It does use emmc. My thread had many links and diagrams. No tri wing screwdriver so I wanted to see if people had or would try it...like the 3ds.

where is your thread ?

 

[yuyuyup]

where is your thread ?

Good job necro bumping Ray Lewis's signature

 

[cory1492]

Good job necro bumping Ray Lewis's signature

ahaha... if Ray's profile wasn't private and I had signatures turned on (or the inclination to turn them back on and make this place look more Akhibara street sign again)

I believe this is the link this thread is discussing... if not someone who can see the sigs will surely correct me
http://gbatemp.net/threads/wii-u-emmc-nand-read-write-read-before-flaming.355678/

 

[Ray Lewis]

ahaha... if Ray's profile wasn't private and I had signatures turned on (or the inclination to turn them back on and make this place look more Akhibara street sign again)

I believe this is the link this thread is discussing... if not someone who can see the sigs will surely correct me
http://gbatemp.net/threads/wii-u-emmc-nand-read-write-read-before-flaming.355678/

Yes, that is the one. I referenced this in the current Wii U hacking threads. As you can see there are links with a lot of information. I don't have the ability to open my Wii U and don't want to brick so I hoped knowledgeable people would try and comment. Maybe they could offer a guide? Nobody was interested at the time I made that thread and perhaps it is relevant now. Revert to beat Nintendo and go back to a vulnerable firmware and recover if more involved methods of exploring are utilized. Comex bricked without modifying anything!!!! Edit; ts, please add the links from my old thread here.

 

[mixelpixx]

What is the part number on the Wii U Nand? anyone know it off hand. I have a ton of chip programmers, and if needed i can probably build one to read from the nand.. just need to know where to start messin.

 

[Bug_Checker_]

What is the part number on the Wii U Nand? anyone know it off hand. I have a ton of chip programmers, and if needed i can probably build one to read from the nand.. just need to know where to start messin.

http://wiiubrew.org/wiki/EMMC_NAND
http://www.psdevwiki.com/ps3/KLMAG2GE4A-A001
http://wiiubrew.org/wiki/Wii_U/console/motherboard

 

[hundshamer]

If I have read correctly, you need to read 2 NANDs. Both the one in orange here:

...and the one in black here:

Pics taken from ifixit.

 

[mixelpixx]

Samsung KLM8G2FE3B eMMC 8 GB NAND Flash/Memory Controller (8GB and 32GB flavors)
and
Samsung K9K8G08U1D 4 Gb (512 MB) NAND Flash

i see five resistors and a cap on the top side near nand. possibly JTAG point, 1cap and 5 resistors. See some similar spots on back near the other nand. One has to be SYSTEM, and the other is probably storage. The K9K part has leads on it, and in most designs that would be what holds the system operating flash code.

Same chips were used in Samsung Galaxy Tab 2 7.0 , and reflashing and reading / writing has already been accomplished. Looks like i can only find a few pieces of hardware for sale to dump them, but it is done via JTAG, so if the points can be found for proper JTAG connection it should be easy (easy enough).

Would be nice to be able to use the PPC to dump all of it.


Has anyone done any probing? found any serial communication / uart ports?

 

[mixelpixx]

And without measuring looks like the 2 nands are almost on top of each other on opposite side of PCB. Wonder if they use same lines/connections and there is pass through, maybe a space saving technique? Wish I had an XRAY




So before i get totally loaded for bear, and piss money into the wind. Anyone else want to (and able) to work on this approach together?

 

[mixelpixx]

How to find the JTAG port? I am thinking since the data lines [7-0] all have 50Kohm res on them, the JTAG lines would probably have 100 to 330 Ohm res on them close to the nand as possible.


*Note: Just probing with a meter can be misleading, resistors and capacitors in circuit will measure different, maybe, if they are in parallel or series. And there is also "in circuit" cap and res to consider.



* should I start a new thread for this? realize i am kinda hijacking a thread on dumping to an SD Card..?

 

[jammybudga777]

yea probable better to start a new thread tbh

 

[NWPlayer123]

nah, we have enough threads as it is, and it's relevant to the topic, keep it here.

 

[Goku Junior]

Well it could be possible, I prefer wait to homebrew NAND dump, because that could be risky and you need a 32GB or 64GB SD Card to dump all the NAND of Wii U (the basic owners have only 8GB so it's easier), if we have a Wii U NAND Dumper, I hope it bring USB support to dumping the 32GB NAND because I don't have a very big SD card...