Hacking Wiiu Nand Dump

[Veho]

what is this?

I'm going to say it's the pinout schematic for the TSOP NAND on a Wii U.

 

[hashcheck1]

Pinout and shows wiiu and wii CE. If asking probably won't mean anything to you

 

[shinyquagsire23]

Pinout and shows wiiu and wii CE. If asking probably won't mean anything to you

I thought it was neat actually, it certainly explained why the RB pins always were continuous for some reason. The way they do CE is neat too. Probably won't take my Wii U apart again (just got it replaced) but I'm looking forwards to see what happens with this.

 

[FaTaL_ErRoR]

You can't restore a backup of another console, because the backup is encrypted with console-specific keys.

???? Not what I asked at all. Don't jump to a conclusion as to what it is for. It will never be flashed to a wii u.
I have a JP u coming, a friend sent it. But, it's being held at customs for some odd reason. Was hoping maybe to get this part over with already.
Which is why I am willing to pay for a current firmware nand dump...(I say current because by the time someone dumps one we very well may be past 5.5 same holds true for my jp console being released at customs.)
If you have a JP U and can dump your nand (wii u nand) pm me I am willing to pay for it.

 

[nastys]

???? Not what I asked at all. Don't jump to a conclusion as to what it is for. It will never be flashed to a wii u.
I have a JP u coming, a friend sent it. But, it's being held at customs for some odd reason. Was hoping maybe to get this part over with already.
Which is why I am willing to pay for a current firmware nand dump...(I say current because by the time someone dumps one we very well may be past 5.5 same holds true for my jp console being released at customs.)
If you have a JP U and can dump your nand (wii u nand) pm me I am willing to pay for it.

You might as well ask for any Wii U dump...
You can't read anything from a backup unless you have the keys, and we can't dump them yet.

 

[LawnMeower]

You might as well ask for any Wii U dump...
You can't read anything from a backup unless you have the keys, and we can't dump them yet.

What keys are required to encrypt the NAND dump?

 

[nastys]

What keys are required to encrypt the NAND dump?

The keys are probably in the CPU. It's possible to get them via software, but I think we'd need an IOSU exploit first.

 

[hashcheck1]

Each nand dump are console specific you can't swap between wiiu and are encrypted based on your console. Most likely very similar to 3ds

 

[Seelbreaker]

Each nand dump are console specific you can't swap between wiiu and are encrypted based on your console. Most likely very similar to 3ds

Wasn't that the same case with the Wii?

 

[quantumboy]

I wish I had seen this post before I updated above 5.3.2

 

[FaTaL_ErRoR]

You might as well ask for any Wii U dump...
You can't read anything from a backup unless you have the keys, and we can't dump them yet.

Again not what I am asking for at all. Just asking for a JP nand dump. But you did answer me on that and that is "you" can't dump them yet.
I am curious if anyone else attempting this method have successfully dumped one yet. As far as needing this I no longer need a JP dump. My console was released from customs this morning. Yay, should be here by friday. Also, if I can give one thing and one thing only it would be:
both sides of 3.3v and grounds need to be supplied, power off and internal battery should also be removed. Dual powered chips regardless of which bank is being flashed still need both sides powered up.

 

[nastys]

Again not what I am asking for at all. Just asking for a JP nand dump. But you did answer me on that and that is "you" can't dump them yet.

I mean, nobody can get the keys, except Nintendo, not literally "we"...

As far as needing this I no longer need a JP dump. My console was released from customs this morning.

Great
I don't understand why you'd need an encrypted JP NAND backup to release the console from the customs, though...

 

[Adr990]

@shinyquagsire23 I got my Teensy++ 2.0, do I kick off the resistors?

Like you showed here:
http://wiiubrew.org/w/images/thumb/5/56/Tsop-pinout.jpg/800px-Tsop-pinout.jpg

As in, that wasn't the part that broke yours?

 

[shinyquagsire23]

@shinyquagsire23 I got my Teensy++ 2.0, do I kick off the resistors?

Like you showed here:
http://wiiubrew.org/w/images/thumb/5/56/Tsop-pinout.jpg/800px-Tsop-pinout.jpg

As in, that wasn't the part that broke yours?

Does yours have resistors? Mine did not come with any at all. I soldered to that portion though, yes. I had no problems though until I started closing up the casing for the Wii U (it booted all the way in fine). As long as you don't get solder anywhere it shouldn't be (or bridge the connections) you'll do fine. Here's my job I had before:

Spoiler

 

[Adr990]

Does yours have resistors? Mine did not come with any at all. I soldered to that portion though, yes. I had no problems though until I started closing up the casing for the Wii U (it booted all the
way in fine). As long as you don't get solder anywhere it shouldn't be (or bridge the connections) you'll do fine. Here's my job I had before:

Neither does mine, I didn't remember them from last time, but I haven't had the time to set the mod up yet.

Some questions though...
1. I really want to know what those kinds of wires are called.
I scavenged some of them, but they ran out.

2. Which .hex of the two (boost/dual) did you use on your Teensy++ 2.0? The readme is not on point with the content (https://github.com/hjudges/NORway)
Even if some PS3's had the same dual NANDs for some reason as the WiiU does for vWii and the WiiU itself. Does it still deliver two separate dumps?
Either I have the wrong github project, or the readme is just way off. heh

Hopefully will be able to get to it tomorrow.

 

[shinyquagsire23]

Neither does mine, I didn't remember them from last time, but I haven't had the time to set the mod up yet.

Some questions though...
1. I really want to know what those kinds of wires are called.
I scavenged some of them, but they ran out.

2. Which .hex of the two (boost/dual) did you use on your Teensy++ 2.0? The readme is not on point with the content (https://github.com/hjudges/NORway)
Even if some PS3's had the same dual NANDs for some reason as the WiiU does for vWii and the WiiU itself. Does it still deliver two separate dumps?
Either I have the wrong github project, or the readme is just way off. heh

Hopefully will be able to get to it tomorrow.

Those are magnet wires, they're (usually) thin copper wires insulated in an epoxy. So for soldering I got a bit of solder on the tip of the iron and melted the ends of the wire, then soldered. As for the hex I used, I used the dual NAND option, and then I moved the Chip Enable (CE) pin manually. You could totally switch that stuff in software but I was lazy and a soldering iron was faster As per the schematic earlier, both R/B wires can be put to the same spot on the Teensy. You could maybe do something with the program so that both CE wires are placed in other pin spots and then add code to enable one or the other depending on which one you're dumping.

 

[FaTaL_ErRoR]

I mean, nobody can get the keys, except Nintendo, not literally "we"...

Great
I don't understand why you'd need an encrypted JP NAND backup to release the console from the customs, though...

What are you talking about? Once you remove the console specific part they are all the same. (well unsure about JP reason I need it)



I didn't need the dump to get it released from customs I needed the flash so I didn't have to wait for the console being shipped.
But since they let it go from customs a ton faster than I thought they would disregard my request for it.

 

[shinyquagsire23]

What are you talking about? Once you remove the console specific part they are all the same. (well unsure about JP reason I need it)

The entire NAND image is console-specific. There isn't a console specific and a non-console specific part, it's all, in it's entirety, console specific. Can't flash one image onto another console.

 

[EmceeKerser]

What are you talking about? Once you remove the console specific part they are all the same. (well unsure about JP reason I need it)



I didn't need the dump to get it released from customs I needed the flash so I didn't have to wait for the console being shipped.
But since they let it go from customs a ton faster than I thought they would disregard my request for it.

But its encrypted. Did you buy a JP console just to play around with an encrypted NAND?

 

[FaTaL_ErRoR]

The entire NAND image is console-specific. There isn't a console specific and a non-console specific part, it's all, in it's entirety, console specific. Can't flash one image onto another console.

It's encrypted with console specific keys. Once those have been entered in the raw image you can bit by bit view to see if they are identical or if parts are different. Also looking into decrypting console specific part. and using a different set of console key and attempting to flash it back to see what happens.

But its encrypted. Did you buy a JP console just to play around with an encrypted NAND?

Kinda yeah. But I also wanna get inside the drive to see if there are any differences as well. these same methods also work for obtaining keys. (even one time programmable) http://www.cl.cam.ac.uk/~sps32/mcu_lock.html All you have to do is be willing to ruin a few consoles. And since all my children have recently upgraded to xbox 1 I have a few consoles I was not worried about ruining. Combine those consoles with the ones my wife poached from all over the globe and now I have plenty of them to destroy from all regions. Currently I am successful on my third attempt. But that third console is also ruined so I have no real way of validating my findings. I am attempting to correct it and not kill the console when they are extracted. And then will work on not messing up the first two. But my main focus right this minute is just to get one that dumps them without messing up the chip. I think I am going to remove the chip this time and see if any good luck comes my way.