Hacking Dumping Wii U NAND via SD card adapter

[obcd]

So, the sd card reader is a known working one with the 3ds?
How do you power the wiiu/emmc? Those devices have several different modes of operation.
1. spi mode
2. 1 bit sd mode
3. 4 bit sd mode
The cardreader expects the device to come up in default mode after reset (spi I think)
When the wiiu is powered, it will likely put the emmc in 4 bit sd mode as it's the fastest, and all 4 data lines are connected.
The 3ds has problems accessing it's emmc when a sd card reader is connected to it.
That's likely why the sd card reader recognises it and is able to access it.
I don't know the wiiu behavour with a cardreader connected. Just summing up possible causes of failure.

 

[spett]

So, the sd card reader is a known working one with the 3ds?
How do you power the wiiu/emmc? Those devices have several different modes of operation.
1. spi mode
2. 1 bit sd mode
3. 4 bit sd mode
The cardreader expects the device to come up in default mode after reset (spi I think)
When the wiiu is powered, it will likely put the emmc in 4 bit sd mode as it's the fastest, and all 4 data lines are connected.
The 3ds has problems accessing it's emmc when a sd card reader is connected to it.
That's likely why the sd card reader recognises it and is able to access it.
I don't know the wiiu behavour with a cardreader connected. Just summing up possible causes of failure.

Great info, thanks! The wii u power up as nothing have ever happened if I connect a sd-card reader to the emmc. Maybe we need a way to crash/interrupt the wii u boot..

 

[PhyChris]

Great info, thanks! The wii u power up as nothing have ever happened if I connect a sd-card reader to the emmc. Maybe we need a way to crash/interrupt the wii u boot..

are you guys powering the chip with external 3.3v?

 

[Deleted User]

So, the sd card reader is a known working one with the 3ds?
How do you power the wiiu/emmc? Those devices have several different modes of operation.
1. spi mode
2. 1 bit sd mode
3. 4 bit sd mode
The cardreader expects the device to come up in default mode after reset (spi I think)
When the wiiu is powered, it will likely put the emmc in 4 bit sd mode as it's the fastest, and all 4 data lines are connected.
The 3ds has problems accessing it's emmc when a sd card reader is connected to it.
That's likely why the sd card reader recognises it and is able to access it.
I don't know the wiiu behavour with a cardreader connected. Just summing up possible causes of failure.

Great info, thanks! The wii u power up as nothing have ever happened if I connect a sd-card reader to the emmc. Maybe we need a way to crash/interrupt the wii u boot..

Wii U in standby - SD reader gets detected but no drive letter assigned
Wii U power on - Same result as above
External power - I haven't tried 3.3v external yet. Anyone know solder point for 3v?

 

[obcd]

Best way would indeed be interrupting the boot process.
Isolating the supply voltage of the EMMC chip might be difficult.
The EMMC is a BGA.
Usually, complex equipment like the wiiu use a multilayer printed circuit board.
The VCC and GND layers are usually 2 of the inner layers. So, you can connect to them with a simple via.
There are no visible pcb tracks you can cut to isolate the supply from the emmc.
(Just telling what it normally is. I have no wiiu to confirm this assumption)
Maybe, you can remove the resistor that connects the cmd signal to the emmc.
This would isolate the emmc chip from the wiiu, but maybe that won't stay powered on, as it will be unable to access the EMMC.
No idea how it will react on that, but I would expect everything to become normal again if you reverse the removal.
Just be very carefull as those resistors are really small. They are so light they simply stick to your solder iron tip.

 

[PhyChris]

Best way would indeed be interrupting the boot process.
Isolating the supply voltage of the EMMC chip might be difficult.
The EMMC is a BGA.
Usually, complex equipment like the wiiu use a multilayer printed circuit board.
The VCC and GND layers are usually 2 of the inner layers. So, you can connect to them with a simple via.
There are no visible pcb tracks you can cut to isolate the supply from the emmc.
(Just telling what it normally is. I have no wiiu to confirm this assumption)
Maybe, you can remove the resistor that connects the cmd signal to the emmc.
This would isolate the emmc chip from the wiiu, but maybe that won't stay powered on, as it will be unable to access the EMMC.
No idea how it will react on that, but I would expect everything to become normal again if you reverse the removal.
Just be very carefull as those resistors are really small. They are so light they simply stick to your solder iron tip.

its 3.3v use an external power supply and leave the wiiu off

Edit: yes you will need to probe close to the chip to find a 3.3v spot to solder to

 

[obcd]

If you connect 3V3 to the emmc chip, you will power the rest of the wiiu circuits that run on 3V3 as well.
How would you isolate the emmc power connection from the rest of the power plane?
The CMD signal can be isolated as there are some small resistors on the tracks from the emmc to the rest of the circuit.

 

[FaTaL_ErRoR]

I honestly don't think the issue with other chip power up is an issue. And if so just remove the cpu and that should solve that.
I think you need to bridge some connections. Scroll down here and see where that is talked about. (It's darn near the same chip and the same process applies here)
http://team-xecuter.com/forums/thre...l-Corona-Motherboard-Identification-Solutions
Pretty sure if you make the bridges you'll be able to dump it without doing an off chip. I really need to take apart one of mine and try this method myself. Just be careful I think @Adr990 messed his/her console up already attempting this.

 

[ja450n]

i found this thread as i saw mention of dumping the eMMC on other sites, has anyone read these articles and had success?

http://gamegaz.com/2015082416608/

They are talking about both vWii and Wii flash dumping.

 

[kavid]

https://www.reboot.ms/forum/threads/guide-emmc-nand-dump-backup-restore.530/

 

[Deleted User]

Best way would indeed be interrupting the boot process.
Isolating the supply voltage of the EMMC chip might be difficult.
The EMMC is a BGA.
Usually, complex equipment like the wiiu use a multilayer printed circuit board.
The VCC and GND layers are usually 2 of the inner layers. So, you can connect to them with a simple via.
There are no visible pcb tracks you can cut to isolate the supply from the emmc.
(Just telling what it normally is. I have no wiiu to confirm this assumption)
Maybe, you can remove the resistor that connects the cmd signal to the emmc.
This would isolate the emmc chip from the wiiu, but maybe that won't stay powered on, as it will be unable to access the EMMC.
No idea how it will react on that, but I would expect everything to become normal again if you reverse the removal.
Just be very carefull as those resistors are really small. They are so light they simply stick to your solder iron tip.

Since my wii u auto updated t0 5.5.0 i'm going to mess with this some more. If anyone has successfully done this please drop knowledge.

 

[hundshamer]

Just want to warn you. This has been attempted by more than one person. This has also led to a brick by more than one person (myself included). I have done many NAND mods on 3DS, in case you were wondering about my credentials. Check this thread out for more info too (which you posted in about a month ago):
http://gbatemp.net/threads/wiiu-nand-dump.395491/

 

[Elusivo]

https://www.reboot.ms/forum/threads/guide-emmc-nand-dump-backup-restore.530/

That looks nice and simple, but isn't that what some ppl here tried to do and ended up with bricked wiius?

 

[hundshamer]

That looks nice and simple, but isn't that what some ppl here tried to do and ended up with bricked wiius?

Yes. Myself included.

 

[Elusivo]

Yes. Myself included.

Which makes me wonder about the reliability of that website (unless someone shows some proof of an actual downgrade).
Was thinking of using their dns to block updates but this makes me think twice about it!

 

[oumoumad]

Which makes me wonder about the reliability of that website (unless someone shows some proof of an actual downgrade).
Was thinking of using their dns to block updates but this makes me think twice about it!

Technically they didn't give a"downgrade" tutorial. They showed a method for NAND dump and restore, and they said theorically this is something that would allow us to go back to a previous state of the nand after update, however in any kind of concepts like these you don't go from theory to practice with a guaranteed 100% success, you gonna need testing and analizing and study if there are other factors that affect the proccess too. So some people already caused a brick on their console testing the method straight forward. It does require a lot more than that to be fully successful.

And since hardmoding is not something that all developpers can do (at least when it comes to those who are involved in the Wii U hacking scene), we don't have so much search in this area.

 

[Deleted User]

Technically they didn't give a"downgrade" tutorial. They showed a method for NAND dump and restore, and they said theorically this is something that would allow us to go back to a previous state of the nand after update, however in any kind of concepts like these you don't go from theory to practice with a guaranteed 100% success, you gonna need testing and analizing and study if there are other factors that affect the proccess too. So some people already caused a brick on their console testing the method straight forward. It does require a lot more than that to be fully successful.

And since hardmoding is not something that all developpers can do (at least when it comes to those who are involved in the Wii U hacking scene), we don't have so much search in this area.

Wired it up and down about 10 times so far and wii U works perfect. Have done 1000's of xbox rgh and 1000's of ps3 downgrades so this is insanely easy. Looking for a 3v3 point to try and power externally. Probing mobo now. I'll let you guys know if I find anything worth sharing.

 

[oumoumad]

Wired it up and down about 10 times so far and wii U works perfect. Have done 1000's of xbox rgh and 1000's of ps3 downgrades so this is insanely easy. Looking for a 3v3 point to try and power externally. Probing mobo now. I'll let you guys know if I find anything worth sharing.

Are you saying you've been able to successfuly downgrade a Wii U without a brick ?
Well you should make a video or something . since @hundshamer couldn't do it, I thought it was not that simple. What did you do and others didn't ?

 

[FaTaL_ErRoR]

Are you saying you've been able to successfuly downgrade a Wii U without a brick ?
Well you should make a video or something . since @hundshamer couldn't do it, I thought it was not that simple. What did you do and others didn't ?

No, he said it's been wired up and down meaning he has soldered it and desoldered it without messing it up. Odds are the previous attempts were botched by an error in connection. He is giving his rgh background as a sort of proof he has the skill to not screw up connections. Now, lets see if he gets around the protection.
BTW I have dumped the nand and emmc but haven't attempted a downgrade.
But not by this method. Remove the chips and extract that is the easiest way.

 

[Deleted User]

No, he said it's been wired up and down meaning he has soldered it and desoldered it without messing it up. Odds are the previous attempts were botched by an error in connection. He is giving his rgh background as a sort of proof he has the skill to not screw up connections. Now, lets see if he gets around the protection.
BTW I have dumped the nand and emmc but haven't attempted a downgrade.
But not by this method. Remove the chips and extract that is the easiest way.

I have the hardware to dump nand off board but not emmc.