Hacking Successfully dumped WiiU EMMC nand with hardmod.

Leeful

GBAtemp Member
OP
Developer
Joined
Sep 4, 2015
Messages
1,903
Trophies
1
XP
7,068
Country
United Kingdom
UPDATE: It is now possible to fully UNBRICK the WiiU using a hardmod, teensy and WiiU Nand Tools.

I have tried a new approach to dumping the Emmc nand and it has worked. With this method I was able to dump the nand to an img file on the PC and then successfully write the img file back to the WiiU.

The trick was to disconnect the CLK signal to the nand on the motherboard and then the pc was able to read the nand. After you have dumped / wrote your nand.img make sure to reconnect the CKL with a jumper.

01.jpg 02.jpg 03.jpg 04.jpg 05.jpg20170113_050250.jpg 20170113_050347.jpg 20170113_050504.jpg 20170113_100648.jpg

Dumping the nand was the same procedure as with the 3DS hardmod using Win32DiskImager.

First connect the SD card to your card reader on your PC.
Press the power button on the WiiU.
A popup message should appear on the PC saying you need to format the drive. CLICK CANCEL. DO NOT FORMAT THE DRIVE!!!! remember what drive letter it says.
format.jpg
Open Win32DiskImager and make sure the Drive letter on the right is the same as the one that popped up!
Select where you want to save the .img file and click read.
win32diskimg-Reading.jpg
The dump size was 29.7gb and took around 2 hours at 5.7MB/sec

If when you click read and it says "Lock Error" keep trying. it could do it on the first attemp or the third or the twentieth. This was exactly the same with the 3DS. To try and eliminate this problem make sure there are no explorer windows open or anything else that might be trying to read the drive.
win32diskimg-ERROR.jpg

When the read is complete close Win32DiskImager and safely eject the drive using "Safely Remove Hardware and Eject Media"
Hold the power button on the WiiU to turn off the console and don't forget to insert the jumper so that the wiiU can boot normally again.


PLEASE NOTE this is not a proper step by step tutorial (yet). I'm ony posting my findings and what I did to successfully read and write the nand.

If someone wants to write up a more detailed tutorial later please feel free (just give me a mention :)

I WILL NOT BE RESPONSIBLE FOR ANY BRICKS. ONLY ATTEMPT THIS IF YOU KNOW WHAT YOU ARE DOING!!!

Even though this by itself cannot UNbrick a bricked system. Its a start.

The next thing to try is the TSOP NAND and then anyone with a backup of BOTH the eMMC and TSOP nands should be able to fully UNbrick their WiiU if anything goes wrong..

UPDATE:
Not all Card Readers will work. Here is a list of confirmed Working & non Working Readers:
Transcend TS-RDP8K - WORKED
ALL IN 1 HDD Docking Station Model:875 - WORKED
Logilink Cr0001b - Confirmed WORKING. Thanks @Tommy084
Anker USB 3.0 AR200 - DID NOT WORK (would not detect drive?)
Kingwin 5.25 inch bay mounted fan controller/multi card reader - NOT WORKING. Thanks @DocAmes1980

UPDATE 2:
I've been playing around with this some more and if you also connect the other 3 DAT lines the read rate goes up to 18.4MB/sec (write rate 10MB/sec) so a full 32GB nand can now be dumped in around 30 minutes instead of 2 hours!
20170110_233016.jpg card.jpg

UPDATE 3:
Here is a video of it working.


UPDATE 4:
I can confirm that the mlc backup made with dimoks' sdio_nand_manager works with the hardmod.
I created a new rednand, dumped the nand images with sdio_nand_manager then straight away made a mlc dump with the hardmod and the SHA256 hashes form both mlc dumps match.

UPDATE 5:
Thanks to @DocAmes1980 & @Tommy084 for trying it out and confirming the mod works.
 
Last edited by Leeful,

DocAmes1980

Well-Known Member
Member
Joined
Oct 31, 2016
Messages
873
Trophies
0
Age
43
XP
975
Country
United States
I just completed the mod. I used a three way switch to direct the clock signal. One position sends it to the fake SD for read/write mode and the other sends it to the Wii U so the sucker actually boots and plays games. All the continuity checks out but it didn't work in the two readers I tried. One was a SD card reader built in to my laptop. The other was a Kingwin 5.25 inch bay mounted fan controller/multi card reader connected to a internal USB 2.0 header. I might try that transcend reader and report back.

Pictures:

https://filetrip.net/view?WIoGQq27MF

https://filetrip.net/view?dtmauNR2Cp
embed
 
Last edited by DocAmes1980, , Reason: embedding pictures won't work
  • Like
Reactions: Tommy084 and Kappcy

Leeful

GBAtemp Member
OP
Developer
Joined
Sep 4, 2015
Messages
1,903
Trophies
1
XP
7,068
Country
United Kingdom
I just completed the mod. I used a three way switch to direct the clock signal. One position sends it to the fake SD for read/write mode and the other sends it to the Wii U so the sucker actually boots and plays games. All the continuity checks out but it didn't work in the two readers I tried. One was a SD card reader built in to my laptop. The other was a Kingwin 5.25 inch bay mounted fan controller/multi card reader connected to a internal USB 2.0 header. I might try that transcend reader and report back.

Pictures:

https://filetrip.net/view?WIoGQq27MF

https://filetrip.net/view?dtmauNR2Cp
embed
Sorry to hear you couldn't get it working yet. It probably is the card reader that is giving you the trouble.
Another thing to try is to shorten the length of the wires to try and minimise any interference. (people were always mentioning this with the 3DS but I dont know if it makes any great difference)

Can you confirm that the switch is working like the image below and that the clk track is definately cut:
doc-switch.jpg


What happens when you turn on the WiiU in read/write mode?(it doesn't have to be plugged into a reader)

On mine when the power button is pressed you can hear the DVD drive make a noise as normal but the wiiU does not boot up. There is no picture sent to the TV and the gamepad will not connect if turned on. (this is handy because when dumping the nand you only need the power cable plugged in so you can easily move the WiiU near a PC.) To turn off, the power button must be held in. When the WiiU boots the next time the warning comes on screen about not shutting down properly like when a crash happens.

When you checked the continuity did you test between the contacts of the sd card and the resistors on the motherboard? It may sound obvious but I'm just trying to think of any thing that can help.

Hope you can get it working.:)



Good job. I really should get to doing this. I already can read and write the nand chip without any issues, I just haven't jumped into the eMMC yet.
This is good to hear. I have ordered a teensy, 3.3v regulator, pins, wires e.t.c so I'm planning to tackle the tsop nand next.

Do you have any advice that could help? Does the nand need an external power source or can it be powered by the teensy? Have you posted a tutorial anywhere?
 
  • Like
Reactions: Tommy084

DocAmes1980

Well-Known Member
Member
Joined
Oct 31, 2016
Messages
873
Trophies
0
Age
43
XP
975
Country
United States
Sorry to hear you couldn't get it working yet. It probably is the card reader that is giving you the trouble.
Another thing to try is to shorten the length of the wires to try and minimise any interference. (people were always mentioning this with the 3DS but I dont know if it makes any great difference)

Thank you for your response. I'm also guessing that it is the readers that are the issue. I've only read a little bit about the 3DS hard mod but it seems that built in card readers either don't work or are very unlikely to work. Perhaps my wires are too long. They are a little longer than yours because I was hoping I could use the built in readers of my laptop or desktop. I will try a known good reader before making any adjustments.

Can you confirm that the switch is working like the image below and that the clk track is definately cut:
View attachment 76052

Yes, the switch is working exactly as you have labeled. Pin 2 is the clock signal from the eMMC. Pin 1 goes back into the Wii U and jumps the cut trace. Pin 3 goes to the fake SD card. The trace is definitely cut. I checked to confirm there was no continuity between the two points. After wiring up the switch I confirmed that there was continuity between the points when the switch was in position "A". When in position "B" the clock signal has continuity with the appropriate pin on the fake SD card.

What happens when you turn on the WiiU in read/write mode?(it doesn't have to be plugged into a reader)

On mine when the power button is pressed you can hear the DVD drive make a noise as normal but the wiiU does not boot up. There is no picture sent to the TV and the gamepad will not connect if turned on. (this is handy because when dumping the nand you only need the power cable plugged in so you can easily move the WiiU near a PC.) To turn off, the power button must be held in. When the WiiU boots the next time the warning comes on screen about not shutting down properly like when a crash happens.

Yes, sir. Exactly as you described. DVD drive does it's usual thing. No signal is sent to the TV. Gamepad doesn't do anything. Holding the power button shuts off the system and upon reboot it gives me the nag screen.

When you checked the continuity did you test between the contacts of the sd card and the resistors on the motherboard? It may sound obvious but I'm just trying to think of any thing that can help.

Yes, I checked from the resistors to the pads of the fake SD card. I also tested the switch in both positions to ensure that it was functioning as expected. Also, you might notice that the solder joints on DAT0 and GND in the picture I uploaded are shitty. They still checked out for continuity but I resoldered them. All joints looked good when I reassembled (ok, the JMP point is ugly but it's solid as the Wii U boots). I'll try a known good reader at some point and see if I get joy. If you find any other readers are working please update.

Thanks for your help,

Andy
 
  • Like
Reactions: Tommy084

Derpncheez

Well-Known Member
Newcomer
Joined
Apr 12, 2016
Messages
71
Trophies
0
Age
35
XP
128
Country
United States
This is awesome work! I'm so terrified of bricking my console by installing CFW. Is it safe to say to wait before messing with that? Again, thanks for your contributution!
 

DocAmes1980

Well-Known Member
Member
Joined
Oct 31, 2016
Messages
873
Trophies
0
Age
43
XP
975
Country
United States
I was also thinking of installing RedNand+Mocha, which could lead to a possible brick, no? or maybe I read wrong.

As far as I know, the only way that you will brick your system while using redNAND is if you update redNAND. It seems unlikely that Nintendo will push out another Wii U update but it's possible. Also, you can block updates to prevent this. That being said, forget redNAND. It is 100% useless for the end user. Not only is it useless but it wastes 32GB of SD card space (only 8GB if it's an 8GB Wii U). Also it can be a pain to deal with. Many threads have been started because a user encountered problems related to redNAND. Sometimes there is junk data that can't be deleted, sometimes redNAND corrupts itself so you lose everything since the last dump. Many users on this forum will violently disagree with me. They say redNAND is great to use because it protects you against bricks. The thing is that using homebrew, CFW, and running backups doesn't expose you to any brick risks. If you look at the list of known bricks only one of them could have been prevented by using redNAND. In that case it was a dev experimenting with some custom shit that bricked his system. Pretty much every other brick that I'm aware of was from the user failing to follow instruction during or after installing coldboothax/CBHC. These type of brick can't be prevented with redNAND because coldboothax/CBHC is applied to sysNAND and screwing up causes the console to fail to boot the Wii U menu. One guy bricked by messing up a hardware mod. Another claims he bricked by installing an update. With the latter there has to be more to the story or maybe his hardware failed and the last thing he did was install an update so he blamed that.

Even if you decide to install CBHC you'll be fine if you can follow instructions. So far every brick has been 100% user error.
 

C0mm4nd_

Aspirant Wii U homebrew dev :P
Member
Joined
Oct 9, 2016
Messages
697
Trophies
0
Website
127.0.0.1
XP
540
Country
Italy
how come? I thought everything was saved on NAND?!
Wii U has 2 NANDs
eMMC(with userdata,games,ecc... like the 3DS) TSOP(with sys files like system.xml)

And for dumping TSOP NAND ehm... you'll need a Teensy and other things, it's more difficoult

--------------------- MERGED ---------------------------

It can fix only if you delete the title/format and you did a NAND bak
 

tvall

Well-Known Member
Member
Joined
May 12, 2014
Messages
276
Trophies
0
Age
29
XP
348
Country
United States
how come? I thought everything was saved on NAND?!
the use of nand there is a little confusing.

so the wiiu has multiple flash chips, the large emmc, and a slc nand (which is actually two, one part for for the vwii mode too).

the only thing being talked about much here is the emmc. and most of the coldboot bricks involve broken stuff on the slc nand. which also is the one thats more work to flash. mess of data and address pins instead of just clk, cmd, and dat

edit: ninja'd :ph34r:
 
  • Like
Reactions: naddel81

DocAmes1980

Well-Known Member
Member
Joined
Oct 31, 2016
Messages
873
Trophies
0
Age
43
XP
975
Country
United States
the use of nand there is a little confusing.

so the wiiu has multiple flash chips, the large emmc, and a slc nand (which is actually two, one part for for the vwii mode too).

the only thing being talked about much here is the emmc. and most of the coldboot bricks involve broken stuff on the slc nand. which also is the one thats more work to flash. mess of data and address pins instead of just clk, cmd, and dat

edit: ninja'd :ph34r:

Actually I would say most of the coldboothax bricks are because the user deleted the Haxchi title or formatted the system. Since CBHC I believe all coldboothax bricks have been from one of these two causes. That being said this mod really doesn't do much for you. I just thought it would be fun. I don't even want to spend the $10 on a card reader to confirm that the mod is working since I have no practical use for dumping/restoring the eMMC. I suppose I have to now so I can feel special as one of the few people to risk ruining a perfectly good Wii U to perform a hard mod that I have little to no use for.

Soldering is fun.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • S @ salazarcosplay:
    @BigOnYa they ruined the gaming experience for me to be honest
  • S @ salazarcosplay:
    @BigOnYa Im not crazy about getting all of them, i feel like I have something to show for for the time put in
  • S @ salazarcosplay:
    @BigOnYa If you want to do rgh or 360 mod
  • S @ salazarcosplay:
    does it matter if you update your 360 or not before trying is it advisable or not
  • BigOnYa @ BigOnYa:
    Yea I don't pay attention to them really. Or do I try to 100% a game. I just play till story ends/ or I get the girl!
  • K3Nv2 @ K3Nv2:
    Bigonya uses his wiener to mod 360s
    +1
  • Xdqwerty @ Xdqwerty:
    Going to the water park, see ya
  • BigOnYa @ BigOnYa:
    You should update the 360 to newest dash before RGHing it yes. But not a big deal if you don't, you can install new dash/avatar updates after. It's just easier to do it auto online before, instead manual offline after.
  • BigOnYa @ BigOnYa:
    Have fun @Xdqwerty. If you see a chocolate candy bar floating in the water, don't eat it!
  • AncientBoi @ AncientBoi:
    :O:ohnoes: Y didn't U Tell ME that ALSO? @BigOnYa :ohnoes: 🤢🤮
    +1
  • BigOnYa @ BigOnYa:
    Does it taste like... chicken?
    +1
  • S @ salazarcosplay:
    @BigOnYa I wanted to ask you about your experience with seeing south park. Most of the people a bit younger like my younger brother and cousins that are a few younger than me that saw kids found south park funny because of the curse words, kids at school, that seemed like liking the show on a very basic level.

    I could not quite have a in depth discussion of the show.

    How was it for you? As an adult. What did you find the most interesting part about it. Did you relate to the parents of the kids and their situations. Was it satires, the commentary on society. The references on celebrities' and pop culture.
    +1
  • BigOnYa @ BigOnYa:
    I remember seeing the very first episode back in the day, and have watched every episode since. I used to set my VCR to record them even, shows how long ago.
  • BigOnYa @ BigOnYa:
    I just like any comedies really, and cartoons have always been a favorite of mine. Family guy, American Dad, Futurama, Cleveland Show, Simpsons - I like them all.
    +1
  • BigOnYa @ BigOnYa:
    South Park is great cause they always touch on relavent issues going on today, and make something funny out of it.
    +3
  • S @ salazarcosplay:
    @BigOnYa were you always up to date on the current events and issues of the time or were there issues that you first found out thru south park
  • BigOnYa @ BigOnYa:
    Most of the time yea I knew, I watch and read the news regularly, but sometimes the Hollywood BS stuff, like concerning actors slip by me. I don't follow most Hollywood BS (example: the Kardasians)
    +2
  • S @ salazarcosplay:
    @BigOnYa there were relevant issues before south park was made, that's why i think a south park prequel/spinoff would be great. Randy and his friends in their child hood
    +1
  • BigOnYa @ BigOnYa:
    Yea, like them running in high school together, getting into stuff, and how they got hitched and had kids. And how the town of South Park was back then compared to now. That would be cool to see.
  • BakerMan @ BakerMan:
    yeah
  • The Real Jdbye @ The Real Jdbye:
    @salazarcosplay if they made a prequel, it would still be about current issues, cause it doesn't make sense to make it about stuff that happened 30 years ago that nobody cares about anymore
  • The Real Jdbye @ The Real Jdbye:
    it's too late
  • The Real Jdbye @ The Real Jdbye:
    the older south park episodes about particular issues usually age poorly since the topic is no longer relevant
  • The Real Jdbye @ The Real Jdbye:
    an exception is giant douche vs turd sandwich, that's always relevant :P
    +1
    The Real Jdbye @ The Real Jdbye: an exception is giant douche vs turd sandwich, that's always relevant :P +1