Hacking [RELEASE] Wii U NAND Tools

[EyeKey]

00:00:05:084: ISFS: fs_ops.c(3733)Can not change the owner Id of a non-empty file
00:00:05:084: ISFS: fs_ops.c(6719)Could not set attribute, rc=-524312
It was on a log actually. fs_ops.c, the only google result related to that is GFS2.

That is ISFS, not WFS. (Internal Storage File System). It is the file system that this thread is about, and it is totally not GFS2...

 

[happydance]

been waiting for this one! very nice of you to make this tool.

Upcoming tools:
Tool to fix CBHC bricked NAND (with OTP and hardmod).

I take this will use the rednand backup created via software before cfw and otp to make a nand backup flashable with teensy?

I read somewhere that rendnand dump is kidda different from a teensy dump

 

[EyeKey]

been waiting for this one! very nice of you to make this tool.



I take this will use the rednand backup created via software before cfw and otp to make a nand backup flashable with teensy?

I read somewhere that rendnand dump is kidda different from a teensy dump

No, without backup. With the OTP you can edit the file and revert CBHC.

nandFixer is the tool to make redNAND dumps flashable. CBHC brick can now be fixed with it if you have NAND backup and OTP. Leeful just unbricked his WiiU with this tool and redNAND backup.

With the upcoming tool NAND backup would be optional.

If you don't have OTP, you can't fix the brick.

 

[GraFfiX420]

No, without backup. With the OTP you can edit the file and revert CBHC.

nandFixer is the tool to make redNAND dumps flashable. CBHC brick can now be fixed with it if you have NAND backup and OTP. Leeful just unbricked his WiiU with this tool and redNAND backup.

With the upcoming tool NAND backup would be optional.

If you don't have OTP, you can't fix the brick.

Awesome, so LeeFul did confirm that he fixed his brick with this?

 

[aut0mat3d]

Awesome, so LeeFul did confirm that he fixed his brick with this?

Yes, take a look: https://gbatemp.net/threads/success...-nand-with-hardmod.457165/page-8#post-7198620

 

[EyeKey]

Added the last tool that I promised: nandCbhcRemover. Please notice that I didn't try this tool with a real NAND with installed CBHC. (I don't have it installed)

If someone with installed CBHC want to help to test it, you can do it in this way:
run nandFixer on redNAND dump (that was made after cbhc installation).
run nandCbhcRemover on the new nand
open the new nand in NAND Explorer, extract /sys/config/system.xml, and check that default_title_id is wiiu menu.

 

[aut0mat3d]

Thank You verry much!

Did the Test:
Before:

<default_title_id type="hexBinary" length="8">0005000010195b00</default_title_id>

After:

 <default_title_id type="hexBinary" length="8">0005001010040200</default_title_id>

RedNAND dump on a PAL console

Should be pretty fine, right?

 

[victormr21]

How Can I get a bin file of my NAND?
I only have two bin files and they are OTP and SEEPROM.
My NAND files are the three img files (mlc, slc, slccmpt)
So if i put this files' path in any program, it can't find the correct file
Bye!

 

[jbuck1975]

Thank You verry much!

Did the Test:
Before:

<default_title_id type="hexBinary" length="8">0005000010195b00</default_title_id>

After:

 <default_title_id type="hexBinary" length="8">0005001010040200</default_title_id>

RedNAND dump on a PAL console

Should be pretty fine, right?

Why is the before part the title id of new Super Mario bros?

 

[EyeKey]

Thank You verry much!

Did the Test:
Before:

<default_title_id type="hexBinary" length="8">0005000010195b00</default_title_id>

After:

 <default_title_id type="hexBinary" length="8">0005001010040200</default_title_id>

RedNAND dump on a PAL console

Should be pretty fine, right?

Yeah, it is good. Thanks!

--------------------- MERGED ---------------------------

How Can I get a bin file of my NAND?
I only have two bin files and they are OTP and SEEPROM.
My NAND files are the three img files (mlc, slc, slccmpt)
So if i put this files' path in any program, it can't find the correct file
Bye!

What tool are you trying to use? The tools here are for slc and slccmpt.

 

[aut0mat3d]

Why is the before part the title id of new Super Mario bros?

I had CHBC patched into this title which caused a softbrick after formatting system due missing title after format/wipe

 

[jbuck1975]

I had CHBC patched into this title which caused a softbrick after formatting system due missing title after format/wipe

Ok.
I would like to dump and test too. How do I do it? I HAD rednand before chbc. but don't remember how I dumped it.

 

[aut0mat3d]

at first get sure to have OTP keys avaiable - without that there is no way atm.
OTP can be dumped seperately or extracted from a rednand dump if you had redirected seeprom and opt

 

[EyeKey]

It seems that he isn't bricked, he just wanted to test it. So to dump OTP run otp2sd homebrew.
To dump nand with redNand, just run mochafw homebrew with sd without rednand (it will format it and dump the nand).

 

[Leeful]

@EyeKey I've just tested nandCbhcRemover.exe by writing just the 3 blocks that were changed to the nand and it worked.
The WiiU booted the standard home menu without sigpatches. CBHC boot was removed successfully!

Could you get nandCbhcRemover.exe to display the hex offsets of the changed blocks so that people could write just those blocks to the nand. It would save people a lot of time.
It only takes about 5 seconds to write 3 blocks Vs 3 hours for a full nand write.

 

[GraFfiX420]

Added the last tool that I promised: nandCbhcRemover. Please notice that I didn't try this tool with a real NAND with installed CBHC. (I don't have it installed)

If someone with installed CBHC want to help to test it, you can do it in this way:
run nandFixer on redNAND dump (that was made after cbhc installation).
run nandCbhcRemover on the new nand
open the new nand in NAND Explorer, extract /sys/config/system.xml, and check that default_title_id is wiiu menu.

Awesome, I just want to say thank you so much for taking the time to insure that we don't brick our wii u's!

 

[victormr21]

What tool are you trying to use? The tools here are for slc and slccmpt.

I'm trying the NAND fixer because some folders of slccmpt are empty, and then if I can (I couldn't use NAND fixer yet) check the result of this with nandbinCheck, but like I said before, I don't have any bin
And other question, NAND Extractor only shows the FST of the file and extract it or we an do other think like repack...
Bye!

 

[Cava]

I have 3 img file too slc mlc slccmpt so how can i get a .bin file?

 

[aut0mat3d]

just rename it - its only the file ending differing (if you using windows, you probably have to enable "show file extensions" in folder settings)

 

[victormr21]

Hi @EyeKey
Finally i could use nandFixer, i renamed the img to bin and done
But it only "works" with slccmpt, with slc it says that it couldn't open input nand, and you said that mlc won't work too.
1 question: Indicates this that slc is fixed? [i think no because i tried it with the fixed slccmpt and it says: Invalid input NAND size (should be dump without ECC))]

2 question: what do you mean with make redNAND dump flashable? We can copy it in a non-formated SD or we can use a friend's dump?
Bye and thanks you so much!