Hacking fw.img that boots into HBL?

[ptdborth]

Hi, i've semi bricked my WiiU (I know..I know, stupid), it's got CBHC installed, however I updated haxchi with a different config.txt as it was set to default to hbl and not sysmenu. The installed config.txt is
a-fw.img
b-sysmenu
default-sysmenu

so my question is..is there a fw.img that boots straight into hbl so that I can uninstall cbhc? Thanks in advance.

 

[Kafluke]

What happens when you boot your Wii U? Can you hold home button to get to CBHC menu?

 

[ptdborth]

It auto boots straight to the system menu, holding home does nothing, just carries on booting into the sysmenu. Obviously something is working as quickstart works and I can boot to fw.img (tried the rednand image creator, which boots and allows me to make a backup..useless as it is I know). Thanks. Paul

 

[EyeKey]

So why not just launch HBL from the browser?

 

[bootmonster]

So why not just launch HBL from the browser?

Was just about to ask the same thing

 

[ptdborth]

My apologies..it's bootlooping, so won't actually get into sysmenu. Thanks. Paul

 

[jbuck1975]

Your problem is you installed haxchi over
cbhc

 

[icw35]

Pity, if you have default=sysmenu you didn't set b=HBL or something (which is the normal thing to do). Pressing A works to boot fw.img? You could try changing that to the HBL elf (change the name of the elf to fw.img?). I don't know if that will work.

 

[bootmonster]

Not 100% sure this would work, but if you can create a rednand, you could use the nand tools to extract the dumped nand. Then run nandCbhcRemover, then rebuild the rednand to potentially fix the rednand and make it bootable. May not be able to fix your system nand and you may be stuck only using rednand, but unless I've missed something that should (maybe) work.

 

[ptdborth]

Pity, if you have default=sysmenu you didn't set b=HBL or something (which is the normal thing to do). Pressing A works to boot fw.img? You could try changing that to the HBL elf (change the name of the elf to fw.img?). I don't know if that will work.

Have tried this..was hoping it would work but doesn't seem to boot an elf..only img. Will give it another go though. Thanks for the suggestion

Not 100% sure this would work, but if you can create a rednand, you could use the nand tools to extract the dumped nand. Then run nandCbhcRemover, then rebuild the rednand to potentially fix the rednand and make it bootable. May not be able to fix your system nand and you may be stuck only using rednand, but unless I've missed something that should (maybe) work.

Tried this too unfortunately, when I tried to open the slc.img it needs the otp.bin, which I don't have. Thanks.

 

[icw35]

Have tried this..was hoping it would work but doesn't seem to boot an elf..only img. Will give it another go though. Thanks for the suggestion

Did you rename the "elf" to "fw.img"?

 

[ptdborth]

Did you rename the "elf" to "fw.img"?

Yes, will give it another go later. Would be great if this worked Thanks. Paul

 

[icw35]

OK. You can boot to fw.img, right? So all is not lost (you are lucky).

If so, then you can use FTPeverywhere and remove the CBHC hack. I don't use CBHC myself so I can't remember where it is located, but you can remove the .xml file or reset it to boot properly using FTPe or wupclient. Obviously don't remove it It needs to be set back to normal to boot wiiu system menu.

So your system.xml file is in:

slc/sys/config/

The line that is changed (presumably - might be worth checking with other that know more about CBHC) is the default title id. Mine is set to 0005001010040200.

I don't know if CBHC changes anything else. You might also need to change the permissions on the file to 777 (to be sure) using chmod if using wupclient.

 

[bootmonster]

if you use hexfw as your fw.img you can use that to dump your otp.bin, seeprom etc