Tutorial Project  Updated

How to set up ISFShax

Warning


Use this at your own risk. Messing with the isfs superblocks is dangerous and can brick your Wii U. Make sure to make a SLC backup before installing isfshax. If something goes wrong, you will need defuse to restore this backup. The superblock linked here was tested and confirmed working. Installing an broken superblock will brick your Wii U.
Also while ISFShax is installed standby services and with that the quick start menu won't work. (Your Wii U will hang once you turn it off till you remove power if standby services are enabled).
Also keep in mind: if you are restoring an old SLC backup, which was taken before installing ISFShax, ISFShax will remove by restoring that backup.

To protect against Nintendo pushing a boot1 update (very unlikely, but you newer know), which would brick a console with ISFShax, system updates get blocked by the wafel_isfshax_patch.ipx plugin. If you need to do a system update, you can use the v1.0 of said plugin, which doesn't contain the update block. Game updates are not affected.


Update


04.04.2024 - Add Fastboot
13.03.2024 - System updates now get blocked by the wafel_isfshax_patch.ipx plugin.
29.12.2023 - Standby Services are now supported. For that to work you need to have the latests ISFShax superblock installed and need to use the latest minute fw.img and wafel_core.ipx. Also autoboot needs to be enabled.


What is this for?


ISFShax exploits boot1 with specially crafted ISFS (the filesystem of the SLC) superblock. Once it is installed ISFShax provides similar capabilities to defuse once it is installed. Since it launches before IOSU, so it can be used to apply early patches to IOSU and can be used to fix most bricks. But it won't protect you of bricks caused by: breaking boot1, seeprom bricks or installing a broken ISFShax superblock. ISFShax also doesn't help you if you already bricked the Wii U.
Usecases are:
  • Rebuilding / upgrading the MLC
  • Removing 64GB MLC limit and disabling SCFM
  • Brick protection (e.g. before doing region change)
  • Cold booting redNAND (useful when when the eMMC is failing)
  • It gives a minimal CFW, which can launch old homebrew using the homebrew launcher (not sure how usefull since we have Aroma and Tiramisu)
  • Stop the Wii U from turning the Tablet on during boot (using a stroopwafel plugin)

Choosing the Exploit


There are multiple ways to launch the ISFShax installer:
If you already have Tiramisu or Aroma installed and can launch it follow the Instructions for [Tiramisu]
If the Browser still works and you can launch the browser exploit u.wiidb.de follow the Instructions for [Browser]
If you can't access the Browser, but Settings still work follow Instructions for [DNSpresso]
If you your Wii U crashes in the initial setup on Mii creation follow Instructions for [DNSpresso]
If your Wii U can't launch the browser anymore or can't connect to the internet follow the Instructions for [UDPIH]
Steps without a prefix apply to all.

Note: if you have Haxchi installed you can also use that. For Haxchi you follow the Tiramisu steps, but hold A instead of B.

Preparing the SD card



Make sure the SD card is formatted FAT32 (already the case if you are using it for Tiramisu). You can use guiformat for that.

Get the following files and put them in the root of the SD. Choose the release tagged with "Latest" for each.
  1. ISFShax installer (ios.img) from https://github.com/isfshax/isfshax_installer/releases
  2. ISFShax superblock.img and superblock.img.sha from https://github.com/isfshax/isfshax/releases
  3. Put the stroopwafel wafel_core.ipx from https://github.com/jan-hofmeier/stroopwafel/releases in wiiu/ios_plugins
  4. Put the wafel_isfshax_patch.ipx stroopwafel plugin from https://github.com/isfshax/wafel_isfshax_patch/releases in wiiu/ios_plugins
  5. [Tiramisu | Browser | DNSpresso] minute fw_encrypted.img from https://github.com/jan-hofmeier/minute_minute/releases and rename to fw.img
  6. [Browser | DNSpresso] fw_img_payload from https://github.com/wiiu-env/fw_img_payload/releases extract the zip and put the wiiu folder, containing the payload.elf on the SD
  7. [DNSpresso] Extract the root.rpx from https://github.com/wiiu-env/PayloadFromRPX/releases and rename it to launch.rpx and place it in the root of the SD card
  8. [UDPIH] minute fw.img and boot1.img from https://github.com/jan-hofmeier/minute_minute/releases
  9. [UDPIH] recovery_menu from https://github.com/jan-hofmeier/recovery_menu/releases
The structure on the SD should look like this:
Code: 
boot1.img (only for UDPIH)
fw.img
ios.img
recovery_menu   (only for UDPIH)
superblock.img
superblock.img.sha
wiiu
    ios_plugins
         wafel_core.ipx
         wafel_isfshax_patch.ipx

Launching into minute


This step heavily depends on the used Exploit.

  1. Hold B on the Gamepad while booting (if coldboot is enabled) or launching the H&S app
  2. A black and white menu should show up asking you to choose a payload.
  3. Select fw_img_loader
Note: if the fw_img_loader is missing get the "fw.img loader" payload from https://aroma.foryour.cafe/

  1. Open the Browser and browse to u.wiidb.de
  2. Click on "HAXX"

If you can a access the settings just follow these instructions (you already have the right files on the SD): https://gbatemp.net/threads/dnspresso-a-wii-u-dns-exploit.642123/
If you are stuck on the Mii creation in the Inital setup:
  1. If you already connected your Wii U to your AP / Router, turn the AP / Router or the Wifi on it off.
  2. When the setup asks you if you already have a NNID, say yes (even if you don't have one)
  3. Now it tries to connect to the Internet, but will fail and ask you to take you back to the Wifi settings, follow back to thge settings.
  4. Turn your Router / AP on again and give it time to start.
  5. If you don't already have your Wifi configured there, connect to it now, but enter a wrong password.
  6. Edit your wifi connection and configure 85.215.57.182 as Primary DNS, if you entered a wrong password before set the right one now.
  7. Press (B) Back and select Connection Test.

  1. Load the recovery using UDPIH: https://gbatemp.net/threads/udpih-usb-host-stack-exploit-recovery-menu.613369/ (don't replace the recovery_menu)
  2. Unplug the Pico
  3. select the "Load BOOT1 payload" and proceed. (If you don't have screen output: 18x eject, 1x power, 1 eject, 1 power)

Now you should see the minute main menu. If not something went wrong, make sure you have the correct fw.img file on the SD.
In minute you move the cursor with the power button and enter with the eject button (swapped compared to the recovery menu).

Note minute only outputs 1080p through HDMI, no picture on the gamepad, and nothing on the analog outputs.
Some people reported that the screen output is not working for them when minute was loaded from the recovery. If you made sure nothing else is the problem (right fw.img, TV supports 1080p HDMI), you can still follow along blindly by pressing the approriate buttons. Make sure to wait long enough between the presses, so the system has time to load. Without display output skip the first backup and go directly to Installing ISFShax.

Backup


  1. Navigate to Backup and Restore
  2. Dump SEEPROM & OTP
  3. Dump SLC.RAW
  4. Return to Main Menu

Installing ISFShax


  1. Choose Boot `ios.img` (5x Power, 1x Eject)
  2. Now the ISFShax installer should launch (this takes a few seconds)
  3. Follow the Instructions on the screen, the buttons are the same as in minute. (3x Eject, 1x Power, 3x Eject)
  4. The console should now turn off.
  5. [Tiramisu | Browser | DNSpresso] replace the (encrypted) fw.img on the SD with the fw.img (NOT the encrypted one) from https://github.com/jan-hofmeier/minute_minute/releases
  6. If the install was successfull the Wii U should directly start into minute once you turn it on again.

Backup ISFShax


Dump the SLC.RAW again. This will overwrite the previous SLC.RAW file on the SD. This is required if you need to restore the SLC for unbricking, without loosing ISFShax. Keep that backup in a safe place.

Booting


If you came here from the redNAND or the MLC rebuild tutorial continue with that tutorial now.

For now your Wii U needs the SD card to boot. From there it loads minute (fw.img), which then applies the required patches from SD card. (IOSU needs to be patched, so it doesn't fall over the ISFShax superblock).
To boot into the Wii U OS select Patch (sd) and boot IOS (slc)

Aroma / Tiramisu


  1. To install Aroma or Tiramisu put the corresponding files on the SD.
    Tiramisu: https://tiramisu.foryour.cafe/
    Aroma: https://aroma.foryour.cafe/ (You don't need to have install Tiramisu to have Aroma, also the FTPiiU plugin will become handy later)
  2. Put the wafel_payloader.ipx in the ios_plugins folder https://github.com/jan-hofmeier/wafel_payloader/releases
  3. Put the root.rpx from PayloadFromRPX in the wiiu folder on the SD https://github.com/wiiu-env/PayloadFromRPX/releases
Note: if you are already coldbooting Tiramisu / Aroma via the PayloadLoaderInstaller, you have to disable the coldboot in the PayloaderLoaderInstaller first. For more detailed instructions on this, see this post by ZaMaster: https://gbatemp.net/threads/how-to-set-up-isfshax.642258/post-10343876

Booting without SD


This step is optional but highly recommended. Now the Wii U doesn't show anything on the screen without the SD. That could lead to confusion if the SD ever gets lost or corrupts.
To make it from the internal memory we need to install the minute fw.img and the ios_plugins to the SLC. This can be accomplished using FTPiiU Everywhere, which can be launched from Tiramisu and is already part of the Aroma Package (enable Everywhere in the settings) or you can use the haxcopy homebrew https://github.com/mackieks/haxcopy/releases
Using haxcopy is recommended for most users, but if you copy a wrong plugin to the slc or need to delete one for whatever reason you still have to use FTP for that.
  1. create a folder hax on the SD card (this will be copied to the slc)
  2. copy the fw.img to the hax folder
  3. create a subfolder ios_plugins in the hax folder
  4. rename the wafel_core.ipx to 0core.ipx and copy it to the hax/ios_plugins folder
  5. rename the wafel_isfshax_patch.ipx to 6isfshax.ipx and copy it to the hax/ios_plugins folder
  6. if you want to coldboot aroma or tiramisu, rename the wafel_payloader.ipx to 9payldr.ipx and copy it to the hax/ios_plugins folder
  7. If you need any other plugins like the wafel_unlimit.ipx, you have to rename and copy it to the hax/ios_plugins folder
  8. Copy the haxcopy app to the wiiu/apps folder (like you usually install homebrew)
  9. Put the SD in the Wii U and run haxcopy to copy the hax folder to the slc.
On Aroma you have to make sure access to system files is enabled:
  1. Open the Aroma Plugin Configuration Menu using L + Down + SELECT (-) on the GamePad or Pro Controller (or B + Down + Minus (-) for WiiMotes)
  2. Open the FTPiiU option, then settings and set ‘Allow access to system files’ to ‘true’ by pressing A

Uploading the files:
  1. (Tiramisu only) Make sure FTPiiU Everywhere is running on the Wii U
  2. Using a FTP client on the PC browse to /storage_slc/
  3. If you see a scfm.img file and sys folder go into the sys folder. If you see a bunch of folders (config import logs proc rights security title tmp) just go to the next step.
  4. create a subfolder hax and enter it
  5. Make sure your FTP client is in binary mode (not ASCII mode)
  6. upload the minute fw.img to the /storage_slc/sys/hax folder
  7. create another subfolder ios_plugins in /storage_slc/sys/hax
  8. enter that /storage_slc/sys/hax/ios_plugins folder
  9. rename the wafel_core.ipx to 0core.ipx and upload it
  10. rename the wafel_isfshax_patch.ipx to 6isfshax.ipx and upload it
  11. if you want to coldboot aroma or tiramisu, rename the wafel_payloader.ipx to 9payldr.ipx and upload it
  12. If you need other plugins like the wafel_unlimit.ipx, you have to rename and upload them too
Now the Wii U should autoboot if no SD card is inserted.
If a SD card is inserted the minute menu should show up (even if the SD doesn't contain a fw.img). In that menu you can select the Patch (slc) and boot IOS (slc) to load the plugins from the slc and boot (no need to have them on the SD anymore).

The Wii U will first try to load the fw.img from the SLC and if that fails it falls back to the SD.
If you installed a broken fw.img which doesn't load, you can force isfshax to load the fw.img from sd by repeatly pressing power till the menu shows up.

Warning: A factory reset will delete the hax folder. Without the fw.img on the SD the Wii U will then just have a black screen with a orange LED


Optional Autobooting with SD


To make the Wii U autoboot with an SD card inserted you need to create the file sd:/minute/minute.ini with the following content:
Code: 
[boot]
autoboot=1
autoboot_timeout=3
You can adjust the timeout (in seconds) to your liking. The autoboot option specifies which entry from the minute menu will be loaded. 1 corresponds to Patch (slc) and boot IOS (slc), which loads the ios_plugins from the SLC. If you haven't installed them to the SLC or want to load them from the sd for another reason you can change that value to 3 which corresponds to Patch (sd) and boot IOS (slc)

As an Alternative check out the Fastboot option below.

Optional: Fastbooting (Advanced)


To make the Wii U boot as fast as possible, without showing minute, you can now use the fw_fastboot.img. This won't work with redNAND
It is hardcoded to go straight to the first option (booting the slc, with patches from SLC). It won't display anything and ignore any autoboot configuration in the minute.ini.
  1. First make sure the system can boot using the first option in minute. (see booting without SD)
  2. Replace the the fw.img in the hax folder on the SLC with the fw_fastboot.img (renamed to fw.img)
In case you ever get stuck and need to load the full minute from SD you can do this:
  1. Place the minute fw.img on the SD card
  2. repeatedly press the power button until the minute menu shows up on the screen.


Uninstalling ISFShax


DON'T just restore an older SLC backup, as that would break SCFM!
  • Make sure your Wii U doesn't depend on any patches (linke wafel_unlimit_mlc.ipx or redNAND). You can check that by booting with only the wafel_core.ipx and the wafel_isfshax_ipx plugins in the ios_plugins directory on the SD and using the Patch (sd) and boot IOS (slc) option
  • Delete the /storage_slc/sys/hax folder if you set up the slc booting
  • run the ISFShax installer again from minute and follow the on screen instructions to uninstall.

Credits


  • @rw-r-r_0644 for finding and implementing isfshax
  • @GaryOderNichts and ashquarky for their direct contributions and help
  • @vgmoose for all the support and for the Wii U that replaced the one Idestroyed during early isfshax testing
  • @Maschell for his help and all other contributions to the Wii U scene
  • hexkyz for the warmboot boot1 exploit which made all of this possible
  • @shinyquagsire23 for de_Fuse, minute and stroopwafel
  • Salt Team for the original minute CFW
  • dimok789, FIX94 and others for the iosuhax CFW
  • fail0verflow for mini
  • and all other contributors to the Wii U scene!
 
Last edited by SDIO,
  • Like
  • Love
Reactions: alcab, AlamosIT, andreiarturo and 27 others
Click to expand...
Hedoking

Hedoking

Member
Newcomer
Level 1
Joined
Sep 20, 2023
Messages
14
Trophies
0
Age
23
Location
The interwebs
XP
72
Country
Canada
I keep getting the orange/redblue console light after a fresh install... Pretty sure I have all my files in the right spots, installed via browser.

edit: added filetree
 

Attachments

  • ios_plugins.png
    ios_plugins.png
    6.7 KB · Views: 7
  • wiiu.png
    wiiu.png
    10.5 KB · Views: 7
  • root.png
    root.png
    11.1 KB · Views: 7
Last edited by Hedoking,
S

SDIO

Well-Known Member
OP
Member
Level 9
Joined
Feb 13, 2023
Messages
2,475
Trophies
0
Age
28
XP
1,734
Country
Germany
Nuggo said:
I keep getting the orange/redblue console light after a fresh install... Pretty sure I have all my files in the right spots, installed via browser.

edit: added filetree
Click to expand...
What happens if you try to boot without the SD in?

yamaharacer said:
When I want to boot ios.img, I get the error: body hash check failed. What am I doing wrong?
Click to expand...
Sounds like your ios.img is corrupted, redownload it

ThommoMC said:
Do I need to do the aroma/tiramisu where I setup wafel_payloader.ipx or can I skip it? I do have aroma installed.
Click to expand...
You need to have the Aroma files on the SD if you want to use Aroma (which is the point of the payloader)
 
  • Like
Reactions: Blythe93
Hedoking

Hedoking

Member
Newcomer
Level 1
Joined
Sep 20, 2023
Messages
14
Trophies
0
Age
23
Location
The interwebs
XP
72
Country
Canada
SDIO said:
What happens if you try to boot without the SD in?


Sounds like your ios.img is corrupted, redownload it


You need to have the Aroma files on the SD if you want to use Aroma (which is the point of the payloader)
Click to expand...
Solid orange light, it doesn't boot up at all.

EDIT: Fixed. For anyone else with this problem, use the attached files to replace any you used from github. If you can't see anything on your gamepad, press the power button on the console twice (wait a couple of seconds between presses) and finally the eject button. this should take you out of minute and into the wii u menu.

Thank you for your help @SDIO
 

Attachments

  • to_sd.zip
    807.7 KB · Views: 5
Last edited by Hedoking,
  • Like
Reactions: Blythe93
tmnr1992

tmnr1992

Well-Known Member
Member
Level 10
Joined
Oct 22, 2016
Messages
360
Trophies
0
XP
2,134
Country
United States
I'm trying to Launch minute using UDPIH, the 3rd step asks to select the "Load BOOT1 payload" and proceed, but there is no such option in the recovery menu. I double checked and all the needed files are in the correct path on the SD card. I don't know if it makes any difference but I'm loading UDPIH using a Switch.
 

Attachments

  • screenshot.png
    screenshot.png
    205.8 KB · Views: 8
Q

QuickLearner

Member
Newcomer
Level 1
Joined
Jun 3, 2024
Messages
21
Trophies
0
Age
124
XP
19
Country
Canada
Hello :) I'm super new to console hacking, thank you so much for putting this guide together!

I'm trying to fix error code 160-0103 on my Wii U with ISFSHax and redNAND, and I've gotten as far as the ISFSHax installer but the installation fails with "Failed to find an unpatched isfs superblock (-1)".

I also noticed several instances of "uncorrectable ecc error" getting printed out before the installation fails completely.

Based on these errors and a bit of poking around in the installer code, it appears I am dealing with not just MLC corruption, but also SLC corruption. And that the SLC is corrupted to such an extent that even its ISFS Superblock isn't readable... Now, I expect (and this is probably my inexperience talking) that such corruption would cause my Wii U to be unable to boot. But it can! Before I started messing with it, it could reach the menu just fine. Only specific actions (e.g. starting certain games, pressing certain UI buttons, etc.) would trigger the 160-0103 error.

Have I found a bug in the installer? Or perhaps I'm just missing some knowledge about the SLC, ISFS, etc.

Many thanks in advance to anyone who answers :)
 
Q

QuickLearner

Member
Newcomer
Level 1
Joined
Jun 3, 2024
Messages
21
Trophies
0
Age
124
XP
19
Country
Canada
Very interesting! Thank you for linking that Wiki article. After doing some digging, I (think I) was able to find my superblock generations. In case anyone reading this thread is facing the same problem, here is what I did:
  • Open SLC.RAW in HxD (a hex editor for Windows)
  • Search-All for the magic string SFS!, which gives 64 results - one for each superblock
    • The magic string is SFS! on Wii U, and SFFS for Wii. So you'll need to use SFFS if you're looking at SLCCMPT.RAW which is the vWii side of the SLC. When I did this, I found 16 superblocks as expected.
1717457878640.png


For all 64 entries, the magic string is followed by 00 57 45 and then a byte semi-unique to each entry, and then 00 00 00 00 FF FE FF FC. I believe the semi-unique bytes are the generation numbers. They are:

C2 - CD, 8E - A2, 9C - BA

where XX - YY means the inclusive range of values between XX and YY (e.g. AA - AE would mean AA, AB, AC, AD, AE)
 
S

SDIO

Well-Known Member
OP
Member
Level 9
Joined
Feb 13, 2023
Messages
2,475
Trophies
0
Age
28
XP
1,734
Country
Germany
The 00 75 45 C8 is the generation number, you can also see it increasing by one in each block like expected. That looks normal.

What does nandBinCheck say about the slc dump?
 
Q

QuickLearner

Member
Newcomer
Level 1
Joined
Jun 3, 2024
Messages
21
Trophies
0
Age
124
XP
19
Country
Canada
SDIO said:
The 00 75 45 C8 is the generation number, you can also see it increasing by one in each block like expected. That looks normal.

What does nandBinCheck say about the slc dump?
Click to expand...
It says:
** nandBinCheck : Wii nand info tool **
from giantpune
built: Mar 24 2017 23:49:06
NAND Type: SLC (WiiU)
checking boot1...
Boot1 hash: "3806d41a5c5f139f5b09bbe5b74a5ec45e0f5507"
Boot1 OK!
checking for lost clusters...
total used clusters 2fe7 of 0x8000
found 0 lost clusters
UNK ( 0xffff ) 19 (3817, 48cf, 6548, 6549, 654a, 654b, 654c, 654d, 654e, 654f, 6d09, 6d0a, 6d0b, 6d0c, 6d0d, 6d0e, 6d0f, 7260, 7261, 7262, 7263, 7264, 7265, 7266, 7267)
free 48f1
verifying ecc...
16 out of 902080 pages had incorrect ecc.
they were spread through 4 clusters in 2 blocks:
(3488, 3660)
0 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 475 files
hmac bad (3)
"fw.img" is dfd200 bytes ( 380 ) clusters

00000000 ffe470a7 1e3f9ef2 350d85e6 735a40ed ..p..?..5...sZ@.
00000010 cd9cd9dd a3e470a7 1e3f9ef2 350d85e6 ......p..?..5...
00000020 735a40ed cd9cd9dd a3000000 00000000 sZ@.............
00000030 c40d3b02 11021102 2c03d30c 6f046f04 ..;.....,...o.o.

00000000 ffe470a7 1e3f9ef2 350d85e6 735a40ed ..p..?..5...sZ@.
00000010 cd9cd9dd a3e470a7 1e3f9ef2 350d85e6 ......p..?..5...
00000020 735a40ed cd9cd9dd a3000000 00000000 sZ@.............
00000030 2b01d40e 78087808 e40c1b03 fb09fb09 +...x.x.........

00000000 e470a71e 3f9ef235 0d85e673 5a40edcd .p..?..5...sZ@..
00000010 9cd9dda3 ....
bad HMAC for "/sys/title/00050010/1000400a/code/fw.img"
hmac bad (1)
"scfm.img" is 8004000 bytes ( 2001 ) clusters

00000000 ff000000 00000000 00000000 00000000 ................
00000010 00000000 00000000 00000000 00000000 ................
00000020 00000000 00000000 00000000 00000000 ................
00000030 00000000 00000000 00000000 00000000 ................

00000000 ff000000 00000000 00000000 00000000 ................
00000010 00000000 00000000 00000000 00000000 ................
00000020 00000000 00000000 00000000 00000000 ................
00000030 00000000 00000000 660e9901 be0d4102 ........f.....A.

00000000 840af21b c796fe9f 9a6555f9 b93aacac .........eU..:..
00000010 49e10dbb I...
bad HMAC for "/scfm.img"
2 files had bad HMAC data
checking HMAC for superclusters...
hmac bad (3)
supercluster 7d20

00000000 ffd9a016 2cdf4fec cd580295 54a38f85 ....,.O..X..T...
00000010 65560eab a8d9a016 2cdf4fec cd580295 eV......,.O..X..
00000020 54a38f85 65560eab a82e6047 5f35f1b2 T...eV....`G_5..
00000030 00000000 00000000 00000000 00000000 ................

00000000 ffd9a016 2cdf4fec cd580295 54a38f85 ....,.O..X..T...
00000010 65560eab a8d9a016 2cdf4fec cd580295 eV......,.O..X..
00000020 54a38f85 65560eab a82e6047 5f35f1b2 T...eV....`G_5..
00000030 00000000 00000000 00000000 00000000 ................

00000000 d9a0162c df4feccd 58029554 a38f8565 ...,.O..X..T...e
00000010 560eaba8 V...
hmac bad (3)
supercluster 7f10

00000000 ff6ded5a 07154d57 d4ca36f6 dd971918 .m.Z..MW..6.....
00000010 dd5b3fcb 9b6ded5a 07154d57 d4ca36f6 .[?..m.Z..MW..6.
00000020 dd971918 dd5b3fcb 9b000000 00000000 .....[?.........
00000030 00000000 00000000 00000000 00000000 ................

00000000 ff6ded5a 07154d57 d4ca36f6 dd971918 .m.Z..MW..6.....
00000010 dd5b3fcb 9b6ded5a 07154d57 d4ca36f6 .[?..m.Z..MW..6.
00000020 dd971918 dd5b3fcb 9b000000 00000000 .....[?.........
00000030 00000000 00000000 00000000 00000000 ................

00000000 6ded5a07 154d57d4 ca36f6dd 971918dd m.Z..MW..6......
00000010 5b3fcb9b [?..
2 superClusters had bad HMAC data
(32032, 32528)
 
Last edited by QuickLearner,
S

SDIO

Well-Known Member
OP
Member
Level 9
Joined
Feb 13, 2023
Messages
2,475
Trophies
0
Age
28
XP
1,734
Country
Germany
Could it be that you have the otp from another console?

Delete the otp.bin from the SD and dump it again
 
Q

QuickLearner

Member
Newcomer
Level 1
Joined
Jun 3, 2024
Messages
21
Trophies
0
Age
124
XP
19
Country
Canada
I erased the dumps from the SD card and dumped otp.bin and SLC.RAW again:
  • otp.bin is identical to the original
  • SLC.RAW has many differences when I look at it in HxD
    • With the new dump, nandBinCheck says:
3 superClusters had bad HMAC data
(31840, 32208, 32688)

The console is still able to boot to the Wii U menu without any issue.
 
Q

QuickLearner

Member
Newcomer
Level 1
Joined
Jun 3, 2024
Messages
21
Trophies
0
Age
124
XP
19
Country
Canada
I deleted the dumps (including otp.bin) from the SD card, reinserted it into the Wii U, and retried the ISFSHax installer. The "uncorrectable ecc error" messages and "Failed to find an unpatched isfs superblock (-1)" failure persisted.
 

Site & Scene News

Go to forum More news

Popular threads in this forum

Tutorial Homebrew app  USB Partition - Use partitioned USB HDDs with the Wii U

Using a single external partitioned hard drive.

How can I change the Wii U and vWii region of a japanese wii u to ntsc-u, and keep compatibility with the gamepad?

ROM Hack  PMD Tempest, Wildfire, Radiant

Wii U is super messed up after trying to install Aroma

[Solved] BOTW voice packs after eShop shutdown

My WII U seems to have turned into a brick.

Hacking Hardware Homebrew  Is it even possible to dump the Wii U Cleaning Disc?

General chit-chat
Help Users
    Veho @ Veho: Why does Psi have PMS?