Hardware SLC Corruption help request

AverageHumanPerson · Jun 19, 2024

Hello All, Apologizes if this is the incorrect place to make this post

I am currently in the process of attempting to fix my bricked Wii U and could use some advice or aid.

I believe my issue is SLC corruption, and have followed the guide in the Ultimate Wii U Troubleshooting guide as far as I can go, but I have reached a roadblock.

The nandBinCheck identified a bad HMAC file, but did not show a path to a specific file other than the "/scfm.img" file. I believe this means that the fix used in the SLC thread will not work for my situation.
I lack the understanding of Nintendo's systems and community made tools to be certain however, hence why I am making this thread. What are my next steps?

I did attempt the fix stated in the SLC thread, but it didn't work and might have made things worse.

I will also include any and all information I believe will be useful to anyone attempting to help. Thanks in advance.

Here is the System.xml

Code:

<?xml version="1.0" encoding="utf-8"?>
<system type="complex" access="777">
  <version type="unsignedInt" length="4">21</version>
  <cmdFlags type="unsignedInt" length="4">0</cmdFlags>
  <default_os_id type="hexBinary" length="8">000500101000400a</default_os_id>

  <default_title_id type="hexBinary" length="8">0005001010040100</default_title_id>

  <log type="complex" length="0">
    <enable type="unsignedInt" length="4">0</enable>
    <max_size type="unsignedInt" length="4">8388607</max_size>
  </log>
  <standby type="complex" length="0">
    <enable type="unsignedInt" length="4">1</enable></standby>
  <ramdisk type="complex" length="0">
    <cache_user_code type="unsignedInt" length="4">0</cache_user_code>
    <max_file_size type="unsignedInt" length="4">10485760</max_file_size>

    <cache_delay_ms type="unsignedInt" length="4">10000</cache_delay_ms>
  </ramdisk>
  <simulated_ppc_mem2_size type="hexBinary" length="4">00000000</simulated_ppc_mem2_size>

  <dev_mode type="unsignedInt" length="4">0</dev_mode>
  <prev_title_id type="hexBinary" length="8">0000000000000000</prev_title_id>

  <prev_os_id type="hexBinary" length="8">0000000000000000</prev_os_id>
  <default_app_type type="hexBinary" length="4">90000001</default_app_type>

  <default_device_type type="string" length="16" />
  <default_device_index type="unsignedInt" length="4">0</default_device_index>

  <fast_relaunch_value type="unsignedInt" length="4">0</fast_relaunch_value>

  <default_eco_title_id type="hexBinary" length="8">0005001010066000</default_eco_title_id>

</system>

And here is the app.xml of the OSv10 file

Code:

<?xml version="1.0" encoding = "utf-8"?>
<app type="complex" access="777">
  <version type="unsignedInt" length="4">15</version>
  <os_version type="hexBinary" length="8">0000000000000000</os_version>
  <title_id type="hexBinary" length="8">000500101000400A</title_id>
  <title_version type="hexBinary" length="2">3d56</title_version>
  <sdk_version type="unsignedInt" length="4">21301</sdk_version>
  <app_type type="hexBinary" length="4">1000000a</app_type>
  <group_id type="hexBinary" length="4">00000000</group_id>
  <os_mask  type="hexBinary" length="32">0</os_mask>
</app>

I forgot to include the nandBinCheck output, so that's here now.

SDIO · Jun 19, 2024

The scfm.img isn't hmac protected, so it is totally normal for it to have a bad hmac.

Is there anything else that makes you believe the SLC has a problem?

What even is your problem?

AverageHumanPerson · Jun 19, 2024

My issue I can best summarize with log 23. The system is crashing on startup, giving an error code 1602215, and throwing the data corruption error. It seems to fail when doing a hash verification, which from what I could tell is something the SLC boot0 file does. I may be totally wrong, SLC corruption seemed to be the most likely possibility. What else might cause this then?

Here is the section of the log that I'm going off of, taken from log 23.

Code:

00;00;12;054: SYSLOG_LEVEL 1: Warnings Enabled
00;00;12;054: UserMode Core & Thread Initialization (3 Cores)
00;00;12;054:   Core 1 Complete, Default Thread 0x100457E0
00;00;12;056:   Core 0 Complete, MSR 0x00005072, Default Thread 0x10045140
00;00;12;057:   Core 2 Complete, MSR 0x00005072, Default Thread 0x10045E80
00;00;12;080: UserMode OS library build date: Jul 28 2015 19:57:03
00;00;12;080: __AppFlags: 0x00000200

00;00;12;080: OSBlockThreadsOnExit default for sdk version 21211
00:00:12:304: ISFS: fs_block.c(478)Hash conflict detected
00:00:12:305: ISFS: Dump computedHash:
00:00:12:305: 7300:00:12:305: e500:00:12:305: 4e00:00:12:305: a100:00:12:305: c600:00:12:305: 8e00:00:12:305: 8500:00:12:306: e800:00:12:306: 7c00:00:12:306: 1500:00:12:306: 0500:00:12:306: b600:00:12:306: c300:00:12:306: a800:00:12:306: df00:00:12:306: 9b00:00:12:306: 9900:00:12:307: 5300:00:12:307: 1000:00:12:307: d000:00:12:307:
Dump tmpSpareBuf:
00:00:12:307: 4b00:00:12:307: 9600:00:12:307: 7d00:00:12:307: f600:00:12:307: 0d00:00:12:308: ca00:00:12:308: 4c00:00:12:308: ea00:00:12:308: 4a00:00:12:308: 9c00:00:12:308: 8700:00:12:308: 6800:00:12:308: 2f00:00:12:308: 3600:00:12:309: c600:00:12:309: 8d00:00:12:309: 2600:00:12:309: f900:00:12:309: 7100:00:12:309: d700:00:12:309: 4b00:00:12:309: 9600:00:12:309: 7d00:00:12:309: f600:00:12:310: 0d00:00:12:310: ca00:00:12:310: 4c00:00:12:310: ea00:00:12:310: 4a00:00:12:310: 9c00:00:12:310: 8700:00:12:310: 6800:00:12:310: 2f00:00:12:310: 3600:00:12:311: c600:00:12:311: 8d00:00:12:311: 2600:00:12:311: f900:00:12:311: 7100:00:12:311: d700:00:12:311:
00:00:12:311: ISFS: fs_ops.c(5295)Could not read file system block with block number: 0x5e02, rc=-524315
00:00:12:312: FSA: ### DATA CORRUPTION ERROR ###, dev:slc01, err:-524315, cmd:11, path:(null)
00:00:12:312: failed to read file /vol/system/title/00050010/1000400a/code/padscore.rpl, err -196635
00;00;12;192: ***IOP-IPC FAILED reading padscore.rpl with a fatal error code to LiWaitIopComplete. Fatal err = (3,-27).
00;00;12;194: ***LiLoadForPrep failure (3,-27) loading "padscore".
00;00;12;194: ***Loader failure (3,-27).
00;00;12;194: __OSDynLoad_InitFromCoreInit() - main program load failed (err=0xFFFCFFE5).
00;00;12;194: SystemFatal(core1)

SDIO · Jun 19, 2024

Ok, that looks like SLC corruption, and t also tells you that the /vol/system/title/00050010/1000400a/code/padscore.rpl is bad. Should be an easy fix, by just replacing that file with the wupserver or simply reinstalling the whole OSv10.
It's probably a good idea to install ISFShax first, if you are using UDPIH. If you have defuse anyway, then you don't need ISFShax.

I just wonder why nandBinCheck didn't detect that error.

AverageHumanPerson · Jun 19, 2024

In the effort to make sure I do this correctly:

I use JNUSTool to download the encrypted OSv10

Code:

java -jar JNUSTool.jar 000500101000400A -dlEncrypted

I then put the temp folder it gives into a folder called "wafel_install" on the SD card.
Would I still need to take an unencrypted Osv10 fw.img and rename it to ios_orig.img?

I would also put the wafel_install.ipx folder found the the troubleshooting guide in the wiiu/ios_plugins folder on the SD.

From there I just need to get into Minute and select the "boot from ios_orig.img".

Is that the correct procedure?

SDIO · Jun 19, 2024

You don't need to get the OSv10 fw.img, since the installed one seems to be fine. You can just do the patch SD boot slc

AverageHumanPerson · Jun 20, 2024

I appear to have done something incorrectly, the wii u crashed in the same way as before. I will attempt to figure out what went wrong, but I am far from confident in my ability to parse all of this myself. I will wait for your input before trying anything new.

The .txt file contains what the serial console outputted

Thanks again for the help.

Edit: gbatemp isn't letting me attach the zip file of my sd card contents, so if that is needed let me know and ill take screenshots or something.

SDIO · Jun 20, 2024

this install returned 0, so it should be fine. Did you try booting again, without the install?

AverageHumanPerson · Jun 20, 2024

Once the install was complete, I powered off the Wii-U and disconnected the raspberry pico to try booting normally. When I did the system crashed as it had before. Do I need to try booting from ios in minute before disconnecting?

SDIO · Jun 20, 2024

maybe it's not the SLC, maybe it's bad DRAM and that file just happens to get loaded there.
You don't need to fully disconnect the pico, it's just enough to not power it in case of defuse.
You can dump the logs again and see if something in the error changed, like maybe a different block number

AverageHumanPerson · Jun 20, 2024

I dumped the logs again and tracked down the most recent log. Same issue as before. Nothing seems to have changed to my eyes.

Code:

00;00;10;964: ------------------PROCESS 5 GAIN FOREGROUND--------------------
00;00;10;966: SYSLOG_LEVEL 1: Warnings Enabled
00;00;10;966: UserMode Core & Thread Initialization (3 Cores)
00;00;10;966:   Core 1 Complete, Default Thread 0x100457E0
00;00;10;967:   Core 0 Complete, MSR 0x00005072, Default Thread 0x10045140
00;00;10;968:   Core 2 Complete, MSR 0x00005072, Default Thread 0x10045E80
00;00;10;991: UserMode OS library build date: Jul 28 2015 19:57:03
00;00;10;991: __AppFlags: 0x00000200

00;00;10;992: OSBlockThreadsOnExit default for sdk version 21211
00:00:11:316: ISFS: fs_block.c(478)Hash conflict detected
00:00:11:316: ISFS: Dump computedHash:
00:00:11:316: 7300:00:11:316: e500:00:11:316: 4e00:00:11:316: a100:00:11:316: c600:00:11:317: 8e00:00:11:317: 8500:00:11:317: e800:00:11:317: 7c00:00:11:317: 1500:00:11:317: 0500:00:11:317: b600:00:11:317: c300:00:11:317: a800:00:11:318: df00:00:11:318: 9b00:00:11:318: 9900:00:11:318: 5300:00:11:318: 1000:00:11:318: d000:00:11:318:
Dump tmpSpareBuf:
00:00:11:318: 4b00:00:11:318: 9600:00:11:319: 7d00:00:11:319: f600:00:11:319: 0d00:00:11:319: ca00:00:11:319: 4c00:00:11:319: ea00:00:11:319: 4a00:00:11:319: 9c00:00:11:319: 8700:00:11:320: 6800:00:11:320: 2f00:00:11:320: 3600:00:11:320: c600:00:11:320: 8d00:00:11:320: 2600:00:11:320: f900:00:11:320: 7100:00:11:320: d700:00:11:321: 4b00:00:11:321: 9600:00:11:321: 7d00:00:11:321: f600:00:11:321: 0d00:00:11:321: ca00:00:11:321: 4c00:00:11:321: ea00:00:11:321: 4a00:00:11:322: 9c00:00:11:322: 8700:00:11:322: 6800:00:11:322: 2f00:00:11:322: 3600:00:11:322: c600:00:11:322: 8d00:00:11:322: 2600:00:11:322: f900:00:11:322: 7100:00:11:323: d700:00:11:323:
00:00:11:323: ISFS: fs_ops.c(5295)Could not read file system block with block number: 0xb0, rc=-524315
00:00:11:323: FSA: ### DATA CORRUPTION ERROR ###, dev:slc01, err:-524315, cmd:11, path:(null)
00:00:11:323: failed to read file /vol/system/title/00050010/1000400a/code/padscore.rpl, err -196635
00;00;11;211: ***IOP-IPC FAILED reading padscore.rpl with a fatal error code to LiWaitIopComplete. Fatal err = (3,-27).
00;00;11;214: ***LiLoadForPrep failure (3,-27) loading "padscore".
00;00;11;214: ***Loader failure (3,-27).
00;00;11;214: __OSDynLoad_InitFromCoreInit() - main program load failed (err=0xFFFCFFE5).
00;00;11;214: SystemFatal(core1)

If it is a DRAM issue, how would I even go about diagnosing that?

V10lator · Jun 20, 2024

AverageHumanPerson said:
tracked down the most recent log

This might be an extremely stupid question but how did you track this down? Just asking to make sure you're really looking at the correct log file.

In case you want either SDIO or me to confirm you're looking at the correct file you could also zip the whole logs folder (including the meta.bin file!) and DM that to one of us (don't post it publicly in case you're privacy concerned as the logs contain your consoles serial number).

//EDIT:

Code:

UserMode OS library build date: Jul 28 2015 19:57:03

That's way too old. Should be something along the lines

Code:

UserMode OS library build date: Feb  4 2021 16:38:58

(and maybe even 2021 is from a years old log, not from newest firmware, I just looked into the first best logfile I found on my HDD). This rises my suspicion that you're looking at the wrong log file.

//EDIT²: @SDIO Got the logs. Writing this here instead of answering by DM so you see it, to.

Allright, so what I do now is open the meta.bin with a hex editor. This shows 742. We have to transfom that from hexadecimal to decimal which gives 1858. That's the total number of log files ever created, so the last thing we do is a modulo 100 calculation which gives us 58. So the last log file should be 58.log, not 63.log.

This shows the exact same error through.

Now one thing I see is the date of this log: 2020-06-19 05:26:38
That might either mean the clock in your Wii U is wrong or that this log is indeed 4 years old. Could you (@AverageHumanPerson ) try recreating the issue and look if the meta.bin file changed at all? If not this is a softlock not creating a crashlog.

AverageHumanPerson · Jun 20, 2024

Assuming what you meant by recreating the issue was to crash the system, i did so three times with a normal boot attempt. No de_fuse. The meta.bin file did change. it now reads hex 747. the three new files share the exact same error, though I have noticed the some log files seem to be completely different than others. Log 18 in specific seems odd. I believe that was the last log crated before the crashes that happen now started.

Edit: Figured I might as well post log 18, so that it's easier to see the issue:

Code:

2023-03-18 20:24:31
Cafe OS SDK Version 2.13.01 Build 68939 Branch sdk_2_13
Espresso:       0x0000700100000201
Latte:          0x0000409f
System mode:    0x80000
Boot flags:     0x4220000
Security Level: 0x1e
Key Type:       0xfffffffc
Prod Version:   0x5
Serial:         417027713
Model:          WUP-101(02)
Prod Area:      0x2
Game Area:      0x2
5GHz Code:      0x7
BT:             0x205
BOOT1:          0x20b9
DRH:            0x190c





----------- Starting System Log -----------
00:00:00:590: AHCI_MGR Trace: This platform does not require SATA in ECO mode.
00:00:00:595: TEST Info: crossProcessHeap OK.
00:00:00:599: AUXIL Info: crossProcessHeap OK.
00:00:00:601: AUXIL Info: Net OK.
00:00:00:862: ISFS: FAT INFO (ch WUP): slot 22 / seq 1588184 (Each FAT slot has been updated 24815 times in avr)
00:00:00:863: FSA: [uptime 0.863 s]: Attached volume to slc01 (isfs): Capacity 511 MB, 262016 logical blocks of size 2048 B.
00:00:01:036: ISFS: FAT INFO (ch RVL Compat): slot 14 / seq 363952 (Each FAT slot has been updated 22747 times in avr)
00:00:01:037: FSA: [uptime 1.037 s]: Attached volume to slccmpt01 (isfs): Capacity 511 MB, 261632 logical blocks of size 2048 B.
00:00:01:048: SCFM:Start init. BUILD_TIME:[19:23:46]
00:00:01:059: SCFM:FSAInit
00:00:01:060: SCFM:AddClient
00:00:01:061: SCFM:scfmMountSlc
00:00:01:062: SCFM:scfmLoad
00:00:01:062: SCFM:Done init.
00:00:01:064: PCFS: Disabled because we are in PROD mode.
00:00:01:065: MCP: booting from NAND
00:00:01:065: MCP: Boot PM flags - PON_SMC PON_SMC_TIMER DDR_SREFRESH
00:00:01:066: MCP: System is in ECO Mode
00:00:01:124: MCP: Cafe OS SDK Version 2.13.01 Build 68939 Branch sdk_2_13
00:00:01:124: MCP: Booting on Espresso (0x0000700100000201), Latte (0x25100028), RTC (0x21)
00:00:01:124: MCP: Platform - boardType(CF), boardRevision(11), devicePresence(0x00000000), sataDevice(3), consoleType(1)
00:00:01:131: ISFS: FAT block entries check start
00:00:01:145: ISFS: FAT block entries check finished.
00:00:01:182: FSA: [uptime 1.182 s]: Attached volume to mlc01 (wfs): Capacity 29760 MB, 60948480 logical blocks of size 512 B.
00:00:01:192: FSA: [uptime 1.192 s]: Attached volume to ramdisk01 (wfs): Capacity 127 MB, 131070 logical blocks of size 1024 B.
00:00:01:315: ISFS: FAT block entries check start
00:00:01:328: ISFS: FAT block entries check finished.
00:00:01:531: MCP: File loading from ramdisk cache is enabled
00:00:01:545: MCP: Master title 0005001010066000 os 000500101000400a from mlc01 flags 0004
00:00:01:603: MCP: os version 10 NDEBUG (0x000500101000400a)
00:00:01:606: MCP: FSA volume on device /dev/mlc01 (wfs) attached @ uptime 1.606 s.
00:00:01:640: MCP: found master title 5001010066000 on mlc01 at 1.640 s
00:00:01:647: MCP: FSA volume on device /dev/ramdisk01 (wfs) attached @ uptime 1.647 s.
00:00:01:648: MCP: Titles scanned (dev_state 0006) on device /dev/ramdisk01 (wfs) @ uptime 1.648 s.
00:00:01:649: MCP: FSA volume on device /dev/slc01 (isfs) attached @ uptime 1.649 s.
00:00:01:649: MCP: FSA volume on device /dev/slccmpt01 (isfs) attached @ uptime 1.649 s.
00:00:01:650: MCP: Titles scanned (dev_state 0006) on device /dev/slccmpt01 (isfs) @ uptime 1.650 s.
00:00:01:653: MCP: Titles scanned (dev_state 0004) on device /dev/mlc01 (wfs) @ uptime 1.653 s.
00:00:01:653: MCP: Titles scanned (dev_state 000e) on device /dev/slc01 (isfs) @ uptime 1.653 s.
00:00:02:003: ISFS: fs_ops.c(3733)Can not change the owner Id of a non-empty file
00:00:02:003: ISFS: fs_ops.c(6719)Could not set attribute, rc=-524312
00:00:02:636: MCP: ECO mode is enabled
00:00:02:636: [+-* DK is ready for console input *-+]
00:00:02:637: MCP: syslog mask is set to 0xffffffff
00:00:02:650: USB Trace: Device hierarchy retrieved from SLC (4).
00:00:02:652: USB Trace: Activating root hubs @ uptime 2.652 s with options 0xc0000.
00:00:02:683: UHS0 Trace: DevFsm(EHCI-0/L0/P0): Creating device, speed=HIGH.
00:00:02:689: UHS0 Trace: DevFsm(OHCI-0:0/L0/P0): Creating device, speed=FULL.
00:00:02:689: USB Info: UhsServerAddHc 0 OK.
00:00:02:717: UHS0 Trace: DevFsm(EHCI-1/L0/P0): Creating device, speed=HIGH.
00:00:02:723: UHS0 Trace: DevFsm(OHCI-1:0/L0/P0): Creating device, speed=FULL.
00:00:02:724: USB Info: UhsServerAddHc 1 OK.
00:00:02:726: MCP: Titles scanned (dev_state 000c) on device /dev/mlc01 (wfs) @ uptime 2.726 s.
00:00:02:728: MCP: Titles scanned (dev_state 0006) on device /dev/mlc01 (wfs) @ uptime 2.728 s.
00:00:02:742: W2C: Does not need W2C-reflection
00:00:03:412: UHS1 Trace: DevFsm(EHCI-2/L0/P0): Creating device, speed=HIGH.
00:00:03:418: UHS1 Trace: DevFsm(OHCI-2:0/L0/P0): Creating device, speed=FULL.
00:00:03:419: CCR_MAIN: activating root hub.
00:00:03:732: UHS1 Trace: DevFsm(EHCI-2/L1/P1): Creating device, speed=HIGH.
00:00:03:733: UHS1 Trace: DevFsm: There are now a total of 1 connected devices.
00:00:03:773: UHS1 Trace: CltIfFsm(V057e|P0341|IF0): Device EHCI-2/L1/P1/A01 entering probing state @ uptime 3.773 s.
00:00:03:774: UHS1 Trace: CltIfFsm(V057e|P0341|IF1): Device EHCI-2/L1/P1/A01 entering probing state @ uptime 3.774 s.
00:00:03:774: UHS1 Trace: CltIfFsm(V057e|P0341|IF2): Device EHCI-2/L1/P1/A01 entering probing state @ uptime 3.774 s.
00:00:03:775: UHS1 Trace: CltIfFsm(V057e|P0341|IF3): Device EHCI-2/L1/P1/A01 entering probing state @ uptime 3.775 s.
00:00:03:776: UHS1 Trace: CltIfFsm(V057e|P0341|IF4): Device EHCI-2/L1/P1/A01 entering probing state @ uptime 3.775 s.
00:00:03:776: UHS1 Trace: CltIfFsm(V057e|P0341|IF5): Device EHCI-2/L1/P1/A01 entering probing state @ uptime 3.776 s.
00:00:03:777: UHS1 Trace: CltIfFsm(V057e|P0341|IF6): Device EHCI-2/L1/P1/A01 entering probing state @ uptime 3.777 s.
00:00:03:777: UHS1 Trace: CltIfFsm(V057e|P0341|IF7): Device EHCI-2/L1/P1/A01 entering probing state @ uptime 3.777 s.
00:00:03:778: UHS1 Trace: CltIfFsm(V057e|P0341|IF8): Device EHCI-2/L1/P1/A01 entering probing state @ uptime 3.778 s.
00:00:03:778: UHS1 Trace: CltIfFsm(V057e|P0341|IF9): Device EHCI-2/L1/P1/A01 entering probing state @ uptime 3.778 s.
00:00:03:779: UHS1 Trace: CltIfFsm(V057e|P0341|IF10): Device EHCI-2/L1/P1/A01 entering probing state @ uptime 3.779 s.
00:00:03:780: UHS1 Trace: CltIfFsm(V057e|P0341|IF11): Device EHCI-2/L1/P1/A01 entering probing state @ uptime 3.779 s.
00:00:03:780: UHS1 Trace: CltIfFsm(V057e|P0341|IF0): Acquired by client in pid 6.
00:00:03:781: UHS1 Trace: CltIfFsm(V057e|P0341|IF0): Enable endpoints 0x00080000.
00:00:03:866: __ccr_hid_attach_add_interface: idx 0 ep 3
00:00:03:867: UHS1 Trace: CltIfFsm(V057e|P0341|IF1): Acquired by client in pid 6.
00:00:03:868: UHS1 Trace: CltIfFsm(V057e|P0341|IF1): Enable endpoints 0x00100000.
00:00:03:954: __ccr_hid_attach_add_interface: idx 1 ep 4
00:00:03:955: UHS1 Trace: CltIfFsm(V057e|P0341|IF2): Acquired by client in pid 6.
00:00:03:956: UHS1 Trace: CltIfFsm(V057e|P0341|IF3): Acquired by client in pid 6.
00:00:03:957: UHS1 Trace: CltIfFsm(V057e|P0341|IF3): Activating bAlternateSetting 0.
00:00:03:960: UHS1 Trace: CltIfFsm(V057e|P0341|IF4): Acquired by client in pid 6.
00:00:03:960: UHS1 Trace: CltIfFsm(V057e|P0341|IF5): Acquired by client in pid 6.
00:00:03:961: UHS1 Trace: CltIfFsm(V057e|P0341|IF5): Activating bAlternateSetting 0.
00:00:03:965: UHS1 Trace: CltIfFsm(V057e|P0341|IF7): Acquired by client in pid 6.
00:00:03:965: UHS1 Trace: CltIfFsm(V057e|P0341|IF7): Enable endpoints 0x08001000.
00:00:03:967: UHS1 Trace: CltIfFsm(V057e|P0341|IF8): Acquired by client in pid 6.
00:00:03:968: UHS1 Trace: CltIfFsm(V057e|P0341|IF9): Acquired by client in pid 6.
00:00:03:969: UHS1 Trace: CltIfFsm(V057e|P0341|IF9): Activating bAlternateSetting 0.
00:00:03:973: UHS1 Trace: CltIfFsm(V057e|P0341|IF10): Acquired by client in pid 6.
00:00:03:974: UHS1 Trace: CltIfFsm(V057e|P0341|IF11): Acquired by client in pid 6.
00:00:03:975: UHS1 Trace: CltIfFsm(V057e|P0341|IF11): Activating bAlternateSetting 0.
00:00:03:977: DRH chip revision 00000040
00:00:03:978: DRH firmware version 190c0117
00:00:03:978: DRH cdc version 00080000
00:00:03:978: DRH wifi module id a8e502d0
00:00:03:979: DRH SPL id 00001c58
00:00:04:215: MCP: boot1 version 2.11.09
00:00:04:232: MCP: loaded and parsed 'preload.txt' at '/vol/system/title/00050010/1000400a/code'
00:00:04:249: MCP: Wake 0 signal
00:00:04:309: NET: Applied interface MTU (wl0:1400 eth0:1400).
00:00:04:339: USBETH Trace: Created interface 100.
00;00;04;197: COSREPORT: Set level:1 from syslog level
00;00;04;197:
----------------------------------------------- BPERF: (0/4198199) PPC Init.
00;00;04;197: Cafe OS SDK Version 2.13.01 Build 68939 Branch sdk_2_13
00;00;04;197: PPC NDEBUG Kernel Build date - Jul 28 2015 19:55:58
00;00;04;197: BUILT AS OS_VERSION_MAJOR 000500101000800A MINOR 0x3D56
00;00;04;197: core=1 WARM BOOT
00;00;04;198: SOFT INTERRUPT MODE
00;00;04;198: PPC KERNEL IN ECO MODE
00;00;04;198: -----------------------------------------------

00;00;04;220: KiCblRegisterBlocks() completed with status 0:-4.
00:00:04:499: DRH using runtime generated WLAN data
00:00:04:499: Setting DRH to ECO mode
00:00:04:503: setting DRH system time to 20:24:34
00:00:04:505: NOT sending WoWL wake for DRC for PM_ECO
00;00;04;252: PROD Mode - don't even try to load kdebug.elf
00;00;04;258: title id: 5001010066000, app type 9000002f
00;00;04;258:
00;00;04;258: ---------------------------------------
00;00;04;258: OS VERSION ID     0x000500101000400A
00;00;04;258: MASTER TITLE ON   FLASH
00;00;04;258: ---------------------------------------
00;00;04;258:
00:00:05:031: ACT: Current account is #1.
00;00;04;690: DIAG:+KiRPLLoaderSetup
00;00;04;691: DIAG:-KiRPLLoaderSetup: before no-return call to KiLoadContext (0xEFE09400) (0x01003FFC)
00:00:05:443: [ACP]ERROR:ThreadFunc:733: failed to start DrcLed
00:00:05:647: MCP: Heartbeat Enabled
00;00;05;403: DIAG:+KiProcess_FinishInitAndPreload
00;00;05;403: KiCblRegisterBlocks() completed with status 0:-4.
00;00;05;403: DIAG:-KiProcess_FinishInitAndPreload: before no-return call to KiInitKernelFinish
00;00;05;403: DIAG:+KiInitKernelFinish
00;00;05;405: VVVVVVV----- PPC Kernel Waiting -----VVVVVVV
00;00;05;405: ^^^^^^^----- PPC Kernel Release -----^^^^^^^
00;00;05;405: DIAG:-KiInitKernelFinish: before no-return call to KiProcess_Launch
00;00;05;405:
--------------------
00;00;05;405: PROCESS  1 STARTING
00;00;05;406: SYSLOG_LEVEL 1: Warnings Enabled
00;00;05;406: UserMode Core & Thread Initialization (3 Cores)
00;00;05;406:   Core 1 Complete, Default Thread 0x100457E0
00;00;05;409:   Core 0 Complete, MSR 0x00005072, Default Thread 0x10045140
00;00;05;410:   Core 2 Complete, MSR 0x00005072, Default Thread 0x10045E80
00;00;05;410: Clearing Process MEM2 Arena...
00;00;05;437: MEM2 Arena clear complete, size 23 MB, 26ms
00:00:05:760: FSA: ### DATA CORRUPTION ERROR ###, dev:ramdisk01, err:-1245211, cmd:11, path:(null)
00:00:05:761: failed to read file /vol/system/title/00050010/1000400a/code/padscore.rpl, err -196635
00;00;05;482: UserMode OS library build date: Jul 28 2015 19:57:03
00:00:05:766: COS encountered unrecoverable error...

Pending Resource Request for COS processes...
        Title Id       Process Id -> RM Path             
00;00;05;482: __AppFlags: 0x00000200

00;00;05;484: OSBlockThreadsOnExit default for sdk version 21301
00;00;05;519: ***IOP-IPC FAILED reading padscore.rpl with a fatal error code to LiWaitIopComplete. Fatal err = (3,-27).
00;00;05;523: ***LiLoadForPrep failure (3,-27) loading "padscore".
00;00;05;523: ***Loader failure (3,-27).
00;00;05;523: __OSDynLoad_InitFromCoreInit() - main program load failed (err=0xFFFCFFE5).
00;00;05;523: SystemFatal: messageType:       1
00;00;05;523: SystemFatal: errorCode:         1872a7
00;00;05;523: SystemFatal: internalErrorCode: fffcffe5
00;00;05;523: SystemFatal: processId:         1
00;00;05;523: SystemFatal: functionName:      LiWaitOneChunk
00;00;05;523: SystemFatal: line:              114
00;00;05;523: Error: forcing shutdown of COS.
00:00:06:166: NET: Change admin state (2 -> 1)(iface:0 link:2)
00:00:06:167: [WD]>>>> Linkup msg from Net
00:00:06:181: wlc_mlme_join_cmd called with Command 0x3 Length 0x21
00:00:06:187: NET: Change admin state (0 -> 2)(iface:1 link:2)
00:00:06:188: IFNET_ETH: Configuring link adminState to DOWN.
00:00:06:189: NET: Change admin state (1 -> 1)(iface:0 link:3)
00:00:06:306: [WD]>>>> Linkup msg from Net
00:00:06:320: wlc_mlme_join_cmd called with Command 0x3 Length 0x21
00:00:07:332: NET: Change admin state (1 -> 2)(iface:0 link:2)
00:00:10:334: NET: Change admin state (2 -> 1)(iface:0 link:2)
00:00:10:334: [WD]>>>> Linkup msg from Net
00:00:10:347: wlc_mlme_join_cmd called with Command 0x3 Length 0x21
00:00:10:773: MCP: life time number of fatal errors - 1817
 1  ЎV  V4(  M  ܾ U  n,  6 )HH&\ ?>  P k  Y      қ   ~<  r 3Txs ^ D   P   /  q   a E  Ym
  6#1  Ůzt N     /L 3   ( C   c ^  Ў   v E " #  6 c^obo  r    q U    q  { a] W Р   j  >  _} R  ӝ .     K T  4 Lq &31ХI 9~ _ X* Ѝ  Yx nx&zD;y    | ǉN   3   sd  6   7    v ! gX Z   P   QÇ  x  j   4 . 6 ڧ  ;x Qu)  U L  0 !vy    K
  a  N -   V[  )I b]+ Lz1   ڥ  b1   t      g   a  X     
  )  I.# s x ·
    S  TM   AuC)  ?z N u    s /T    _p m2  b CLqP@ u de
ol6*  1    h    易5sڕ.t C | ߐ  =  38 E M  j 3   G  n9I0M    
Q 3 S+~ 
̼      nБ>      I B r
 Eį([  IV   t   MH ,#{  8;  G   m  'Qx    +-  A s#  7=   a % &- k 1   v
  LU   I  ;   V ku
 5Vg6q
/  L   #   M N g ׇ #CV  ӿ X-&( =   I f( % 8 ШE ]偔
   ͬ 0  L AI [k        + ! ã/   6v$    7 4aq 1 :CZ f    Ó 4  l ;d X`{}l  ,     fbX\  5 ] , !i1
# 47    ˀ   *  N E@r    5  LٌBK #   ˥ ٖ   Q  [~}|8 1Of * V Rd7E ? v  qp 5 =    qR    GFf#j 2xۃ
 V  :  o r)  ?     W   cb   G q; R#7 [ h;Ǻ+ [#&.    i m  e^ ҍ*   n 4 d^J@
k|Ӿ  WD  č    bȂ '   +   / 2n 2y       Jc 
l    \ 5   M ?I џ b  `    / e   4
' $r   $-> g  i 9 }   7  5ڂ݇'h)  i ?1*  9 ;Q  ^  ^     嫐 ]  \1 ;C  ٿ  DL   ǳ  :nHI    q\   =, ݋N :^   4; @0_ M^Ue 1 o?L    "#`œ  f6#'P  h  x ֒  Y u  m H    b{K "@    h   M  h+   Q@    ]   Z  XsB; o`~ Ac I   k       .I54N      f A  1_T&
\ I㊅ W lީl v  :u\  d\48' Y%'9 K@  j
_>>d޹  b辒8 |1[Y P] f  . T`  T F \  D  #    )٪on]   y" < ů    @u-  ^! 3  {N( "z/.  fB    سa A zW;  &    hq Re" )[|}a]D    = kIl   $      Ԭ         S ~joc ug =J V   _    Àgl ~ g4:  1 au   x. z    Hʆ|W 8  14ԯ - Ɔpx   =G 8     ]   C   q  ߊu *  x z &ƺ  5H  &   ӓ|f x03t   C < _' 80 F +' }:     h @<  b   i   M
Z  vV r a,  &  O Er u Y -  |0] ]˙   1  ȳ`t& l뵴d  ׹>. }y   =(& >'    ~
O|
]     D x  K:h? r   #8 v s 1)  80 v3
  j9 -wh     U   ߞ L d  _ Ǽh 9lY  s     7 B@  \, Q R  Yb X .5 Z    43[  W% sBM m  ?_).  PD+~   0-1 ,P  b  w 8 z}qG e  ?  ;\  P  e   8    !  m  e Ԫ!$ ?_
 ܽ 0      $5  '    &
-Ѥ  Flӟq   E ̦Ӟ  H&6  Ѕ&% V 
  P9r uR_܋v g םZa`     Q+   c   a $   o  0a    XL@  J`        Ld  K߂ ;r"8 .+   dɣ ]nE}     z   
  [k5
 ; 7c0 Q J  _ ս * > R    * .Y zl V  6v ] \P 'ܦ6. gs      Q   h X<  N"h  4\Op\*
y}   * !h  2&?~  g $       _  [%  u   cm (  h   c   % #  UL  Is ^   $ 6g\   ,NG ?:x       $v-ǘ   +
5jC  #       } [@ Ԁ  J  }   * 0K;:= PPő
: z U     k   ^~ y    T  ( g4 _  _ y  E : l}X  F      Tr  : ?,K7  =s  * q  M  8 Ɋ   '  6u %  ΀ݧ  `  J  s ; $
f    #
\  O̺       ~  y1&  U o `   :
  h  X 'L ~b4H _ q\ hef9Q   > C?  qw  $3IyX 5   R$d  f <1l   <k/4   "  1R1  v  FyG F    ="      y   >B ӟ R L л    ґ #˅t  n   G60 V 9 v  r   l
T  xv ?     tn GU %lgA 8:   <ڧ"`/s  )  wVK
A>-)    [6 y  d [ \h L   ; s (  q` LݽN|X S    S
 b @ C |{   z
   ^a
   Q 1 #
+) F    SPw e sC  d      ;G   ڛ   v 1   #S آ =e %  Q$i >63 
 K )   "r       
  :=  K!Y   i <   ]UB  Jm    Z& | 8֢8h|y1  s  sF r ;
 &    b~  6   8-Qu   0 G   g m  L <   z  9   w-7w    4 ڸj M z^? W {/  \wˌ -n 툶`+EE  Q ! U
 Q nmn@#y   ,1  O W  C  <    k    P(  Q4   S [ءea   3 0 , o  hĮ
  >    2O   {w   k Tp 5 ӯqe .6    ]힁  r K@ W 9g#T% L; t C     ( a  K H:]2 k    E  P%  .M  TS*    /E cm  (I VE.?DE     X~ߝEJ !O ! a5m sU  } ۄ4DB-X d *i>c
   a   Z KC   ͉   9R  E i v  {N  TE ryH9z %o <d  Y.g w   L   cZ&  ! By @ (9Ŏ 2   xhg    =7a+

The most interesting part about this is the ramdisc error. this is the only one to have this issue. Log 19 to 63 all have the hash conflict data corruption error.

I do want to be sure, did the patch attempt work? If for some reason the OSv10 file didn't install correctly that would result in the same behavior in the system, and would also be the easiest thing to troubleshoot at this point.

SDIO · Saturday at 12:54 AM

I think it did the rewrite, since the block number it is complaining about changed.

For the memtest I hacked one into the minute boot1 in this fork: https://github.com/jan-hofmeier/min...287d225dd6e495d100e8b/source/main.c#L272-L312 If you want you can try to build it yourself. Else you have to wait until tomorrow or so, when I find time for that.

AverageHumanPerson · Saturday at 1:14 AM

I'd rather not risk introducing anymore user error into the process than I need to. I have no issue waiting for you to have some time, however long that needs to take. No pressure!

Thanks again for the help.

SDIO · Tuesday at 11:09 PM

Flash that boot1 to the SD card and see what it outputs.
If you flashed the boot1 to slccmpt, then I recommend you use the defuse 0.7 firmware on the pico, to make sure it only tries the SD and not slccmpt

AverageHumanPerson · 2024-06-26T00:15:27+0100

I essentially just set-up de_fuse with the only difference being that I used the memtest images you made instead of the normal ones. I did also flash the 7.0 De_fuse code to the pico. Aside from that I treated it like a normal setup of De_fuse.

Here's the serial output - or at least a part of it -

Code:

[pico] Changed state: WIIU_CHECK_IF_POWERED_OFF -> WIIU_STATE_POWERED_OFF
[pico] Changed state: WIIU_STATE_POWERED_OFF -> WIIU_STATE_NEEDS_DEFUSE
Starting... 3224
Results:
01
02
03
04
05
08
09
0a
0b
0c
0d
0e
13
14
15
18
1b
1c
1d
1e
00
00
Error code: 00
Starting... 3223
Results:
01
02
03
04
05
08
09
0a
0b
0c
0d
0e
13
14
15
18
1b
1c
1d
1e
00
00
Error code: 00
Starting... 3222
Results:
Winner! 0xf36a
01
02
03
04
05
08
09
0a
0b
0c
0d
0e
13
14
15
18
1b
1c
1d
1e
1f
25
88
89
8a
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
81
01
0f
8f
0f
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
81
01
0f
8f
0f
00
80
00
80
00
80
00
80
00
80
00
80
00
80
00
80
00
80
00
0f
8f
0f
00
80
00
80
00
80
00
80
00
80
00
80
00
80
00
80
00
80
00
0f
8f
0f
00
01
81
01
00
01
81
01
00
01
81
01
00
80
00
80
00
01
81
01
00
80
00
01
81
01
81
01
0f
8f
0f
00
01
81
01
00
80
00
80
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
81
01
0f
8f
0f
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
80
00
80
00
80
00
80
00
80
00
0f
8f
0f
00
80
00
80
00
80
00
01
81
01
00
01
81
01
00
80
00
80
00
[pico] Changed state: WIIU_STATE_NEEDS_DEFUSE -> WIIU_STATE_DEFUSED
[pico] Changed state: WIIU_STATE_DEFUSED -> WIIU_STATE_MONITORING
020203!CF%10(MEM2U▒U▒U▒U▒U▒U▒U▒U▒beef[Pico] Switching to data mode...

fe ff ff ff ff dd dd dd dd ee ee ee ee fa fb fc
fd 00 00 00 00 4d 45 4d 30 50 52 53 48 84 80 00
00 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01

It takes the system a couple of minutes to get to the 4d 45 4d part. During which the light blinked purple. After that it started outputting all the values seen after in a constant stream. The light is solid orange when this happens. the program does not seem to end, as I let it go for about 30 minutes before Powering off and trying again to make this post.

I have no clue if this is expected behavior. It doesn't seem like it failed to start or anything.

Edit:
I did do some digging on my own and was able to confirm something interesting:

First off, Until I did the patch there WAS data corruption in the padscore file. Attached is a side by side of the padscore file taken from JUSTool and the one taken from my SLC.RAW BEFORE doing the Patch. There are only around 4 text characters (im guessing those are either bytes or nibbles) that deviate.

Once seeing that there was a difference, I de_fused and dumped a new SLC.RAW and compared the know good padscore and my new one. This time the two files were perfectly identical.

JNUSTool ver and the new SLC.RAW ver.png

This means that the SLC corruption error was genuine at first, but repairing the file didn't stop the system from crashing. RAM still seems to be the most likely issue, but at least we can rule out sticky bits or hard faults in the SLC itself.

SDIO · 2024-06-26T00:32:41+0100

That means it didn't find problems.
Now let's see if this finds anything

AverageHumanPerson · 2024-06-26T00:42:22+0100

Ok. I replaced the boot1-memtest-f file with the memtest-boot1-f file and ran it again.

The output was seemingly identical:

Code:

[pico] Changed state: WIIU_STATE_NEEDS_DEFUSE -> WIIU_STATE_DEFUSED
[pico] Changed state: WIIU_STATE_DEFUSED -> WIIU_STATE_MONITORING
020203!CF%10(MEM2U▒U▒U▒U▒U▒U▒U▒U▒be[Pico] Switching to data mode...

fe ff ff ff ff dd dd dd dd ee ee ee ee fa fb fc
fd 00 00 00 00 4d 45 4d 30 50 52 53 48 84 80 00
00 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04

SDIO · 2024-06-26T00:45:20+0100

you flashed it to the sdcard?

Hardware SLC Corruption help request

Member

Attachments

Well-Known Member

Member

Well-Known Member

Member

Well-Known Member

Member

Attachments

Well-Known Member

Member

Well-Known Member

Member

Well-Known Member

Member

Well-Known Member

Member

Well-Known Member

Attachments

Member

Well-Known Member

Attachments

Member

Well-Known Member

Popular threads in this forum