Toggle sidebar

Tutorial  Updated

How To: Upgrading / Rebuilding Wii U Internal Memory (MLC)

Warning


This tutorial is only for advanced users and has a serious risk of bricking the console. Make sure you read it completely before executing any step and that you understand every step and its implications. With de_Fuse everything should be unbrickable if you know how.

You should at least have a backup of the SLC, as we can’t rebuild it easily. (a backup can be done in minute_minute, so there is no excuse). We had two cases where the SLC corrupted for an unknown reason, so a backup is essential.

What is this for?


This tutorial goes into rebuilding the MLC from scratch on a clean media. This can become useful, if
  • the MLC (eMMC) chip died or corrupted the filesystem
  • the SCFM (SLC cache for MLC) became inconsistent
  • you want to upgrade the capacity of the internal storage.
  • you want to set up a redNAND without SCFM
If you have a bad eMMC chip, but the recovery still works (which is most likely), then there are also ways to fix it without a complete reformat.
If the LED is blinking blue, you have a SLC problem and not a MLC problem, so this tutorial won't help with that.

It will format your MLC, so all data on the internal Wii U memory will be lost.

Update


13.03.2024 - The wafel_setup_mlc.ipx now uses a built in IOSU function to create system folders, that should make sure the permissions are right, which caused problems with game updates in the past. It will also recreate the update folder (so system updates won't be blocked by that)

Prerequisites


Backing up save games



Do a backup of what you want to preserve, like savegames and Miis.
For Backing up Save games, it is recommended to use SaveMii. That requires that you have Tiramisu or Aroma running.
You can also move your savgames (or whole games) to USB, which should still be readable. When recreating the users after the rebuild, you just have to be carefull to create the users in the right order, to make the ID’s match. A backup by other means (Like savemii) is still recommended.
If you are using this tutorial to fix a failing eMMC you might not be able to use the other Backup options. In that case use the Dump MLC option in the Recovery. You can extract your data from there using wfs-extract.

Storage Options


The Wii U has two ways of connecting internal memory, each with its own drawbacks:
  • SDIO – On retail consoles the internal memory is a eMMC chip connected through an internal SDIO bus to the Latte chip. This SDIO bus can also use SD cards (hence the name SD IO). Access to media connected on the SDIO is cached through a file on the SLC, presumably to reduce writes on the MLC. This cache is called SCFM and it is the reason why you always need to backup / restore SLC and MLC together and doesn’t allow easy swapping of multiple SDs.
    IOSU also only supports 3 sizes of media on this bus: <=8GB, 32GB and 64GB. The size will be limited to the biggest it fits, the rest is unusable. This bus is limited to 26MB/s (4bit@52Mhz). For replacing the eMMC with an micro SD you can use MLC2SD or a similar Interposer. Soldering and micro SD adapter using wires, works too.
    It is recommended to use a 64GB Sandisk Max Endurance card (But similar card should also be fine), since the Wii U is known for writing much.

  • SATA – The Disc drive is connected through SATA, the connectors are different but the electrical signals are still the same. Some Kiosk consoles used this Interface to connect to a HDD. The type of the SATA device can be configured in the SEEPROM, so we can configure our retail consoles to also use a SATA HDD / SSD.
    NOTE: @QuarkTheAwesome is building an SATA adapter for that purpose, available soon™.

    The advantage of using this interface is, that the size isn’t limited (well WFS is limited to 2TB) and it doesn’t use SCFM, which makes some things easier and improves performance in some circumstances. The obvious disadvantage is that you can’t use your disc drive anymore. Without the Disc Drive vWii System Menu doesn't work. vWii Injectes / Wii VC from the eShop can still be used, but only when installed to USB. Also you still might need to disable the MLC on the SDIO bus, or else the wii u might still use the SDIO one if the SATA device takes too long to init.

  • redNAND – redirects the read / writes to one or more of the internal storage devices to paritions on the SD card. You can create an arbitrary size MLC partition on the SD card and set it up using this tutorial. SCFM can be easily disabled for the redNAND. The 64GB limit does not exist for redNAND if the SCFM is disabled. For redNAND we have a dedicated Tutorial here: https://gbatemp.net/threads/fixing-...-soldering-using-rednand-with-isfshax.642268/

Does that mean we can’t get more than 64GB on the SDIO bus? No, BUT it requires ISFShax / defuse to boot the console every time. @GaryOderNichts created a patch to remove the limits and always use the maximum size of the SDIO media and it also disables SCFM, because SCFM doesn’t work with more than 64GB and disabling SCFM improves performance and reduces wear on the SLC, at the cost of increasing wear of the MLC media. I packaged this patch in wafel_unlimit_mlc.

Rebuilding the MLC


Now that you decided what media you want to use as MLC, we can start with the actual process:
  1. Download all the mlc system titles for your region from NUS. This can be done conveniently with MLCRestorerDownloader by @Xpl0itU. Copy the otp.bin from the SD to the folder with the MLCRestorer Downloader so it can get the common key from there.

    You will get the output/MLC/{region} directory, which then contains a directory for each title. In total there should be 52 titles totaling ~1.1GiB.

    If your console has an old firmware it might also be necessary to get the latest SLC titles.

  2. On the root of your SD card (the one that will go in the front slot, not the MLC replacement) create a folder wafel_install. Then copy all 52 titles to the wafel_install folder, so it now contains the 52 subfolders, one for each title. If you want to reinstall / update SLC titles, you would also put them there.

  3. [not needed if you just reinstall to the existing eMMC] Attach your MLC media of choice. (If you are using SATA got to Backup and Restore, then at Set SATA Device in SEEPROM select GEN2-HDD (Kiosk CAT-I with HDD)).
    For installing MLC2SD look here: https://gbatemp.net/threads/using-n...emmc-fix-160-0103-system-memory-error.636361/ at the Soldering section.

  4. If you install to eMMC / MLC2SD, got to Backup and Restore and select Erase MLC and Delete scfm.img. If the Erase MLC fails, you can ignore that if it wasn't formatted as MLC before (from a failed install or so).

  5. Put the wafel_setup_mlc.ipx on the SD card in /wiiu/ios_plugins. If you want more than 64GB on SDIO you also need to put the wafel_unlimit_mlc.ipx there. If you install with wafel_unlimit_mlc.ipx, it will be permanently required and therefore also permanently requires ISFShax or defuse.

  6. [Optional, only when using defuse] Open the serial monitor on the PC (Putty / minicom) for defuse to see the setup progress. There will be no display output in the Wii U itself. I attached the whole serial log of a successfull install as a reference.

  7. Select Patch (sd) and boot IOS (slc) in minute to start the setup of your fresh MLC.During the setup you won't see anything on the screen. You have to go by the power led.
    The power LED will flash blue, while it is installing the titles.
    if something goes wrong the LED will turn orange, but it will continue as long as it is blinking.
    The LED will become static once it finished. You can now power off the console.
    If the led is blinking red, something fatal happend. Ask for help.
    During the setup a short log gets written to the SD: wafel_setup_mlc.log.
    In the end it will enable the initial setup on the next boot.

  8. Check that the wafel_setup_mlc.ipx deleted itself from /wiiu/ios_plugins folder on the SD.

  9. Boot the console. Patch (sd) and boot IOS (slc)

  10. If everything worked, the initial setup should launch.

  11. (Optional) delete the wafel_install folder to free up space

ISFShax only: Finalizing


If you are using the wafel_unlimit_mlc.ipx you need to keep ISFShax installed. If you haven't done already complete the "Booting without SD" step form the ISFShax tutorial but also add the wafel_unlimit_mlc.ipx renamed to 9unlimit.ipx to the /storage_slc/sys/hax/ios_plugins directory.
If you are not using the wafel_unlimit_mlc.ipx you can either uninstall ISFShax or keep it as a brick protection. If you keep it complete the "Booting without SD" step form the ISFShax tutorial.
The Wii U should now boot automatically if you don't have an SD in.
You probably also want to enable the autobooting now.

See Also


https://gbatemp.net/threads/wii-u-internal-storage-upgrades-are-possible.635629/

Pictures


512 GB SD card:
img_20230702_021647-jpg.381270


@QuarkTheAwesome 120 GB SSD:
img_2709-jpg.381271


Thanks


 

Attachments

Last edited by SDIO,
  • Like
  • Love
  • Wow
Reactions: iPor, DolphinPussy, andlinux and 35 others
Click to expand...
SDIO said:
You can use this plugin for that: https://github.com/StroopwafelCFW/wafel_sata_usb/releases
Click to expand...
Okay so I did the uSATA to USB mod and it's not working!

It can format the drive and then it does read it but as soon as I return to the Wii U Menu from the System Settings the SSD is no longer readable by the Wii U and has to be formatted again. It doesn't prompt a format on the menu, it literally only reads in the Format USB Storage Device menu and nowhere else.

I've installed the ISFSHax plugins to SLC, what else am I missing? Thanks again!
 
  • Like
Reactions: DolphinPussy
Oh yeah sorry I forgot about that. The crypto stuff for USB initializes too late for sata. So this is more involved than just patching that one value.
I would have to apply a similar workaround like I did for the SDUSB plugin.
Post automatically merged:

As a workaround you could try the USB no crypto plugin.
 
  • Like
Reactions: DolphinPussy
SDIO said:
Oh yeah sorry I forgot about that. The crypto stuff for USB initializes too late for sata. So this is more involved than just patching that one value.
I would have to apply a similar workaround like I did for the SDUSB plugin.
Post automatically merged:

As a workaround you could try the USB no crypto plugin.
Click to expand...
..still not working, unfortunately, even with the SD Card out.

Doesn't USB No Crypto just disable encryption? The SATA Storage acts like a totally new drive every time I go to format it, is that the encryption kicking in?

At this point, with a guaranteed working SSD, would I be better off just doing the internal storage mod? It seems like it would be more reliable than the SATA to USB mod because right now I'm getting the impression there is no fix for this right now.
Post automatically merged:

raikaMayoXD said:
..still not working, unfortunately, even with the SD Card out.

Doesn't USB No Crypto just disable encryption? The SATA Storage acts like a totally new drive every time I go to format it, is that the encryption kicking in?

At this point, with a guaranteed working SSD, would I be better off just doing the internal storage mod? It seems like it would be more reliable than the SATA to USB mod because right now I'm getting the impression there is no fix for this right now.
Click to expand...
Oh christ it got worse. Now my console won't boot at all, it won't read minute from an SD Card and it's flashing a red light before going back to purple.

Am I fucked?
 
Last edited by raikaMayoXD,
  • Like
Reactions: DolphinPussy
flashing red likely means a short. Make sure the sata cable is plugged in correctly.

EDIT: are you sure it's not flashing orange? because orange would mean it can't lot the fw.img from SD. In that case try unplugging the console and check the SD for corruption
 
SDIO said:
flashing red likely means a short. Make sure the sata cable is plugged in correctly.

EDIT: are you sure it's not flashing orange? because orange would mean it can't lot the fw.img from SD. In that case try unplugging the console and check the SD for corruption
Click to expand...
It is orange, my bad. I've already tried a second SD Card and still the same flashing light.
Post automatically merged:

raikaMayoXD said:
It is orange, my bad. I've already tried a second SD Card and still the same flashing light.
Click to expand...
For more info, it flashed three times before returning to solid purple and staying on a black screen.
 
Last edited by raikaMayoXD,
YOOOO THANK YOU SO MUCH FOR ALL THE HELP!! Maybe I won't be able to play vWii games but I already have a Wii if I wanna play Wii games

My 1TB Wii U mod was a success! Thanks again for all the help :3
Post automatically merged:

raikaMayoXD said:
YOOOO THANK YOU SO MUCH FOR ALL THE HELP!! Maybe I won't be able to play vWii games but I already have a Wii if I wanna play Wii games

My 1TB Wii U mod was a success! Thanks again for all the help :3
Click to expand...
Final question: when I'm moving my plugins onto SLC, what should I rename the wafel_disable_mlc.ipx plugin to? I know you have to do this with the unlimit plugin, so I just wanna be safe.
 

Attachments

  • 01fd3d0f-d10b-43c1-a41b-a10e763db707.jpg
    01fd3d0f-d10b-43c1-a41b-a10e763db707.jpg
    713.4 KB · Views: 26
  • Love
Reactions: DolphinPussy
SDIO said:
I guess then the DRH is bad
Click to expand...
Is there a good way to rule out any software issues? It would be preferable not to scrap a whole console.

Edit: Whenever I turn the console off with the button, the indicator light blinks red. When the 5GHz module is removed, the flashing does not occur... So the problem is definitely to do with this part. I just can't see why it would suddenly fail when messing with the MLC.
 
Last edited by W3Y0U2,
Hi, @SDIO I'm trying to recover my Wii U using NAND AID. I'm following the tutorial steps, and when I select the "Patch (sd) and boot IOS (slc)" option, it gets to a certain point and then stops. The blue LED never blinks. I've attached a PuTTY console log in case you have any idea what's happening.

Main menu

Patch (slc) and boot IOS (slc)
Patch (sd) and boot IOS redNAND
> Patch (sd) and boot IOS (slc) <
Patch (sd) and boot sdmc:/ios_orig.img
Patch (sd) and boot sdmc:/ios_orig.img redNAND
Patch ISFShax and boot IOS (slc)
Boot 'ios.img'
Boot IOP firmware file
Boot PowerPC ELF file
Backup and Restore
Interactive debug console
PRSH tweaks
Display crash log
Clear crash log
Restart minute
Hardware reset
Power off
Credits
Mounting slc...
ISFShax detected
ancast: no patch file `ios.patch`, stubbing...
ancast: reading 0xdfd200 bytes from slc:/sys/title/00050010/1000400a/code/fw.img
ancast: ...00000000 -> 01000000
ancast: ...00100000 -> 01100000
ancast: ...00200000 -> 01200000
ancast: ...00300000 -> 01300000
ancast: ...00400000 -> 01400000
ancast: ...00500000 -> 01500000
ancast: ...00600000 -> 01600000
ancast: ...00700000 -> 01700000
ancast: ...00800000 -> 01800000
ancast: ...00900000 -> 01900000
ancast: ...00a00000 -> 01a00000
ancast: ...00b00000 -> 01b00000
ancast: ...00c00000 -> 01c00000
ancast: ...00d00000 -> 01d00000
ancast: done reading
ancast: decrypting slc:/sys/title/00050010/1000400a/code/fw.img...
ancast: fini
ancast: IOS image is prod 5.5.0 ~ 5.5.4
00core.ipx
5isfshax.ipx
wafel_debug_exts.ipx
wafel_setup_mlc.ipx
ancast: pre-parsing plugin `sdmc:/wiiu/ios_plugins/wafel_core.ipx`
ancast: pre-parsing plugin `sdmc:/wiiu/ios_plugins/00core.ipx`
ancast: pre-parsing plugin `sdmc:/wiiu/ios_plugins/5isfshax.ipx`
ancast: pre-parsing plugin `sdmc:/wiiu/ios_plugins/wafel_debug_exts.ipx`
ancast: pre-parsing plugin `sdmc:/wiiu/ios_plugins/wafel_setup_mlc.ipx`
ancast: loading plugin `sdmc:/wiiu/ios_plugins/wafel_core.ipx` to 27c00000
ancast: loading plugin `sdmc:/wiiu/ios_plugins/00core.ipx` to 27d7a000
ancast: loading plugin `sdmc:/wiiu/ios_plugins/5isfshax.ipx` to 27ef5000
ancast: loading plugin `sdmc:/wiiu/ios_plugins/wafel_debug_exts.ipx` to 27f07000
ancast: loading plugin `sdmc:/wiiu/ios_plugins/wafel_setup_mlc.ipx` to 27f18000
ancast: loading data to 27f44000
prsh: checksum header: old=9254f7bf new=5ad4c19c
prsh: checksum prst: old=505276c9 new=505276c9
GPU clocked at: 544.999877MHz
Unmounting SLC...
Shutting down MLC...
Shutting down SD card...
sdhc_bus_power(0x0)
Shutting down interrupts...
Shutting down caches and MMU...
prsh: checksum header: old=5ad4c19c new=acb78489
prsh: checksum prst: old=505276c9 new=505276c9
Vectoring to 0x01000300...
Jumping to IOS... GO GO GO
we in here kern 0x27c014e0, base 0x27c00000
Inserted 27c00000 before e0000000 and after 20000000!
Inserted 27c00000 before e0000000 and after 27c00000!
Inserted 27c00000 before e0000000 and after 05200000!
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg A lign
PHDR 0x000034 0x1d000000 0x1d000000 0x00000960 0x00000960 0x000000 0 x4
NOTE 0x000934 0x1d000960 0x1d000960 0x000002ac 0x000002ac 0x000000 0 x4
LOAD 0x000034 0x1d000000 0x1d000000 0x00000c0c 0x02b00000 0x000000 0 x4000
LOAD 0x000be0 0x04000000 0x08280000 0x00017020 0x00017020 0x300005 0 x4
LOAD 0x017c00 0x04020000 0x082a0000 0x00003f70 0x00003f70 0x300004 0 x4
LOAD 0x01bb70 0x04024000 0x082a4000 0x00000ed4 0x00000ed4 0x300006 0 x40
LOAD 0x01ca44 0x04025000 0x082a5000 0x00000000 0x000095c0 0x300006 0 x40
LOAD 0x01ca44 0x05000000 0x081c0000 0x000598f0 0x000598f0 0x100005 0 x4
LOAD 0x076334 0x05060000 0x08220000 0x0000ffc4 0x0000ffc4 0x100004 0 x40
LOAD 0x0862f8 0x05070000 0x08230000 0x00003420 0x00003420 0x100006 0 x40
LOAD 0x089718 0x05074000 0x08234000 0x00000000 0x00048574 0x100006 0 x40
LOAD 0x089718 0x05100000 0x13d80000 0x00015d6c 0x00015d6c 0x100005 0 x4
LOAD 0x09f484 0x08120000 0x08120000 0x00015000 0x00015000 0x000005 0 x10
LOAD 0x0b4484 0x08140000 0x08140000 0x00002478 0x00002478 0x000004 0 x10
LOAD 0x0b68fc 0x08143000 0x08143000 0x0000d000 0x0000d000 0x000006 0 x10
LOAD 0x0c38fc 0x08150000 0x08150000 0x00000000 0x00061230 0x000006 0 x4000
LOAD 0x0c38fc 0x10000000 0x10000000 0x00000000 0x00100000 0x100006 0 x1
LOAD 0x0c38fc 0x10100000 0x10100000 0x000312d0 0x000312d0 0x400005 0 x4
LOAD 0x0f4bcc 0x10140000 0x10140000 0x00004694 0x00004694 0x400004 0 x4
LOAD 0x0f9260 0x10145000 0x10145000 0x000000dc 0x000000dc 0x400006 0 x4
LOAD 0x0f933c 0x10146000 0x10146000 0x00000000 0x0037f4e8 0x400006 0 x20
LOAD 0x0f933c 0x10700000 0x10700000 0x000f81c4 0x000f81c4 0x500005 0 x4
LOAD 0x1f1500 0x10800000 0x10800000 0x00033b6c 0x00033b6c 0x500004 0 x20
LOAD 0x22506c 0x10834000 0x10834000 0x000005d0 0x000005d0 0x500006 0 x4
LOAD 0x22563c 0x10835000 0x10835000 0x00000000 0x01406554 0x500006 0 x200
LOAD 0x22563c 0x11f00000 0x11f00000 0x00085770 0x00085770 0x600005 0 x4
LOAD 0x2aadac 0x11fc0000 0x11fc0000 0x000140b0 0x000140b0 0x600004 0 x4
LOAD 0x2bee5c 0x11fd5000 0x11fd5000 0x00023234 0x00023234 0x600006 0 x4
LOAD 0x2e2090 0x11ff9000 0x11ff9000 0x00000000 0x0015f41c 0x600006 0 x1000
LOAD 0x2e2090 0x12300000 0x12300000 0x00131844 0x00131844 0x700005 0 x4
LOAD 0x4138d4 0x12440000 0x12440000 0x000288e8 0x000288e8 0x700004 0 x4
LOAD 0x43c1bc 0x12469000 0x12469000 0x000000e4 0x000000e4 0x700006 0 x4
LOAD 0x43c2a0 0x1246a000 0x1246a000 0x0005b31d 0x0005b31d 0x700006 0 x4
LOAD 0x4975c0 0x124c6000 0x124c6000 0x00000000 0x003c7028 0x700006 0 x40
LOAD 0x4975c0 0x1fb00000 0x1fb00000 0x00300000 0x00300000 0x700006 0 x4
LOAD 0x7975c0 0x1fe00000 0x1fe00000 0x00014ef4 0x00014ef4 0x100006 0 x20
LOAD 0x7ac4b4 0x1fe40000 0x1fe40000 0x00000000 0x001c0000 0x100006 0 x1
LOAD 0x7ac4b4 0x20000000 0x20000000 0x00000000 0x07c00000 0x500006 0 x1
LOAD 0x000000 0x27c00000 0x27c00000 0x00400000 0x00400000 0x100007 0 x1
LOAD 0x000000 0x05200000 0x27c00000 0x00000000 0x00100000 0x100007 0 x1
LOAD 0x000000 0x10600000 0x27c00000 0x00000000 0x00100000 0x100007 0 x1
LOAD 0x7ac4b4 0xe0000000 0x12900000 0x000db65c 0x000db65c 0x800005 0 x4
LOAD 0x887b10 0xe0100000 0x12a00000 0x0002088c 0x0002088c 0x800004 0 x4
LOAD 0x8a839c 0xe0121000 0x12a21000 0x00000124 0x00000124 0x800006 0 x4
LOAD 0x8a84c0 0xe0122000 0x12a22000 0x00000650 0x00000650 0x800006 0 x4
LOAD 0x8a8b10 0xe0123000 0x12a23000 0x00000000 0x0013ef10 0x800006 0 x40
LOAD 0x8a8b10 0xe1000000 0x12bc0000 0x00090d08 0x00090d08 0x900005 0 x4
LOAD 0x939818 0xe10c0000 0x12c80000 0x000213b4 0x000213b4 0x900004 0 x4
LOAD 0x95abcc 0xe10e2000 0x12ca2000 0x00001734 0x00001734 0x900006 0 x4
LOAD 0x95c300 0xe10e4000 0x12ca4000 0x00000000 0x002043b8 0x900006 0 x20
LOAD 0x95c300 0xe2000000 0x12ec0000 0x002651e0 0x002651e0 0xb00005 0 x4
LOAD 0xbc14e0 0xe2280000 0x13140000 0x00048934 0x00048934 0xb00004 0 x4
LOAD 0xc09e14 0xe22c9000 0x13189000 0x00000264 0x00000264 0xb00006 0 x4
LOAD 0xc0a078 0xe22ca000 0x1318a000 0x00000604 0x00000604 0xb00006 0 x4
LOAD 0xc0a67c 0xe22cb000 0x1318b000 0x00000000 0x003fd9f0 0xb00006 0 x40
LOAD 0xc0a67c 0xe3000000 0x13640000 0x0016ba14 0x0016ba14 0xc00005 0 x4
LOAD 0xd76090 0xe3180000 0x137c0000 0x0002c78c 0x0002c78c 0xc00004 0 x4
LOAD 0xda281c 0xe31ad000 0x137ed000 0x00000150 0x00000150 0xc00006 0 x4
LOAD 0xda296c 0xe31ae000 0x137ee000 0x000009d0 0x000009d0 0xc00006 0 x4
LOAD 0xda333c 0xe31af000 0x137ef000 0x00000000 0x0014da94 0xc00006 0 x40
LOAD 0xda333c 0xe4000000 0x13a40000 0x00019704 0x00019704 0xd00005 0 x4
LOAD 0xdbca40 0xe4040000 0x13a80000 0x00005ae8 0x00005ae8 0xd00004 0 x4
LOAD 0xdc2528 0xe4046000 0x13a86000 0x0000005c 0x0000005c 0xd00006 0 x4
LOAD 0xdc2584 0xe4047000 0x13a87000 0x00000000 0x0011123c 0xd00006 0 x20
LOAD 0xdc2584 0xe5000000 0x13c00000 0x0000fd64 0x0000fd64 0xa00005 0 x4
LOAD 0xdd22e8 0xe5040000 0x13c40000 0x0000328c 0x0000328c 0xa00004 0 x4
LOAD 0xdd5574 0xe5044000 0x13c44000 0x000006e4 0x000006e4 0xa00006 0 x4
LOAD 0xdd5c58 0xe5045000 0x13c45000 0x00000000 0x00029900 0xa00006 0 x20
LOAD 0xdd5c58 0xe6000000 0x13cc0000 0x00010a80 0x00010a80 0x200005 0 x4
LOAD 0xde66d8 0xe6040000 0x13d00000 0x00001b90 0x00001b90 0x200004 0 x4
LOAD 0xde8268 0xe6042000 0x13d02000 0x00004990 0x00004990 0x200006 0 x4
LOAD 0xdecbf8 0xe6047000 0x13d07000 0x00000000 0x000011f4 0x200006 0 x4
LOAD 0xdecbf8 0xe7000000 0x082c0000 0x00001000 0x00001000 0x200006 0 x4
LOAD 0xdedbf8 0xeff00000 0xfff00000 0x00000000 0x00008000 0x100006 0 x1
LOAD 0xdedbf8 0xffff0000 0xffff0000 0x0000eb0c 0x0000eb0c 0x000007 0 x4
kern_main symbol at: 27c014e0
our module mem size is: 0017a000
registering plugin: 27d7a000
registering plugin: 27ef5000
registering plugin: 27f07000
registering plugin: 27f18000
skipping data: 27f44000
linking plugin: 27d7a000
wafel_core: 31 00000000->00000000 __syscall_exit
wafel_core: c2 00000000->00000000 __syscall_getreent
wafel_core: 2e 00000000->00000000 __syscall_lock_acquire
wafel_core: 2e 00000000->00000000 __syscall_lock_acquire
wafel_core: 2bb 00000000->00000000 __syscall_lock_release
wafel_core: 125 00000000->00000000 __syscall_lock_acquire_recursive
wafel_core: 125 00000000->00000000 __syscall_lock_acquire_recursive
wafel_core: 106 00000000->00000000 __syscall_lock_release_recursive
wafel_core: 22e 00000000->00000000 __syscall_cond_signal
wafel_core: 186 00000000->00000000 __syscall_cond_broadcast
wafel_core: 24e 00000000->00000000 __syscall_cond_wait
wafel_core: 58 00000000->00000000 __syscall_cond_wait_recursive
wafel_core: bf 00000000->00000000 __syscall_clock_gettime
wafel_core: fd 00000000->00000000 __syscall_clock_settime
wafel_core: 23b 00000000->00000000 __syscall_clock_getres
wafel_core: 31 00000000->00000000 __syscall_exit
wafel_core: c2 00000000->00000000 __syscall_getreent
wafel_core: 2e 00000000->00000000 __syscall_lock_acquire
wafel_core: 2bb 00000000->00000000 __syscall_lock_release
wafel_core: 125 00000000->00000000 __syscall_lock_acquire_recursive
wafel_core: 106 00000000->00000000 __syscall_lock_release_recursive
wafel_core: 22e 00000000->00000000 __syscall_cond_signal
wafel_core: 186 00000000->00000000 __syscall_cond_broadcast
wafel_core: 24e 00000000->00000000 __syscall_cond_wait
wafel_core: 58 00000000->00000000 __syscall_cond_wait_recursive
wafel_core: bf 00000000->00000000 __syscall_clock_gettime
wafel_core: fd 00000000->00000000 __syscall_clock_settime
wafel_core: 23b 00000000->00000000 __syscall_clock_getres
wafel_core: 5e 00000000->00000000 __syscall_lock_try_acquire_recursive
wafel_core: 114 00000000->00000000 __syscall_lock_try_acquire
linking plugin: 27ef5000
wafel_core: 5 00000000->27c00474 __wafel_dynamic
wafel_core: 8 00000000->27c073bc memcpy16
wafel_core: 9 00000000->27c00db0 ios_elf_vaddr_to_paddr
wafel_core: 20 00000000->27c006e8 wafel_find_symbol
wafel_core: 21 00000000->27c04058 debug_printf
wafel_core: 23 00000000->27c002c8 boyer_moore_search
linking plugin: 27f07000
wafel_core: 3 00000000->27c00474 __wafel_dynamic
wafel_core: 7 00000000->27c03d54 trampoline_hook_before
wafel_core: 19 00000000->27c04058 debug_printf
wafel_core: 1b 00000000->27c1b478 svc_sys_write
linking plugin: 27f18000
wafel_core: 15 00000000->00000000 __syscall_exit
wafel_core: 4f 00000000->00000000 __syscall_getreent
wafel_core: 14 00000000->00000000 __syscall_lock_acquire
wafel_core: 14 00000000->00000000 __syscall_lock_acquire
wafel_core: 11a 00000000->00000000 __syscall_lock_release
wafel_core: 76 00000000->00000000 __syscall_lock_acquire_recursive
wafel_core: 76 00000000->00000000 __syscall_lock_acquire_recursive
wafel_core: 6a 00000000->00000000 __syscall_lock_release_recursive
wafel_core: e3 00000000->00000000 __syscall_cond_signal
wafel_core: 9a 00000000->00000000 __syscall_cond_broadcast
wafel_core: f2 00000000->00000000 __syscall_cond_wait
wafel_core: 28 00000000->00000000 __syscall_cond_wait_recursive
wafel_core: 4c 00000000->00000000 __syscall_clock_gettime
wafel_core: 67 00000000->00000000 __syscall_clock_settime
wafel_core: e8 00000000->00000000 __syscall_clock_getres
wafel_core: 15 00000000->00000000 __syscall_exit
wafel_core: 4f 00000000->00000000 __syscall_getreent
wafel_core: 14 00000000->00000000 __syscall_lock_acquire
wafel_core: 11a 00000000->00000000 __syscall_lock_release
wafel_core: 76 00000000->00000000 __syscall_lock_acquire_recursive
wafel_core: 6a 00000000->00000000 __syscall_lock_release_recursive
wafel_core: e3 00000000->00000000 __syscall_cond_signal
wafel_core: 9a 00000000->00000000 __syscall_cond_broadcast
wafel_core: f2 00000000->00000000 __syscall_cond_wait
wafel_core: 28 00000000->00000000 __syscall_cond_wait_recursive
wafel_core: 4c 00000000->00000000 __syscall_clock_gettime
wafel_core: 67 00000000->00000000 __syscall_clock_settime
wafel_core: e8 00000000->00000000 __syscall_clock_getres
wafel_core: a 00000000->27c07430 iosCreateThread
wafel_core: 18 00000000->27c00474 __wafel_dynamic
wafel_core: 20 00000000->27c075c0 iosOpen
wafel_core: 2a 00000000->27c073bc memcpy16
wafel_core: 2d 00000000->00000000 __syscall_lock_try_acquire_recursive
wafel_core: 30 00000000->27c00db0 ios_elf_vaddr_to_paddr
wafel_core: 32 00000000->27c0444c usleep
wafel_core: 33 00000000->27c07570 iosFree
wafel_core: 44 00000000->27c0514c FSA_Remove
wafel_core: 47 00000000->27c075f0 iosIoctlv
wafel_core: 53 00000000->27c04528 FSA_Open
wafel_core: 5d 00000000->27c0477c FSA_FlushVolume
wafel_core: 6e 00000000->27c0460c MCP_InstallTarget
wafel_core: 70 00000000->27c04cd0 FSA_FlushFile
wafel_core: 71 00000000->00000000 __syscall_lock_try_acquire
wafel_core: 74 00000000->27c0470c FSA_Unmount
wafel_core: 78 00000000->27c048cc FSA_ReadDir
wafel_core: 81 00000000->27c04a80 FSA_OpenFile
wafel_core: 88 00000000->27c075c8 iosClose
wafel_core: 9b 00000000->27c04940 FSA_CloseDir
wafel_core: a1 00000000->27c03f70 trampoline_t_hook_before
wafel_core: a9 00000000->27c04854 FSA_OpenDir
wafel_core: b9 00000000->27c075e8 iosIoctl
wafel_core: c4 00000000->27c0465c FSA_Mount
wafel_core: d9 00000000->27c04534 MCP_InstallGetInfo
wafel_core: dc 00000000->27c07560 iosAlloc
wafel_core: f4 00000000->27c04bdc FSA_WriteFile
wafel_core: f8 00000000->27c07460 iosStartThread
wafel_core: 109 00000000->27c006e8 wafel_find_symbol
wafel_core: 10c 00000000->27c04c78 FSA_CloseFile
wafel_core: 110 00000000->27c04058 debug_printf
wafel_core: 118 00000000->27c045a8 MCP_Install
wafel_core: 120 00000000->27c07568 iosAllocAligned
skipping data: 27f44000
00: boot_info
01: otp
02: minute_boot
Found OTP in PRSH at 0x27f44220 with size 1024
wafel_core: found OTP read pattern 1 at 08120290...
wafel_core: found OTP read at 08120248.
Patch size: 0xc
Patch size: 0x18
Patch size: 0x4
Patch size: 0x4
Patch size: 0x4
Patch size: 0x4
Patch size: 0x4
Patch size: 0x4
Patch size: 0x8
Patch size: 0x10
Patch size: 0xc
Patch size: 0xc
Patch size: 0xc
Patch size: 0xc
Patch size: 0x2
Patch size: 0x2
Patch size: 0x2
Patch size: 0x4
Patch size: 0x2
Patch size: 0x4
Patch size: 0x8
Patch size: 0x4
Patch size: 0x1a
Patch size: 0xc
Patch size: 0x4
Patch size: 0x4
Patch size: 0x4
Patch size: 0x4
Patch size: 0x8
Patch size: 0x2
Patch size: 0x4
Patch size: 0x4
Patch size: 0x2
Patch size: 0x8
Patch size: 0x8
Patch size: 0x4
Patch size: 0x4
Patch size: 0x4
Patch size: 0x4
Patch size: 0x8
Patch size: 0x8
calling kern_entry in plugin: 27d7a000
we in here kern 0x27d7b324, base 0x27d7a000
Inserted 27d7a000 before e0000000 and after 10600000!
Add MCP_ALT_BASE
Inserted 27d7a000 before e0000000 and after 27d7a000!
Add FS_ALT_BASE
Inserted 27d7a000 before e0000000 and after 05200000!
Add NET_ALT_BASE
Inserted 27d7a000 before e0000000 and after 10600000!
Inserted 27d7a000 before e0000000 and after 12200000!
Inserted 27d7a000 before e1300000 and after 12200000!
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg A lign
PHDR 0x000034 0x1d000000 0x1d000000 0x00000a20 0x00000a20 0x000000 0 x4
NOTE 0x000934 0x1d000a20 0x1d000a20 0x000002ac 0x000002ac 0x000000 0 x4
LOAD 0x000034 0x1d000000 0x1d000000 0x00000ccc 0x02b00000 0x000000 0 x4000
LOAD 0x000be0 0x04000000 0x08280000 0x00017020 0x00017020 0x300005 0 x4
LOAD 0x017c00 0x04020000 0x082a0000 0x00003f70 0x00003f70 0x300004 0 x4
LOAD 0x01bb70 0x04024000 0x082a4000 0x00000ed4 0x00000ed4 0x300006 0 x40
LOAD 0x01ca44 0x04025000 0x082a5000 0x00000000 0x000095c0 0x300006 0 x40
LOAD 0x01ca44 0x05000000 0x081c0000 0x000598f0 0x000598f0 0x100005 0 x4
LOAD 0x076334 0x05060000 0x08220000 0x0000ffc4 0x0000ffc4 0x100004 0 x40
LOAD 0x0862f8 0x05070000 0x08230000 0x00003420 0x00003420 0x100006 0 x40
LOAD 0x089718 0x05074000 0x08234000 0x00000000 0x00048574 0x100006 0 x40
LOAD 0x089718 0x05100000 0x13d80000 0x00015d6c 0x00015d6c 0x100005 0 x4
LOAD 0x09f484 0x08120000 0x08120000 0x00015000 0x00015000 0x000005 0 x10
LOAD 0x0b4484 0x08140000 0x08140000 0x00002478 0x00002478 0x000004 0 x10
LOAD 0x0b68fc 0x08143000 0x08143000 0x0000d000 0x0000d000 0x000006 0 x10
LOAD 0x0c38fc 0x08150000 0x08150000 0x00000000 0x00061230 0x000006 0 x4000
LOAD 0x0c38fc 0x10000000 0x10000000 0x00000000 0x00100000 0x100006 0 x1
LOAD 0x0c38fc 0x10100000 0x10100000 0x000312d0 0x000312d0 0x400005 0 x4
LOAD 0x0f4bcc 0x10140000 0x10140000 0x00004694 0x00004694 0x400004 0 x4
LOAD 0x0f9260 0x10145000 0x10145000 0x000000dc 0x000000dc 0x400006 0 x4
LOAD 0x0f933c 0x10146000 0x10146000 0x00000000 0x0037f4e8 0x400006 0 x20
LOAD 0x0f933c 0x10700000 0x10700000 0x000f81c4 0x000f81c4 0x500005 0 x4
LOAD 0x1f1500 0x10800000 0x10800000 0x00033b6c 0x00033b6c 0x500004 0 x20
LOAD 0x22506c 0x10834000 0x10834000 0x000005d0 0x000005d0 0x500006 0 x4
LOAD 0x22563c 0x10835000 0x10835000 0x00000000 0x01406554 0x500006 0 x200
LOAD 0x22563c 0x11f00000 0x11f00000 0x00085770 0x00085770 0x600005 0 x4
LOAD 0x2aadac 0x11fc0000 0x11fc0000 0x000140b0 0x000140b0 0x600004 0 x4
LOAD 0x2bee5c 0x11fd5000 0x11fd5000 0x00023234 0x00023234 0x600006 0 x4
LOAD 0x2e2090 0x11ff9000 0x11ff9000 0x00000000 0x0015f41c 0x600006 0 x1000
LOAD 0x2e2090 0x12300000 0x12300000 0x00131844 0x00131844 0x700005 0 x4
LOAD 0x4138d4 0x12440000 0x12440000 0x000288e8 0x000288e8 0x700004 0 x4
LOAD 0x43c1bc 0x12469000 0x12469000 0x000000e4 0x000000e4 0x700006 0 x4
LOAD 0x43c2a0 0x1246a000 0x1246a000 0x0005b31d 0x0005b31d 0x700006 0 x4
LOAD 0x4975c0 0x124c6000 0x124c6000 0x00000000 0x003c7028 0x700006 0 x40
LOAD 0x4975c0 0x1fb00000 0x1fb00000 0x00300000 0x00300000 0x700006 0 x4
LOAD 0x7975c0 0x1fe00000 0x1fe00000 0x00014ef4 0x00014ef4 0x100006 0 x20
LOAD 0x7ac4b4 0x1fe40000 0x1fe40000 0x00000000 0x001c0000 0x100006 0 x1
LOAD 0x7ac4b4 0x20000000 0x20000000 0x00000000 0x07c00000 0x500006 0 x1
LOAD 0x000000 0x27c00000 0x27c00000 0x00400000 0x00400000 0x100007 0 x1
LOAD 0x000000 0x05200000 0x27c00000 0x00000000 0x00100000 0x100007 0 x1
LOAD 0x000000 0x10600000 0x27c00000 0x00000000 0xffe7a000 0x100007 0 x1
LOAD 0x000000 0x27d7a000 0x27d7a000 0x00286000 0x00286000 0x000007 0 x1
LOAD 0x000000 0x05200000 0x27d7a000 0x00000000 0x00100000 0x000007 0 x1
LOAD 0x000000 0x10600000 0x27d7a000 0x00000000 0x00100000 0x000007 0 x1
LOAD 0x000000 0x12200000 0x27d7a000 0x00000000 0x00100000 0x000007 0 x1
LOAD 0x000000 0xe5f00000 0x27d7a000 0x00000000 0x00100000 0x000007 0 x1
LOAD 0x000000 0xe1300000 0x27d7a000 0x00000000 0x00100000 0x000007 0 x1
LOAD 0x7ac4b4 0xe0000000 0x12900000 0x000db65c 0x000db65c 0x800005 0 x4
LOAD 0x887b10 0xe0100000 0x12a00000 0x0002088c 0x0002088c 0x800004 0 x4
LOAD 0x8a839c 0xe0121000 0x12a21000 0x00000124 0x00000124 0x800006 0 x4
LOAD 0x8a84c0 0xe0122000 0x12a22000 0x00000650 0x00000650 0x800006 0 x4
LOAD 0x8a8b10 0xe0123000 0x12a23000 0x00000000 0x0013ef10 0x800006 0 x40
LOAD 0x8a8b10 0xe1000000 0x12bc0000 0x00090d08 0x00090d08 0x900005 0 x4
LOAD 0x939818 0xe10c0000 0x12c80000 0x000213b4 0x000213b4 0x900004 0 x4
LOAD 0x95abcc 0xe10e2000 0x12ca2000 0x00001734 0x00001734 0x900006 0 x4
LOAD 0x95c300 0xe10e4000 0x12ca4000 0x00000000 0x002043b8 0x900006 0 x20
LOAD 0x95c300 0xe2000000 0x12ec0000 0x002651e0 0x002651e0 0xb00005 0 x4
LOAD 0xbc14e0 0xe2280000 0x13140000 0x00048934 0x00048934 0xb00004 0 x4
LOAD 0xc09e14 0xe22c9000 0x13189000 0x00000264 0x00000264 0xb00006 0 x4
LOAD 0xc0a078 0xe22ca000 0x1318a000 0x00000604 0x00000604 0xb00006 0 x4
LOAD 0xc0a67c 0xe22cb000 0x1318b000 0x00000000 0x003fd9f0 0xb00006 0 x40
LOAD 0xc0a67c 0xe3000000 0x13640000 0x0016ba14 0x0016ba14 0xc00005 0 x4
LOAD 0xd76090 0xe3180000 0x137c0000 0x0002c78c 0x0002c78c 0xc00004 0 x4
LOAD 0xda281c 0xe31ad000 0x137ed000 0x00000150 0x00000150 0xc00006 0 x4
LOAD 0xda296c 0xe31ae000 0x137ee000 0x000009d0 0x000009d0 0xc00006 0 x4
LOAD 0xda333c 0xe31af000 0x137ef000 0x00000000 0x0014da94 0xc00006 0 x40
LOAD 0xda333c 0xe4000000 0x13a40000 0x00019704 0x00019704 0xd00005 0 x4
LOAD 0xdbca40 0xe4040000 0x13a80000 0x00005ae8 0x00005ae8 0xd00004 0 x4
LOAD 0xdc2528 0xe4046000 0x13a86000 0x0000005c 0x0000005c 0xd00006 0 x4
LOAD 0xdc2584 0xe4047000 0x13a87000 0x00000000 0x0011123c 0xd00006 0 x20
LOAD 0xdc2584 0xe5000000 0x13c00000 0x0000fd64 0x0000fd64 0xa00005 0 x4
LOAD 0xdd22e8 0xe5040000 0x13c40000 0x0000328c 0x0000328c 0xa00004 0 x4
LOAD 0xdd5574 0xe5044000 0x13c44000 0x000006e4 0x000006e4 0xa00006 0 x4
LOAD 0xdd5c58 0xe5045000 0x13c45000 0x00000000 0x00029900 0xa00006 0 x20
LOAD 0xdd5c58 0xe6000000 0x13cc0000 0x00010a80 0x00010a80 0x200005 0 x4
LOAD 0xde66d8 0xe6040000 0x13d00000 0x00001b90 0x00001b90 0x200004 0 x4
LOAD 0xde8268 0xe6042000 0x13d02000 0x00004990 0x00004990 0x200006 0 x4
LOAD 0xdecbf8 0xe6047000 0x13d07000 0x00000000 0x000011f4 0x200006 0 x4
LOAD 0xdecbf8 0xe7000000 0x082c0000 0x00001000 0x00001000 0x200006 0 x4
LOAD 0xdedbf8 0xeff00000 0xfff00000 0x00000000 0x00008000 0x100006 0 x1
LOAD 0xdedbf8 0xffff0000 0xffff0000 0x0000eb0c 0x0000eb0c 0x000007 0 x4
kern_main symbol at: 27d7b324
our module mem size is: 0017b000
registering plugin: 27ef5000
registering plugin: 27f07000
registering plugin: 27f18000
skipping data: 27f44000
linking plugin: 27ef5000
wafel_core: 5 00000000->27d7a474 __wafel_dynamic
wafel_core: 8 00000000->27d81d2c memcpy16
wafel_core: 9 00000000->27d7ab4c ios_elf_vaddr_to_paddr
wafel_core: 20 00000000->27d7a6d4 wafel_find_symbol
wafel_core: 21 00000000->27d7d390 debug_printf
wafel_core: 23 00000000->27d7a2c8 boyer_moore_search
linking plugin: 27f07000
wafel_core: 3 00000000->27d7a474 __wafel_dynamic
wafel_core: 7 00000000->27d7d018 trampoline_hook_before
wafel_core: 19 00000000->27d7d390 debug_printf
wafel_core: 1b 00000000->27d960f8 svc_sys_write
linking plugin: 27f18000
wafel_core: 15 00000000->00000000 __syscall_exit
wafel_core: 4f 00000000->00000000 __syscall_getreent
wafel_core: 14 00000000->00000000 __syscall_lock_acquire
wafel_core: 14 00000000->00000000 __syscall_lock_acquire
wafel_core: 11a 00000000->00000000 __syscall_lock_release
wafel_core: 76 00000000->00000000 __syscall_lock_acquire_recursive
wafel_core: 76 00000000->00000000 __syscall_lock_acquire_recursive
wafel_core: 6a 00000000->00000000 __syscall_lock_release_recursive
wafel_core: e3 00000000->00000000 __syscall_cond_signal
wafel_core: 9a 00000000->00000000 __syscall_cond_broadcast
wafel_core: f2 00000000->00000000 __syscall_cond_wait
wafel_core: 28 00000000->00000000 __syscall_cond_wait_recursive
wafel_core: 4c 00000000->00000000 __syscall_clock_gettime
wafel_core: 67 00000000->00000000 __syscall_clock_settime
wafel_core: e8 00000000->00000000 __syscall_clock_getres
wafel_core: 15 00000000->00000000 __syscall_exit
wafel_core: 4f 00000000->00000000 __syscall_getreent
wafel_core: 14 00000000->00000000 __syscall_lock_acquire
wafel_core: 11a 00000000->00000000 __syscall_lock_release
wafel_core: 76 00000000->00000000 __syscall_lock_acquire_recursive
wafel_core: 6a 00000000->00000000 __syscall_lock_release_recursive
wafel_core: e3 00000000->00000000 __syscall_cond_signal
wafel_core: 9a 00000000->00000000 __syscall_cond_broadcast
wafel_core: f2 00000000->00000000 __syscall_cond_wait
wafel_core: 28 00000000->00000000 __syscall_cond_wait_recursive
wafel_core: 4c 00000000->00000000 __syscall_clock_gettime
wafel_core: 67 00000000->00000000 __syscall_clock_settime
wafel_core: e8 00000000->00000000 __syscall_clock_getres
wafel_core: a 00000000->27d81da0 iosCreateThread
wafel_core: 18 00000000->27d7a474 __wafel_dynamic
wafel_core: 20 00000000->27d81f30 iosOpen
wafel_core: 2a 00000000->27d81d2c memcpy16
wafel_core: 2d 00000000->00000000 __syscall_lock_try_acquire_recursive
wafel_core: 30 00000000->27d7ab4c ios_elf_vaddr_to_paddr
wafel_core: 32 00000000->27d7d784 usleep
wafel_core: 33 00000000->27d81ee0 iosFree
wafel_core: 44 00000000->27d7e894 FSA_Remove
wafel_core: 47 00000000->27d81f60 iosIoctlv
wafel_core: 53 00000000->27d7d85c FSA_Open
wafel_core: 5d 00000000->27d7dba0 FSA_FlushVolume
wafel_core: 6e 00000000->27d7d9b8 MCP_InstallTarget
wafel_core: 70 00000000->27d7e31c FSA_FlushFile
wafel_core: 71 00000000->00000000 __syscall_lock_try_acquire
wafel_core: 74 00000000->27d7db30 FSA_Unmount
wafel_core: 78 00000000->27d7dcf0 FSA_ReadDir
wafel_core: 81 00000000->27d7df64 FSA_OpenFile
wafel_core: 88 00000000->27d81f38 iosClose
wafel_core: 9b 00000000->27d7ddbc FSA_CloseDir
wafel_core: a1 00000000->27d7d2a8 trampoline_t_hook_before
wafel_core: a9 00000000->27d7dc78 FSA_OpenDir
wafel_core: b9 00000000->27d81f58 iosIoctl
wafel_core: c4 00000000->27d7da08 FSA_Mount
wafel_core: d9 00000000->27d7d868 MCP_InstallGetInfo
wafel_core: dc 00000000->27d81ed0 iosAlloc
wafel_core: f4 00000000->27d7e13c FSA_WriteFile
wafel_core: f8 00000000->27d81dd0 iosStartThread
wafel_core: 109 00000000->27d7a6d4 wafel_find_symbol
wafel_core: 10c 00000000->27d7e2c4 FSA_CloseFile
wafel_core: 110 00000000->27d7d390 debug_printf
wafel_core: 118 00000000->27d7d92c MCP_Install
wafel_core: 120 00000000->27d81ed8 iosAllocAligned
skipping data: 27f44000
00: boot_info
01: otp
02: minute_boot
Found OTP in PRSH at 0x27f44220 with size 1024
wafel_core: found OTP read pattern 1 at 08120290...
wafel_core: found OTP read at 0811fe90.
Patch size: 0xc
Firmware not 5.5.x! All you get is the OTP patch, sorry.
calling kern_entry in plugin: 27ef5000
we in here isfshax patch kern 0x27ef529c
init_linking symbol at: 00000000
Patch size: 0x4
Patch size: 0x4
Failed to translate vaddr 08223e10!
isfshax patch applied
calling kern_entry in plugin: 27f07000
Failed to find DT_REL
we in here in wafel_debug_exts plugin kern 0x27f072c8
0x5055334: EBFFFFD6 -> 0x5055294
Overwriting 0x5055334: EBFFFFD6 -> 0x5055294
Installing trampoline from 0x5055334 at 0x27da3640 size 32
calling kern_entry in plugin: 27f18000
we in here setup mlc plugin kern 0x27f184d0
init_linking symbol at: 00000000
Patch size: 0x4
Patch size: 0x4
Patch size: 0x4
Patch size: 0x4
Patch size: 0x2
Patch size: 0x2
Patch size: 0x4
0x5027e9e: F031F91F -> 0x50590e1
found bl to 0x50590e1
Installing trampoline from 0x5027e9e at 0x27da3660 size 28
setup patches applied
skipping data: 27f44000
stroopwafel kern_main done
region starting at virtual address 0xffff0000:
size = 0x00010000
paddr = 0xffff0000
domain = 0x00000000
attributes: Kernel-Only, cached
region starting at virtual address 0x08120000:
size = 0x000a0000
paddr = 0x08120000
domain = 0x00000000
attributes: Kernel-Only, cached
region starting at virtual address 0x1d000000:
size = 0x02b00000
paddr = 0x1d000000
domain = 0x00000000
attributes: Read/Write, cached
region starting at virtual address 0x08000000:
size = 0x00100000
paddr = 0x08000000
domain = 0x0000000f
attributes: Read/Write, cached
region starting at virtual address 0x08100000:
size = 0x00020000
paddr = 0x08100000
domain = 0x00000000
attributes: Read/Write, cached
region starting at virtual address 0x00000000:
size = 0x00001000
paddr = 0x00000000
domain = 0x00000000
attributes: Kernel-Only, cached
region starting at virtual address 0x00001000:
size = 0x01fff000
paddr = 0x00001000
domain = 0x00000000
attributes: Read/Write, cached
region starting at virtual address 0x14000000:
size = 0x09000000
paddr = 0x14000000
domain = 0x00000000
attributes: Read/Write, cached
region starting at virtual address 0x27c00000:
size = 0x00400000
paddr = 0x27c00000
domain = 0x00000000
attributes: Read/Write, cached
region starting at virtual address 0x27c00000:
size = 0x00400000
paddr = 0x27c00000
domain = 0x00000000
attributes: Read/Write, cached
IOS_KERNEL: Built 07/28/15 19:27:01, SRAM Utilization 91%, MEM Utilization 90%.
region starting at virtual address 0x05000000:
size = 0x0005a000
paddr = 0x081c0000
domain = 0x00000001
attributes: Read-Only, cached
region starting at virtual address 0x05060000:
size = 0x00010000
paddr = 0x08220000
domain = 0x00000001
attributes: Read-Only, cached
region starting at virtual address 0x05070000:
size = 0x00004000
paddr = 0x08230000
domain = 0x00000001
attributes: Read/Write, cached
region starting at virtual address 0x05074000:
size = 0x00049000
paddr = 0x08234000
domain = 0x00000001
attributes: Read/Write, cached
region starting at virtual address 0x04000000:
size = 0x00018000
paddr = 0x08280000
domain = 0x00000003
attributes: Read-Only, cached
region starting at virtual address 0x04020000:
size = 0x00004000
paddr = 0x082a0000
domain = 0x00000003
attributes: Read-Only, cached
region starting at virtual address 0x04024000:
size = 0x00001000
paddr = 0x082a4000
domain = 0x00000003
attributes: Read/Write, cached
region starting at virtual address 0x04025000:
size = 0x0000a000
paddr = 0x082a5000
domain = 0x00000003
attributes: Read/Write, cached
region starting at virtual address 0xe7000000:
size = 0x00001000
paddr = 0x082c0000
domain = 0x00000002
attributes: Read/Write, cached
region starting at virtual address 0x10000000:
size = 0x00100000
paddr = 0x10000000
domain = 0x00000001
attributes: Read/Write, cached
region starting at virtual address 0x10100000:
size = 0x00032000
paddr = 0x10100000
domain = 0x00000004
attributes: Read-Only, cached
region starting at virtual address 0x10140000:
size = 0x00005000
paddr = 0x10140000
domain = 0x00000004
attributes: Read-Only, cached
region starting at virtual address 0x10145000:
size = 0x00001000
paddr = 0x10145000
domain = 0x00000004
attributes: Read/Write, cached
region starting at virtual address 0x10146000:
size = 0x00380000
paddr = 0x10146000
domain = 0x00000004
attributes: Read/Write, cached
region starting at virtual address 0x10700000:
size = 0x000f9000
paddr = 0x10700000
domain = 0x00000005
attributes: Read-Only, cached
region starting at virtual address 0x10800000:
size = 0x00034000
paddr = 0x10800000
domain = 0x00000005
attributes: Read-Only, cached
region starting at virtual address 0x10834000:
size = 0x00001000
paddr = 0x10834000
domain = 0x00000005
attributes: Read/Write, cached
region starting at virtual address 0x10835000:
size = 0x01407000
paddr = 0x10835000
domain = 0x00000005
attributes: Read/Write, cached
region starting at virtual address 0x11f00000:
size = 0x00086000
paddr = 0x11f00000
domain = 0x00000006
attributes: Read-Only, cached
region starting at virtual address 0xd1f00000:
size = 0x00086000
paddr = 0x11f00000
domain = 0x00000006
attributes: Read-Only, un-cached
region starting at virtual address 0x11fc0000:
size = 0x00015000
paddr = 0x11fc0000
domain = 0x00000006
attributes: Read-Only, cached
region starting at virtual address 0xd1fc0000:
size = 0x00015000
paddr = 0x11fc0000
domain = 0x00000006
attributes: Read-Only, un-cached
region starting at virtual address 0x11fd5000:
size = 0x00024000
paddr = 0x11fd5000
domain = 0x00000006
attributes: Read/Write, cached
region starting at virtual address 0xd1fd5000:
size = 0x00024000
paddr = 0x11fd5000
domain = 0x00000006
attributes: Read/Write, un-cached
region starting at virtual address 0x11ff9000:
size = 0x00160000
paddr = 0x11ff9000
domain = 0x00000006
attributes: Read/Write, cached
region starting at virtual address 0xd1ff9000:
size = 0x00160000
paddr = 0x11ff9000
domain = 0x00000006
attributes: Read/Write, un-cached
region starting at virtual address 0x12300000:
size = 0x00132000
paddr = 0x12300000
domain = 0x00000007
attributes: Read-Only, cached
region starting at virtual address 0x12440000:
size = 0x00029000
paddr = 0x12440000
domain = 0x00000007
attributes: Read-Only, cached
region starting at virtual address 0x12469000:
size = 0x00001000
paddr = 0x12469000
domain = 0x00000007
attributes: Read/Write, cached
region starting at virtual address 0x1246a000:
size = 0x0005c000
paddr = 0x1246a000
domain = 0x00000007
attributes: Read/Write, cached
region starting at virtual address 0x124c6000:
size = 0x003c8000
paddr = 0x124c6000
domain = 0x00000007
attributes: Read/Write, cached
region starting at virtual address 0xe0000000:
size = 0x000dc000
paddr = 0x12900000
domain = 0x00000008
attributes: Read-Only, cached
region starting at virtual address 0xe0100000:
size = 0x00021000
paddr = 0x12a00000
domain = 0x00000008
attributes: Read-Only, cached
region starting at virtual address 0xe0121000:
size = 0x00001000
paddr = 0x12a21000
domain = 0x00000008
attributes: Read/Write, cached
region starting at virtual address 0xe0122000:
size = 0x00001000
paddr = 0x12a22000
domain = 0x00000008
attributes: Read/Write, cached
region starting at virtual address 0xe0123000:
size = 0x0013f000
paddr = 0x12a23000
domain = 0x00000008
attributes: Read/Write, cached
region starting at virtual address 0xe1000000:
size = 0x00091000
paddr = 0x12bc0000
domain = 0x00000009
attributes: Read-Only, cached
region starting at virtual address 0xe10c0000:
size = 0x00022000
paddr = 0x12c80000
domain = 0x00000009
attributes: Read-Only, cached
region starting at virtual address 0xe10e2000:
size = 0x00002000
paddr = 0x12ca2000
domain = 0x00000009
attributes: Read/Write, cached
region starting at virtual address 0xe10e4000:
size = 0x00205000
paddr = 0x12ca4000
domain = 0x00000009
attributes: Read/Write, cached
region starting at virtual address 0xe2000000:
size = 0x00266000
paddr = 0x12ec0000
domain = 0x0000000b
attributes: Read-Only, cached
region starting at virtual address 0xe2280000:
size = 0x00049000
paddr = 0x13140000
domain = 0x0000000b
attributes: Read-Only, cached
region starting at virtual address 0xe22c9000:
size = 0x00001000
paddr = 0x13189000
domain = 0x0000000b
attributes: Read/Write, cached
region starting at virtual address 0xe22ca000:
size = 0x00001000
paddr = 0x1318a000
domain = 0x0000000b
attributes: Read/Write, cached
region starting at virtual address 0xe22cb000:
size = 0x003fe000
paddr = 0x1318b000
domain = 0x0000000b
attributes: Read/Write, cached
region starting at virtual address 0xe3000000:
size = 0x0016c000
paddr = 0x13640000
domain = 0x0000000c
attributes: Read-Only, cached
region starting at virtual address 0xe3180000:
size = 0x0002d000
paddr = 0x137c0000
domain = 0x0000000c
attributes: Read-Only, cached
region starting at virtual address 0xe31ad000:
size = 0x00001000
paddr = 0x137ed000
domain = 0x0000000c
attributes: Read/Write, cached
region starting at virtual address 0xe31ae000:
size = 0x00001000
paddr = 0x137ee000
domain = 0x0000000c
attributes: Read/Write, cached
region starting at virtual address 0xe31af000:
size = 0x0014e000
paddr = 0x137ef000
domain = 0x0000000c
attributes: Read/Write, cached
region starting at virtual address 0xe4000000:
size = 0x0001a000
paddr = 0x13a40000
domain = 0x0000000d
attributes: Read-Only, cached
region starting at virtual address 0xe4040000:
size = 0x00006000
paddr = 0x13a80000
domain = 0x0000000d
attributes: Read-Only, cached
region starting at virtual address 0xe4046000:
size = 0x00001000
paddr = 0x13a86000
domain = 0x0000000d
attributes: Read/Write, cached
region starting at virtual address 0xe4047000:
size = 0x00112000
paddr = 0x13a87000
domain = 0x0000000d
attributes: Read/Write, cached
region starting at virtual address 0xe5000000:
size = 0x00010000
paddr = 0x13c00000
domain = 0x0000000a
attributes: Read-Only, cached
region starting at virtual address 0xe5040000:
size = 0x00004000
paddr = 0x13c40000
domain = 0x0000000a
attributes: Read-Only, cached
region starting at virtual address 0xe5044000:
size = 0x00001000
paddr = 0x13c44000
domain = 0x0000000a
attributes: Read/Write, cached
region starting at virtual address 0xe5045000:
size = 0x0002a000
paddr = 0x13c45000
domain = 0x0000000a
attributes: Read/Write, cached
region starting at virtual address 0xe6000000:
size = 0x00011000
paddr = 0x13cc0000
domain = 0x00000002
attributes: Read-Only, cached
region starting at virtual address 0xe6040000:
size = 0x00002000
paddr = 0x13d00000
domain = 0x00000002
attributes: Read-Only, cached
region starting at virtual address 0xe6042000:
size = 0x00005000
paddr = 0x13d02000
domain = 0x00000002
attributes: Read/Write, cached
region starting at virtual address 0xe6047000:
size = 0x00002000
paddr = 0x13d07000
domain = 0x00000002
attributes: Read/Write, cached
region starting at virtual address 0x05100000:
size = 0x00016000
paddr = 0x13d80000
domain = 0x00000001
attributes: Read-Only, cached
region starting at virtual address 0x1fb00000:
size = 0x00300000
paddr = 0x1fb00000
domain = 0x00000007
attributes: Read/Write, cached
region starting at virtual address 0x1fe00000:
size = 0x00015000
paddr = 0x1fe00000
domain = 0x00000001
attributes: Read/Write, cached
region starting at virtual address 0x1fe40000:
size = 0x001c0000
paddr = 0x1fe40000
domain = 0x00000001
attributes: Read/Write, cached
region starting at virtual address 0x20000000:
size = 0x07c00000
paddr = 0x20000000
domain = 0x00000005
attributes: Read/Write, cached
region starting at virtual address 0x05200000:
size = 0x00100000
paddr = 0x27c00000
domain = 0x00000001
attributes: Read/Write, cached
region starting at virtual address 0x10600000:
size = 0xffe7a000
paddr = 0x27c00000
domain = 0x00000001
attributes: Read/Write, cached
HAI PARAMS: magic: 0x0, count: 0
 
It seems you have a old version of the files, since they still have to old name. Get the latest stroopwafel and isfshax patch. Your minute is probably outdated too. You can find everything on the isfsh.ax page.
But it seems you are not using isfshax anyway, so you don't need the isfshax patch at all.

Your main problem ist that your IOSU is too old. You can get the lastest OSv10 with JNUS, take the fw.img from it, renamed to ios_orig and boot the corresponding option in minute. Also make sure to include the SLC titles in your wafel_install folder, since the ones you have are outdated.
 
Hey guys. I have posted for some help on a Wii U that I received with some problems that are stopping me auto loading Aroma through Health and Safety application.The person I got the Wii U from decided to reset it halfway through setting it up and I think he screwed it up.I have a full nand backup and I can get into the minute menu, although I haven't installed isfshax yet. What would I need to get the backup back onto the Wii U with as little fuss and soldering as possible. Thanks for any help any of you may have.
 
SDIO said:
It seems you have a old version of the files, since they still have to old name. Get the latest stroopwafel and isfshax patch. Your minute is probably outdated too. You can find everything on the isfsh.ax page.
But it seems you are not using isfshax anyway, so you don't need the isfshax patch at all.

Your main problem ist that your IOSU is too old. You can get the lastest OSv10 with JNUS, take the fw.img from it, renamed to ios_orig and boot the corresponding option in minute. Also make sure to include the SLC titles in your wafel_install folder, since the ones you have are outdated.
Click to expand...
Hello @SDIO, I did what you indicated and downloaded isfshax again since I already have it installed. I also downloaded iosu v10 with the command java -jar JNUSTool.jar 0005001010004009. I extracted the firmware and renamed it, but I'm getting the error shown in the attached file. Any ideas on what I can do?

skipping data: 27f44000
00: boot_info
01: otp
02: minute_boot
Found OTP in PRSH at 0x27f44220 with size 1024
wafel_core: found OTP read pattern 1 at 08120268...
wafel_core: found OTP read at 0811fe68.
Patch size: 0xc
Firmware not 5.5.x! All you get is the OTP patch, sorry.
calling kern_entry in plugin: 27ef5000
we in here isfshax patch kern 0x27ef529c
init_linking symbol at: 00000000
Patch size: 0x4
Failed to translate vaddr 1072272c!
Patch size: 0x4
Failed to translate vaddr 05100688!
Failed to find search pattern!
62 6f 6f 74 2e 69 6d 67 00 00 00 00
 

Attachments

SDIO said:
the log is trucated, but you have the core twice. Once as wafel_core.ipx and once as 00core.ipx
Click to expand...
Thanks @SDIO, it worked perfectly after removing 00core.ipx
I have a question: isfshax is still installed on the Wii U, causing the status LED to change from blue to purple.
 
I tried to Rebuild my MLC without and eMMC replacement and it again got stuck at the GO GO GO screen. But this time with a solid orange light. Nevermind, my mistake, I didn't have it proper in the wafel_instal folder.
 
Last edited by Intoxicus5,
That means something failed during the install and you have to check to log. It might still boot, if you try.
 
Now that I have the WiiU up and running, I have a few basic questions about this project.

I intend on going the MLC2SD route and getting some interposers printed.

Does the SD card replace the eMMC 1:1, or are there specific caveats I will have to be prepared for?

For example, will an end user be able to factory reset the console through the Wii U system memory?

Could ISFShax be removed, or is it required to allow the MLC3SD to function?

SDIO said:
Does that mean we can’t get more than 64GB on the SDIO bus? No, BUT it requires ISFShax / defuse to boot the console every time. @GaryOderNichts created a patch to remove the limits and always use the maximum size of the SDIO media and it also disables SCFM, because SCFM doesn’t work with more than 64GB and disabling SCFM improves performance and reduces wear on the SLC, at the cost of increasing wear of the MLC media. I packaged this patch in wafel_unlimit_mlc.
Click to expand...

Is there a theoretical limit to how large the internal MLC sd card can be?

I don't think I'm bold enough to spend $82 on a 256GB Samsung Pro Endurance Card, but it would be a much better price per GB compared to the 64 GB card.
 

Site & Scene News

Go to forum More news

Popular threads in this forum

Homebrew  [PRERELEASE] Sonic Advance 2 Wii U

Strange Blue Blinking Wii U

Struggling to get WiiFlow/USBLoaderGX to recognize USB sticks

Feedback  Community Overclock Stats: A5X vs B1X Motherboards

Hacking Homebrew Project  Modernized YouTube for Wii U

Sonic 3 AIR Wii U teaser screenshot

Wii Games Performance on Wii U (vWii C2W Overclock) – Community Testing & Results Sharing

My dad's Wii U cannot install Aroma. HELP!!