UDPIH: USB Host Stack exploit + Recovery Menu

It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!


Supported devices:​

  • Raspberry Pi Pico (W) / Pico 2 (W)
  • Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
  • Steam Deck
  • Espressif ESP32 S2 / S3
  • Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

Booting the recovery_menu​

warning
Important notes for this to work:
  • Make sure no other USB devices are attached to the console.
  • Only use USB ports on the front of the console, the back ports will not work.
  • If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.
  • Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
  • Insert the SD Card into the console and power it on.
  • As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
    This timing is important. If you're already in the menu, the exploit won't work.
    Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
    If you get no video output or a distorted screen, your timing was most likely wrong.
  • After a few seconds you should be in the recovery menu.
So what's this recovery menu? The recovery menu allows you to fix several bricks:
screenshot

Wii U Recovery Menu

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:
  • Wii U Menu (JPN) - 00050010-10040000
  • Wii U Menu (USA) - 00050010-10040100
  • Wii U Menu (EUR) - 00050010-10040200
On non-retail systems the following additional options are available:
  • System Config Tool - 00050010-1F700500
  • DEVMENU (pre-2.09) - 00050010-1F7001FF
  • Kiosk Menu - 00050010-1FA81000
Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:
Code:
type=eth

For using wifi:
Code:
type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!
 
Last edited by GaryOderNichts,
why would you use UDPIH, if it just crashes on the Mii Maker? If the Browser still works you can just use the browser exploit for installing ISFShax.
I can't access a browser as far as I know. I'm still in the Wii U setup, like it has been factory reset.
 
Last edited by Jan_Niek,
You could still try DNSpresso. The ISFShax guide has instructions for exactly our situation.

What firmware are you on? If you get the error screen, it also shows the FW version. If it is too old (not 5.5.x) then neither exploit will work and you will need to use paid a beak (but that still needs a little work, as it is brand new)
 
is there any pybass the gamepad update msg on wiiu the console usa the gamepad is jap region. is internet if tearn off fix this msg.
 
@GaryOderNichts @GerbilSoft any trick to run the exploit in the demo kiosk console unit? I have the error 160-0103 i try the exploit in 2 regular wii u with no problem, but in the demo kiosk console cant run the exploit , and i have 2 demo consoles 1 with the problem and the other working good but in any cant.
 

Attachments

  • 20251117_231228.jpg
    20251117_231228.jpg
    2 MB · Views: 31
  • 20251117_193336.jpg
    20251117_193336.jpg
    4.3 MB · Views: 30
It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!


Supported devices:​

  • Raspberry Pi Pico (W) / Pico 2 (W)
  • Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
  • Steam Deck
  • Espressif ESP32 S2 / S3
  • Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

Booting the recovery_menu​


  • Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
  • Insert the SD Card into the console and power it on.
  • As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
    This timing is important. If you're already in the menu, the exploit won't work.
    Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
    If you get no video output or a distorted screen, your timing was most likely wrong.
  • After a few seconds you should be in the recovery menu.
So what's this recovery menu? The recovery menu allows you to fix several bricks:
screenshot

Wii U Recovery Menu

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:
  • Wii U Menu (JPN) - 00050010-10040000
  • Wii U Menu (USA) - 00050010-10040100
  • Wii U Menu (EUR) - 00050010-10040200
On non-retail systems the following additional options are available:
  • System Config Tool - 00050010-1F700500
  • DEVMENU (pre-2.09) - 00050010-1F7001FF
  • Kiosk Menu - 00050010-1FA81000
Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:
Code:
type=eth

For using wifi:
Code:
type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

I'm having a "Failed to get pincode" error when I try to sync the Gamepad, what can I do?
 
Would a pi pico with a usb c port work? Or is it different from the pico with micro usb port?
yes will work.

On the op:

Supported devices:​

  • Raspberry Pi Pico (W) / Pico 2 (W)
  • Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5

There are Raspberry Pi Pico y Zero clones which uses USB-C ports, that will work.

But be aware there are some RP2040 boards like the RP2040-Zero and similar which ARE NOT PI PICOs they are not computers but only the microcontroller, those WILL NOT WORK, those do not run Linux, instead they work with Arduino or like programming.
 
I ask because I found this one. When you say it is compatible, I buy it.
https://www.ebay.de/itm/397478625626
Should work fine.
But be aware there are some RP2040 boards like the RP2040-Zero and similar which ARE NOT PI PICOs they are not computers but only the microcontroller, those WILL NOT WORK, those do not run Linux, instead they work with Arduino or like programming.
A regular Pi Pico is also not running Linux. The RP2040-Zero is a microcontroller board with the same RP2040 as the Pi Pico and also features USB1.1 host and device support, which means it's possible to use it with UDPIH.
 
Hello! Have anyone tried doing this process with a steamdeck?, i'm having no luck trying to boot the recovery menu, no purple led nor any menu loading, i had a conversation in reddit and referred me to here but im still having the same issue.
 
Hello! Have anyone tried doing this process with a steamdeck?, i'm having no luck trying to boot the recovery menu, no purple led nor any menu loading, i had a conversation in reddit and referred me to here but im still having the same issue.
If the steamdeck would be an option, it would have been posted in here for sure. So, no. No steam deck. But a pico isn't that expensive.
 
If the steamdeck would be an option, it would have been posted in here for sure. So, no. No steam deck.
The Steam deck is listed under supported devices: https://github.com/GaryOderNichts/udpih
So yes a Steamdeck would work, while the Pico is the easiest option.

But depending on the State the Wii U is in, UDPIH won't work at all and you would need to use Paid the Beak instead.

EDIT: looking at the reddit post. UDPIH should work, if the firmware isn't acient.
Did you make sure no other USB devices are connected and to use the front port?
 
The Steam deck is listed under supported devices: https://github.com/GaryOderNichts/udpih
So yes a Steamdeck would work, while the Pico is the easiest option.

But depending on the State the Wii U is in, UDPIH won't work at all and you would need to use Paid the Beak instead.

EDIT: looking at the reddit post. UDPIH should work, if the firmware isn't acient.
Did you make sure no other USB devices are connected and to use the front port?
I make sure the only thing connected was the USB from the steam deck, I will buy the pico, regardless the steam deck is a supported device don't find info on people who uses this method and I'm not sure that I'm doing the process correctly.

After getting my pico and try it out I will update. Thanks for the response.
 
I make sure the only thing connected was the USB from the steam deck, I will buy the pico, regardless the steam deck is a supported device don't find info on people who uses this method and I'm not sure that I'm doing the process correctly.

After getting my pico and try it out I will update. Thanks for the response.
I just tried it out of curiosity with my Steam Deck, and it actually worked with my Wii U. I can see the menu on the GamePad, and after trying a few options, everything seems to be working. Previously, I set up my Steam Deck exactly according to the manual, following every step and command, even though I didn’t really know what I was doing since I’m not familiar with how Linux works under the hood.
 
  • Like
Reactions: impeeza
I just tried it out of curiosity with my Steam Deck, and it actually worked with my Wii U. I can see the menu on the GamePad, and after trying a few options, everything seems to be working. Previously, I set up my Steam Deck exactly according to the manual, following every step and command, even though I didn’t really know what I was doing since I’m not familiar with how Linux works under the hood.

Really? I haven't figured out the timing, I mean it does sound two times the disk reader and then it does like a flickering on the Wii U logo and after few seconds the Wii U logo appears normal and nothing after that.

I do follow the guide to setup and use a USB-C to USB-A cable that I have for my keyboard.

Also something worth to mention is that I don't have any gamepad connected, I bought the console second hand like two months ago and the gamepad last week.

I'll try setting up again with a clean deck and see if it works
 
  • Like
Reactions: impeeza
Really? I haven't figured out the timing, I mean it does sound two times the disk reader and then it does like a flickering on the Wii U logo and after few seconds the Wii U logo appears normal and nothing after that.

I do follow the guide to setup and use a USB-C to USB-A cable that I have for my keyboard.

Also something worth to mention is that I don't have any gamepad connected, I bought the console second hand like two months ago and the gamepad last week.

I'll try setting up again with a clean deck and see if it works
Make sure you use a working USB data cable; check it by connecting your phone to a PC. You should connect the cable when the first "Wii U" logo appears. My Wii U performs two disk checks, with a 2-3 second pause in between checks and the logo appears immediately after the second one.
On the Steam Deck side, if you have already set it up, enter the command:
sudo insmod udpih.ko
If it doesn't return an error, it should be fine and ready for connection. If you do see errors, try entering all the setup commands again in reverse order until they run without issue. It seems that Steam Deck updates may remove some or all of your setup, so you might need to start from scratch. As long as the last command doesn't give you an error, you should be good to go.
Also on the Wii U side make sure you have recovery_menu file present in the root of your FAT32 formatted SD card.

Depending on the task you need to accomplish with your Wii U, you could also use the isfshax setup guide, which doesn't require a UDPIH device. In fact, I have just resurrected a non-modded Japanese Wii U with a failing NAND using only the isfshax setup guide.
 
Last edited by pankos,
  • Like
Reactions: impeeza

Site & Scene News

Popular threads in this forum