Hacking Any way to dump the complete Wii U NAND via software?

[GraFfiX420]

I've been doing some reading and it looks like a teensy is needed. I have one of these leftover from modding my ps3, but I'm curious if there's a software method to backup all areas of NAND on the Wii U? It looks like possibly just creating a rednand will create a complete backup, but is that of all areas of nand? The reason I'm looking for a software solution is I feel like I will then have no reason to open up my Wii U, unless I brick it, at which point I would open it up and solder in my teensy and restore the backup. In a related question, is there any definitive guide to wii U hardmodding? I saw a tutorial about dumping emmc, basically you just have to pull the clk line to get that to dump, but from what I understand there are several more areas of flash memory that need to be dumped.

 

[Deleted User]

You could set up redNAND using Mocha, and then use dimok's SDIO NAND Dumper utility to make a backup of your redNAND on your computer.
A backup of a backup. Nifty, huh?

 

[pelago]

See https://gbatemp.net/threads/how-to-backup-nand-in-case-of-bricking.459958/

 

[GraFfiX420]

See https://gbatemp.net/threads/how-to-backup-nand-in-case-of-bricking.459958/

Thank you sir, I believe this is what I'm looking for. Also here:

https://gbatemp.net/threads/successfully-dumped-wiiu-emmc-nand-with-hardmod.457165/

 

[GraFfiX420]

I am now dumping my Wii U via rednand creation. Unfortunately, it does not look like there is, at this time, a way to restore from a rednand dump. While all required information is contained in the dump, there is some missing information that we need in order to be able to flash some portions of the dump back to the wii. Hopefully this additional information can be discovered, also, if I'm wrong in some way, please, someone let me know.

 

[GraFfiX420]

OK, I was able to create a rednand, and it boots, using sdio nand manager I am able to get backups of SLC, SLCCMPT, and MLC. However, when I attempt to backup SEEPROM or OTP I get an error, "NAND typeot found on SD card". Anyone have any ideas what is causing this? I followed a tutorial for rednand creation, but there was an anomaly, I used the latest release of mocha (v0.2), but when I initialy selected the options to create my rednand there weren't ant options available for SEEPROM redirection and OTP redirection available. After my rednand was created, I changed the options to enable rednand, seeprom redirection, and otp redirection manually under wiiu/apps/mocha/config.ini.

 

[EyeKey]

They are create only when they needed. Use seeprom2sd and otp2sd homebrews instead.

 

[GraFfiX420]

They are create only when they needed. Use seeprom2sd and otp2sd homebrews instead.

Thank you sir, I just found those and was creating my backups then saw your reply, thanks again!

 

[lefthandsword]

Is there a way to backup just the SLC in case of a CBHC brick?

 

[GraFfiX420]

So, after dumping my SEEPROM and OTP with the appropriate utilities, each file is 1kb, is this correct? The procedure I followed was to launch mocha with rednand, then launch HBL, finally launch seeprom2sd or otp2sd.

--------------------- MERGED ---------------------------

Is there a way to backup just the SLC in case of a CBHC brick?

Yeah create a rednand then use sdio nand manager to extract the slc only, it's 512mb.

 

[Madridi]

So, after dumping my SEEPROM and OTP with the appropriate utilities, each file is 1kb, is this correct? The procedure I followed was to launch mocha with rednand, then launch HBL, finally launch seeprom2sd or otp2sd.

Yes, the bins are correct.

But seriously on-topic, someone should really create a NAND dumper, rather than forcing a rednand creation

 

[aut0mat3d]

The Nand out of RedNAND does not contain the ECC Areas of the Chip (error correction and Bad Block Remapping as i understand)
So, to have a full dump atm we need some sort of tool to dump the complete NAND or do it with a hardware flasher.
Also, if your nand gets bad blocks in the time between dump and restore we will need a Tool which checks for bad blocks differing to the dump and does a remapping.

Take a look at https://gbatemp.net/threads/successfully-dumped-wiiu-emmc-nand-with-hardmod.457165/ for some further details and the partial progress on dumping/restoring with hardware flasher

 

[GraFfiX420]

The Nand out of RedNAND does not contain the ECC Areas of the Chip (error correction and Bad Block Remapping as i understand)
So, to have a full dump atm we need some sort of tool to dump the complete NAND or do it with a hardware flasher.
Also, if your nand gets bad blocks in the time between dump and restore we will need a Tool which checks for bad blocks differing to the dump and does a remapping.

Take a look at https://gbatemp.net/threads/successfully-dumped-wiiu-emmc-nand-with-hardmod.457165/ for some further details and the partial progress on dumping/restoring with hardware flasher

Yeah I read through that thread, I'm completely comfortable with taking apart my wii u and dumping what I need to dump, but I would really like to avoid opening it up unless truly necessary. I have no doubt in my ability to complete the mod, looks pretty easy, but, the way I see it, I will most likely NEVER open my Wii U, however, if one of my kids accidentally deletes something they shouldn't and brick it, it would be nice to have the option to restore. It looked to me like at the end of that thread Leeful was able to get everything to restore properly from a rednand dump except for otp and seeprom, or am I incorrect on that?

 

[Leeful]

... It looked to me like at the end of that thread Leeful was able to get everything to restore properly from a rednand dump except for otp and seeprom, or am I incorrect on that?

The only part I could correctly restore from the rednand dumps was the MLC.img. The SLC.img and SLCCMPT.img from the rednand dump will not write back correctly with the teensy hardmod because they are incomplete. They are missing 64 bytes of ECC data in every page of the image. (rednand dump = 512 MB Vs hardmod dump = 528 MB)
The OTP.bin and SEEPROM.bin files themselves are not restored using the hardmod but they are very important to have because they contain the needed keys to decrypt or encrypt the dumped images.

 

[piratesephiroth]

The only part I could correctly restore from the rednand dumps was the MLC.img. The SLC.img and SLCCMPT.img from the rednand dump will not write back correctly with the teensy hardmod because they are incomplete. They are missing 64 bytes of ECC data in every page of the image. (rednand dump = 512 MB Vs hardmod dump = 528 MB)
The OTP.bin and SEEPROM.bin files themselves are not restored using the hardmod but they are very important to have because they contain the needed keys to decrypt or encrypt the dumped images.

so maybe there's a way to add the missing data to the software-dumped images?

 

[GraFfiX420]

The only part I could correctly restore from the rednand dumps was the MLC.img. The SLC.img and SLCCMPT.img from the rednand dump will not write back correctly with the teensy hardmod because they are incomplete. They are missing 64 bytes of ECC data in every page of the image. (rednand dump = 512 MB Vs hardmod dump = 528 MB)
The OTP.bin and SEEPROM.bin files themselves are not restored using the hardmod but they are very important to have because they contain the needed keys to decrypt or encrypt the dumped images.

Damn it, so my worse fears have been realized, I will need to hook up the teensy to get my dumps. From what I understand, SLC would be the portion of the Wii U firmware that would be corrupted/made unusable by accidentally deleting CBCH, correct?

--------------------- MERGED ---------------------------

so maybe there's a way to add the missing data to the software-dumped images?

The ECC data would be the error correction data, I would think this would be of utmost importance, as it could contain additional mapping info to account for bad regions etc.. I'm pretty sure someone smarter than myself could write a "default" set of ECC data to these regions, but the resulting dump would be useless if the ECC moved/marked anything at any point. I may be incorrect about this, someone please chime in if so.