BluUBomb - A primary Wii U entrypoint via bluetooth

H2x1_generic_WiiU_image1280w.jpg

BluUBomb exploits the Wii U's bluetooth stack to gain IOSU kernel access via bluetooth.

Not to be confused with BlueBomb for the Wii and Wii Mini.

What does this mean?
This means you can get IOSU code execution by only pairing an emulated Wii Remote to the system.

This should be useful to fix a few softbricks on the Wii U side.
You don't need a working browser or Mii Maker.
if you've messed up with regionhax and can no longer access the browser, BluUBomb can fix this as well.

The BluUBomb repository contains a few different kernel binaries for different purposes:

loadrpx.bin
Launches a launch.rpx from the root of your SD card on the next application launch.

regionfree.bin
Applies IOSU patches to temporarily remove region restrictions.
This should be helpful if you've locked yourself out of your applications due to permanent region modifications.

wupserver.bin
Launches a wupserver instance directly after using bluubomb.
This gets you full system access remotely via wupclient (replace the IP in line 29 with the one of your Wii U).
This works without having to leave the controller pairing screen.

Check out the repository for additional instructions:
https://github.com/GaryOderNichts/bluubomb

The write-up and technical details can be found here:
https://github.com/GaryOderNichts/bluubomb/blob/master/WRITEUP.md

Credits
  • GaryOderNichts - bluUbomb
  • rnconrad for the WiimoteEmulator
  • dimok789 and everyone else who made mocha possible
 
Last edited by GaryOderNichts,

testing_this

Member
Newcomer
Joined
May 17, 2021
Messages
12
Trophies
0
Age
41
XP
102
Country
United States
Alright so here is a binary which copies a file named "cert.der" from the root of your SD card to the correct certificate path.
You can get the original cert from the decrypted NUS title or if you have a backup.
So what you need to do:
- extract the attached .zip
- rename the "ssl_unbrick.bin" to "bluu_kern.bin" and copy it to the root of the SD
- rename the cert to "cert.der" and copy it to the root
- power on your Wii U
- run bluubomb
- wait

Once finished successfully the console will reboot. If it fails it will power off without rebooting.
Let me know how it goes.

It didn't work. :(

I double checked that the files were the correct ones (ssl_unbrick.bin and CACERT_NINTENDO_CA_G3.der)
I did rename them.

Nothing changes on the console, I still can go back and then freezes. I tried 3 times.
 

GaryOderNichts

Well-Known Member
OP
Member
Joined
Aug 9, 2018
Messages
449
Trophies
1
XP
2,636
Country
Germany
Tested and nope. Same as before.
Hmm it seems like the kernel binary isn't even loaded from the SD.
Do you happen to know what firmware version you're running?

Try replacing your bluubomb executable with the attached one and see if it shuts down your console.
 

Attachments

  • bluubomb.zip
    13.3 KB · Views: 18

lemontree123

New Member
Newbie
Joined
Sep 26, 2021
Messages
4
Trophies
0
Age
36
XP
5
Country
Vietnam
Please help to check my issue:
This is my output:

[email protected]:~/WiimoteEmulator$ sudo ./bluubomb
listening for connections... (press wii u's sync button)
connected to 9C:E6:35:97:8C:E0
sent 803
kernel bin sent 0
sent 772
rop sent 0
pivot sent 207
cleaning up...


Thanks
 

lemontree123

New Member
Newbie
Joined
Sep 26, 2021
Messages
4
Trophies
0
Age
36
XP
5
Country
Vietnam
Please help to check my issue:
This is my output:

[email protected]:~/WiimoteEmulator$ sudo ./bluubomb
listening for connections... (press wii u's sync button)
connected to 9C:E6:35:97:8C:E0
sent 803
kernel bin sent 0
sent 772
rop sent 0
pivot sent 207
cleaning up...


Thanks
 

lemontree123

New Member
Newbie
Joined
Sep 26, 2021
Messages
4
Trophies
0
Age
36
XP
5
Country
Vietnam
From looking at the terminal output it seems fine. Make sure your SD Card is formatted to FAT32, and the kernel is placed correctly and named correctly on the SD. Try blowing into the SD Card slot to remove any dust.
I changed to new SD card, blow to clean the slot then IT WORKED!!! Thank you so much for saving my WiiU ^^
 
General chit-chat
Help Users
  • No one is chatting at the moment.
    ShadF0x @ ShadF0x: Pretty sure that is not a thing yet