BluUBomb exploits the Wii U's bluetooth stack to gain IOSU kernel access via bluetooth.

Not to be confused with BlueBomb for the Wii and Wii Mini.

What does this mean?
This means you can get IOSU code execution by only pairing an emulated Wii Remote to the system.

This should be useful to fix a few softbricks on the Wii U side.
You don't need a working browser or Mii Maker.
if you've messed up with regionhax and can no longer access the browser, BluUBomb can fix this as well.

The BluUBomb repository contains a few different kernel binaries for different purposes:

loadrpx.bin
Launches a launch.rpx from the root of your SD card on the next application launch.

regionfree.bin
Applies IOSU patches to temporarily remove region restrictions.
This should be helpful if you've locked yourself out of your applications due to permanent region modifications.

wupserver.bin
Launches a wupserver instance directly after using bluubomb.
This gets you full system access remotely via wupclient (replace the IP in line 29 with the one of your Wii U).
This works without having to leave the controller pairing screen.

Check out the repository for additional instructions:
https://github.com/GaryOderNichts/bluubomb

The write-up and technical details can be found here:
https://github.com/GaryOderNichts/bluubomb/blob/master/WRITEUP.md

Credits

• GaryOderNichts - bluUbomb
• rnconrad for the WiimoteEmulator
• dimok789 and everyone else who made mocha possible

 

[testing_this]

Alright so here is a binary which copies a file named "cert.der" from the root of your SD card to the correct certificate path.
You can get the original cert from the decrypted NUS title or if you have a backup.
So what you need to do:
- extract the attached .zip
- rename the "ssl_unbrick.bin" to "bluu_kern.bin" and copy it to the root of the SD
- rename the cert to "cert.der" and copy it to the root
- power on your Wii U
- run bluubomb
- wait

Once finished successfully the console will reboot. If it fails it will power off without rebooting.
Let me know how it goes.

It didn't work.

I double checked that the files were the correct ones (ssl_unbrick.bin and CACERT_NINTENDO_CA_G3.der)
I did rename them.

Nothing changes on the console, I still can go back and then freezes. I tried 3 times.

 

[GaryOderNichts]

It didn't work.

I double checked that the files were the correct ones (ssl_unbrick.bin and CACERT_NINTENDO_CA_G3.der)
I did rename them.

Nothing changes on the console, I still can go back and then freezes. I tried 3 times.

Did the console reboot or power off?

 

[testing_this]

Did the console reboot or power off?

No, it doesn't. It remains in the sync screen.

 

[Deleted member 397813]

im liking the names for these entrypoints

 

[GaryOderNichts]

No, it doesn't. It remains in the sync screen.

Can you test if this reboots the console?
Extract (!), copy to SD, and rename the "test.bin" to "bluu_kern.bin".

 

[testing_this]

Can you test if this reboots the console?
Extract (!), copy to SD, and rename the "test.bin" to "bluu_kern.bin".

Tested and nope. Same as before.

 

[GaryOderNichts]

Tested and nope. Same as before.

Hmm it seems like the kernel binary isn't even loaded from the SD.
Do you happen to know what firmware version you're running?

Try replacing your bluubomb executable with the attached one and see if it shuts down your console.

 

[testing_this]

Hmm it seems like the kernel binary isn't even loaded from the SD.
Do you happen to know what firmware version you're running?

Try replacing your bluubomb executable with the attached one and see if it shuts down your console.

Now the console turns off!

I think it has 5.5.1U

 

[GaryOderNichts]

Now the console turns off!

I think it has 5.5.1U

Can I contact you on discord? Debugging this is probably going to be a bit more complicated.
I'm not sure why your console doesn't load anything from the SD.

 

[testing_this]

Can I contact you on discord? Debugging this is probably going to be a bit more complicated.
I'm not sure why your console doesn't load anything from the SD.

Yes, no problem. I sent you a PM.

 

[lemontree123]

Please help to check my issue:
This is my output:

ubuntu@ubuntu:~/WiimoteEmulator$ sudo ./bluubomb
listening for connections... (press wii u's sync button)
connected to 9C:E6:35:97:8C:E0
sent 803
kernel bin sent 0
sent 772
rop sent 0
pivot sent 207
cleaning up...


Thanks

 

[lemontree123]

Please help to check my issue:
This is my output:

ubuntu@ubuntu:~/WiimoteEmulator$ sudo ./bluubomb
listening for connections... (press wii u's sync button)
connected to 9C:E6:35:97:8C:E0
sent 803
kernel bin sent 0
sent 772
rop sent 0
pivot sent 207
cleaning up...


Thanks

 

[lemontree123]

I tried every kernels, but it always turns off the console:

 

[GaryOderNichts]

I tried every kernels, but it always turns off the console:

From looking at the terminal output it seems fine. Make sure your SD Card is formatted to FAT32, and the kernel is placed correctly and named correctly on the SD. Try blowing into the SD Card slot to remove any dust.

 

[lemontree123]

From looking at the terminal output it seems fine. Make sure your SD Card is formatted to FAT32, and the kernel is placed correctly and named correctly on the SD. Try blowing into the SD Card slot to remove any dust.

I changed to new SD card, blow to clean the slot then IT WORKED!!! Thank you so much for saving my WiiU ^^

 

[CMDreamer]

@GaryOderNichts Sorry to bother, just got a second-hand softbricked WiiU with error 160-0103. Can't get to the home screen, it stops when configuring the language, looks like the seller did a system format or something like that.

How could I go into installing a system update on the WiiU using a homebrew application, so the damaged system files could be replaced, is that even possible?

Thanks in advance!

 

[Helvetica]

Heya. I'm trying to connect to my console but as I attempt to disable Simple pairing mode, I get thrown this error:

Can't set Simple Pairing mode on hci0: Input/output error (5)

Is there any way to get around this? Or am I at a dead end?

 

[GaryOderNichts]

Heya. I'm trying to connect to my console but as I attempt to disable Simple pairing mode, I get thrown this error:

Can't set Simple Pairing mode on hci0: Input/output error (5)

Is there any way to get around this? Or am I at a dead end?

Have you seen this section in the readme? https://github.com/GaryOderNichts/bluubomb#simple-pairing-mode
As long as "hciconfig hci0 sspmode" says that SSP is disabled that error can be ignored.

 

[Helvetica]

Have you seen this section in the readme? https://github.com/GaryOderNichts/bluubomb#simple-pairing-mode
As long as "hciconfig hci0 sspmode" says that SSP is disabled that error can be ignored.

Tried the command and it says SSP is enabled. I've tried to use "sudo hciconfig hci0 sspmode disabled" to disable it but as I mentioned earlier, it throws that error

 

[GaryOderNichts]

Tried the command and it says SSP is enabled. I've tried to use "sudo hciconfig hci0 sspmode disabled" to disable it but as I mentioned earlier, it throws that error

Ignore that error and run "sudo hciconfig hci0 reset". Then check if it's still enabled.