de_Fuse, a Wii U modchip in development by ShinyQuagsire

tumblr_991e04845ab30223dd16b2d1624b6f4c_b49fe612_500.jpg

The Wii U was truly the black sheep of the main Nintendo consoles, but in terms of homebrew capabilities, it was but a diamond in the rough. While the Wii U is way past its heyday by almost a decade, the homebrew community still continues to thrive and develop great things for the system.

One of these developers, @shinyquagsire23, has made some research and advancements towards creating a modchip for the Wii U, which he titled "de_Fuse". The modchip started when Shiny Quasire started looking at the then unhacked Wii Mini console, in an attempt to glitch boot0 on it, and while getting curious if it could work on Wii U, he found that a similar exploit could be attempted for it, with the only downsides being OTP dumps being impossible due it being all 00s and the driver for boot0 being limited to SDHC cards.

While the necessity of having a modchip for the Wii U is not a must since Wii U already has coldboot exploits and many other things like Aroma that could serve a similar purpose, the main purpose of this modchip is to allow booting a Wii U console straight from the SD card, without having to rely on the Wii U's internal eMMC chip to boot into the console. This due to the recent news about some Wii U consoles bricking entirely due to failures in the eMMC chip, so giving players the option to boot from SD card would be a relief to this delicate issue that plagues the console.

72a7403a2705acdef1d456e392cbcbfc94439cd0.jpg

The rest of the information is highly technical and dives into the eFuses, OTP, boot0, boot1 and SRAM of the console, so those interested in a more in-depth and detailed information regarding the process can read it in Shiny Quagsire's own article about de_Fuse on his webpage.

The modchip is currently in early stages of development, and it currently requires an FPGA of sorts, but it hasn't been standardized in terms of schematics or parts. However, Shiny Quagsire is trying to aim for a $25-$35 dlls range when its finished (or lower), based on RP2040 chip. Those interested and willing to collaborate and help out throughout its development can do so through Shiny Quagsire's GitHub repository for the modchip, where he keeps all of the coding and research for it open source.

:arrow: de_Fuse, the One True Pwn article
:arrow: GitHub Repository
 

kitsune1324

Member
Newcomer
Joined
Aug 9, 2023
Messages
15
Trophies
0
Age
30
XP
81
Country
United States
@kitsune1324 Check that wafel_core.ipx is inside the ios_plugins folder
├── fw.img
└── wiiu
....└── ios_plugins
........└── wafel_core.ipx
Verified that it is in there, the only other files (in each folder) is the .DS_Store files, but those shouldn't be a problem I assume. I have the latest version, I'll try to go a version back today and see if that changes anything.
 
  • Like
Reactions: Fabioperez

Fabioperez

Active Member
Newcomer
Joined
Jul 31, 2022
Messages
32
Trophies
0
Age
40
Location
San Gil
XP
227
Country
Colombia
Verified that it is in there, the only other files (in each folder) is the .DS_Store files, but those shouldn't be a problem I assume. I have the latest version, I'll try to go a version back today and see if that changes anything.

@kitsune1324 What size is the SD you are using? Remember that the maximum size is 2GB
 

SDIO

Well-Known Member
Member
Joined
Feb 13, 2023
Messages
2,263
Trophies
0
Age
28
XP
1,382
Country
Germany
I would recommend checking if you really connected everything to the right testpoints and if nohing came lose
 

kitsune1324

Member
Newcomer
Joined
Aug 9, 2023
Messages
15
Trophies
0
Age
30
XP
81
Country
United States
Got it working! Looks like it was an issue with de_Fuse_v0.7 (most likely the boot image or something?), but I downloaded the VERY recently released de_Fuse_v0.8 and it's working now!

I successfully pulled the otp.bin, seeprom.bin, slc.raw, and slccmpt.raw files. I'm unable to get the Interactive Debug Console to load, it just gives me a blank page until I restart the system.

At this point, I'm trying to verify if my nand is bad or if something else is going on with my system. Can someone point me in the right direction?
Post automatically merged:

Pulled the factory.log and got the following, not sure if it's useful.

0,0,OK,01.04,2013/10/22,18:26,CheckCode=5E66, 0,1,OK,01.04,2013/10/24,16:07,CheckCode=D634$, 0,2,OK,01.00,2013/10/24,16:11,TesterID : 00:09:0D:00:B2:0F, 0,3,INFO,01.01,,,DRIVE RFAMP:370 mV (Check), 0,3,INFO,01.01,,,DRIVE RFAMP:362 mV (Change), 0,3,OK,03.02,,17:11,, 0,4,START,03.01,2013/10/25,17:38,Wireless Start, 0,4,OK,03.01,2013/10/25,17:38,MARKO:9CE635C22635$GG:B8AE6E46BA3D$BRLYN:B8AE6E49756A, 0,5,OK,02.50,,,All Passed, 0,6,START,01.90,,,, 0,6,OK,01.90,,,190-32G-USZ-sys4.0.0-usr1.0.0-wii2.0.0-H.ddi, 0,9,OK,01.01,,,WRITE OK LOG, 0,11,OK,01.22,,,All Passed,
 
  • Like
Reactions: Valery0p

pyromixLua

Active Member
Newcomer
Joined
Oct 25, 2022
Messages
31
Trophies
0
Age
17
XP
95
Country
France
Hello everyone, I have installed de_fuse on my bricked wii u.

The problem is that I received an error when I start my wiiu.

On Putty I saw this :
Code:
Error code: c3
Starting... 3192
Results:
01
02
03
04
05
08
09
0a
0b
0c
0d
0e
c3
01
00
00
Error code: c3
Starting... 3191
Results:
01
02
03
04
05
08
09
0a
0b
0c
0d
0e
c3
01
00
00

...


How to fix this?

Thanks.
 

Ysecond

Well-Known Member
Member
Joined
Apr 27, 2023
Messages
186
Trophies
0
Age
26
XP
469
Country
China
Maybe you can check your SD card, it must be an SD protocol, not an SDHC SDXC. Check if BOOT1, fw.img are correct.

It's just some of my experience, not guaranteed to be completely correct ,If I am wrong, please correct me.
SD卡.jpg
 
Last edited by Ysecond,

pyromixLua

Active Member
Newcomer
Joined
Oct 25, 2022
Messages
31
Trophies
0
Age
17
XP
95
Country
France
Hello, thank you for your help.
Now I have another problem.

Putty gives me this :
Code:
Starting... 3166:1
Results:
00
00
Error code: 00
Starting... 3165:0
Results:
00
00
Error code: 00
Starting... 3165:1
Results:
00
00
Error code: 00
Starting... 3164:0
Results:
01
02
03
04
05
08
09
0a
0b
0c
0d
0e
0f
13
14
15
18
19
1a
1b
1c
1d
1e
00
00
Error code: 00
Starting... 3164:1
Results:
01
02
03
04
05
08
09
0a
0b
0c
0d
0e
c3
01
00
00
Error code: c3
Starting... 3163:0
Results:
Winner! 0xf3a5
01
02
03
04
05
08
09
0a
0b
0c
0d
0e
13
14
15
18
1b
1c
1d
1e
1f
25
88
89
8a
0f
8f
0f
00
80
01
81
00
80
01
81
00
80
01
81
00
80
01
81
0f
8f
0f
00
01
81
00
80
01
81
00
80
01
81
00
80
01
81
00
80
0f
8f
0f
00
80
01
81
00
80
01
81
00
80
01
81
00
80
01
81
0f
8f
0f
00
01
81
00
80
01
81
00
80
01
81
00
80
01
81
00
80
0f
8f
0f
00
80
01
81
00
80
01
81
00
80
81
01
81
00
80
01
81
0f
8f
0f
00
01
81
00
80
01
81
00
80
01
81
00
80
01
81
00
80
0f
8f
0f
00
80
01
81
00
80
01
81
00
80
01
81
00
80
01
81
0f
8f
0f
00
01
81
00
80
01
81
00
80
01
81
00
80
01
81
00
80
0f
8f
0f
00
80
01
81
00
80
01
81
00
80
01
81
00
80
01
81
0f
8f
0f
00
01
81
00
80
01
81
00
80
01
81
00
80
01
81
00
80
0f
8f
0f
00
80
01
81
00
80
01
81
00
80
01
81
00
80
01
81
0f
8f
0f
00
01
81
00
80
01
81
00
80
01
81
00
80
[pico] Changed state: WIIU_STATE_NEEDS_DEFUSE -> WIIU_STATE_DEFUSED
[pico] Changed state: WIIU_STATE_DEFUSED -> WIIU_STATE_MONITORING
060501CF%10(MEM2[pico] Changed state: WIIU_STATE_MONITORING -> WIIU_CHECK_IF_POWERED_OFF
[pico] Changed state: WIIU_CHECK_IF_POWERED_OFF -> WIIU_STATE_POWERED_OFF

My wiiu flashes red at the end...
 

SDIO

Well-Known Member
Member
Joined
Feb 13, 2023
Messages
2,263
Trophies
0
Age
28
XP
1,382
Country
Germany
There are 4 BGA chips around the SoC. These are the 2GB DDR3 DRAM. I Suspect they are failing the memory test of the minute boo1. I can take a closer look later at the minute code.

How did your Wii U go bad?

EDIT: looked at the code, looks like it is failing the memory test :(. Either a Hardware problem or a problem with the memoy init, which is unlikely. Can you show a picture of your dram, so we can see which vendor it is?
Do you have a otp dump of that console?
 
Last edited by SDIO,

pyromixLua

Active Member
Newcomer
Joined
Oct 25, 2022
Messages
31
Trophies
0
Age
17
XP
95
Country
France
Unfortunately I don't have the otp.bin...

Since i installed de_fuse it flashes red at the end.

There, I am dismantling my wiiu.

Hoping that the wii u was badly reassembled.
 

SDIO

Well-Known Member
Member
Joined
Feb 13, 2023
Messages
2,263
Trophies
0
Age
28
XP
1,382
Country
Germany
You don't need to reasamble it, you need almost nothing but the board to run it. What was it doing without defuse? Blinking blue? Staying red? Constant blue?
Also don't conect 3V3 between the pico and the wii u (but that shouldn't be your problem here).

You can flash the boot1 I attached, start with that, wait a minute and then post the output from the terminal
Post automatically merged:

Oh @Lazr1026 just remained me that that could be a wrong installed disc drive cable. Just disconnect the disc drive on the MB side completely, we don't need it for now.
 

Attachments

  • boot1-fftest.zip
    18.8 KB · Views: 13

pyromixLua

Active Member
Newcomer
Joined
Oct 25, 2022
Messages
31
Trophies
0
Age
17
XP
95
Country
France
Oh sorry, I forgot to tell you that the wii u was in constant blue without defusing.

Here is the output of Putty :

Code:
Starting... 3186
Results:
Winner! 0xf38e
02
00
01
02
03
04
05
08
09
0a
0b
0c
0d
0e
13
14
15
18
1b
1c
1d
1e
1f
25
88
89
8a
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
81
01
0f
8f
0f
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
81
01
0f
8f
0f
00
80
00
80
00
80
00
80
00
80
00
80
00
80
00
80
00
80
00
0f
8f
0f
00
80
00
80
00
80
00
80
00
80
00
80
00
80
00
80
00
80
00
0f
8f
0f
00
01
81
01
00
01
81
01
00
01
81
01
00
80
00
80
00
01
81
01
00
80
00
01
81
01
81
01
0f
8f
0f
00
01
81
01
00
80
00
80
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
81
01
0f
8f
0f
00
01
81
01
00
01
81
01
00
01
81
01
00
01
81
01
00
80
00
80
00
80
00
80
00
80
00
0f
8f
0f
00
80
00
80
00
80
00
01
81
01
00
01
81
01
00
80
00
[pico] Changed state: WIIU_STATE_NEEDS_DEFUSE -> WIIU_STATE_DEFUSED
[pico] Changed state: WIIU_STATE_DEFUSED -> WIIU_STATE_MONITORING
06020501CF%10(MEM2U▒U▒U▒U▒U▒U▒U▒U▒be[Pico] Switching to data mode...

fe

Yes I have connected the disk in the right place.
 

SDIO

Well-Known Member
Member
Joined
Feb 13, 2023
Messages
2,263
Trophies
0
Age
28
XP
1,382
Country
Germany
Just disconnect the disc drive and it's cable from the MB, we don't need it for now.

If the memory was really bad I would expect blue blinking without defuse
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    K3Nv2 @ K3Nv2: Lol rappers still promoting crypto