​

The Wii U was truly the black sheep of the main Nintendo consoles, but in terms of homebrew capabilities, it was but a diamond in the rough. While the Wii U is way past its heyday by almost a decade, the homebrew community still continues to thrive and develop great things for the system.

One of these developers, @shinyquagsire23, has made some research and advancements towards creating a modchip for the Wii U, which he titled "de_Fuse". The modchip started when Shiny Quasire started looking at the then unhacked Wii Mini console, in an attempt to glitch boot0 on it, and while getting curious if it could work on Wii U, he found that a similar exploit could be attempted for it, with the only downsides being OTP dumps being impossible due it being all 00s and the driver for boot0 being limited to SDHC cards.

While the necessity of having a modchip for the Wii U is not a must since Wii U already has coldboot exploits and many other things like Aroma that could serve a similar purpose, the main purpose of this modchip is to allow booting a Wii U console straight from the SD card, without having to rely on the Wii U's internal eMMC chip to boot into the console. This due to the recent news about some Wii U consoles bricking entirely due to failures in the eMMC chip, so giving players the option to boot from SD card would be a relief to this delicate issue that plagues the console.

​

The rest of the information is highly technical and dives into the eFuses, OTP, boot0, boot1 and SRAM of the console, so those interested in a more in-depth and detailed information regarding the process can read it in Shiny Quagsire's own article about de_Fuse on his webpage.

The modchip is currently in early stages of development, and it currently requires an FPGA of sorts, but it hasn't been standardized in terms of schematics or parts. However, Shiny Quagsire is trying to aim for a $25-$35 dlls range when its finished (or lower), based on RP2040 chip. Those interested and willing to collaborate and help out throughout its development can do so through Shiny Quagsire's GitHub repository for the modchip, where he keeps all of the coding and research for it open source.

de_Fuse, the One True Pwn article
GitHub Repository

 

[GerbilSoft]

I will note that OSv10 (aka IOSU) *does* have the infrastructure to completely reformat an MLC chip, but this is usually not used on retail systems. It's used on dev/kiosk when using a DDI flash with the base OS image. (A variant is used to format USB storage, but that uses a different set of keys.)

Using de_Fuse and sdboot, we can boot a patched boot1 and fw.img from SD card, which can then be used to format a new MLC chip (either a replacement eMMC or an SD card) and then install OS packages, similar to a DDI flash. More testing will be needed to make this possible though.

 

[Metoroid0]

Yeez since none one is actually reading what IT IS FOR.

They DO read...the TITLE "a Wii U modchip in development".
If it's something else it should have been said in the title. Yeez...

 

[Pachee]

This is amazing.
The only thing that could beat this is if somebody figured out what kind of procedure nintendo does that is able to set the UNSTBL_PWR bit without opening up the console that allows booting a recovery image from SD.
(But then, that image needs to be signed and we don't have it.)

 

[Ondrashek06]

Does it need any soldering?

 

[pivix]

iirc early in the lifespan of the Wii U, they used cheaper Hynix NANDs that tend to stop functioning long before they're expected to. The Wii was made with better NAND chips, so they rarely fail today. i believe the only safe bet on a non-Hynix system is the Wind Waker edition, but i could be wrong.

My windwaker wiiu has Hynix chip , but it still works.

 

[eskinner3742]

This is exciting, as someone who has the dreaded emmc failure this gives me hope that one day I'll be able to revive my dear old friend. Thank Hylia I still have my Nand dump!

 

[Valery0p]

I will note that OSv10 (aka IOSU) *does* have the infrastructure to completely reformat an MLC chip, but this is usually not used on retail systems. It's used on dev/kiosk when using a DDI flash with the base OS image. (A variant is used to format USB storage, but that uses a different set of keys.)

Using de_Fuse and sdboot, we can boot a patched boot1 and fw.img from SD card, which can then be used to format a new MLC chip (either a replacement eMMC or an SD card) and then install OS packages, similar to a DDI flash. More testing will be needed to make this possible though.

That's really cool to know!
One less thing to develop to recover completely gone nands ^.^

In the meantime, development on the RP2040 implementation has started:

 

[GerbilSoft]

This is amazing.
The only thing that could beat this is if somebody figured out what kind of procedure nintendo does that is able to set the UNSTBL_PWR bit without opening up the console that allows booting a recovery image from SD.
(But then, that image needs to be signed and we don't have it.)

The great thing about de_Fuse is it can be used in combination with UNSTBL_PWR to boot an *unsigned* boot1 from SD. The only major issue here is boot0 doesn't support SDHC cards, which means you'd need a 2GB or smaller SD card for sdboot.

(IIRC UNSTBL_PWR can be triggered by messing with the EXI bus at the particular moment the RTC registers are read by boot0.)

 

[tiger111]

The great thing about de_Fuse is it can be used in combination with UNSTBL_PWR to boot an *unsigned* boot1 from SD. The only major issue here is boot0 doesn't support SDHC cards, which means you'd need a 2GB or smaller SD card for sdboot.

(IIRC UNSTBL_PWR can be triggered by messing with the EXI bus at the particular moment the RTC registers are read by boot0.)

hey buddy im having a broken wiiu ..its software error happened due to power pff during update no screen nor gamepad syncs the console powers on fan works led turns blue..not having backup nand ..will this method of d fuse helpful in my situation

to be more precise will this method be helpful in bringing back to life broken wiius without nand back up ???

 

[linuxares]

hey buddy im having a broken wiiu ..its software error happened due to power pff during update no screen nor gamepad syncs the console powers on fan works led turns blue..not having backup nand ..will this method of d fuse helpful in my situation

to be more precise will this method be helpful in bringing back to life broken wiius without nand back up ???

Yes but with a Donor.

 

[tiger111]

Yes but with a Donor.

kindly explain something about donor ..will it be applicable if a guy uploads donor files on internet to be downloaded and used as donor ?? if we relate it to my situation with no nand back up what can be done practically to get donor files??

 

[linuxares]

Basically yes. You Wii U will look like another one sort of speak. Imagine if you cloned your Wii Us harddrive to another Wii U.

 

[Kioku]

That is expecting a lot from them.

If these kids could read they’d be very upset right now.

 

[tiger111]

Basically yes. You Wii U will look like another one sort of speak. Imagine if you cloned your Wii Us harddrive to another Wii U.

correct me if im wrong every hard disd formatted on wii u is encryptes for that particular wii u ..as far as i know it dosent work in another wii u it again asks ti be formatted ..

my question is suppose my wii u gets broken not booting and display ( assuming its software error file corrupted in system ) will it be able to rescue using this method if i had no back up ...since rescuing wii u using backup with hard mod has been possible since long ago

 

[Valery0p]

correct me if im wrong every hard disd formatted on wii u is encryptes for that particular wii u ..as far as i know it dosent work in another wii u it again asks ti be formatted ..

my question is suppose my wii u gets broken not booting and display ( assuming its software error file corrupted in system ) will it be able to rescue using this method if i had no back up ...since rescuing wii u using backup with hard mod has been possible since long ago

In theory yes, since you can dump your OTP and recover the encryption keys, but I'm not sure about the details.

In other news, get your Pico ready ^.^

 

[gorgyrip]

I've just installed it in a U with the blinking blue issue.
The power led turns blue, flashes really fast a few times and then it STAYS purple. Still no image on hdmi.
I don't have otp. bin. Waiting for the future release that will not require it.

Spoiler

And here's the serial log:

Spoiler

 

[tiger111]

getting display will be the key

I've just installed it in a U with the blinking blue issue.
The power led turns blue, flashes really fast a few times and then it STAYS purple. Still no image on hdmi.
I don't have otp. bin. Waiting for the future release that will not require it.

Spoiler

View attachment 366644View attachment 366645View attachment 366646View attachment 366647View attachment 366648

And here's the serial log:

Spoiler

buddy according to circuit to be made ..points on pico gp 10...gp 11...gp12..and gp 13 are to be connected to tp176 on wii u motherboard ..is it ok to bridge these points on pico from gp 10 to gp 13 and connect to tp 176 using single wire after bridging these 4 points since in circuit all these points are to be connected to same point on wii u tp176. is it ok to do so?? i think you got my point

 

[gorgyrip]

Yes, there's no point in using 4 wires when you can use only one wire. The same thing for gp18-21 & gp8
And don't forget to post your log from the serial console and to mention if you already have otp.bin or not.

 

[Valery0p]

I've just installed it in a U with the blinking blue issue.
The power led turns blue, flashes really fast a few times and then it STAYS purple. Still no image on hdmi.
I don't have otp. bin. Waiting for the future release that will not require it.

Spoiler

View attachment 366644View attachment 366645View attachment 366646View attachment 366647View attachment 366648

And here's the serial log:

Spoiler

All I know is that it's supposed to flash purple while booting; you could try opening an issue on the official repo.


BTW for anyone interested, the first pre-release is out:
https://github.com/shinyquagsire23/wii_u_modchip/releases

Post automatically merged: Apr 24, 2023

I've just installed it in a U with the blinking blue issue.
The power led turns blue, flashes really fast a few times and then it STAYS purple. Still no image on hdmi.
I don't have otp. bin. Waiting for the future release that will not require it.

Spoiler

View attachment 366644View attachment 366645View attachment 366646View attachment 366647View attachment 366648

And here's the serial log:

Spoiler

By looking at the log it looks like it glitches the WiiU fine? So the Pico installation should work.
Not having the otp dump does not help, but it looks like it fails at powering up your MLC memory AFAIK.
Btw you are using a <2GB SD right?
Future releases should have a redNAND implementation so you can use your WiiU even with a dead NAND.

 

[tiger111]

Yes, there's no point in using 4 wires when you can use only one wire. The same thing for gp18-21 & gp8
And don't forget to post your log from the serial console and to mention if you already have otp.bin or not.

yes you are right its also applicable for other repeat connections for single point ...

well i havent tried this yet since im waiting for this scene to develop since its in early stages ..my issue is wii u black screen of death .i.e console powers on blue led but no display nor connects to gamepad..its software error common when wii u is shut down during updates and i also dont have the otp