​

The Wii U was truly the black sheep of the main Nintendo consoles, but in terms of homebrew capabilities, it was but a diamond in the rough. While the Wii U is way past its heyday by almost a decade, the homebrew community still continues to thrive and develop great things for the system.

One of these developers, @shinyquagsire23, has made some research and advancements towards creating a modchip for the Wii U, which he titled "de_Fuse". The modchip started when Shiny Quasire started looking at the then unhacked Wii Mini console, in an attempt to glitch boot0 on it, and while getting curious if it could work on Wii U, he found that a similar exploit could be attempted for it, with the only downsides being OTP dumps being impossible due it being all 00s and the driver for boot0 being limited to SDHC cards.

While the necessity of having a modchip for the Wii U is not a must since Wii U already has coldboot exploits and many other things like Aroma that could serve a similar purpose, the main purpose of this modchip is to allow booting a Wii U console straight from the SD card, without having to rely on the Wii U's internal eMMC chip to boot into the console. This due to the recent news about some Wii U consoles bricking entirely due to failures in the eMMC chip, so giving players the option to boot from SD card would be a relief to this delicate issue that plagues the console.

​

The rest of the information is highly technical and dives into the eFuses, OTP, boot0, boot1 and SRAM of the console, so those interested in a more in-depth and detailed information regarding the process can read it in Shiny Quagsire's own article about de_Fuse on his webpage.

The modchip is currently in early stages of development, and it currently requires an FPGA of sorts, but it hasn't been standardized in terms of schematics or parts. However, Shiny Quagsire is trying to aim for a $25-$35 dlls range when its finished (or lower), based on RP2040 chip. Those interested and willing to collaborate and help out throughout its development can do so through Shiny Quagsire's GitHub repository for the modchip, where he keeps all of the coding and research for it open source.

de_Fuse, the One True Pwn article
GitHub Repository

 

[gorgyrip]

By looking at the log it looks like it glitches the WiiU fine? So the Pico installation should work.
Not having the otp dump does not help, but it looks like it fails at powering up your MLC memory AFAIK.
Btw you are using a <2GB SD right?
Future releases should have a redNAND implementation so you can use your WiiU even with a dead NAND.

yes, I tried 2x 2gb sd cards. de_fuse even writes an otp file on the sd card, but it's all zeros.
The U doesn't have all the voltages at power on. If i remember correctly, the 1.15v line is only 1v. after a successful boot it raises at 1.15v. Maybe because i don't have otp.bin prevents that. I will see when the future release comes out.

Post automatically merged: Apr 24, 2023

yes you are right its also applicable for other repeat connections for single point ...

well i havent tried this yet since im waiting for this scene to develop since its in early stages ..my issue is wii u black screen of death .i.e console powers on blue led but no display nor connects to gamepad..its software error common when wii u is shut down during updates and i also dont have the otp

Blinking blue light can also have the same cause. I hope that's my case, too. i remember that a long time ago i've seen a youtube video with some guys starting the update and soon after that they removed the power supply. They called nintendo after that...

 

[Valery0p]

yes, I tried 2x 2gb sd cards. de_fuse even writes an otp file on the sd card, but it's all zeros.
The U doesn't have all the voltages at power on. If i remember correctly, the 1.15v line is only 1v. after a successful boot it raises at 1.15v. Maybe because i don't have otp.bin prevents that. I will see when the future release comes out.

Post automatically merged: Apr 24, 2023

Blinking blue light can also have the same cause. I hope that's my case, too. i remember that a long time ago i've seen a youtube video with some guys starting the update and soon after that they removed the power supply. They called nintendo after that...

New release is out, you can dump your otp now and do other useful stuff, be sure to check the changelog:
https://github.com/shinyquagsire23/wii_u_modchip/releases/tag/v0.2
Let us know if it works this time!

Post automatically merged: Apr 25, 2023

Good news about those MLC errors!

 

[gorgyrip]

New release is out, you can dump your otp now and do other useful stuff, be sure to check the changelog:
https://github.com/shinyquagsire23/wii_u_modchip/releases/tag/v0.2
Let us know if it works this time!

Post automatically merged: Apr 25, 2023

Good news about those MLC errors!

Yes, I've seen it a few hours ago and just tested it. Still can't dump OTP. I dumped the slc.
It seems i have an older version of boot1, that's why, the otp can't be dumped.

 

[indigenous]

Yes, I've seen it a few hours ago and just tested it. Still can't dump OTP. I dumped the slc.
It seems i have an older version of boot1, that's why, the otp can't be dumped.

from the available content and instructions from developer of de fuse i got around 60 percent but I'm still confused ..will there be any tutorial being made for the entire process for YouTube ...the soldering is simple since it's clearly mentioned points but after that serial console and .swapping SD card etc is very confusing if a simple tutorial appears of YouTube it will be helpful for many since a small mistake due to confusion can be catastrophic

 

[gorgyrip]

from the available content and instructions from developer of de fuse i got around 60 percent but I'm still confused ..will there be any tutorial being made for the entire process for YouTube ...the soldering is simple since it's clearly mentioned points but after that serial console and .swapping SD card etc is very confusing if a simple tutorial appears of YouTube it will be helpful for many since a small mistake due to confusion can be catastrophic

I don't have the experience/equipment to make a video. I also had some problems with the serial console, because i have never done that. In fact, everything is very simple.
1. Hold the button on the pico and connect it to the pc. Place the ucf file on pico.
2. Prepare the sd card.
3. Solder pico to the U. I used pin headers so i can easily remove it if necessary.
4. Connect pico to the USB (don't hold the button). Insert the power supply to the console. Don't power it on.
On newer versions of windows, i think the drivers will be installed automatically. I'm on win7 x64. In device manager i had 2 devices: CDC board and a Reset board, both with exclamation mark. To install the driver I used zadig 2.8. Make sure the CDC board is selected in the top bar. Next to the the driver there's another box. I forgot what i selected there, but i think it was USB serial (CDC). Now in the device manager -- port (com and lpt) you should have the cdc board. Take a note of the com port number.
5. Install puTTY and run it. on the first window that opens, select serial . On the box above it will ask you for the com port number (the one from the step above, in device manager). After that click on open. A black window will open.
6. power on the console. The led will become purple and you will start to see text on the pc in that black window.

Post automatically merged: Apr 26, 2023

UPDATE: de_fuse v0.3 has been released and I was able to dump otp.bin
I've used nandBinCheck.exe and got those hmac errors:

Spoiler

Is it possible to get the blinking blue light because of those? If yes, how can I fix them?

 

[Valery0p]

UPDATE: de_fuse v0.3 has been released and I was able to dump otp.bin
I've used nandBinCheck.exe and got those hmac errors:

Spoiler

Is it possible to get the blinking blue light because of those? If yes, how can I fix them?

Great to hear it's working! First console being recovered in the wild!
And yes, a blinking led is expected according to this article if the fw.img is corrupted.

Spoiler

Front panel LED blinks blue.
The back fan is spinning.
boot1 failure. The specific error code will blink on NDEV_LED.
This may mean that the filesystem on SLC NAND is corrupt, however it could also mean that the RTC failed to read, DRAM failed to initialize (which can also be caused by RTC failures, since it stores a semi-warmboot flag),
IOSU's fw.img is corrupt/failed signature checks/doesn't exist, etc.

Maybe you only need to fix that file and use rednand from now on once the CFWs are updated to work with de_Fuse.

I will note that OSv10 (aka IOSU) *does* have the infrastructure to completely reformat an MLC chip, but this is usually not used on retail systems. It's used on dev/kiosk when using a DDI flash with the base OS image. (A variant is used to format USB storage, but that uses a different set of keys.)

Using de_Fuse and sdboot, we can boot a patched boot1 and fw.img from SD card, which can then be used to format a new MLC chip (either a replacement eMMC or an SD card) and then install OS packages, similar to a DDI flash. More testing will be needed to make this possible though.

I guess it's time to start testing!

 

[gorgyrip]

Maybe you only need to fix that file and use rednand from now on once the CFWs are updated to work with de_Fuse.


I guess it's time to start testing!

Yes, but how to fix the file? there's no tool to insert a file back to the slc. Btw, about 30% of the file is corrupted at the end.

 

[shinyquagsire23]

It's worth noting, any console with a blue light can be recovered to *at least* the functionality of an online-banned console or a devkit (unless it's blinking blue bc the DRAM is bad I guess lol, in that case you can at least pull the drive key and fix a broken drive Wii U). But if the light blinks blue, boot1 is booting which means OTP can be recovered.

If it's a red light (not blinking red, that means the power regulators are dead) it can maybe be recovered via spoofing a donor console, it honestly depends on what failed.

Granted, recovery from scratch is just in theory, there's a lot of work to be done on actually making clean NAND images from just otp/seeprom. But de_Fuse is basically the same as ntrcardhax on 3DS, as long as you have all of your backups you can make a full recovery from bad flashes and corruption.

 

[gorgyrip]

It's worth noting, any console with a blue light can be recovered to *at least* the functionality of an online-banned console or a devkit (unless it's blinking blue bc the DRAM is bad I guess lol, in that case you can at least pull the drive key and fix a broken drive Wii U). But if the light blinks blue, boot1 is booting which means OTP can be recovered.

If it's a red light (not blinking red, that means the power regulators are dead) it can maybe be recovered via spoofing a donor console, it honestly depends on what failed.

Granted, recovery from scratch is just in theory, there's a lot of work to be done on actually making clean NAND images from just otp/seeprom. But de_Fuse is basically the same as ntrcardhax on 3DS, as long as you have all of your backups you can make a full recovery from bad flashes and corruption.

Is it possible to add a dram test to the de_fuse?

 

[Valery0p]

Yes, but how to fix the file? there's no tool to insert a file back to the slc. Btw, about 30% of the file is corrupted at the end.

@EyeKey was working on something related, but writing on the MLC partition was still WIP, take everything with a grain of SALT:
https://gbatemp.net/threads/release-wii-u-nand-tools.465386/
https://gbatemp.net/threads/wfsdump-pc-util-for-dumping-wfs-devices-wiiu-file-system.478480/
https://github.com/koolkdev/wfs-tools

The corruption you mention doesn't make it easier.
There might be some way to sideload fw.img in theory.

Also, welcome back to the 'temp ShinyQuagsire

 

[tiger111]

@EyeKey was working on something related, but writing on the MLC partition was still WIP, take everything with a grain of SALT:
https://gbatemp.net/threads/release-wii-u-nand-tools.465386/
https://gbatemp.net/threads/wfsdump-pc-util-for-dumping-wfs-devices-wiiu-file-system.478480/
https://github.com/koolkdev/wfs-tools

The corruption you mention doesn't make it easier.
There might be some way to sideload fw.img in theory.

Also, welcome back to the 'temp ShinyQuagsire

 

[tivu100]

Yeez since none one is actually reading what IT IS FOR.

The Wii U have an issue with the quality of the eMMC. It breaks!
This will make it possible to boot your Wii U from a SD Card.

"With the news that a handful of Hynix Wii U eMMCs were starting to rapidly degrade, I decided to revisit a recurring project idea of mine: an open-source Wii U modchip."

Would this development allow Wii U boot from SSD in the future?

 

[linuxares]

Would this development allow Wii U boot from SSD in the future?

Read third line

 

[tivu100]

Read third line

I know. I meant whether this can get more ambitious and from SSD portable hard drive. It would may help with Wii U slow boot time/ even using it as main storage for game/app.

 

[linuxares]

I know. I meant whether this can get more ambitious and from SSD portable hard drive. It would may help with Wii U slow boot time/ even using it as main storage for game/app.

No idea, read third line.

 

[Valery0p]

Versions v0.4 and v0.5 are out!

Post automatically merged: May 3, 2023

I know. I meant whether this can get more ambitious and from SSD portable hard drive. It would may help with Wii U slow boot time/ even using it as main storage for game/app.

I think there was already something like that?
You can get a faster eMMC/SD card replacement, but that's going to be limited by the bus speed; similar problem for USB drives.
Overclocking can help a bit tho.

 

[ShadowOne333]

Versions v0.4 and v0.5 are out!

Post automatically merged: May 3, 2023

I think there was already something like that?
You can get a faster eMMC/SD card replacement, but that's going to be limited by the bus speed; similar problem for USB drives.
Overclocking can help a bit tho.

Given how quick the updates are moving for deFuse, I'll wait until the whole thing reaches a proper stable version 1.0.
If I make the news article about these updates, it might be outdated by tomorrow

 

[voddy]

sadly it freezes using aroma cfw (at least for me)
If i add a wrong formatted or too big sd card it times out after a while and starts „normal State“ boot. This is a not patching boot which starts the console perfectly fine. Hope the creator adds a normal boot into de_fuse - that would be nice

 

[tiger111]

sadly it freezes using aroma cfw (at least for me)
If i add a wrong formatted or too big sd card it times out after a while and starts „normal State“ boot. This is a not patching boot which starts the console perfectly fine. Hope the creator adds a normal boot into de_fuse - that would be nice

have you installed the de fuse mod chip already ..is yours a broken unit ???

 

[voddy]

have you installed the de fuse mod chip already ..is yours a broken unit ???

i have installed it to try it out - my wii u is not completely broken but that mod has big potential.
My NAND Chip sometimes throws errors or refuses to install an Update on the first try (it starts the install process but the install will sometimes fail and throws errors when writing on NAND - not everytime but sometimes. I bought Breath of the wild PAL and it had to be updated to run and that update took around 3 install attempts to successfully install on NAND) so i wanted to be sure to have the option ready in case it crashes one day.