Toggle sidebar

de_fuse - Unable to dump OTP.bin

  • Thread starter Thread starter bialasik
  • Start date Start date
  • Views Views 6,943
  • Replies Replies 44
B

bialasik

Well-Known Member
Newcomer
Level 3
Joined
Aug 24, 2017
Messages
60
Reaction score
2
Trophies
0
Age
36
XP
235
Country
Poland
I have a broken EUR Wii U: bought as-is, blue light stays on. Hynix chips.
It was unable to boot from UDPIH, so I decided to try de_fuse with Pi Pico.

I soldered it on, but I am unable to dump OTP.bin with PRSHhax.
"boot1 never jumped to payload! Offset or SEEPROM version might be incorrect".
449812051_499601265972030_4983056209814645550_n.jpg


I tried various https://github.com/shinyquagsire23/wii_u_modchip/releases versions: 1.0, 0.8, 0.7.
I would like to revive that machine - it will be good to also reroute the OS to the SD card to avoid using these Hynix chips.

Could you help me folks?
Post automatically merged:

I was only able to dump OTP without PRSHhax along with SEEPROM.

But this OTP doesn't work for further actions. Also compared to others OTP.bin found on web I see that from some part there are just a bunch of NULLs on mine file.
 

Attachments

Last edited by bialasik,
SDIO said:
If nothing works, you can also do this: https://gbatemp.net/posts/10268894/
Click to expand...
I tried, but I stuck with the first step:

> First flash the zero boot1 to the slccmpt boot1, so it won't interfere.

Because I don't have otp.bin file, it was a problem to flash the slccmpt boot1.
I tried to put this file from the thread you've posted,
then Backup and Restore -> Restore BOOT1_SLCCMPT.IMG.

I have received on the screen:
Code: 
Initializing SLCCMPT...
SLCCMPT: Page 0x0000 / 0x0020 completed
0 pages failed to program
SEEPROM failed to verify!
(Check your otp.bin?)
(...)
SEEPROM failed to verify! 0xe402 and 0x9b24

boot1 version cannot be written to SEEPROM without a valid otp.bin!
 
SDIO said:
it's fine, just carry on
Click to expand...

Holy smokes. It worked! I have the otp.bin!

I did it in a slightly different way: I flashed BOOT1_SLCCMPT.IMG and then I was able to just get the OTP.BIN file just with PRSHhax from the minute.

Thank you. You've changed the Wii U scene so much - not only by tutorials and software, but with this acts of help and responsiveness. Chapeau bas.


Could you also direct me what should I do now?
I mean, I would like to avoid using built-in NAND for reliability reasons.
I see that the best way to do that is to use ISFSHax.

I've put the https://github.com/jan-hofmeier/isfshax_installer/releases/tag/defuse-support ios.img to the SD card.

I wasn't able to boot that ios.img from a larger 256GB card - I needed to use the 1GB which I use for de_fuse boot process.

However, after booting that from minute (with de_fuse pico still connected) and when I selected "boot ios.img", I've got a message that "boot 1 version: unsupported (8296)". Thus, isfshax cannot be installed.

What should I do?
 
Last edited by bialasik,
You don't need ISFShax for now, since you have defuse and the otp.bin

I would suggest you just try to boot the third option and look at the serial terminal to see where it crashes and if it is even eMMC related.
 
SDIO said:
You don't need ISFShax for now, since you have defuse and the otp.bin

I would suggest you just try to boot the third option and look at the serial terminal to see where it crashes and if it is even eMMC related.
Click to expand...
But to do that I will need to connect via serial to the Pico, right?

Is there any chance to fix this console without that? I mean - I will need to order FT232 USB board, I don't have one for now.

When I selected "Patch (sd) and boot IOS (slc)" the last things displayed was "Jumping to IOS... GO GO GO". After that, nothing happened.
 
SDIO said:
The pico should have a USB connector?
Click to expand...
LMAO
I didn't realised that it's just built-in!

So the terminal output after selecting third option is:

Code: 
  Patch (slc) and boot IOS (slc) 
  Patch (sd) and boot IOS redNAND 
> Patch (sd) and boot IOS (slc) <
  Patch (sd) and boot sdmc:/ios_orig.img 
  Patch (sd) and boot sdmc:/ios_orig.img redNAND 
  Patch ISFShax and boot IOS (slc) 
  Boot 'ios.img' 
  Boot IOP firmware file 
  Boot PowerPC ELF file 
  Backup and Restore 
  Interactive debug console 
  PRSH tweaks 
  Display crash log 
  Clear crash log 
  Restart minute 
  Hardware reset 
  Power off 
  Credits 
Mounting slc...
ancast: no patch file `ios.patch`, stubbing...                                 
ancast: reading 0x8aa200 bytes from slc:/sys/title/00050010/1000400a/code/fw.img
ancast: ...00000000 -> 01000000                                                 
ancast: ...00100000 -> 01100000                                                 
ancast: ...00200000 -> 01200000                                                 
ancast: ...00300000 -> 01300000                                                 
ancast: ...00400000 -> 01400000                                                 
ancast: ...00500000 -> 01500000                                                 
ancast: ...00600000 -> 01600000                                                 
ancast: ...00700000 -> 01700000                                                 
ancast: ...00800000 -> 01800000                                                 
ancast: done reading                                                           
ancast: decrypting slc:/sys/title/00050010/1000400a/code/fw.img...             
ancast: fini                                                                   
ancast: IOS image might not be 5.5?                                             
wafel_debug_exts.ipx                                                           
ancast: pre-parsing plugin `sdmc:/wiiu/ios_plugins/wafel_core.ipx`             
ancast: pre-parsing plugin `sdmc:/wiiu/ios_plugins/wafel_debug_exts.ipx`       
ancast: loading plugin `sdmc:/wiiu/ios_plugins/wafel_core.ipx` to 27e00000     
ancast: loading plugin `sdmc:/wiiu/ios_plugins/wafel_debug_exts.ipx` to 27f7a000
ancast: loading data to 27f8b000                                               
prsh: checksum header: old=9254f7bf new=5ad8319c                               
prsh: checksum prst: old=505276c9 new=505276c9                                 
GPU clocked at: 544.999877MHz                                                   
Unmounting SLC...                                                               
Shutting down MLC...                                                           
Shutting down SD card...                                                       
sdhc_bus_power(0x0)                                                             
Shutting down interrupts...                                                     
Shutting down caches and MMU...                                                 
prsh: checksum header: old=5ad8319c new=acbb7489                               
prsh: checksum prst: old=505276c9 new=505276c9                                 
Vectoring to 0x01000300...                                                     
Jumping to IOS... GO GO GO                                                     
we in here kern 0x27e014e0, base 0x27e00000                                     
Inserted 27e00000 before e0000000 and after 20000000!                           
Inserted 27e00000 before e0000000 and after 27e00000!                           
Inserted 27e00000 before e0000000 and after 05200000!                           
  Type           Offset   VirtAddr   PhysAddr   FileSiz    MemSiz     Flg      n
  PHDR           0x000034 0x1d000000 0x1d000000 0x00000900 0x00000900 0x000000 4
  NOTE           0x0008d4 0x1d000900 0x1d000900 0x000002ac 0x000002ac 0x000000 4
  LOAD           0x000034 0x1d000000 0x1d000000 0x00000bac 0x02700000 0x000000 0
  LOAD           0x000b80 0x04000000 0x08280000 0x00014d08 0x00014d08 0x300005 4
  LOAD           0x015888 0x04020000 0x082a0000 0x00003f58 0x00003f58 0x300004 4
  LOAD           0x0197e0 0x04024000 0x082a4000 0x000007c8 0x000007c8 0x300006 0
  LOAD           0x019fa8 0x04025000 0x082a5000 0x00000000 0x000095c0 0x300006 0
  LOAD           0x019fa8 0x05000000 0x081b0000 0x00060090 0x00060090 0x100005 4
  LOAD           0x07a038 0x05070000 0x08220000 0x0000d7b4 0x0000d7b4 0x100004 0
  LOAD           0x0877ec 0x0507e000 0x0822e000 0x00002bec 0x00002bec 0x100006 0
  LOAD           0x08a3d8 0x05081000 0x08231000 0x00000000 0x00049b80 0x100006 0
  LOAD           0x08a3d8 0x08120000 0x08120000 0x00014000 0x00014000 0x000005 0
  LOAD           0x09e3d8 0x08140000 0x08140000 0x00001df0 0x00001df0 0x000004 0
  LOAD           0x0a01c8 0x08142000 0x08142000 0x0000d000 0x0000d000 0x000006 0
  LOAD           0x0ad1c8 0x08150000 0x08150000 0x00000000 0x00055204 0x000006 0
  LOAD           0x0ad1c8 0x10000000 0x10000000 0x00000000 0x00100000 0x100006 1
  LOAD           0x0ad1c8 0x10100000 0x10100000 0x00036e0c 0x00036e0c 0x400005 4
  LOAD           0x0e3fd4 0x10140000 0x10140000 0x00004088 0x00004088 0x400004 4
  LOAD           0x0e805c 0x10145000 0x10145000 0x000000f0 0x000000f0 0x400006 4
  LOAD           0x0e814c 0x10146000 0x10146000 0x00000000 0x00449160 0x400006 0
  LOAD           0x0e814c 0x10800000 0x10800000 0x000d1624 0x000d1624 0x500005 4
  LOAD           0x1b9770 0x10900000 0x10900000 0x0002aa38 0x0002aa38 0x500004 0
  LOAD           0x1e41a8 0x1092b000 0x1092b000 0x00001734 0x00001734 0x500006 4
  LOAD           0x1e58dc 0x1092d000 0x1092d000 0x00000000 0x01538068 0x500006 0
  LOAD           0x1e58dc 0x11f00000 0x11f00000 0x0006b8f0 0x0006b8f0 0x600005 4
  LOAD           0x2511cc 0x11f80000 0x11f80000 0x00010f18 0x00010f18 0x600004 4
  LOAD           0x2620e4 0x11f91000 0x11f91000 0x00023e00 0x00023e00 0x600006 4
  LOAD           0x285ee4 0x11fb5000 0x11fb5000 0x00000000 0x001c80d0 0x600006 0
  LOAD           0x285ee4 0x12300000 0x12300000 0x000ea13c 0x000ea13c 0x700005 4
  LOAD           0x370020 0x12400000 0x12400000 0x00021b80 0x00021b80 0x700004 4
  LOAD           0x391ba0 0x12422000 0x12422000 0x000000bc 0x000000bc 0x700006 4
  LOAD           0x391c5c 0x12423000 0x12423000 0x0005af91 0x0005af91 0x700006 4
  LOAD           0x3ecbf0 0x1247e000 0x1247e000 0x00000000 0x0027aa04 0x700006 0
  LOAD           0x3ecbf0 0x1fe00000 0x1fe00000 0x00000000 0x00200000 0x100006 1
  LOAD           0x3ecbf0 0x20000000 0x20000000 0x00000000 0x07e00000 0x500006 1
  LOAD           0x000000 0x27e00000 0x27e00000 0x00200000 0x00200000 0x100007 1
  LOAD           0x000000 0x05200000 0x27e00000 0x00000000 0x00100000 0x100007 1
  LOAD           0x000000 0x10600000 0x27e00000 0x00000000 0x00100000 0x100007 1
  LOAD           0x3ecbf0 0xe0000000 0x12900000 0x00089190 0x00089190 0x800005 4
  LOAD           0x475d80 0xe00c0000 0x129c0000 0x0001866c 0x0001866c 0x800004 4
  LOAD           0x48e3ec 0xe00d9000 0x129d9000 0x000000b0 0x000000b0 0x800006 4
  LOAD           0x48e49c 0xe00da000 0x129da000 0x000004f4 0x000004f4 0x800006 4
  LOAD           0x48e990 0xe00db000 0x129db000 0x00000000 0x000d149c 0x800006 0
  LOAD           0x48e990 0xe1000000 0x12b00000 0x00084f10 0x00084f10 0x900005 4
  LOAD           0x5138a0 0xe10c0000 0x12bc0000 0x00020ec4 0x00020ec4 0x900004 4
  LOAD           0x534764 0xe10e1000 0x12be1000 0x000016f4 0x000016f4 0x900006 4
  LOAD           0x535e58 0xe10e3000 0x12be3000 0x00000000 0x00201998 0x900006 0
  LOAD           0x535e58 0xe2000000 0x12e00000 0x0017e484 0x0017e484 0xb00005 4
  LOAD           0x6b42dc 0xe2180000 0x12f80000 0x0002ebc8 0x0002ebc8 0xb00004 4
  LOAD           0x6e2ea4 0xe21af000 0x12faf000 0x0000019c 0x0000019c 0xb00006 4
  LOAD           0x6e3040 0xe21b0000 0x12fb0000 0x00000458 0x00000458 0xb00006 4
  LOAD           0x6e3498 0xe21b1000 0x12fb1000 0x00000000 0x0031cb9c 0xb00006 0
  LOAD           0x6e3498 0xe3000000 0x13500000 0x00151018 0x00151018 0xc00005 4
  LOAD           0x8344b0 0xe3180000 0x13680000 0x00025da8 0x00025da8 0xc00004 4
  LOAD           0x85a258 0xe31a6000 0x136a6000 0x00000140 0x00000140 0xc00006 4
  LOAD           0x85a398 0xe31a7000 0x136a7000 0x000009a4 0x000009a4 0xc00006 4
  LOAD           0x85ad3c 0xe31a8000 0x136a8000 0x00000000 0x0013d21c 0xc00006 0
  LOAD           0x85ad3c 0xe4000000 0x13900000 0x00013cf8 0x00013cf8 0xd00005 4
  LOAD           0x86ea34 0xe4040000 0x13940000 0x000059a0 0x000059a0 0xd00004 4
  LOAD           0x8743d4 0xe4046000 0x13946000 0x00000088 0x00000088 0xd00006 4
  LOAD           0x87445c 0xe4047000 0x13947000 0x00000000 0x000d8e18 0xd00006 0
  LOAD           0x87445c 0xe5000000 0x13b00000 0x0000f068 0x0000f068 0xa00005 4
  LOAD           0x8834c4 0xe5040000 0x13b40000 0x00002d54 0x00002d54 0xa00004 4
  LOAD           0x886218 0xe5043000 0x13b43000 0x000005d4 0x000005d4 0xa00006 4
  LOAD           0x8867ec 0xe5044000 0x13b44000 0x00000000 0x00034614 0xa00006 0
  LOAD           0x8867ec 0xe6000000 0x13b80000 0x0000fb14 0x0000fb14 0x200005 4
  LOAD           0x896300 0xe6040000 0x13bc0000 0x000019bc 0x000019bc 0x200004 4
  LOAD           0x897cbc 0xe6042000 0x13bc2000 0x00003134 0x00003134 0x200006 4
  LOAD           0x89adf0 0xe6046000 0x13bc6000 0x00000000 0x0000c1f4 0x200006 4
  LOAD           0x89adf0 0xe7000000 0x082c0000 0x00001000 0x00001000 0x200006 4
  LOAD           0x89bdf0 0xeff00000 0xfff00000 0x00000000 0x00008000 0x100006 1
  LOAD           0x89bdf0 0xffff0000 0xffff0000 0x0000d868 0x0000d868 0x000007 4
kern_main symbol at: 27e014e0                                                   
our module mem size is: 0017a000                                               
registering plugin: 27f7a000                                                   
skipping data: 27f8b000                                                         
linking plugin: 27f7a000                                                       
wafel_core: 3 00000000->27e00474 __wafel_dynamic                               
wafel_core: 7 00000000->27e03d54 trampoline_hook_before                         
wafel_core: 19 00000000->27e04058 debug_printf                                 
wafel_core: 1b 00000000->27e1b478 svc_sys_write                                 
skipping data: 27f8b000                                                         
00: boot_info                                                                   
01: otp                                                                         
02: minute_boot                                                                 
Found OTP in PRSH at 0x27f8b220 with size 1024                                 
wafel_core: found OTP read pattern 1 at 08120268...                             
wafel_core: found OTP read at 08120220.                                         
Patch size: 0xc                                                                 
Firmware not 5.5.x! All you get is the OTP patch, sorry.                       
calling kern_entry in plugin: 27f7a000                                         
we in here in wafel_debug_exts plugin kern 0x27f7a2c8                           
Overwriting 0x5055334: E1A01004 -> 0x0                                         
Installing trampoline from 0x5055334 at 0x27e28e10 size 32                     
skipping data: 27f8b000                                                         
stroopwafel kern_main done                                                     
[pico] Changed state: WIIU_STATE_MONITORING -> WIIU_CHECK_IF_POWERED_OFF       
[pico] Changed state: WIIU_CHECK_IF_POWERED_OFF -> WIIU_STATE_POWERED_OFF
 
Oh the firmware is too old to get log output.
Then just use minute to dump the old logs. There is an option to dump the system crash logs in the Backup and Restore menu.
 
SDIO said:
Oh the firmware is too old to get log output.
Then just use minute to dump the old logs. There is an option to dump the system crash logs in the Backup and Restore menu.
Click to expand...

So I tried to dump sys crash logs.
Code: 
Mounting slc...
Dumping slc:/sys/logs
ERROR opening slc:/sys/logs: 5
Press POWER/Q to continue.

then factory log - it was empty (0 bytes).

Small backstory for this unit - a several years ago (2016?) I have bought a lot of 10 broken WiiUs for almost nothing. Each unit had a same issue - blue light of death. Every year I googled if there's an option to revive them. And finally it seems it is possible.
I don't know the source of consoles, each was very clean. Maybe an official Nintendo service.
Anyway - that's the purpose of my backstory - the firmware version may be very old here.
 
SDIO said:
hm then try to extract the SLC on the PC https://github.com/koolkdev/wiiu-nandextract/releases
Also run nandBinCheck and see what that says https://github.com/koolkdev/wiiuqt/releases
Click to expand...

When I tried to extract the SLC.RAW file (I needed to rename that to SLC.BIN) I've got "Invalid or unsupported dump"
Post automatically merged:

I've just put all things in one directory and I'll be able to extract that now - I need just a minute to figure it out
Post automatically merged:

SDIO said:
hm then try to extract the SLC on the PC https://github.com/koolkdev/wiiu-nandextract/releases
Also run nandBinCheck and see what that says https://github.com/koolkdev/wiiuqt/releases
Click to expand...

Alright. I've extracted the SLC.bin (but I don't know what to do with all the files).

Output from nandBinCheck:
450525200_778159514481686_1052934505892002411_n.png
 
Last edited by bialasik,
Ok the slc looks fine. Check if it has a sys/logs folder and if so zip it an upload it
 
Ok, so at least it is already on OSv10. Since it doesn't even produce logs it must crash very early. Which size does the scfm.img have?

To see where it crashes we need logging and for that we need a newer IOSU. Follow this to use JNSU to get the IOSU from the latest OSv10: https://gbatemp.net/threads/how-to-...ii-u-internal-memory-mlc.636309/post-10385733
Skip the part with the MLCRestoerDownloader since we don't want to install anything yet, we just want to load the latest IOSU as ios_orig.img from SD.
Also get the wafel_debug_exts.ipx from https://github.com/jan-hofmeier/stroopwafel/releases and put it in the ios_plugins folder to redirect the live syslog to the pico serial
 

Site & Scene News

Go to forum More news

Popular threads in this forum

Hacking Homebrew Project  Modernized YouTube for Wii U

[discussion] what game do you wanna see next?

[discussion] Paper Mario Wii U or Mario Kart 64 wii u?

Wii Games Performance on Wii U (vWii C2W Overclock) – Community Testing & Results Sharing

[PRERELEASE] Sonic 3 A.I.R. (finally) Wii U

Homebrew Misc  Wii U Homebrew — accessing certain apps causes 160-0103 error, uncertain if Homebrew attempt is responsible

Can the Wii u pro controller works for Wii games ?

Sonic Advance 2 Wii U (another release, this time it's playable)