The current method for dumping a Wii U kiosk system (CAT-I, CAT-SES) requires using a hardmod to dump the eMMC, then using Recovery Mode to install 2.13.01 and dumping the keys. It turns out that, if the kiosk system has a recent enough firmware, it's possible to dump the eMMC (and SLC, etc) without any hardware modifications.

(This is based on a gist I wrote up here: https://gist.github.com/GerbilSoft/640956725ab3eb46e5e32d2f617c1151)
(Screenshots/video to be added at a later point)

The Wii U operating system (IOSU) includes a debug logging facility (enabled on devkits only) that logs debug output to two places:

• Ethernet (CAT-DEV only)
• USB Serial (CAT-DEV, CAT-R, CAT-I, CAT-SES)

In addition to simply logging debug information, the serial console can be used to run a limited set of commands in the CafeOS (cos) shell, as long as the system is in Development (not Production) mode. It turns out that, on recent enough firmware versions, there's a cos command to launch a title, and this can be used to launch System Config Tool.

Devkit Models: (in case readers are unfamiliar)

• CAT-DEV: High-end debugging system in a metal case. This system has PC connectivity over Ethernet.
• CAT-R Reader: Standard debugging and test system. Looks like a white Wii U with a green faceplate.
• CAT-I: Disc-based kiosk system. Usually has a white Wii U chassis.
• CAT-SES: HDD-based kiosk system. Usually has a black Wii U chassis. The two front USB ports are used by the internal HDD.

This guide is generally not needed for CAT-DEV or CAT-R units, but it should work with them regardless.

Preparations

You will need the following:

• Wii U development console (CAT-DEV, CAT-R, CAT-I, CAT-SES)
• SD card (64 GB or larger, formatted as FAT32)
• USB serial cable with FTDI FT232 chipset
• Debug-signed version of Homebrew Launcher for Wii U
• Wii U NAND Dumper
• TeraTerm Pro, or similar serial terminal program

Serial cables known to work with Wii U's debug logging:

• If you do not have a serial port on your PC:
  * FTDI USB-NMC-2.5M: https://www.amazon.com/gp/product/B00HKJSSQ2
• If you do have a serial port on your PC:
  * Digitus DA-70156 USB to Serial adapter: https://www.amazon.com/gp/product/B0030IT780
  * Delock null-modem serial cable: https://www.amazon.com/gp/product/B0077969OS

Instructions

Serial Cable Setup

1. Connect the USB serial cable to the Wii U and to the PC.
2. On the PC, open TeraTerm. Select Serial and select the COM port that corresponds to the serial cable, then click OK.
3. In TeraTerm, click the Setup menu, then Terminal. Set New-line for both Receive and Transmit to CR+LF, then click OK.
4. In teraTerm, click the Setup menu, then Serial port. Select the COM port that corresponds to the serial cable, set the speed to 57600, then click the "New setting" button.
5. Turn on the Wii U devkit. In 5-10 seconds, you should start seeing debug messages printed on the console.

COS Shell

To determine if the COS Shell is working, type the following in the serial terminal, then press Enter:

cos sdkversion

If COS Shell is working, and Development mode is enabled, a message similar to the following will be printed:

cos sdkversion
# 00;01;55;243:
---- COS Debugging Shell Command: sdkversion ----
00;01;55;243: SDKVer:21301

In this example, the system has SDK version 2.13.01 installed. This is the latest version of the system software, which corresponds to Wii U menu 5.5.0.

Launch Title

To launch the System Config Tool, run the following command:

cos launch 0x00050010 0x1F700500

This will result in one of the following:

1. Nothing (just a '#') - the SDK version may be too old, in which case it doesn't have a launch command. Unfortunately there's no known workaround for this at the moment, other than dumping eMMC manually.
2. Errcode -6: The specified title ID was not found. Make sure you entered it correctly. Note that some older firmware versions might have a different menu called DEVMENU installed, and DEVMENU has a different title ID.
3. System Config Tool will load. This is what we want!

If either #1 or #2 happens, stop here and reply in this thread for support.

System Config Tool

TODO: Add screenshots

Set the default title to System Config Tool:

1. Select Boot Configuration.
2. Select Default Title.
3. In the Default Title menu, select System Config Tool, press A to view title information, then press A to select.
4. Power-cycle the system. It should boot to System Config Tool instead of the Kiosk Menu.

Install Homebrew Launcher:

1. On PC, extract the debug-signed version of Homebrew Launcher to the SD card.
2. Also extract Wii U NAND Dumper to the SD card. This will be used later.
3. Put the SD card in the Wii U.
4. In System Config Tool, select Data Manager, Title Manager, Install.
5. Select SD Card, then browse to where Homebrew Launcher was copied.
6. Homebrew Launcher will be detected as an Install Image. Highlight it and press A to select the title for installation.
7. Press R to install. Follow the prompts to continue installation.

Wii U NAND Dumper

Set the system to Production Mode:

*** WARNING: After setting Production Mode, DO NOT RUN ANY KIOSK TITLES. Doing so may result in Kiosk Menu being set as the default title, and the COS Shell won't allow any commands to be run anymore since the system is in Production Mode.

1. In the System Config Tool main menu, select Boot Configuration.
2. Set System Mode to Production Mode and save changes.
3. Power-cycle the system. System Config Tool should load.

Run the Wii U NAND Dumper:

1. In System Config Tool, select Title Launcher.
2. Select Homebrew Launcher, press A to view details, then press A twice to load it.
3. In Homebrew Launcher, load Wii U NAND Dumper.
4. In Wii U NAND Dumper, enable dumping of everything, including slc, slccmpt, mlc, otp, and seeprom.
5. Dump everything. The system will look like it's rebooting, but a progress indicator will be printed on the gamepad screen. If it crashes instead of showing progress, make sure you set the system to Production Mode.

Switch Back to Development Mode

After dumping the system's NAND, put the system back in Development Mode to re-enable commands on the serial port:

1. In the System Config Tool main menu, select Boot Configuration.
2. Set System Mode to Development Mode and save changes.
3. Power-cycle the system. System Config Tool should load.

Final Steps

Save the NAND dumps in a safe place for later use. You can use wfslib to browse the MLC dump and extract titles.

As an optional step, you can flash 2.13.01 and Wii U Menu Changer. This requires recovery image files that cannot be linked here and are beyond the scope of this guide.

 

[godreborn]

Great tutorial, my friend.

 

[SENSENuii]

Do you know how to pack titles using the dev common key to install the homebrew launcher instead of downloading a pre packaged one?

 

[Revlic]

Cool! Thank you for sharing useful information!

 

[GerbilSoft]

Do you know how to pack titles using the dev common key to install the homebrew launcher instead of downloading a pre packaged one?

As part of RVT-H Tool, I wrote a program called "nusresign" that can re-sign any NUS package using the dev keys. I haven't made a release of RVT-H Tool with nusresign yet, but the code is available here: https://github.com/GerbilSoft/rvthtool

For Homebrew Launcher, the "channel" package would be the NUS package version.

 

[SENSENuii]

As part of RVT-H Tool, I wrote a program called "nusresign" that can re-sign any NUS package using the dev keys. I haven't made a release of RVT-H Tool with nusresign yet, but the code is available here: https://github.com/GerbilSoft/rvthtool

For Homebrew Launcher, the "channel" package would be the NUS package version.

Thank you for the info, can I PM you if I have problems?

 

[GerbilSoft]

Thank you for the info, can I PM you if I have problems?

Sure thing.

Also, in some more recent testing, I found that the current version of the HBL channel will crash if the system doesn't have SDK 2.13.01 installed. (tested on 2.12.xx from the Dec 2014 CAT-I update disc) So even if you're able to launch System Config Tool on these systems, if the installed OS isn't the right version, HBL won't load. I'm looking into finding a workaround for this.

 

[Deleted member 397813]

nice info

 

[chainswordcs]

I can totally take photos and/or screenshots of the process if you'd like.

Also, sorry but I'm stuck on Preparations... What sort of cable do I need? My PC (and sorry but any modern PC) doesn't have a Serial Port...

(Side Note: maybe specify more clearly for those folks that you do need both products listed under "if your PC has Serial")

The Amazon screenshot is awful:

And I know that not every cable with the specific two ends will work. But I am curious which port is the other end, and whether there is a slightly cheaper option for me.

By the way I know I'm going to run into issues later: My SDK Version is 2.12.12 Build 67129... But I'm still willing to take steps right now and help test stuff!

Edit: Just so you know, I have a model WIS-001 and the Kiosk Settings say it is a CAT-I Standalone.

 

[Jayro]

All these findings, and we still can't get a coldboot exploit. Or restore a NAND backup without a hardmod. Sad.

 

[LawnMeower]

Thank you for this guide. Sadly this FTDI NMC-USB cable is hard to get and really expensive. Do you think I can use some board with the FT232R chip on it?
Got one SES and 2 unmodded WIS units I'd love to dump

 

[GerbilSoft]

Thank you for this guide. Sadly this FTDI NMC-USB cable is hard to get and really expensive. Do you think I can use some board with the FT232R chip on it?
Got one SES and 2 unmodded WIS units I'd love to dump

The FT232 is only strictly needed for the Wii U side. You can use any other serial adapter on the PC side (either a real serial port or a USB adapter, or an Arduino or similar).

I'm not sure if it's possible to dump the CAT-SES HDD without disassembling the system, but it should be straightforward to dump using e.g. ddrescue and a USB SATA adapter.

--------------------- MERGED ---------------------------

I can totally take photos and/or screenshots of the process if you'd like.

Also, sorry but I'm stuck on Preparations... What sort of cable do I need? My PC (and sorry but any modern PC) doesn't have a Serial Port...

(Side Note: maybe specify more clearly for those folks that you do need both products listed under "if your PC has Serial")

The Amazon screenshot is awful:

And I know that not every cable with the specific two ends will work. But I am curious which port is the other end, and whether there is a slightly cheaper option for me.

By the way I know I'm going to run into issues later: My SDK Version is 2.12.12 Build 67129... But I'm still willing to take steps right now and help test stuff!

Edit: Just so you know, I have a model WIS-001 and the Kiosk Settings say it is a CAT-I Standalone.

SDK 2.12 should have the `cos launch` command available.

Since you don't have a serial port on your PC, I'd recommend the FTDI USB Null Modem Cable: https://www.amazon.com/gp/product/B00HKJSSQ2 - this is basically two FTDI serial adapters in one.

Alternatively, you can get two USB to Serial adapters: https://smile.amazon.com/gp/product/B0030IT780
and then a null-modem serial cable: https://smile.amazon.com/gp/product/B0077969OS

This method might be a bit more expensive, but the advantage over the USB Null Modem Cable is you can use it for other devices that have 9-pin serial.

 

[chainswordcs]

The FT232 is only strictly needed for the Wii U side. You can use any other serial adapter on the PC side (either a real serial port or a USB adapter, or an Arduino or similar).

...

Since you don't have a serial port on your PC, I'd recommend the FTDI USB Null Modem Cable: https://www.amazon.com/gp/product/B00HKJSSQ2 - this is basically two FTDI serial adapters in one.

Alternatively, you can get two USB to Serial adapters: https://smile.amazon.com/gp/product/B0030IT780
and then a null-modem serial cable: https://smile.amazon.com/gp/product/B0077969OS

So it does plug into just a USB port on the Wii U, huh. I'll work on getting cables then.

Edit: And I know it's not as simple as some plugs that match up. But I'm willing to throw caution to the wind to maybe save some money and learn something.

 

[LawnMeower]

I just found a decent reseller that had some serial cables on stock. Since I don't have a 64GB SD Card yet (but I will tomorrow) I just wanted to try get it run. But the system is stuck at the Waiting for server authentication screen.

 

[chainswordcs]

Oh yeah and before I forget...

https://smile.amazon.com/CableCreation-Converter-Register-Industriual-Machinery/dp/B0758BMXBG/

https://smile.amazon.com/StarTech-com-Black-RS232-Serial-Modem/dp/B00QM8ZPZ4

These were the cheapest alternatives I found on Amazon, and I can actually confirm that they both work. For the serial-USB adapter, you may have to install special drivers from their website (that's what I did anyway).

 

[LawnMeower]

Small update:
When I insert an SD Card I can reach the Kiosk Settings (like with these CAT-I units). Pairing Wiimotes and GamePads works fine.
Typing anything into the console doesn't work, however.
Any help?



EDIT: Also tried using an internet adapter. Didn't help here

 

[GerbilSoft]

Small update:
When I insert an SD Card I can reach the Kiosk Settings (like with these CAT-I units). Pairing Wiimotes and GamePads works fine.
Typing anything into the console doesn't work, however.
Any help?
View attachment 261503 View attachment 261504


EDIT: Also tried using an internet adapter. Didn't help here

Sorry for the delay, I haven't been checking in this thread too often.

If *no* commands work, the system might be in Prod mode, which is unusual for kiosks.

What firmware version is displayed on the kiosk settings menu, if any?

 

[nold]

Sorry for the delay, I haven't been checking in this thread too often.

If *no* commands work, the system might be in Prod mode, which is unusual for kiosks.

What firmware version is displayed on the kiosk settings menu, if any?

Hi, i'm facing the same issue. In the menu it just shows: "Wii U Interactive Menu - May 7 2013"
I can post a full log if that helps.

It states:
Cafe OS SDK Version 2.09.10 Build
PPC NDEBUG Kernel Build date - Apr 10 2013 14:27:06
BUILT AS OS_VERSION_MAJOR 000500101000800A MINOR 0x0000
OS VERSION ID 0x000500101000400A

 

[GerbilSoft]

I also have a CAT-SES with 2.09.xx (I forget what the xx is). Unfortunately, it seems this version of IOSU doesn't have the title launch command. It *might* be possible to upgrade IOSU using a disc-based updater, since the CAT-SES has an HDD-based optical drive emulator, but I'll need to do some more research into doing this.

 

[chainswordcs]

Okay, my SDK Version before updating was 2.12.12 Build 67129 (or just 2.12.12)

I talked to Maschell, they told me to install only os_v10_ndebug from the latest release of the Cafe SDK (which is 2.13.01, as of writing at least). I will be taking a few extra steps to ensure these files are archived.

Success! I updated the OSv10 without bricking. The Homebrew Launcher and dumping program both work as intended, but I haven't finished dumping the NAND. I will keep you posted

Edit: NAND is fully successfully dumped. I will be working on releasing the kiosk demos from my unit. One or two titles of mine may be undumped for all regions, but I think most of them have been dumped in at least one region.