Dumping Wii U kiosk systems without hardmods

The current method for dumping a Wii U kiosk system (CAT-I, CAT-SES) requires using a hardmod to dump the eMMC, then using Recovery Mode to install 2.13.01 and dumping the keys. It turns out that, if the kiosk system has a recent enough firmware, it's possible to dump the eMMC (and SLC, etc) without any hardware modifications.

(This is based on a gist I wrote up here: https://gist.github.com/GerbilSoft/640956725ab3eb46e5e32d2f617c1151)
(Screenshots/video to be added at a later point)

The Wii U operating system (IOSU) includes a debug logging facility (enabled on devkits only) that logs debug output to two places:
  • Ethernet (CAT-DEV only)
  • USB Serial (CAT-DEV, CAT-R, CAT-I, CAT-SES)

In addition to simply logging debug information, the serial console can be used to run a limited set of commands in the CafeOS (cos) shell, as long as the system is in Development (not Production) mode. It turns out that, on recent enough firmware versions, there's a cos command to launch a title, and this can be used to launch System Config Tool.

Devkit Models: (in case readers are unfamiliar)
  • CAT-DEV: High-end debugging system in a metal case. This system has PC connectivity over Ethernet.
  • CAT-R Reader: Standard debugging and test system. Looks like a white Wii U with a green faceplate.
  • CAT-I: Disc-based kiosk system. Usually has a white Wii U chassis.
  • CAT-SES: HDD-based kiosk system. Usually has a black Wii U chassis. The two front USB ports are used by the internal HDD.

This guide is generally not needed for CAT-DEV or CAT-R units, but it should work with them regardless.

Preparations

You will need the following:

Serial cables known to work with Wii U's debug logging:

Instructions

Serial Cable Setup
  1. Connect the USB serial cable to the Wii U and to the PC.
  2. On the PC, open TeraTerm. Select Serial and select the COM port that corresponds to the serial cable, then click OK.
  3. In TeraTerm, click the Setup menu, then Terminal. Set New-line for both Receive and Transmit to CR+LF, then click OK.
  4. In teraTerm, click the Setup menu, then Serial port. Select the COM port that corresponds to the serial cable, set the speed to 57600, then click the "New setting" button.
  5. Turn on the Wii U devkit. In 5-10 seconds, you should start seeing debug messages printed on the console.

COS Shell

To determine if the COS Shell is working, type the following in the serial terminal, then press Enter:

Code:
cos sdkversion

If COS Shell is working, and Development mode is enabled, a message similar to the following will be printed:

Code:
cos sdkversion
# 00;01;55;243:
---- COS Debugging Shell Command: sdkversion ----
00;01;55;243: SDKVer:21301

In this example, the system has SDK version 2.13.01 installed. This is the latest version of the system software, which corresponds to Wii U menu 5.5.0.

Launch Title

To launch the System Config Tool, run the following command:

Code:
cos launch 0x00050010 0x1F700500

This will result in one of the following:
  1. Nothing (just a '#') - the SDK version may be too old, in which case it doesn't have a launch command. Unfortunately there's no known workaround for this at the moment, other than dumping eMMC manually.
  2. Errcode -6: The specified title ID was not found. Make sure you entered it correctly. Note that some older firmware versions might have a different menu called DEVMENU installed, and DEVMENU has a different title ID.
  3. System Config Tool will load. This is what we want!
If either #1 or #2 happens, stop here and reply in this thread for support.

System Config Tool

TODO: Add screenshots

Set the default title to System Config Tool:
  1. Select Boot Configuration.
  2. Select Default Title.
  3. In the Default Title menu, select System Config Tool, press A to view title information, then press A to select.
  4. Power-cycle the system. It should boot to System Config Tool instead of the Kiosk Menu.

Install Homebrew Launcher:
  1. On PC, extract the debug-signed version of Homebrew Launcher to the SD card.
  2. Also extract Wii U NAND Dumper to the SD card. This will be used later.
  3. Put the SD card in the Wii U.
  4. In System Config Tool, select Data Manager, Title Manager, Install.
  5. Select SD Card, then browse to where Homebrew Launcher was copied.
  6. Homebrew Launcher will be detected as an Install Image. Highlight it and press A to select the title for installation.
  7. Press R to install. Follow the prompts to continue installation.

Wii U NAND Dumper

Set the system to Production Mode:

*** WARNING: After setting Production Mode, DO NOT RUN ANY KIOSK TITLES. Doing so may result in Kiosk Menu being set as the default title, and the COS Shell won't allow any commands to be run anymore since the system is in Production Mode.
  1. In the System Config Tool main menu, select Boot Configuration.
  2. Set System Mode to Production Mode and save changes.
  3. Power-cycle the system. System Config Tool should load.

Run the Wii U NAND Dumper:
  1. In System Config Tool, select Title Launcher.
  2. Select Homebrew Launcher, press A to view details, then press A twice to load it.
  3. In Homebrew Launcher, load Wii U NAND Dumper.
  4. In Wii U NAND Dumper, enable dumping of everything, including slc, slccmpt, mlc, otp, and seeprom.
  5. Dump everything. The system will look like it's rebooting, but a progress indicator will be printed on the gamepad screen. If it crashes instead of showing progress, make sure you set the system to Production Mode.

Switch Back to Development Mode

After dumping the system's NAND, put the system back in Development Mode to re-enable commands on the serial port:
  1. In the System Config Tool main menu, select Boot Configuration.
  2. Set System Mode to Development Mode and save changes.
  3. Power-cycle the system. System Config Tool should load.

Final Steps

Save the NAND dumps in a safe place for later use. You can use wfslib to browse the MLC dump and extract titles.

As an optional step, you can flash 2.13.01 and Wii U Menu Changer. This requires recovery image files that cannot be linked here and are beyond the scope of this guide.
 

SENSENuii

Well-Known Member
Newcomer
Joined
Jan 30, 2019
Messages
92
Trophies
0
Age
24
XP
1,099
Country
Japan
Do you know how to pack titles using the dev common key to install the homebrew launcher instead of downloading a pre packaged one?
 

GerbilSoft

Well-Known Member
OP
Member
Joined
Mar 8, 2012
Messages
2,395
Trophies
2
Age
34
XP
4,249
Country
United States
Do you know how to pack titles using the dev common key to install the homebrew launcher instead of downloading a pre packaged one?
As part of RVT-H Tool, I wrote a program called "nusresign" that can re-sign any NUS package using the dev keys. I haven't made a release of RVT-H Tool with nusresign yet, but the code is available here: https://github.com/GerbilSoft/rvthtool

For Homebrew Launcher, the "channel" package would be the NUS package version.
 
Last edited by GerbilSoft,

SENSENuii

Well-Known Member
Newcomer
Joined
Jan 30, 2019
Messages
92
Trophies
0
Age
24
XP
1,099
Country
Japan
As part of RVT-H Tool, I wrote a program called "nusresign" that can re-sign any NUS package using the dev keys. I haven't made a release of RVT-H Tool with nusresign yet, but the code is available here: https://github.com/GerbilSoft/rvthtool

For Homebrew Launcher, the "channel" package would be the NUS package version.
Thank you for the info, can I PM you if I have problems?
 

GerbilSoft

Well-Known Member
OP
Member
Joined
Mar 8, 2012
Messages
2,395
Trophies
2
Age
34
XP
4,249
Country
United States
Thank you for the info, can I PM you if I have problems?
Sure thing.

Also, in some more recent testing, I found that the current version of the HBL channel will crash if the system doesn't have SDK 2.13.01 installed. (tested on 2.12.xx from the Dec 2014 CAT-I update disc) So even if you're able to launch System Config Tool on these systems, if the installed OS isn't the right version, HBL won't load. I'm looking into finding a workaround for this.
 

chainswordcs

Active Member
Newcomer
Joined
Mar 24, 2020
Messages
36
Trophies
0
Age
21
Location
USA
XP
142
Country
United States
I can totally take photos and/or screenshots of the process if you'd like.

Also, sorry but I'm stuck on Preparations... What sort of cable do I need? My PC (and sorry but any modern PC) doesn't have a Serial Port...

(Side Note: maybe specify more clearly for those folks that you do need both products listed under "if your PC has Serial")

The Amazon screenshot is awful:
21GWD2QmunL._AC_.jpg

And I know that not every cable with the specific two ends will work. But I am curious which port is the other end, and whether there is a slightly cheaper option for me.
20210422_012357.jpg


By the way I know I'm going to run into issues later: My SDK Version is 2.12.12 Build 67129... But I'm still willing to take steps right now and help test stuff!

Edit: Just so you know, I have a model WIS-001 and the Kiosk Settings say it is a CAT-I Standalone.
 
Last edited by chainswordcs,

CosmoCortney

i snack raw pasta and chew lollipops
Member
Joined
Apr 18, 2013
Messages
1,768
Trophies
2
Location
on the cool side of the pillow
Website
follow-the-white-rabbit.wtf
XP
3,007
Country
Germany
Thank you for this guide. Sadly this FTDI NMC-USB cable is hard to get and really expensive. Do you think I can use some board with the FT232R chip on it?
Got one SES and 2 unmodded WIS units I'd love to dump
 
Last edited by CosmoCortney,
  • Like
Reactions: chainswordcs

GerbilSoft

Well-Known Member
OP
Member
Joined
Mar 8, 2012
Messages
2,395
Trophies
2
Age
34
XP
4,249
Country
United States
Thank you for this guide. Sadly this FTDI NMC-USB cable is hard to get and really expensive. Do you think I can use some board with the FT232R chip on it?
Got one SES and 2 unmodded WIS units I'd love to dump
The FT232 is only strictly needed for the Wii U side. You can use any other serial adapter on the PC side (either a real serial port or a USB adapter, or an Arduino or similar).

I'm not sure if it's possible to dump the CAT-SES HDD without disassembling the system, but it should be straightforward to dump using e.g. ddrescue and a USB SATA adapter.

--------------------- MERGED ---------------------------

I can totally take photos and/or screenshots of the process if you'd like.

Also, sorry but I'm stuck on Preparations... What sort of cable do I need? My PC (and sorry but any modern PC) doesn't have a Serial Port...

(Side Note: maybe specify more clearly for those folks that you do need both products listed under "if your PC has Serial")

The Amazon screenshot is awful:
21GWD2QmunL._AC_.jpg

And I know that not every cable with the specific two ends will work. But I am curious which port is the other end, and whether there is a slightly cheaper option for me.
20210422_012357.jpg


By the way I know I'm going to run into issues later: My SDK Version is 2.12.12 Build 67129... But I'm still willing to take steps right now and help test stuff!

Edit: Just so you know, I have a model WIS-001 and the Kiosk Settings say it is a CAT-I Standalone.
SDK 2.12 should have the `cos launch` command available.

Since you don't have a serial port on your PC, I'd recommend the FTDI USB Null Modem Cable: https://www.amazon.com/gp/product/B00HKJSSQ2 - this is basically two FTDI serial adapters in one.

Alternatively, you can get two USB to Serial adapters: https://smile.amazon.com/gp/product/B0030IT780
and then a null-modem serial cable: https://smile.amazon.com/gp/product/B0077969OS

This method might be a bit more expensive, but the advantage over the USB Null Modem Cable is you can use it for other devices that have 9-pin serial.
 

chainswordcs

Active Member
Newcomer
Joined
Mar 24, 2020
Messages
36
Trophies
0
Age
21
Location
USA
XP
142
Country
United States
The FT232 is only strictly needed for the Wii U side. You can use any other serial adapter on the PC side (either a real serial port or a USB adapter, or an Arduino or similar).

...

Since you don't have a serial port on your PC, I'd recommend the FTDI USB Null Modem Cable: https://www.amazon.com/gp/product/B00HKJSSQ2 - this is basically two FTDI serial adapters in one.

Alternatively, you can get two USB to Serial adapters: https://smile.amazon.com/gp/product/B0030IT780
and then a null-modem serial cable: https://smile.amazon.com/gp/product/B0077969OS

So it does plug into just a USB port on the Wii U, huh. I'll work on getting cables then.

Edit: And I know it's not as simple as some plugs that match up. But I'm willing to throw caution to the wind to maybe save some money and learn something.
 
Last edited by chainswordcs,

chainswordcs

Active Member
Newcomer
Joined
Mar 24, 2020
Messages
36
Trophies
0
Age
21
Location
USA
XP
142
Country
United States
  • Like
Reactions: CosmoCortney

CosmoCortney

i snack raw pasta and chew lollipops
Member
Joined
Apr 18, 2013
Messages
1,768
Trophies
2
Location
on the cool side of the pillow
Website
follow-the-white-rabbit.wtf
XP
3,007
Country
Germany
Small update:
When I insert an SD Card I can reach the Kiosk Settings (like with these CAT-I units). Pairing Wiimotes and GamePads works fine.
Typing anything into the console doesn't work, however.
Any help?
upload_2021-5-4_21-35-46.png upload_2021-5-4_21-36-46.png


EDIT: Also tried using an internet adapter. Didn't help here
 
Last edited by CosmoCortney,

GerbilSoft

Well-Known Member
OP
Member
Joined
Mar 8, 2012
Messages
2,395
Trophies
2
Age
34
XP
4,249
Country
United States
Small update:
When I insert an SD Card I can reach the Kiosk Settings (like with these CAT-I units). Pairing Wiimotes and GamePads works fine.
Typing anything into the console doesn't work, however.
Any help?
View attachment 261503 View attachment 261504


EDIT: Also tried using an internet adapter. Didn't help here
Sorry for the delay, I haven't been checking in this thread too often.

If *no* commands work, the system might be in Prod mode, which is unusual for kiosks.

What firmware version is displayed on the kiosk settings menu, if any?
 

nold

Member
Newcomer
Joined
Apr 25, 2018
Messages
6
Trophies
0
Age
28
XP
66
Country
Germany
Sorry for the delay, I haven't been checking in this thread too often.

If *no* commands work, the system might be in Prod mode, which is unusual for kiosks.

What firmware version is displayed on the kiosk settings menu, if any?

Hi, i'm facing the same issue. In the menu it just shows: "Wii U Interactive Menu - May 7 2013"
I can post a full log if that helps.

It states:
Cafe OS SDK Version 2.09.10 Build
PPC NDEBUG Kernel Build date - Apr 10 2013 14:27:06
BUILT AS OS_VERSION_MAJOR 000500101000800A MINOR 0x0000
OS VERSION ID 0x000500101000400A
 
Last edited by nold,

GerbilSoft

Well-Known Member
OP
Member
Joined
Mar 8, 2012
Messages
2,395
Trophies
2
Age
34
XP
4,249
Country
United States
I also have a CAT-SES with 2.09.xx (I forget what the xx is). Unfortunately, it seems this version of IOSU doesn't have the title launch command. It *might* be possible to upgrade IOSU using a disc-based updater, since the CAT-SES has an HDD-based optical drive emulator, but I'll need to do some more research into doing this.
 

chainswordcs

Active Member
Newcomer
Joined
Mar 24, 2020
Messages
36
Trophies
0
Age
21
Location
USA
XP
142
Country
United States
Okay, my SDK Version before updating was 2.12.12 Build 67129 (or just 2.12.12)

I talked to Maschell, they told me to install only os_v10_ndebug from the latest release of the Cafe SDK (which is 2.13.01, as of writing at least). I will be taking a few extra steps to ensure these files are archived.

Success! I updated the OSv10 without bricking. The Homebrew Launcher and dumping program both work as intended, but I haven't finished dumping the NAND. I will keep you posted :)

Edit: NAND is fully successfully dumped. I will be working on releasing the kiosk demos from my unit. One or two titles of mine may be undumped for all regions, but I think most of them have been dumped in at least one region.
 
Last edited by chainswordcs,
  • Like
Reactions: GerbilSoft

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • Veho @ Veho:
    The fuuuuu---
  • Veho @ Veho:
    I thought it was an actual xBox at that price.
  • Sicklyboy @ Sicklyboy:
    I wanna grab a 360 Slim and a 360 E one of these days. Missed the boat of getting them at their lowest though, once they were discontinued. Could've got them for cheap back when I was a broke 20 something working at Target, but then again, I was a broke 20 something working at Target
  • Veho @ Veho:
    Being broke is no fun.
  • K3Nv2 @ K3Nv2:
    @Sicklyboy, $150 isn't that bad for a jtag slim on ebay
  • Veho @ Veho:
    I only wish it was actually playable.
  • Veho @ Veho:
    There's a guy on the Tube of You that makes playable mechanical arcade games out of Lego. This could work on the same principle.
  • Veho @ Veho:
    Just a couple of guys taking their manatee out for some fresh air, why you have to molest them?
  • Veho @ Veho:
    Stupid Chinese shop switched their shipping company and this one is slooooooow.
  • LeoTCK @ LeoTCK:
    STOP BUYING CHINESE CRAP THEN
  • LeoTCK @ LeoTCK:
    SUPPORT LOCAL PRODUCTS, MAKE REVOLUTION
  • LeoTCK @ LeoTCK:
    THEY KEEP REMOVING LOCAL SHIt AND REPLACING WItH INFERIOR CHINESE CRAP
  • LeoTCK @ LeoTCK:
    THATS WHY MY PARTNER CANT GET A GOOTWEAR HIS SIZE ANYMORE
  • LeoTCK @ LeoTCK:
    HE HAS BIG FOOT AND BIG DUCK
  • LeoTCK @ LeoTCK:
    d*ck i mean*
  • LeoTCK @ LeoTCK:
    lol
  • Veho @ Veho:
    Mkay.
  • Veho @ Veho:
    I just ordered another package from China just to spite you.
  • SylverReZ @ SylverReZ:
    Communism lol
  • SylverReZ @ SylverReZ:
    OUR products
  • The Real Jdbye @ The Real Jdbye:
    @LeoTCK actually good quality products are dying out because they can't compete with dropshipped chinese crap
    +1
    The Real Jdbye @ The Real Jdbye: @LeoTCK actually good quality products are dying out because they can't compete with dropshipped... +1