Hacking [Guide] Kafluke's HardMod CBHC Unbrick guide

[AQS]

I just found out I only have the OTP.bin and SLC.bin, not the MLC. Am I still able to unbrick my Wii U? I bought it off a guy who JUST bought it as flashed, and the FIRST thing he did was he connected Wii U to the internet and updated it... So then it only threw the infamous error code and now it's like that. I am stuck in the menu on the controller, and whatever I click on, it just errors again. So I assume the system has been succesfully updated. Do I also need old mlc or am I good to go with SLC and OTP?

I really think we need more info to know how we can help further.. Connecting the Wiiu to the internet and updating it won't cause issues ... even if you have HAXCHI/CBHC , you'd be fine if all that happened was a system update.
Are you possibly thinking the system was restored back to factory defaults?

When you say you're stuck on the "menu on the controller" , is this the quickstart menu you're referring to (link)? Or are you referring to something else.. Perhaps providing a picture of what you are seeing would help, or maybe a quick youtube video?

Also, please let us know the actual error.. error 160-0101 ? , or is it 160-0103 ? or other ? ... And does this error happen before the Wiiu System menu loads?

Regards

 

[strnadik]

I really think we need more info to know how we can help further.. Connecting the Wiiu to the internet and updating it won't cause issues ... even if you have HAXCHI/CBHC , you'd be fine if all that happened was a system update.
Are you possibly thinking the system was restored back to factory defaults?

When you say you're stuck on the "menu on the controller" , is this the quickstart menu you're referring to (link)? Or are you referring to something else.. Perhaps providing a picture of what you are seeing would help, or maybe a quick youtube video?

Also, please let us know the actual error.. error 160-0101 ? , or is it 160-0103 ? or other ? ... And does this error happen before the Wiiu System menu loads?

Regards

Thank you for further assistance! I have Teensy and the power regulator on the way so I cannot do anything but research now Oh, that is odd, maybe the seller was lying so I buy it, I don't know. All I know is, supposedly a very experienced dude installed Haxchi/CBHC, enjoyed his Wii U, then sold it to another dude. That one "supposedly" played Mario on it for 3 hours, then the only thing he remembers doing is a system update, and then he just got the 160-0103. Then upon starting the Wii U, he encountered the error IMMEDIATELY over and over again. (Maybe he wiped the title that CBHC relied on?).

I then talked to the original dude, who said he didn't expect the new user to screw it up so quickly, and he also found his years old backups of OTP.bin, SLC.bin and so on (bless him).

As for the controller - yes this is the quickstart. When I start Wii U, it just straight up goes to the error screen on THE TV. But the controller provides me with the Quick start. But whatever I click on just results in 160-0103.

I am just going off to sleep now but I will make a quick youtube vid tommorow explaining the situation.

Thank you, and have a nice day!

 

[godreborn]

if it's a cbhc brick, the slc will save you or should anyway. I don't know how that could've happened if he just updated though. it shouldn't have touched the game, though one of the European updates, think it was 5.5.3, undid cbhc, but all you had to do was reinstall it. I think it was a tos update, not sure why the system.xml was replaced, since it's a very small file iirc. however, America didn't have this problem. I updated from 5.5.1 to 5.5.5 directly, and it didn't affect me at all.

 

[strnadik]

I really think we need more info to know how we can help further.. Connecting the Wiiu to the internet and updating it won't cause issues ... even if you have HAXCHI/CBHC , you'd be fine if all that happened was a system update.
Are you possibly thinking the system was restored back to factory defaults?

When you say you're stuck on the "menu on the controller" , is this the quickstart menu you're referring to (link)? Or are you referring to something else.. Perhaps providing a picture of what you are seeing would help, or maybe a quick youtube video?

Also, please let us know the actual error.. error 160-0101 ? , or is it 160-0103 ? or other ? ... And does this error happen before the Wiiu System menu loads?

Regards

I am still confused though - I do have SLC which I can fully restore. But I do not have MLC backup and the Wii U has been updated since the backup. So now I have the issue you had. SLC version =/= MLC ver., but I have no way of restoring MLC. Am I screwed?

 

[AQS]

I am still confused though - I do have SLC which I can fully restore. But I do not have MLC backup and the Wii U has been updated since the backup. So now I have the issue you had. SLC version =/= MLC ver., but I have no way of restoring MLC. Am I screwed?

160-0101 is usually caused by a factory restore on MLC (For which CBHC is installed), and for that error you can do an SLC restore (before CBHC was installed) or an extract of current SLC from the system + edit the defaulttitleID and re-upload back to the system. For this , the Teensy you ordered would have worked.

However since you're getting 160-0103, it usually means MLC corruption of some sorts , or in my case it was a mismatched SLC/MLC version. If you're getting 160-0103 and you haven't done anything with SLC yet, it most likely means that you'd need the MLC backup to get you going again ( what a bummer that you don't have it )...

The only other thing I can think of is if you do the SD hard Mod (MLC), dump your current MLC and then trying to figure out which files are corrupt (because you already have opt.bin which is needed for the extract/injection )... but figuring out which files are bad and then correcting them would be very difficult.

 

[strnadik]

160-0101 is usually caused by a factory restore on MLC (For which CBHC is installed), and for that error you can do an SLC restore (before CBHC was installed) or an extract of current SLC from the system + edit the defaulttitleID and re-upload back to the system. For this , the Teensy you ordered would have worked.

However since you're getting 160-0103, it usually means MLC corruption of some sorts , or in my case it was a mismatched SLC/MLC version. If you're getting 160-0103 and you haven't done anything with SLC yet, it most likely means that you'd need the MLC backup to get you going again ( what a bummer that you don't have it )...

The only other thing I can think of is if you do the SD hard Mod (MLC), dump your current MLC and then trying to figure out which files are corrupt (because you already have opt.bin which is needed for the extract/injection )... but figuring out which files are bad and then correcting them would be very difficult.

Oh well.. :/ I am still bamboozled by what couldve happened. The dude supposedly just updated and that's it. It might be possible he removed the title that was tied to CBHC, sure, but that would more likely spawn the 0101 right? I already ordered Teensy, the power regulator and so on, like 30$ thru the window, so I might aswell try it.

 

[strnadik]

One more silly question. Could a functioning paired controller that still shows Haxchi and stuff from the Wii U (that just displays the error code) be any last resort? For the BluShell for example? I have another Wii U that fully works but doesn't have a Wii U controller paired. But I do not wanna risk unpairing the controller to lose any last straw to the softbricked one. Is it nonsense? I just need a sanity check. Thanks!

 

[PCPapi]

Anyone here interested in buying a bricked Wii U lol I have the SD card backed up on my PC with the otp.bin slc and slccmpt, no way I'm fixing this thing. Can't believe my brain shut off and I tried to factory reset

 

[strnadik]

Anyone here interested in buying a bricked Wii U lol I have the SD card backed up on my PC with the otp.bin slc and slccmpt, no way I'm fixing this thing. Can't believe my brain shut off and I tried to factory reset

Where are you from? Please please be Europe!

 

[ArgoRV]

I will save this and Hopefully never use it.
Thank you so much!

 

[ArgoRV]

Welcome to the CBHC hardmod unbrick guide. This is not for the "faint of heart". In other words, this is not a noob guide. I expect you to have skills in micro-soldering as well as a basic knowledge of windows file system. I will not hold your hand through every step. This guide is for IT professionals with micro-soldering skills. If you do not fit these qualifications then hire someone who does. I will not be held responsible if you permanently disable your Wii U. This guide is for users that inadvertently bricked by messing up CBHC. I know that you can use the same steps to fix other nand issues but I won't be covering that here.

Last updated 10-11-17 - Last checked for updates: 5-15-18

This guide assumes that you at least have a nand backup. This includes but is not limited to "otp.bin" and/or "slc.bin". Please read below for more information on what you actually need to make this work.

WHAT YOU'LL NEED

Spoiler: Pre-setup

• You must have one of the following:

1. A backup of otp.bin. or...
2. A full slc.bin backup BEFORE CBHC install.

• Get both of these before you brick by following Step 3 in my Noob guide here.
• Teensy++ 2.0 - buy it here.
• Voltage regulator for the Teensy++ 2.0 (hereafter simply refered to as "Teesny") - buy it here. (soldering instructions for this are in step 1).
• A Windows based PC. (It uses python so you might be able to use Linux or Mac but I won't be including those instructions)
• Download and install Python for Windows
  • Python 2.7.2 : python-2.7.2.msi
• Download the windows drivers for the Teensy here and install.
• Download the Teensy loader. You will need this to install the .hex file (step 2). Just download it and remember where you saved it. You don't need to install it.
• Download the Nandway-SignalBoosterEdition.hex and NANDway.py files here. There are two files in this zip. You will need them both later in the guide.
• Basic micro-soldering skills and good equipment.

1. PREPARE YOUR TEENSY

Spoiler: Flashing the Teensy

There are 3 steps that must be completed before you solder your Teensy to the Wii U system board.

1. Solder the voltage regulator to the Teensy using the pictures below as a guide.​

2. Cut the track between the 5v and 3v pads & bridge the 3V pads on the Teensy using the pictures above as a guide.​

​

3. Program the Teensy with the Nandway Signal Boost Edition software using the steps below.​

Spoiler: Program the Teensy

1. Double click the program "teensy.exe" (Teensy Loader) that you downloaded in the Pre-Setup steps above.
2. Plug in your Teensy++ 2.0. The LED on the Teensy should start blinking.
3. Press the button on the Teensy board. You should hear the familiar "ba dunk" sound that Windows makes when it sees a new device.
4. The Teensy loader software should now show your Teensy++ 2.0.
5. If you followed all the instructions in the Pre-Setup section Windows should automatically detect and install the device.
6. Check your device manager. You should see a new device under "Ports (COM & LPT) called USB Serial Device (COM3)". Your COM port may be different. Remember what it is. It will be important later.
7. In the Teensy Loader program screen on your PC select File -> Open HEX File.
8. Browse to the file "NANDway_SignalBoosterEdition.hex" which you downloaded earlier and extracted from the .zip file.
9. After the file is loaded you should see the green "program" button light up. It looks like a green arrow curving right and pointing down.
10. Click Operation -> Program or click that curving green arrow.
11. You will get a confirmation letting you know that it successfully programmed the Teensy.
12. Close the Teensy Loader and unplug your Teensy from the PC. You are now ready to solder the Teensy to your Wii U. Move on to the next steps.

2. SOLDER THE TEENSY TO THE WII U BOARD

Spoiler: Wii U NAND solder points

This step should be performed by a professional with micro-soldering skills. The Wii U NAND points are very small and require a steady hand and good equipment. Do NOT attempt this step if you aren't comfortable with micro-soldering. This is where you will permanently brick your Wii U if you screw up. You've been warned!

Click on all images for larger view

1. Look up a Wii U disassemble guide on YouTube. There are a number of them.
2. Solder the Teensy to the Wii U System board following the picture below (If you are only going to fix a CBHC brick then ignore points RB1 & CE1):

Teensy++2.0

Just in case it's not clear in the picture above. Solder all these points together:

Wii U NAND - Again, ignore RB1 & CE1 if you are just fixing a CBHC brick.

Alternate solder points - These are even smaller than the original solder points. Don't screw up here. These are direct solder points to the NAND itself.

It should look like this when finished. Notice where the ground wire is soldered. This goes to the ground point on the Teensy.

3. FIX YOUR WII U BY FLASHING WITH THE TEENSY

Spoiler: Teensy Flash Steps

Follow these instructions carefully and don't stray from the steps unless you are experienced enough with the flashing commands of the Teensy and want to explore other fixes.

1. Create your folder structure to make this easier. Create a blank folder on your desktop and copy "otp.bin" or "slc.bin" to this folder. (You must already have one of these files to use this guide)
2. Back in the Pre-Setup you downloaded a .zip file that contained the .hex file we needed when setting up the Teensy. There is another file in that .zip that we now need. It is "NANDway.py". Copy this file to the same folder that contains "otp.bin".
3. Download the file "release.zip" from here (eyekey's nand tools). Copy all the files in the zip to the same directory as above.

If you ONLY have otp.bin then follow these steps. If you have a full slc.bin backup BEFORE installing CBHC then skip this section.

Start out by first dumping a copy of your current slc.bin from the Wii U.

1. Start out with the Teensy disconnected from the PC.
2. Make sure that your optical drive, power button and your fan are all connected to the Wii U.
3. Plug in your Wii U power connector.
4. Turn on your Wii U. The power LED should turn blue and your fan should spin.
5. Plug in the Teensy to the PC via USB cable.
6. Open a command prompt from within the folder that you created above.
7. Type this command: "NANDway.py COM3 0 info" (Remove the quotes and substitute the COM3 with whatever COM your Teensy is using. See "PREPARE YOUR TEENSY" step 1.)
8. You should see a reply after pinging your Wii U NAND that looks like this:

9. Dump your current slc.bin by running this command: "NANDway.py COM3 0 dump slc.bin" (again, remove quotes and replace COM3 with your correct COM port for Teensy)​

​

10. Open the folder where you dumpted "slc.bin". It should be the same folder where you have otp.bin.​

​

11. You should have all of eyekey's NAND tools in the same directoy as your slc.bin file if you followed the instructions above. This next command will not work if you are missing "otp.bin" from the same directory as "slc.bin" and "nandCbhcRemover.exe". Run this command to fix the CBHC install. (This will remove CBHC). Open a prompt in that directory and run this command:​

• nandCbhcRemover.exe slc.bin

12. This command will fix your slc.bin by removing CBHC. Move on to the next step to flash your now fixed slc.bin.​

​

13. In the same command prompt run this flash command (again replacing the COM port with your own. Do I need to keep saying that?) to fix your CBHC brick:​

• NANDway.py COM3 0 vwrite slc.bin

That's it. You're Wii U should now boot to non-CBHC system menu allowing you to fix anything else that you need to. Test this by pluggin in the AV cord and booting again (unplug the Teensy from your PC). If it boots okay then unsolder all your connections and reassemble your Wii U.​

​

If you still are having issues then see the Troubleshooting section​

​

If you have a full slc.bin backup BEFORE installing CBHC then follow these steps.

You don't need otp.bin if you have a full slc.bin backup that you made before installing CBHC. You can simply flash the full backup to the NAND.

1. Start out with the Teensy disconnected from the PC.
2. Make sure that your optical drive, power button and your fan are all connected to the Wii U.
3. Plug in your Wii U power connector.
4. Turn on your Wii U. The power LED should turn blue and your fan should spin.
5. Plug in the Teensy to the PC via USB cable.
6. Make sure that "slc.bin" is located in the same directory as "NANDway.py".
7. Open a command prompt from within the folder that you created above.
8. Type this command: "NANDway.py COM3 0 info" (Remove the quotes and substitute the COM3 with whatever COM your Teensy is using. See "PREPARE YOUR TEENSY" step 1.)
9. You should see a reply after pinging your Wii U NAND that looks like this:

10. In the same command prompt run this flash command (again replacing the COM port with your own. Do I need to keep saying that?) to fix your CBHC brick:​

• NANDway.py COM3 0 vwrite slc.bin

That's it. You're Wii U should now boot to non-CBHC system menu allowing you to fix anything else that you need to. Test this by pluggin in the AV cord and booting again (unplug the Teensy from your PC). If it boots okay then unsolder all your connections and reassemble your Wii U.​

​

If you still are having issues then see the Troubleshooting section​

CHANGELOG

Spoiler: Changelog

10-11-17
Updated the teensy drivers link

7-17-17
Added python PC program link in the "What You Need" section

7-17-17
Added the changelog

TROUBLESHOOTING

Spoiler: Troubleshooting

Make sure that you have checked and triple checked all your wiring before continuting with additional troubleshooting steps.

Here are some troubleshooting steps from @Leeful

Spoiler: Leeful's steps

This is the procedure I used to dump and write back to the WiiU with the Teensy.

• Connect teensy to WiiU for either WiiU(RB2 & CE2 Connected) or V-Wii Mode(RB1 & CE1 Connected).
• Press Power Button On WiiU
• Blue LED on WiiU should be ON and the fan and Disc Drive start up but The WiiU does not boot.
• Connect teensy to PC
• Use the 'info' command and check that it has detected the NAND.
• If the nand is detected OK then use the 'dump' or 'vwrite' command.
• When finished, Hold the Power Button on WiiU until LED goes red.
• Disconnect the teensy from the PC and then the WiiU.
• If for whatever reason this does not work try doing it in this order instead:
• Connect teensy to WiiU for either WiiU(RB2 & CE2 Connected) or V-Wii Mode(RB1 & CE1 Connected).
• Connect teensy to PC
• Press Power Button On WiiU
• Blue LED on WiiU should be flashing but the fan and the Disc Drive do not start up.
• Use the 'info' command and check that it has detected the NAND.
• If the nand is detected OK then use the 'dump' or 'vwrite' command.
• When finished, Hold the Power Button on WiiU until LED goes red.
• Disconnect the teensy from the PC and then the WiiU.

More soldering tips from Leeful:

A few things to help:
Use liquid solder flux on the board. This helps the solder flow.

Make sure the end of your iron is tinned properly. It should be shiny silver like the solder and not black.

Before trying to solder the wires to the board make sure that the wires are tinned first. (they should have a fine covering of solder on the end.)

Try and solder the points on the board first without trying to attach the wires. This will freshen up the joints on the board so that when you try and solder the wires the fresh solder on the board and the fresh solder on the end of the wires should melt together better and produce a strong clean joint.

Don't hold the iron on the board for too long, about 1 sec or less should be more than enough to melt the solder If your iron is properly tinned and the joint is clean. Any longer and you run the risk of dammaging the board your working on.

Like most things soldering gets easier with practice. If you have some old equiptment lying around try practicing on this first so that you dont wreck the thing your trying to fix even more.

hope this helps. Good luck.

Additional helpful links

Spoiler: other links

https://gbatemp.net/threads/successfully-dumped-wiiu-emmc-nand-with-hardmod.457165/
https://gbatemp.net/threads/release-wii-u-nand-tools.465386/
http://www.psdevwiki.com/ps3/Teensy++_2.0
https://www.pjrc.com/teensy/first_use.html

Please let me know if I've missed somebody

Spoiler: Credits

@EyeKey for his amazing nand backup and restore tools.
@Leeful for almost 100% of the pics and wiring guides and taking one for the team and figuring all this out for us.
@FIX94 - We love you buddy, it's not your fault that people can't follow instructions and end up bricking their Wii U. You have made our lives awesome with CBHC!

is this exclusive for CBHC systems? or it can work to restore the NAND in any situation?

 

[CrisMod]

is this exclusive for CBHC systems? or it can work to restore the NAND in any situation?

For any situation,....the referred CBHC it's just because for 99,9% you will "hard brick" the Console with it (so , not related to the soft brick this guide)

 

[Lazr1026]

Hello! i wanted to ask if the NANDway.py linked in this guide is different from the NANDway.py from hjudges/NORway/blob/master/NANDway.py.

I ask because the mega link is dead.

 

[AQS]

Hello! i wanted to ask if the NANDway.py linked in this guide is different from the NANDway.py from hjudges/NORway/blob/master/NANDway.py.

I ask because the mega link is dead.

It should be the same yes.. but here's a direct link if you need it ( I used it recently and can confirm it works )
NANDway.py = Line 430 in the PY should say VERSION_MINOR = 65 , link here

and in case you need these other files, here they are..

NANDway_SignalBoosterEdition.hex = link here
python-2.7.2.msi - link here , if the direct link doesn't work, you can look here
pyserial-2.5.win32.exe - link here , if the direct link doesn't work, you can look here

 

[Lazr1026]

It should be the same yes.. but here's a direct link if you need it ( I used it recently and can confirm it works )
NANDway.py = Line 430 in the PY should say VERSION_MINOR = 65

Thank you! all i needed to know was if the python script was different, but thats for the extra links anyway .

 

[Lazr1026]

one more thing, do i NEED a teensy or can i get away with using something else

Edit: everywhere i look the teensy linked in the guide is out of stock. i have one of these but i feel like i fried it.

 

[AQS]

one more thing, do i NEED a teensy or can i get away with using something else

at the moment , there's no other documented method to restore SLC.bin or slccmpt.bin without a Teensy.. more specifically it needs to be a "Teensy++ 2.0"as the NANDway_SignalBoosterEdition.hex that is required for read/write will only work/flash with this Teensy model. The only place I see them being sold is on Aliexpress as clones of the original .. Originals have been discontinued.

It was mentioned earlier in this thread that clones should work too - you just have to make an extra cut to the board.

 

[Lazr1026]

at the moment , there's no other documented method to restore SLC.bin without a Teensy.. more specifically it needs to be a "Teensy++ 2.0"as the NANDway_SignalBoosterEdition.hex that is required for read/write will only work/flash with this Teensy model. The only place I see them being sold is on Aliexpress as clones of the original .. Original's have been discontinued.

it was mentioned earlier in this thread that clones should work too - you just had to make an extra cut to the board.

alright. thanks.

 

[M0rphman]

If you have a full dump of SLC/SLCCMPT/MLC/OTP/SEEPROM is it possible to use this with a second systems OTP/SEEPROM and flash that onto second system potentially for region swap?

Also, is it possible to flash SPI chip on gamepad with dump from other regions?

 

[godreborn]

If you have a full dump of SLC/SLCCMPT/MLC/OTP/SEEPROM is it possible to use this with a second systems OTP/SEEPROM and flash that onto second system potentially for region swap?

Also, is it possible to flash SPI chip on gamepad with dump from other regions?

I don't believe that's currently possible.