Help! Bricked / Dead Wii U?

[propi21_argy]

Hello!
I've been struggling with mi wii u for a 6 weeks now and you guys are my last chance.

After about a year, i decided to play some games again, and when i tried to turn it on, the following menu freezed.

So i started searching and using both Gemini/Claude for help, until i found the PPICO fix. I used it, and i was able to get to the main menu without major issues. The thing is, nothing worked, only the menu navegation. I could open internet, but anything else would come to a frozen Wii u screen, similar to the one posted before, but this time, quite bigger.
I started using more and more AI to find a fix, and i tried a lot, most of it a cannot even remember myself. Therefor, i asked my AI to write a summary so i can show what we learn and what i have tried.
I would be so grateful if anyone here could help me. I am about to resign and leave my wii u dead for good, and of course that would be the saddest thing ever.

ps sorry for bad eng.

Here comes the summary from Claude:

USA Wii U, internal eMMC dead. Running redNAND from SD with ISFShax + StroopwafelCFW + `wafel_setup_mlc` v3.0 (51 USA system titles installed, Wii U Menu boots, setup wizard completes).
- **Blocker**: after the wizard, Wii U Menu force-launches Mii Maker. Mii Maker logo appears bottom-right, then the **Mii Maker title hangs forever**. No in-band skip.
- Tried to bypass via `udpih` + `rpx_replacement` -> Aroma `root.rpx`. Hijack fires, but PayloadFromRPX prints `"Failed to load sd:/wiiu/payload.elf"` even though the file is on the SD with the official Aroma hash. Suspect SD devoptab is never mounted in the rpx_replacement-spawned process. One defensive patch didn't help.
**Asks at the bottom.** Primary ask is about the Mii freeze (larger audience), secondary is the PFR/FSA detail.
## The blocker — Mii Maker hangs after wizard
- After the setup wizard completes, sysmenu force-launches Mii Maker (`1004A100`, 78 MB full title installed, not a stub).
- Mii Maker logo appears in the bottom-right; title then hangs.
- **Left it on the freeze screen for 20+ minutes — no SD activity LED, no fan ramp, GamePad unresponsive, HOME button does nothing.** Not a slow first-boot cache build.
- Can't pre-create a Mii from PC: redNAND MLC is WFS-encrypted with this console's OTP.
- Sysmenu version is whatever `wafel_setup_mlc` v3.0 ships from the USA title set (5.5.x USA — happy to dump the exact title version if useful; I haven't pinned it down).
## Hardware + state
- Wii U USA (NTSC, region C:2 per SCI). Internal eMMC failed (black screen on logos before all of this).
- SD: 64 GB, P1 FAT32 boot/`wiiu`/`environments`, P2/P3/P4 raw redNAND MLC/SLC/SLCCMPT.
- ISFShax in SLC -> patched boot1 -> autoboots `sd:/fw.img` (StroopwafelCFW / `minute_minute`). Rock solid.
- UDPIH = RPi Pico clone. Confirmed firing (Windows enumerates "Unknown USB Device / Device Descriptor Request Failed" on hotplug; on-screen output from the loaded `launch.rpx` is visible).
- Console has **never been online** on this firmware. Network kept on a mobile hotspot to block updates.
## Current attempt: `rpx_replacement` -> Aroma `root.rpx`
Built `udpih_payloads/rpx_replacement` from source (devkitPro native Windows, no Docker), and patched PayloadFromRPX. The idea: `rpx_replacement` IOSU-side intercepts `MCP_LoadFile`, so when sysmenu loads its `.rpx` it gets `/vol/storage_homebrew/launch.rpx` instead.
- `launch.rpx` = stock Aroma beta 27 `root.rpx`, SHA256 `F023F1A0E2254E3CB6F970AF9E1858EB7D6539226ABA4C8C06BBF30269057BC1` (matches official bundle byte-for-byte).
- Trigger: rename `sd:/fw.img` to defeat ISFShax autoboot -> Wii U logo appears -> UDPIH hotplug -> `rpx_replacement` payload installed -> rename back, reboot into sysmenu.
**Observed**: bypass fires (on-screen messages are PFR's). Then:
```
Failed to load sd:/wiiu/payload.elf
Starting the console without any modifications
```
...falls through to sysmenu -> Mii Maker freeze.
SD contents hash-verified against the official Aroma beta 27 bundle:

Spoiler: Aroma file hashes on SD

- `/wiiu/payload.elf` — 142464 bytes, SHA1 `421304A1E952C1B2571261E9009FC012BAEC7613` (matches official)
- `/wiiu/payload.rpx` — 202807 bytes, SHA1 `62A2500420122A73E1F2D434AB81FF0A76F6F0C0` (matches official)
- `/wiiu/environments/{installer,tiramisu,aroma}` present, all hash-matched

So PFR is running, and the file it can't find is physically present at the path it claims to look at.
## The PFR patch attempt (inline, since it's the core of the question)
PFR load path:
- Probe: `fopen("fs:/vol/external01/wiiu/payload.elf", "r")` — `source/main.cpp:89`
- Actual: `WHBReadWholeFile()` -> `WHBMountSdCard()` + `WHBGetSdCardMountPath()` — `ElfUtils.c:14-39`
Both resolve via the Cafe OS user-space devoptab. Hypothesis: in `rpx_replacement` context the `.rpx` is loaded by `MCP_DoLoadFile` without a real title-launch handshake, so user-space `savemounter` never sets up `fs:/vol/external01`. The IOSU-side `FSA_Mount` that `rpx_replacement` does (`/dev/sdcard01` -> `/vol/storage_homebrew`) doesn't help, because libwhb / devoptab go through Cafe OS FS client, not IOSU FSA.
Patched PFR `main()` BEFORE the `fopen` probe (pattern copied from `EnvironmentLoader/source/main.cpp:343-352`):
```c
#include <coreinit/filesystem_fsa.h>
// ...
FSAInit();
FSAClientHandle fsaClient = FSAAddClient(nullptr);
if (fsaClient) {
FSError mountRes = FSAMount(fsaClient, "/dev/sdcard01",
"/vol/external01",
(FSAMountFlags) 0, nullptr, 0);
DEBUG_FUNCTION_LINE("FSAMount /dev/sdcard01 -> /vol/external01 returned %d", mountRes);
FSADelClient(fsaClient);
}
```
- Patched PFR: SHA1 `24478A7DCBB6F4136F57A87D147BAA7CE7C1198E` (95943 bytes vs stock 99947).
- `rpx_replacement` reverted to a single `FSA_Mount` (an earlier triple-mount caused a different symptom — Wii U logo hang instead of Mii Maker freeze — so backed out to isolate variables).
- **Result: identical "Failed to load sd:/wiiu/payload.elf"**, no visible change.
**Caveats I haven't fully ruled out** (would value pointers here too):
1. I haven't confirmed `DEBUG_FUNCTION_LINE` actually surfaces anywhere in this context — if it goes nowhere, the absence of the `FSAMount returned N` line on screen is not evidence the if-block was skipped. Plan: instrument with `OSScreenPutFontEx` so the patched binary unconditionally prints a marker string before *and* inside the if, so I can distinguish "patch ran, `FSAAddClient` returned 0" from "patch never ran / cached old `launch.rpx`" from "logging just isn't visible here."
2. I haven't yet tested the patched PFR via the normal Aroma path on a healthy console to confirm the patch doesn't itself break PFR.
I'll post that instrumentation data as a follow-up, but the structural question (no-title-context `.rpx` + Cafe OS FS) is what I'm hoping someone here has hit before.

Spoiler: Other things ruled out already (less relevant to current chain)

- Hex-patched `wafel_payloader` `storage_sdcard` paths — silent fail.
- Stock Aroma `root.rpx` placed as direct sysmenu `.rpx` replacement (no PFR in front) — hangs on launch, no crash dump captured.
- Boot PPC ELF from minute (`homebrew_launcher.elf` via minute's menu entry) — errors with `"PowerPC not ready"`. Read this as minute not bringing up the PPC core without a full IOSU; correct me if a minute build/option exists that does.
- DNSpresso default `85.215.57.182` — console pulls `fw_img_loader` which on this setup reboot-loops. Haven't traced the exact failure point.
- `minute.ini autoboot=0` — not respected, likely PRSH override.
- Mounting redNAND MLC from PC — WFS encrypted with console OTP.
- GaryOderNichts `recovery_menu` — operates on real eMMC, would just expose the dead NAND.
- Hex-patched `wafel_setup_mlc` `SetInitialLaunch(1)` — skips the wizard, but the forced-Mii check is separate (not gated on `cafe.initial_launch`).

## Asks
**Primary (broader audience):** Has anyone hit a forced Mii Maker freeze post-wizard on a fresh `wafel_setup_mlc` redNAND, and is there a bypass that doesn't require going through sysmenu? Either side works:
- (a) offline write of a valid `mii.dat` into the WFS MLC using the console OTP — I have the OTP dumped, just need a tool that takes OTP + raw MLC partition + a Mii blob and produces a valid WFS write; or
- (b) a sysmenu/account-side flag that skips the forced-Mii check (`account.dat`, `UserCommon`, a sysmenu patch — anything). Pointers to relevant tool sources welcome.
Also useful: does the freeze reproduce on a fresh `wafel_setup_mlc` redNAND on a **healthy-eMMC** console? That tells me whether it's dead-eMMC-related or a general redNAND issue.
**Secondary (for the PFR / rpx_replacement folks — Maschell / GaryOderNichts territory):** In a `.rpx` launched via `udpih/rpx_replacement` (no real title-launch handshake), what's the correct way to get `fs:/vol/external01` mounted before PFR's `fopen` runs? Is there a known incantation on either side (rpx_replacement-side MCP title-info forge, or a different user-space init sequence in the `.rpx`) that gets the SD devoptab live? I may be missing something obvious.
If this combo just isn't doable with current public tooling, that's a valid answer — a pointer to the missing piece (even unreleased/private) would still help.
## Versions / artifacts
- Aroma target: **beta 27** (also happy to test latest nightly if anyone suspects a regression here).
- `wafel_setup_mlc`: tagged **v3.0** from the upstream repo — happy to post the exact commit hash if anyone needs it.
- PayloadFromRPX: `wiiu-env/PayloadFromRPX`, patched (hash above).
- udpih_payloads: `GaryOderNichts/udpih_payloads`, `rpx_replacement` built from `master` — will post exact commit on request.
- Host: Windows 11, devkitPro native (wiiu-dev), MSYS2 shell. No Docker.
Happy to attach the patched PFR build, `rpx_replacement` build, `minute.ini`, full SD layout listing, or sanitized SCI/SEEPROM dumps. Just say which.

hope this post is in the right forum.

Thanks in advance, my prayers are up.