How to set up ISFShax

JIaroJIy4 · Nov 11, 2023

Lapin said:
...
EDIT: I managed to progress a little by going in blindly but the "Booting without SD" part doesn't work for me. The sys directory didn't exist in the /storage_slc, so I had to create it (not sure if I should). I copied the files and followed the instructions but if I select the first option in the minute menu, Patch (slc) and boot IOS (slc), the WiiU doesn't boot.
...

I think I sorted this out.
If you're using Tiramisu and FTPiiU Everywhere - Storage_SLC that you gain access to is actually /sys folder.
So in that case you just need to create *hax* folder and proceed as normal.

How I came across this? - I rebooted into Aroma and used the same FTP client.
When you try to access *storage_slc* you will see 2 things:
sys - the folder listed in this guide
scfm.img - obviously related to wii-u operation (i'm dumb rn)

In other words
If you are setting up minute_minute to be booted from SLC you need to create folder *hax* (and dump fw.img) next to folders like *security* *proc* *rights* and NOT create empty *sys* folder in storage_slc

And fun for @SDIO - I've asked about GPU_OC, after loads of github surfing found description in de_fuse project. And then I realized I should check how old is my console - it was made in 2012/11/01 15:46 (id#2287 from the database). So overclock probably should not be happening - or should be very limited.
(I've replaced thermal interface with paste but checked everything prior to doing any OC)

SDIO · Nov 12, 2023

CrazySquid said:
Hm... I think it's impossible for ISFSHax to work with Quick Start Menu and standby features?

The problem with the Standby is, that boot1 doesn't load anything from the SLC, so ISFShax won't be loaded. It will just check the signature of the IOSU image that was placed into dram before entering the Standby mode. Since we need minute there or at least a patched IOSU that signature check fails. If we would make it load an unpatched IOSU it would be missing the ISFShax patch and not boot.
To make it work IOSU would need to be patched to set up PRSHhax when setting up the Standby. That's not trivial and I don't have plans for the near future to implement that.

@JIaroJIy4 I just updated the instructions for the SLC boot.

There were just two revisions of the chipset afaik and the latter one is somewhat rare. I think you should be OK as long as the Thermal pad is alright and the console is clean.

JIaroJIy4 · Nov 12, 2023

SDIO said:
...
@JIaroJIy4 I just updated the instructions for the SLC boot.

There were just two revisions of the chipset afaik and the latter one is somewhat rare. I think you should be OK as long as the Thermal pad is alright and the console is clean.

Great that instructions got updated! I was half an hour ahead of your update.

Again regarding OC. I won't say I'm the most knowledgeable about microchip manufacturing, but
- I agree that revisions should generally be the same in terms of physical performance;
- on the other hand I wouldn't say the same about raw silicon quality at the start of production and several years down the line.

All in all I would consider consoles from 2015 to have better OC potential (in all aspects) compared to initial launch (which my console should be).

Since I was restoring MLC by hand-made NAND-AID - I obviously serviced cooling solution.
I think I will stop with 10% OC for now (600Mhz from 545)

Ysecond · Nov 12, 2023

JIaroJIy4 said:
Since I was restoring MLC by hand-made NAND-AID

Please show me the great handmade nand aid

V10lator · Nov 12, 2023

Ysecond said:
Please show me the great handmade nand aid

Hope I'm allowed to share these pictures:

JIaroJIy4 · Nov 12, 2023

Well I didn't want to share them in this thread since it's not directly related... (so I shared them privately)
Nor my questions about GPU_OC are, for that matter (we have a dedicated thread there).

Odd question about ISFSHax/minute_minute - is it possible to shove a minute.ini config into SLC so the thing loads with my settings? (yes, still about GPU_OC because I don't consider other uses yet)

Zheta · Nov 12, 2023

As mentioned earlier, the "Booting without SD" part didn't work in Tiramisu with FTPiiU Everywhere no matter how I set up the folders (in '/storage_slc/hax' or created /storage_slc/sys/hax folder). Came on with an orange light. FTPiiU Everywhere doesn't show the folder structure correctly (no sys folder)?

It worked when I booted into Aroma and used the FTP plugin, even though I had issues with it disconnecting before (properly shows '/storage_slc/sys/').

SDIO · Nov 12, 2023

What did you see with the tiramisu ftpiiu?

For the problem with FTPiiU Aroma plugin having an unstable connection: Open the Home Menu, that frees up more CPU time for the FTPiiU plugin. When running a Game or the Wii U Menu, then this is taking most of the CPU and the FTP server is starving.

Zheta · Nov 13, 2023

I saw '/storage_slc/' with all the subfolders "a bunch of folders (config import logs proc rights security title tmp)". Putting the files in '/storage_slc/hax' did not work, nor did '/storage_slc/sys/hax'.

When I loaded in Aroma I still had it set up the 2nd way, and then it showed up as '/storage_slc/sys/sys/hax'.

Will try the home menu thing, thanks.

frozencat · Nov 13, 2023

SDIO said:
Warning

Use this at your own risk. Messing with the isfs superblocks is dangerous and can brick your Wii U. Make sure to make a SLC backup before installing isfshax. If something goes wrong, you will need defuse to restore this backup. The superblock linked here was tested and confirmed working. Installing an broken superblock will brick your Wii U.
Also while ISFShax is installed standby services and with that the quick start menu won't work. (Your Wii U will hang once you turn it off till you remove power if standby services are enabled).
Also keep in mind: if you are restoring an old SLC backup, which was taken before installing ISFShax, ISFShax will remove by restoring that backup.

What is this for?

ISFShax exploits boot1 with specially crafted ISFS (the filesystem of the SLC) superblock. Once it is installed ISFShax provides similar capabilities to defuse once it is installed. Since it launches before IOSU, so it can be used to apply early patches to IOSU and can be used to fix most bricks. But it won't protect you of bricks caused by: breaking boot1, seeprom bricks or installing a broken ISFShax superblock. ISFShax also doesn't help you if you already bricked the Wii U.
Usecases are:

Rebuilding / upgrading the MLC

Removing 64GB MLC limit and disabling SCFM

Brick protection (e.g. before doing region change)

Cold booting redNAND (useful when when the eMMC is failing)

It gives a minimal CFW, which can launch old homebrew using the homebrew launcher (not sure how usefull since we have Aroma and Tiramisu)

Stop the Wii U from turning the Tablet on during boot (using a stroopwafel plugin)

Choosing the Exploit

There are multiple ways to launch the ISFShax installer:
If you already have Tiramisu or Aroma installed and can launch it follow the Instructions for [Tiramisu]
If the Browser still works and you can launch the browser exploit u.wiidb.de follow the Instructions for [Browser]
If your Wii U can't launch the browser anymore or can't connect to the internet follow the Instructions for [UDPIH]
Steps without a prefix apply to all.

Preparing the SD card

Make sure the SD card is formatted FAT32 (already the case if you are using it for Tiramisu). You can use guiformat for that.

Get the following files and put them in the root of the SD

ISFShax installer (ios.img) from https://github.com/isfshax/isfshax_installer/releases

ISFShax superblock.img and superblock.img.sha from https://github.com/isfshax/isfshax/releases

Put the stroopwafel wafel_core.ipx from https://github.com/jan-hofmeier/stroopwafel/releases in wiiu/ios_plugins

Put the wafel_isfshax_patch.ipx stroopwafel plugin from https://github.com/jan-hofmeier/wafel_isfshax_patch/releases in wiiu/ios_plugins

[Tiramisu | Browser] minute fw_encrypted.img from https://github.com/jan-hofmeier/minute_minute/releases and rename to fw.img

[Browser] fw_img_payload from https://github.com/wiiu-env/fw_img_payload/releases extract the zip and put the wiiu folder, containing the payload.elf on the SD

[UDPIH] minute fw.img and boot1.img from https://github.com/jan-hofmeier/minute_minute/releases

[UDPIH] recovery_menu from https://github.com/jan-hofmeier/recovery_menu/releases

Launching into minute

This step heavily depends on the used Exploit.

Hold B on the Gamepad while booting (if coldboot is enabled) or launching the H&S app

A black and white menu should show up asking you to choose a payload.

Select fw_img_loader

Open the Browser and browse to u.wiidb.de

Click on "HAXX"

Load the recovery using UDPIH: https://gbatemp.net/threads/udpih-usb-host-stack-exploit-recovery-menu.613369/ (don't replace the recovery_menu)

select the "Load BOOT1 payload" and proceed. (If you don't have screen output: 18x eject, 1x power, 1 eject, 1 power)

Now you should see the minute main menu. If not something went wrong, make sure you have the correct fw.img file on the SD.
In minute you move the cursor with the power button and enter with the eject button (swapped compared to the recovery menu).

Backup

Navigate to Backup and Restore

Dump SEEPROM & OTP

Dump SLC.RAW

Return to Main Menu

Installing ISFShax

Choose Boot `ios.img`

Now the ISFShax installer should launch

Follow the Instructions on the screen, the buttons are the same as in minute.

[Tiramisu | Browser] replace the fw.img on the SD with the fw.img from https://github.com/jan-hofmeier/minute_minute/releases

If the install was successfull the Wii U should directly start into minute once you turn it on again.

Backup ISFShax

Dump the SLC.RAW again. This will overwrite the previous SLC.RAW file on the SD. This is required if you need to restore the SLC for unbricking, without loosing ISFShax. Keep that backup in a safe place.

Booting

For now your Wii U needs the SD card to boot. From there it loads minute (fw.img), which then applies the required patches from SD card. (IOSU needs to be patched, so it doesn't fall over the ISFShax superblock).
To boot into the Wii U OS select Patch (sd) and boot IOS (slc)

Booting without SD

This step is optional but highly recommended. Now the Wii U doesn't show anything on the screen without the SD. That could lead to confusion if the SD ever gets lost or corrupts.
To make it from the internal memory we need to install the minute fw.img and the ios_plugins to the SLC. This can be accomplished using FTPiiU Everywhere, which can be launched from Tiramisu and is already part of the Aroma Package (enable Everywhere in the settings).

Make sure FTPiiU Everywhere is running on the Wii U

Using a FTP client on the PC browse to /storage_slc/

If you see a scfm.img file and sys folder go into the sys folder. If you see a bunch of folders (config import logs proc rights security title tmp) just go to the next step.

create a subfolder hax and enter it

Make sure your FTP client is in binary mode (not ASCII mode)

upload the minute fw.img to the /storage_slc/sys/hax folder

create another subfolder ios_plugins in /storage_slc/sys/hax

enter that /storage_slc/sys/hax/ios_plugins folder

rename the wafel_core.ipx to 0core.ipx and upload it

rename the wafel_isfshax_patch.ipx to 9isfshax.ipx and upload it

Now the Wii U should autoboot if no SD card is inserted.
If a SD card is inserted the minute menu should show up (even if the SD doesn't contain a fw.img). In that menu you can select the Patch (slc) and boot IOS (slc) to load the plugins from the slc and boot (no need to have them on the SD anymore).

The Wii U will first try to load the fw.img from the SLC and if that fails it falls back to the SD.
If you installed a broken fw.img which doesn't load, you can force isfshax to load the fw.img from sd by repeatly pressing power till the menu shows up.

Autobooting with SD

Optional: To make the Wii U autoboot with an SD card inserted you need to create the file sd:/minute/minute.ini with the following content:

Code:

[boot] autoboot=1 autoboot_timeout=3

You can adjust the timeout (in seconds) to your liking. The autoboot option specifies which entry from the minute menu will be loaded. 1 corresponds to Patch (slc) and boot IOS (slc), which loads the ios_plugins from the SLC. If you haven't installed them to the SLC or want to load them from the sd for another reason you can change that value to 3 which corresponds to Patch (sd) and boot IOS (slc)

Uninstalling ISFShax

DON'T just restore an older SLC backup, as that would break SCFM!

Make sure your Wii U doesn't depend on any patches (linke wafel_unlimit_mlc.ipx or redNAND). You can check that by booting with only the wafel_core.ipx and the wafel_isfshax_ipx plugins in the ios_plugins directory on the SD and using the Patch (sd) and boot IOS (slc) option

Delete the /storage_slc/sys/hax folder if you set up the slc booting

run the ISFShax installer again from minute and follow the on screen instructions to uninstall.

Credits

@rw-r-r_0644 for finding and implementing isfshax

@GaryOderNichts and ashquarky for their direct contributions and help

@vgmoose for all the support and for the Wii U that replaced the one Idestroyed during early isfshax testing

@Maschell for his help and all other contributions to the Wii U scene

hexkyz for the warmboot boot1 exploit which made all of this possible

@shinyquagsire23 for de_Fuse, minute and stroopwafel

Salt Team for the original minute CFW

dimok789, FIX94 and others for the iosuhax CFW

fail0verflow for mini

and all other contributors to the Wii U scene!

nice man

Zheta · Nov 15, 2023

Back again! I was trying to boot

Code:

Patch (slc) and boot IOS (slc)

to try testing things from the base system and the boot stops here:

SDIO · Nov 15, 2023

You are missing the plugins on the slc

Zheta · Nov 15, 2023

Ah wow, thanks! I was sure I had that set up. Fixed!

Lapin · Nov 17, 2023

JIaroJIy4 said:
I think I sorted this out.
If you're using Tiramisu and FTPiiU Everywhere - Storage_SLC that you gain access to is actually /sys folder.
So in that case you just need to create *hax* folder and proceed as normal.

This fixed it, thanks! I still don't have any image when it boots into the minute menu for some reason, so I have to go in blindly, but everything is working perfectly.

ButtBoyBoris · Nov 24, 2023

Hello,

Iam trying to boot ans istall ISFSHAX using the UDPIH method. But after "Load BOOT1 payload" my console is showing me a red light and there is nothing on my gamepad? Everything works up until I press the proceed.....

Do I have to have it connected to a tv to see the minute menu?

SDIO · Nov 24, 2023

Do you have the boot.img and the right fw.img on the SD card?

ButtBoyBoris · Nov 24, 2023

SDIO said:
Do you have the boot.img and the right fw.img on the SD card?

I think so..... I downloaded the boot and fw file from:
https://github.com/jan-hofmeier/minute_minute/releases

SDIO · Nov 24, 2023

Try the boot1.img from here: https://github.com/shinyquagsire23/wii_u_modchip/releases/tag/v0.8

ButtBoyBoris · Nov 24, 2023

SDIO said:
Try the boot1.img from here: https://github.com/shinyquagsire23/wii_u_modchip/releases/tag/v0.8

I tried that and get the same result.... The gamepad screen stay on the last screen and the console gets a orange light and the discdrive starts to make two sound, then nothing happens.

The picture is on the root of my SD card

SDIO · Nov 24, 2023

Organe light means there is a problem with the fw.img make sure it is NOT the encrypted one and copy it again to the SD and make sure to safetly eject

Member

Well-Known Member

Member

Well-Known Member

Well-Known Member

Member

Member

Well-Known Member

Member

Well-Known Member

Member

Well-Known Member

Member

Member

Active Member

Well-Known Member

Active Member

Well-Known Member

Active Member

Attachments

Well-Known Member

Similar threads

Popular threads in this forum