Warning

Although this is in use by many users and has proven itself as safe and reliable, you still use this at your own risk. Messing with the isfs superblocks is dangerous and can brick your Wii U. Make sure to make a SLC backup before installing isfshax (included in the guide). If something goes wrong, you will need defuse to restore this backup. The superblock linked here was tested and confirmed working. Installing an broken superblock will brick your Wii U.
Also keep in mind: if you are restoring a old SLC backup, which was taken before installing ISFShax, ISFShax will be removed by restoring that backup. Newer versions of minute try to preserve ISFShax when restoring the SLC.

To protect against Nintendo pushing a boot1 update (very unlikely, but you newer know), which would brick a console with ISFShax, system updates get blocked by the wafel_isfshax_patch.ipx plugin. If you need to do a system update, you can use the v1.0 of said plugin, which doesn't contain the update block. Game updates are not affected.

Update

13.07.2024 - No longer require the wiiu/root.rpx. Replace Tiramisu with Aroma as default. Add Haxchi as Entry Exploit.
04.04.2024 - Add Fastboot
13.03.2024 - System updates now get blocked by the wafel_isfshax_patch.ipx plugin.
29.12.2023 - Standby Services are now supported. For that to work you need to have the latests ISFShax superblock installed and need to use the latest minute fw.img and wafel_core.ipx. Also autoboot needs to be enabled.

What is this for?

ISFShax exploits boot1 with specially crafted ISFS (the filesystem of the SLC) superblock. Once installed, ISFShax provides similar capabilities to defuse. Since it launches before IOSU, it can be used to apply early patches to IOSU and can be used to fix most bricks. But it won't protect you of bricks caused by: breaking boot1, seeprom bricks or installing a broken ISFShax superblock. ISFShax also doesn't help you if you already bricked the Wii U.
Use cases are:

• Rebuilding / upgrading the MLC
• Removing 64GB MLC limit and disabling SCFM
• Brick protection (e.g. before doing region change)
• Cold booting redNAND (useful when when the eMMC is failing)
• It gives a minimal CFW, which can launch old homebrew using the homebrew launcher (not sure how useful since we have Aroma and Tiramisu)
• Stop the Wii U from turning the Tablet on during boot (using a stroopwafel plugin)

Choosing the Exploit

There are multiple ways to launch the ISFShax installer:
If you already have Tiramisu or Aroma installed and can launch it follow the Instructions tagged with [Aroma]
If you already have Haxchi or CBHC installed follow Instructions tagged with [Haxchi]
If the Browser still works and you can launch the browser exploit u.wiidb.de follow the Instructions tagged with [Browser]
If you can't access the Browser, but Settings still work follow Instructions tagged with [DNSpresso]
If you your Wii U crashes in the initial setup on Mii creation follow Instructions tagged with [DNSpresso]
If your Wii U can't launch the browser anymore or can't connect to the internet follow the Instructions tagged with [UDPIH]
Steps without a prefix apply to all.

Preparing the SD card

Windows hides file name extension by default. I highly recommend turning this feature off to avoid confusion (also it's a good idea in general to see what type of you are dealing with): https://www.howtogeek.com/205086/beginner-how-to-make-windows-show-file-extensions/

Make sure the SD card is formatted to FAT32 (already the case if you are using it for Homebrew). You can use guiformat for that.

Get the following files and put them in the root of the SD. Choose the release tagged with "Latest" for each. / is the path seperator wiiu/payload.elf for example means: have a folder wiiu and put the file payload.elf inside

Method	Name	file name	Path on SD	Link
All	ISFShax installer	ios.img	ios.img	https://github.com/isfshax/isfshax_installer/releases
All	ISFSHax superblock	superblock.img superblock.img.sha	superblock.img superblock.img.sh	https://github.com/isfshax/isfshax/releases
All	stroopwafel	wafel_core.ipx	wiiu/ios_plugins/wafel_core.ipx	https://github.com/jan-hofmeier/stroopwafel/releases
All	ISFShax patch	wafel_isfshax_patch.ipx	wiiu/ios_plugins/wafel_isfshax_patch.ipx	https://github.com/isfshax/wafel_isfshax_patch/releases
Aroma Haxchi Browser DNSpresso	minute (encrypted)	fw_encrypted.img	fw.img	https://github.com/jan-hofmeier/minute_minute/releases
Browser DNSpresso	fw.img loader	payload.elf	wiiu/payload.elf	https://github.com/wiiu-env/fw_img_payload/releases
DNSpresso	PayloadFromRPX	root.rpx	launch.rpx	https://github.com/wiiu-env/PayloadFromRPX/releases
UDPIH	minute	fw.img	fw.img	https://github.com/jan-hofmeier/minute_minute/releases
UDPIH	minute boot1	boot1.img	boot1now.img	https://github.com/jan-hofmeier/minute_minute/releases
UDPIH	recovery menu	recovery_menu	recovery_menu	https://github.com/GaryOderNichts/recovery_menu/releases

The structure on the SD should look like this:

boot1.img (only for UDPIH)
fw.img
ios.img
recovery_menu   (only for UDPIH)
superblock.img
superblock.img.sha
wiiu
    ios_plugins
         wafel_core.ipx
         wafel_isfshax_patch.ipx

Launching into minute

This step heavily depends on the used Exploit.

Spoiler: Aroma

1. Hold B on the Gamepad while booting (if coldboot is enabled) or launching the H&S app
2. A black and white menu should show up asking you to choose a payload.
3. Select fw_img_loader

Note: if the fw_img_loader is missing get the "fw.img loader" payload from https://aroma.foryour.cafe/

Spoiler: Haxchi

1. Hold A on the Gamepad while booting (if you have CBHC) or launching the Haxchi or DO NOT TOUCH ME app.

Spoiler: Browser

1. Open the Browser and browse to u.wiidb.de
2. Click on "HAXX"

Spoiler: DNSpresso

If you can a access the settings just follow these instructions (you already have the right files on the SD): https://gbatemp.net/threads/dnspresso-a-wii-u-dns-exploit.642123/
If you are stuck on the Mii creation in the Inital setup:

1. If you already connected your Wii U to your AP / Router, turn the AP / Router or the Wifi on it off.
2. When the setup asks you if you already have a NNID, say yes (even if you don't have one)
3. Now it tries to connect to the Internet, but will fail and ask you to take you back to the Wifi settings, follow back to thge settings.
4. Turn your Router / AP on again and give it time to start.
5. If you don't already have your Wifi configured there, connect to it now, but enter a wrong password.
6. Edit your wifi connection and configure 85.215.57.182 as Primary DNS, if you entered a wrong password before set the right one now.
7. Press (B) Back and select Connection Test.

Spoiler: UDPIH

1. Load the recovery using UDPIH: https://gbatemp.net/threads/udpih-usb-host-stack-exploit-recovery-menu.613369/ (don't replace the recovery_menu)
2. The LED should turn purple and a countdown timer for loading boot1now.img should appear, wait the 5 seconds
3. Unplug the Pico

Note: if the LED turned purple, the UDPIH exploit worked, even if you don't see anything on the screen

Now you should see the minute main menu. If not, something went wrong. Make sure you have the correct fw.img file on the SD.
In minute you move the cursor with the power button and enter with the eject button (swapped compared to the recovery menu).

Note: minute only outputs 1080p through HDMI, no picture on the gamepad, and nothing on the analog outputs.
Some people reported that the screen output is not working for them when minute was loaded from the recovery. If you made sure nothing else is the problem (right fw.img, TV supports 1080p HDMI), you can still follow along blindly by pressing the appropriate buttons. Make sure to wait long enough between the presses, so the system has time to load. Without display output skip the first backup and go directly to Installing ISFShax.

Backup

1. Navigate to Backup and Restore
2. Dump SEEPROM & OTP
3. Dump SLC.RAW
4. Return to Main Menu

Installing ISFShax

1. Choose Boot `ios.img` (6x Power, 1x Eject)
2. Now the ISFShax installer should launch (this takes a few seconds)
3. Follow the Instructions on the screen, the buttons are the same as in minute. (3x Eject, 1x Power, 3x Eject)
4. The console should now turn off.
5. [Aroma | Haxchi | Browser | DNSpresso] replace the (encrypted) fw.img on the SD with the fw.img (NOT the encrypted one) from https://github.com/jan-hofmeier/minute_minute/releases
6. If the install was successfull the Wii U should directly start into minute once you turn it on again.

Backup ISFShax

Dump the SLC.RAW again. This will overwrite the previous SLC.RAW file on the SD. This is required if you need to restore the SLC for unbricking, without loosing ISFShax. Keep that backup in a safe place.

Booting

If you came here from the redNAND, the MLC rebuild or the Region Change guide continue with that tutorial now.

For now your Wii U needs the SD card to boot. From there it loads minute (fw.img), which then applies the required patches from SD card. (IOSU needs to be patched, so it doesn't fall over the ISFShax superblock).
To boot into the Wii U OS select Patch (sd) and boot IOS (slc).

If your console just bootloops through minute over and over again, you are probably coldbooting Aroma and replaced the wiiu/payload.elf with the fw_img loader. Just replace the wiiu/payload.elf again with the Aroma one (applies to Tiramisu too).

Aroma / Tiramisu

1. If you are already coldbooting Aroma / Tiramisu, undo the Autobooting: https://wiiu.hacks.guide/uninstall-payloadloader.html
2. To install Aroma or Tiramisu put the corresponding files on the SD.
   Tiramisu: https://tiramisu.foryour.cafe/
   Aroma: https://aroma.foryour.cafe/ (You don't need to have install Tiramisu to have Aroma, also the FTPiiU plugin will become handy later)
3. Put the wafel_payloader.ipx in the ios_plugins folder https://github.com/jan-hofmeier/wafel_payloader/releases

If the Wii U bootloops through minute endlessly: You replaced the wiiu/payload.elf with the fw_img loader. Just replace the wiiu/payload.elf again with the one from the environmentloader.zip

Booting without SD

This step is optional but highly recommended. Now the Wii U doesn't show anything on the screen without the SD. That could lead to confusion if the SD ever gets lost or corrupted.
To make it from the internal memory we need to install the minute fw.img and the ios_plugins to the SLC. This can be accomplished using FTPiiU Everywhere, which can be launched from Tiramisu and is already part of the Aroma Package (enable Everywhere in the settings) or you can use the haxcopy homebrew https://github.com/mackieks/haxcopy/releases
Using haxcopy is recommended for most users, but if you copy a wrong plugin to the slc or need to delete one for whatever reason you still have to use FTP for that.

Spoiler: haxcopy

1. create a folder hax on the SD card (this will be copied to the slc)
2. copy the fw.img to the hax folder
3. create a subfolder ios_plugins in the hax folder
4. rename the wafel_core.ipx to 0core.ipx and copy it to the hax/ios_plugins folder
5. rename the wafel_isfshax_patch.ipx to 6isfshax.ipx and copy it to the hax/ios_plugins folder
6. if you want to coldboot aroma or tiramisu, rename the wafel_payloader.ipx to 9payldr.ipx and copy it to the hax/ios_plugins folder
7. If you need any other plugins like the wafel_unlimit.ipx, you have to rename and copy it to the hax/ios_plugins folder
8. Copy the haxcopy app to the wiiu/apps folder (like you usually install homebrew)
9. Put the SD in the Wii U and run haxcopy to copy the hax folder to the slc.

Spoiler: FTP

On Aroma you have to make sure access to system files is enabled:

1. Open the Aroma Plugin Configuration Menu using L + Down + SELECT (-) on the GamePad or Pro Controller (or B + Down + Minus (-) for WiiMotes)
2. Open the FTPiiU option, then settings and set ‘Allow access to system files’ to ‘true’ by pressing A

Uploading the files:

1. (Tiramisu only) Make sure FTPiiU Everywhere is running on the Wii U
2. Using a FTP client on the PC browse to /storage_slc/
3. If you see a scfm.img file and sys folder go into the sys folder. If you see a bunch of folders (config import logs proc rights security title tmp) just go to the next step.
4. create a subfolder hax and enter it
5. Make sure your FTP client is in binary mode (not ASCII mode)
6. upload the minute fw.img to the /storage_slc/sys/hax folder
7. create another subfolder ios_plugins in /storage_slc/sys/hax
8. enter that /storage_slc/sys/hax/ios_plugins folder
9. rename the wafel_core.ipx to 0core.ipx and upload it
10. rename the wafel_isfshax_patch.ipx to 6isfshax.ipx and upload it
11. if you want to coldboot aroma or tiramisu, rename the wafel_payloader.ipx to 9payldr.ipx and upload it
12. If you need other plugins like the wafel_unlimit.ipx, you have to rename and upload them too

Now the Wii U should autoboot if no SD card is inserted.
If a SD card is inserted the minute menu should show up (even if the SD doesn't contain a fw.img). In that menu you can select the Patch (slc) and boot IOS (slc) to load the plugins from the slc and boot (no need to have them on the SD anymore).

The Wii U will first try to load the fw.img from the SLC and if that fails it falls back to the SD.
If you installed a broken fw.img which doesn't load, you can force isfshax to load the fw.img from sd by repeatedly pressing the power button till the menu shows up.

Warning: A factory reset will delete the hax folder. Without the fw.img on the SD the Wii U will then just have a black screen with a orange LED with the latest ISFShax it will apply minimal patches to boot and it will still block updates, but some things like leaving the settings might me slower. It's recommended to setup minute and stroopwafel again.

Optional Autobooting with SD

To make the Wii U autoboot with an SD card inserted you need to create the file sd:/minute/minute.ini with the following content:

[boot]
autoboot=1
autoboot_timeout=3

You can adjust the timeout (in seconds) to your liking. The autoboot option specifies which entry from the minute menu will be loaded. 1 corresponds to Patch (slc) and boot IOS (slc), which loads the ios_plugins from the SLC. If you haven't installed them to the SLC or want to load them from the sd for another reason you can change that value to 3 which corresponds to Patch (sd) and boot IOS (slc)

As an Alternative check out the Fastboot option below.

Optional: Fastbooting (Advanced)

To make the Wii U boot as fast as possible, without showing minute, you can now use the fw_fastboot.img. This won't work with redNAND
It is hardcoded to go straight to the first option (booting the slc, with patches from SLC). It won't display anything and ignore any autoboot configuration in the minute.ini.

1. First make sure the system can boot using the first option in minute. (see booting without SD)
2. Replace the the fw.img in the hax folder on the SLC with the fw_fastboot.img (renamed to fw.img)

In case you ever get stuck and need to load the full minute from SD you can do this:

1. Place the minute fw.img on the SD card
2. repeatedly press the power button until the minute menu shows up on the screen.

Uninstalling ISFShax

DON'T just restore an older SLC backup, as that would break SCFM!

• Make sure your Wii U doesn't depend on any patches (linke wafel_unlimit_mlc.ipx or redNAND). You can check that by booting with only the wafel_core.ipx and the wafel_isfshax_ipx plugins in the ios_plugins directory on the SD and using the Patch (sd) and boot IOS (slc) option
• Delete the /storage_slc/sys/hax folder if you set up the slc booting
• run the ISFShax installer again from minute and follow the on-screen instructions to uninstall.

Plugins

Here is a list of currently available stroopwafel plugins, you can use with ISFShax:

• wafel_noinit_tablet - Don't run on the Tablet controller on boot
• SDUSB - Run Wii U games from the SD Card
• USB Partition - Use partitioned USB HDDs with the Wii U
• wafel_setup_mlc - Rebuild / Upgrade the MLC

If you have more plugins, tell me and I can add them to the list

Credits

• @rw-r-r_0644 for finding and implementing isfshax
• @GaryOderNichts and ashquarky for their direct contributions and help
• @vgmoose for all the support and for the Wii U that replaced the one Idestroyed during early isfshax testing
• @Maschell for his help and all other contributions to the Wii U scene
• hexkyz for the warmboot boot1 exploit which made all of this possible
• @shinyquagsire23 for de_Fuse, minute and stroopwafel
• Salt Team for the original minute CFW
• dimok789, FIX94 and others for the iosuhax CFW
• fail0verflow for mini
• and all other contributors to the Wii U scene!

 

[pankos]

Ok, can you try if it is enough to just delete the last partition, that goes beyond 2TB?

Yes, WiiU is able to load to Aroma in SD emulation with two first partitions

 

[SDIO]

Does it also work with the release version of the plugin (not the special ones I posted here for testing)

 

[pankos]

Does it also work with the release version of the plugin (not the special ones I posted here for testing)

SD emulation works only with last two modified plugins after WiiU partition is deleted. Original plugin doesn't work at all in sd emulation.

 

[SDIO]

Here I patch prfile to only look at the first partition. Maybe I will change that to only look at the active partition or at partitions with the FAT32 type, I haven't decided that yet. But for a test it should be good enough.

 

[pankos]

Here I patch prfile to only look at the first partition. Maybe I will change that to only look at the active partition or at partitions with the FAT32 type, I haven't decided that yet. But for a test it should be good enough.

Nope, still doesn't work

 

[SDIO]

this is more like a shot in the dark, if it doesn't work I have to dig deeper

 

[pankos]

this is more like a shot in the dark, if it doesn't work I have to dig deeper

Bingo! Works at least at first glance. Will be testing it more thoroughly later next week. Thanks a lot for your work

 

[SDIO]

nice, you can try this one, where I removed the previous non working patch

Post automatically merged: Dec 1, 2024

and in the no limit patch I also removed the size limit I added previously.

Now the question is: what approach would be best:

1. have it ignore everything except the first partition.
2. Ignore any non fat32 partition.
3. Only look at the active partition
4. ignore partitions outside the 2TB

The first one is the easiest patch, the last one the most complex, but that would be closest to the original behavior...

 

[pankos]

Only the first one is working. The second one "no limit" doesn't work.

 

[pankos]

Ok, there seems to be a major problem with drives larger than 2TB. I installed about 40 Wii U games on the Wii U partition of my 4TB drive (taking up approximately 300GB of space), and after restarting the Wii U, I was unable to load Aroma using the special USB SD emulation plugin. I connected the drive to my PC and found that the first FAT32 partition was missing. I tried restoring the MBR from my 1MB MBR dump, but that didn’t help.
I remember having the same issue when I first installed the USB plugin (not the SD emulation version). After transferring Wii U games from my original single-partition Wii U drive to a newly partitioned multi-partition drive, I noticed that my other partitions were gone. At the time, I thought I had messed something up since it was my first time doing it. So, I reformatted the drive, started over, and tried using the USB SD emulation plugin version.
I suspect that the partition table or some part of the MBR becomes corrupted once the Wii U partition starts to fill up.

 

[SDIO]

I am afraid some layer in he storage stack isn't handling the 64bit addresses correctly if that happens. If the USB mass storage driver for example ignores the high 32bit of the block address, it would begin accessing the beginning of the drive again, when it goes above 2TiB.
That would be a major roadblock.
At the layer I am doing the partition magic, the API to the lower layers has 64bit reserved for the block address. And above that it should only have to deal with smaller addresses, since I add the partition offset, which brings it above 2TiB.

But will check the code again, which does the 64bit additon. https://github.com/StroopwafelCFW/w...f8d4db8bf310ab/source/sal_partition.c#L17-L22

Post automatically merged: Dec 4, 2024

Ugh yeah, the UMS driver ignores the high part of the address

  case 'w':
    if (param_2->read_only == 0) {
      *(undefined4 *)((int)local_1c + 0x24) = 0x10;
      arg = ScsiWrite(param_1,param_2->ums_tp,0,25000000,request->read_buf,request->lba_lo,
                      (ushort)request->num_blocks,request->block_size * request->num_blocks,local_1c
                     );
      break;
    }

see how it only looks at, request->lba_lo and not at ,request->lba_hi.

So yeah that's bad, it would require fixing the UMS driver, not sure yet if that is feasible with reasonable effort.

 

[SDIO]

ok I dug a little deeper:
The original UMS specification also only used 32bit LBA. The Wii U only implements the original commands (read10 / write 10) that are limited to 32bit.
There are new UMS commands (read16 / write16) support 64bit.
Implementing the new commands shouldn't be too difficult. But I also can't just use them for everything, since older storage devices don't support the new commands and so they would stop working. So I will probably make it only use it the new commands if the high word of the address is not zero.
And then I have to find a good place to hook into to divert to the new commands.
And that three times (read, write, sync).

This probably has to wait one or two weeks, as I am busy with other stuff rn.

 

[pankos]

I wonder if current version of USB SD emulation plugin works with USB drive with single FAT32 partition as SD card replacement in combination with separate WiiU USB drive? I'm a bit scared to test it myself to break anything on WiiU drive.

 

[query9999]

I restored my img with UDPIH. Can I remod the image again? It is running off the SD (obviously).

 

[Abdullah12]

cant find ios_plugins in the sd card?

Post automatically merged: Dec 13, 2024

cant find ios_plugins in sd card?

 

[jos3ang3l]

Hi SDIO!

I've installed ISFHAX on my white 8Gb WiiU (Toshiba emmc) as a protection against future bricks and it works like a charm

I have 2 questions:

I've installed the encrypted minute fw.img in /storage_slc/sys/hax so I can boot the system without an SD card. Is this correct or should I use the normal (decrypted) fw.img?

Another question, after changing the Payloader from H&S in the WiiU menu to disable coldboot, can I change it back to H&S? I've tried and it says I have to boot a Payloader instance... It's strange since I can access all the boot options with the X, + and B buttons

Regards!

 

[zal16]

It's possible to create a fw_fastboot.img with a GPU overclock built-in?
My console is WUP-50 board revision and the GPU runs relatively cooler at 740MHz.

 

[Feffe]

I removed the 6isfshax.ipx and 9payldr.ipx plugins from the internal memory with FPiiU, but now my Wii U doesn't book at all. Just a black screen. Did I brick the console?

This is how I left the hax folder

 

[SDIO]

I wonder if current version of USB SD emulation plugin works with USB drive with single FAT32 partition as SD card replacement in combination with separate WiiU USB drive? I'm a bit scared to test it myself to break anything on WiiU drive.

Yes that should work.

I restored my img with UDPIH. Can I remod the image again? It is running off the SD (obviously).

No clue what you mean

cant find ios_plugins in the sd card?

You have to create that folder

I've installed the encrypted minute fw.img in /storage_slc/sys/hax so I can boot the system without an SD card. Is this correct or should I use the normal (decrypted) fw.img?

Both work, the encrypted one just needs to be decrypted on every boot, which takes a little time, but not noticable

Another question, after changing the Payloader from H&S in the WiiU menu to disable coldboot, can I change it back to H&S? I've tried and it says I have to boot a Payloader instance... It's strange since I can access all the boot options with the X, + and B buttons

If you rather want to use the H&S PayloadLoader, then you need to remove the payloader plugin from the ios_plugins folder

It's possible to create a fw_fastboot.img with a GPU overclock built-in?
My console is WUP-50 board revision and the GPU runs relatively cooler at 740MHz.

Possible yes, but I won't do it.

I removed the 6isfshax.ipx and 9payldr.ipx plugins from the internal memory with FPiiU, but now my Wii U doesn't book at all. Just a black screen. Did I brick the console?

Just load the plugins from the SD card, using the third option in minute and then copy the isfshax plugin it back using ftp

 

[Feffe]

Just load the plugins from the SD card, using the third option in minute and then copy the isfshax plugin it back using ftp

Sorry if I'm missing something obvious, but how can I launch minute? Pressing "B" on the GamePad doesn't work (nor do X or + to launch Aroma's autobooting menu). The Wii U does recognise the GamePad, though; I can turn on the console with it.