Hacking I bricked with coldboothax and restored without hardmod : D

[mchenzero]

I tried coldboothax on sunday night and, you know, got a reboot loop. If I had read someone already bricked I wouldn't have tried.

After figuring out why, I thought, ok, I have a rednand backup so the worst will be I'll play with rednand forever. But I still wanted to unbrick. I think it's possible because we have custom code execution in fw.img. So probably I can write some code to recover the system.xml file.

So I dived a little bit into fix94's iosuhax repo, trying to understand how to read/write files. But suddenly last night I got a better/easier idea. Since I have rednand working fine and the same haxchi vc game installed (no rom replaced), why not just redirecting mlc but keep accessing the original slc? In this way, I'll boot into the vc game inside redirected mlc, so it stops the reboot loop. Then I can connect to the wupserver, which has access to sysnand slc! And the best of all, I'll only need to comment out a few lines of code in dimok's iosuhax repo!

I went trying today and it worked as expected! Now I have my sysnand recovered!

Well, that's my story. This approach might not work for everyone who had bricked by trying coldboothax. But you know, we have custom code execution in fw.img so we can always recover somehow. Don't lose hope : )

 

[tatumanu]

Nice save! thanks for telling us, might help someone out!

 

[Chakratos]

I tried coldboothax on sunday night and, you know, got a reboot loop. If I had read someone already bricked I wouldn't have tried.

After figuring out why, I thought, ok, I have a rednand backup so the worst will be I'll play with rednand forever. But I still wanted to unbrick. I think it's possible because we have custom code execution in fw.img. So probably I can write some code to recover the system.xml file.

So I dived a little bit into fix94's iosuhax repo, trying to understand how to read/write files. But suddenly last night I got a better/easier idea. Since I have rednand working fine and the same haxchi vc game installed (no rom replaced), why not just redirecting mlc but keep accessing the original slc? In this way, I'll boot into the vc game inside redirected mlc, so it stops the reboot loop. Then I can connect to the wupserver, which has access to sysnand slc! And the best of all, I'll only need to comment out a few lines of code in dimok's iosuhax repo!

I went trying today and it worked as expected! Now I have my sysnand recovered!

Well, that's my story. This approach might not work for everyone who had bricked by trying coldboothax. But you know, we have custom code execution in fw.img so we can always recover somehow. Don't lose hope : )

I think "most" people bricked by entering wrong id's in the xml or inputting a title that isn't allowed to autoboot

 

[Cyan]

thank you for sharing your issue and how you fixed it.
We were talking about that loop issue yesterday, and @xtheman166 suggested to use fw.img to rewrite the system.xml too. I guess your solution is even easier, no need to write code to replace and edit the xml, you use WUP server yourself to replace the file.

of course it will work only on a reboot-loop case, not on full system.xml brick.

do you have more information how to patch dimok's version? which line to comments, etc.
or only tell it to users in need to fix their reboot-loop to prevent users sharing in the wild a modded version of fw.img with potential risk (thinking they are editing redNAND copy but still affect sysNAND)

edit:
@pwsincd, you might want to add it to your rip list, with a recover []

 

[Ryccardo]

Untested, but it appears you can disable rednand by editing patches/0x10700000.s in cfw source -- it has nicely commented "this enables slc/mlc" parts

 

[NexoCube]

Hey, i bricked my Wii U a few days ago, can you please tell me more on how you got code execution even if you bricked ?

 

[kingraa777]

nexo your becoming quite a legend of temp now you
know

 

[Ryccardo]

how you got code execution even if you bricked ?

Well, he didn't really brick in the most common definition of the word, in fact actually he correctly set up coldboothax (losing the ability to run anything apart from that now-secondary-exploit DS game) and invented a way to remove coldboothax (which however requires being able to run rednand)!