Hacking my spectacular but (currently) failing attempt to fix a cbhc brick

[bnuuy]

so. my smart brain recently decided to get myself a wii u, for hacking, and, y'know, to play games on.
because i decided to be extra smart, i decided to get a bricked (cbhc brick) wii u with nand backups, and then do the hardmod to fix the brick myself; which yes, is and was a fun journey, and i learned a lot both about soldering and nand chips, but it's kind of hard to quantify this into some objective measure of whether this was worth it or not.
on my initial attempts to install the hardmod, i ended up damaging some of the traces, which pushed me towards getting some actually usable soldering equipment and a few more materials in order to fix the traces while also still having to do the hardmod.
fast forward to me actually successfully repairing those traces and hooking up a teensy to the nand chip (both with quite a bit of trail and error), i managed to actually rewrite the nand backup to the nand chip.
in theory, this should have been the end of it, however, now the console won't output any video (and presumably also no audio, but i haven't set audio up at this point).
i know that the console was still perfectly capable of booting up to the error code that corresponds to the cbhc brick before i rewrote the nand, indicating that fixed traces were indeed working, and that i didn't accidentally damage something important somewhere without noticing at least up to that point.
even though there's no video(/audio?) now, the light on the front still turns blue when turning on, the fan spins, and the disk drive makes some disk drive noises, which i guess is all the clues i have to diagnose what might be the problem. i assume these mean i'm getting at least past boot0 and boot1, but then the console gets stuck somewhere (and without video and an error code to look up, it's kind of really hard to narrow it down further). the one final clue i have it that apparently, the wireless gamepad communication doesn't seem to get initialized, which kind of rules out that the video mode is just set up in a bad way (i only really have hdmi to work with :/).
i have also confirmed that yes, the nand image i wrote is indeed correctly on there now; with the exception of a few blocks that seems to more or less randomly change? i'm currently thinking that this is the os writing/rearranging some minor things on booting or something (at least it would fit with what i'm observing...)
currently, i'm just stumped with what could possibly be causing this; my current approach is to try to get the nand chip powered up without powering up the wii u to maybe rewrite the backup or something, but that's neither working yet nor do i have any good reasons to believe that will fix it.
i'm not necessarily asking for advice with this, as i don't think there's a lot of people who could give me useful advice on this (though it'd still be much appreciated if someone could), and i also just kind want to record what i'm doing here, just to get it off my chest.

 

[Hayato213]

Should never tried if you can't solder wires properly, money down the drain, should just bought a working unit instead.

 

[bnuuy]

i am not regretting my decision yet, and i *can* solder wires, as evidenced by the fact that i fixed those tiny traces (turns out enameled copper wire is pretty good for that).
i can check whether the connections work (which i just checked again), AND it booted to the cbhc error screen before i rewrote the nand but after i fixed the traces, so i know the traces i damaged and fixed (some of the IO lines for the nand) are not being the problem.
plus, it seems like if it can't read out the boot1 image properly (requiring the nand connections to work), the power light stays red, but instead, the light does turn blue when i turn it on.

 

[KleinesSinchen]

Interesting story. Now what I would call a "Gretchenfrage":
Did you use your hardmod to backup the NAND with CBHC brick before flashing the image? The image you flashed could be damaged, corrupted or even from the wrong console… whatever.

If the Wii U turned on normally (with HDMI and Gamepad) up to the CBHC problem before flashing the image but after soldering, I guess it is a software problem (bad image). This could easily be verified by flashing the image you should have created yourself before flashing anything.

Most people tend to forget that even a software bricked status might be useful and is worth to be backed up before any modification that might make things worse. As far as I know there are two methods to recover a Wii U with the hardmod: Flashing a known good backup image and removing CBHC from the bricked state – requires the only the OPT (keys).
=============


Don't be too sad in case this project turns out to be a failure. I guess you have learned a lot with this. I would recommend practising soldering before attempting such a thing. It is not easy to to for somebody inexperienced. I went through a lot of trouble with a (successful) DSi hardmod.

Good luck!

 

[bnuuy]

i... tried to make a backup of the previous image, but unfortunately there was some instability with the electrical connections that i only ironed out *after* that, so i now consider the file corrupted :/
i do also have the otp.bin, so that could be useful for examining and changing the contents of the backup, but i'm not aware of a tool that would allow me to do that out-of-the-box.
besides, it's still strange that this issue is occuring in the first place. why would the nand backup be bad? i am also not excluding that the problem lies elsewhere, and just started with unfortunate timing, even if the order of things suggest it's the nand image i wrote.

still, thank you, i'll keep trying. this seems like something that should be fixable.

 

[KleinesSinchen]

Have a look at this:
https://gbatemp.net/threads/release-wii-u-nand-tools.465386/

 

[bnuuy]

thanks, i got the extraction working both with the original nand backup as well as the (presumably?) corrupted version that has the cbhc brick on it. i'm starting to think the backup i made might actually be fine, as i'm not seeing any obvious signs of corruption (some files seem to be missing tho idk), but i still don't entirely trust this file (at least not enough to embark on the >1h endeavor of writing it back onto the nand just yet).
any suggestions what files to look into?
i already looked into and compared /sys/config/system.xml, unsurprisingly, the default_title_id property is different in the cbhc bricked one (also apparently "standby" is disabled?).
and the culprit for the changing blocks seems to be the /scfm.img file at the root of the nand.

 

[bnuuy]

i came up with a plan:
1. try to write the (possibly corrupted) cbhc brick nand image back to the nand. i know this will take quite some time.
2. while the teensy is writing, try to figure out a way to write changes to files in the nand image on my computer, and replace the system.xml in a copy of the cbhc brick image to remove cbhc. i already have a way to figure out what blocks are different, so i won't need to rewrite the entire nand to write those changes.
3. if the wii u gives me an image with the error code, i know both that my cbhc brick backup wasn't actually corrupted (or at least not corrupted enough to be relevant), and that the issue indeed was with the old nand backup. i should be able to restore the system to a working state with ease in that case using the results of step 2. the question why the nand backup caused this still remains open.
if the wii u is behaving the same as with the regular nand backup, i have gained no useful information (since the cbhc brick backup is under suspicion of being corrupted, i can't even rule out that it was something wrong with the nand backup), so it would be nice for that to uh, not happen.
4. formulate a new plan depending on the outcomes of the previous steps

 

[KleinesSinchen]

Sorry, I can't further assist here. I've no experience with Wii U hardmod or dealing with the inner software workings (what files are important) and I avoided using CBHC on my Wii U.

There are tools to read/write Wii U filesystems on a computer:
https://github.com/koolkdev/wfslib

As long as there is no hardware damage and you have the correct key there is some hope – I don't know how to proceed though. Your ideas sound plausible to me.

 

[bnuuy]

eh, i was more asking into the general void in case *somebody* has an idea which files might be interesting or relevant to look into.
the link you gave is unfortunately only for the mlc nand and usb devices, which isn't useful to me rn. i'm planning on repurposing something from https://github.com/koolkdev/wiiuqt (probably nandCbhcRemover, as that's kinda what i'm doing anyway. the vanilla version of the program isn't working because the syshax.xml file in the cbhc brick backup is mysteriously missing).
even hardware damage might be fixable if i can find out what it is (and depending on what is damaged).

 

[bnuuy]

so, update, the cbhc brick nand image didn't work (the led stayed red when turning on), but i could restore the blue simply by programming the original nand backup again...
however, i've started noticing that the led is actually *blinking* blue, rather than solid blue, which, after some searching, is termed the "blue light of death" and vaguely stands for some kind hardware failure (possibly also a failed system update?). the info on possible causes is annoyingly vague, and the only suggestion for fixes is sending it back to nintendo to have them fix it (which lol i don't think they even take the ones that haven't been user tampered anymore).
this is bad news, and i have no expectations that i'll be able to recover the wii u at this point. any further info that could help me narrow down the details of the problem are likely securely locked away in some nintendo vault, unavailable to the public. i can still try to do some low-level hacking and see if i can get anywhere, but other than that, that's it.
over and out.

 

[godreborn]

well, the good thing is the console itself is pretty cheap, since you don't need to replace the gamepad. they're like around $60 by themselves last time I remembered.

 

[sith]

this thread needs pics i assume it is a million pieces on a kitchen table but i could be wrong, i think it cool you are giving this a go but i have zero experience in this realm(wiiu internals) so can't really help, however i have a had a blinking blue light and power down on a 3ds when all the little ribbons arent secure.. maybe something loose?

 

[bnuuy]

i think i've seen standalone consoles as cheap as 40€ (seems to be about 48$ in freedom money), so yeah.
i think i'll still try to investigate a bit before buying a replacement, but i don't really expect anything to come of it.

 

[godreborn]

i think i've seen standalone consoles as cheap as 40€ (seems to be about 48$ in freedom money), so yeah.
i think i'll still try to investigate a bit before buying a replacement, but i don't really expect anything to come of it.

well, I respect your dedication to revive your system.

--------------------- MERGED ---------------------------

btw, you want the syshax.xml. that's the original system.xml fyi, but you may already know that.

--------------------- MERGED ---------------------------

https://www.mediafire.com/file/7napcj3y5oakhuw/NAND+inject.zip/file

I don't know if this will help, but rename syshax.xml to system.xml to use it. I didn't create this app, but I kept it since it worked for someone else. however, it sounds like a soldering issue tbh.

 

[bnuuy]

this thread needs pics i assume it is a million pieces on a kitchen table but i could be wrong, i think it cool you are giving this a go but i have zero experience in this realm(wiiu internals) so can't really help, however i have a had a blinking blue light and power down on a 3ds when all the little ribbons arent secure.. maybe something loose?

i already can rule loose connections and anything you could possibly diagnose from pictures out.

well, I respect your dedication to revive your system.

--------------------- MERGED ---------------------------

btw, you want the syshax.xml. that's the original system.xml fyi, but you may already know that.

--------------------- MERGED ---------------------------

https://www.mediafire.com/file/7napcj3y5oakhuw/NAND+inject.zip/file

I don't know if this will help, but rename syshax.xml to system.xml to use it. I didn't create this app, but I kept it since it worked for someone else. however, it sounds like a soldering issue tbh.

thanks, but as you already suggested, i already know these things and unfortunately these aren't the issue.
to the best of my knowledge, the current contents of the nand are good and cbhc-free (including 100% properly written). if things weren't soldered correctly, i'd see different behavior from the console.
i already got an equivalent program from https://gbatemp.net/threads/release-wii-u-nand-tools.465386/ (specifically nandCbhcRemover from that page), please link to that in the future, as it has source code transparently available and is probably more trustworthy. (besides, i'm not a windows user.)