Hacking "Paid The Beak": A new Wii U coldboot exploit

[GerbilSoft]

It's been known for some time that the Wii U's bootrom (boot0) has a provision for booting from SD card if a particular RTC flag, "UNSTBL_PWR", is set. (aka "sdboot" or "sdboot1") This is used by the de_Fuse exploit to load an unencrypted boot1 from SD, but it doesn't actually set the flag; it merely fakes it in the EXI data stream so boot0 *thinks* it's set.

Recently, a bunch of Nintendo factory GCN memory cards, SD cards, and "battery jigs" were obtained from various sellers. The "battery jig" was the most interesting bit, since it plugs into the Wii U's clock battery slot and injects a signal into TP73. It turns out this signal is what sets the "UNSTBL_PWR" flag, which is most likely how Nintendo's authorized repair centers repaired broken Wii Us. But there's more to getting it to work than just setting the flag...

A Wii U with one of the original battery jigs inserted in the clock battery slot. Photo provided by Kelly.

Full write-up here: https://consolebytes.com/wii-u-sdboot1-exploit-paid-the-beak/ (by DeadlyFoez)
Paid The Beak exploit code: https://github.com/Wack0/paid-the-beak (by Rairii)

Currently, the "battery jig" has been replicated on two different microcontrollers:

• Raspberry Pi Pico: https://github.com/jan-hofmeier/wiiu_unstable_power (by SDIO)
• PICAXE 08M2 (by DeadlyFoez; see the write-up for the code)

Code for the above microcontrollers is available on the ConsoleBytes page. Support for more microcontrollers will be added eventually.


Note that this exploit currently only works on retail-keyed consoles with a working SEEPROM. If SEEPROM is corrupted, boot0 will refuse to boot anything unless the de_Fuse exploit is used. (It also works on dev-keyed consoles set to boot from PCFS, which is currently limited to CAT-DEV units.) In addition, an SDSC (<= 2 GB) card must be used, because boot0 doesn't support SDHC.



Credits to everyone on the linked pages for finding the parts and developing the exploit: WiiCurious, Kelly, Rairii, SDIO, Gary, DeadlyFoez, and anyone I may have missed.

 

[MopSec]

Amazing news, good job!

 

[Lazr1026]

hacc

 

[SDIO]

Next up is making the ISFShax installer work when loaded from that (since SD hot swap is broken in minute and the SD can't be partitioned because of the boot1)

 

[neverendsDull]

Great great News! Been watching this discussion on Discord for some while, hoping the dedicated isfshax installer comes out soon, this way people with bad soldering skills (me included) can revive many died WiiU consoles at hands much more easily.

 

[Chary]

Cool hack, that's pretty--

p.s. DeadlyFoez asked me to add a note saying he would like to appeal his ban on the forums.

...lolno

 

[Technician]

Cool hack, that's pretty--

...lolno
View attachment 517464

What the hell? This should not be here. Is this some kind of war or what?

 

[Chary]

What the hell? This should not be here. Is this some kind of war or what?

It should be here. You can clearly see where OP mentioned a ban appeal. He knows full well what he's asking. I'm shooting that down here and now.

 

[SDIO]

Can we maybe not derail this thread?

 

[Noahboi]

That's really cool actually

 

[GerbilSoft]

FYI I have removed that line at the end of the initial post.

 

[Flame]

It should be here. You can clearly see where OP mentioned a ban appeal. He knows full well what he's asking. I'm shooting that down here and now.

I back this and back chary. if DeadlyFoez returns, he will "burn" this place down... just like ....

 

[Keylogger]

I guess it's a bit similar to ISFHax and UDPIH exploit, right?

 

[Ysecond]

Gods helped the public open another door~

 

[Technician]

I would also like to know more about this exploit. Is it something we can do precautionary to avoid later bricks or can we sit back and enjoy gaming until the console dies and then bring it easily back from the dead? And is there a brick possibility by making a mistake in the process like I read with ISFShax? Or is this in an early state where nobody can predict if this will work properly at all? Too many questions...

 

[SDIO]

You wouldn't want to use that as a permanent thing, as it basically would block the SD slot with a 2GB where you can't even put files on because it can't be partitioned. For a permanent thing you would just use ISFShax. Also it messed with the RTC and the time constantly getting lost would be annoying.

This is for cases where the console bricks, either because of a software thing (user deleted something important) or because the MLC or SLC corrupted and you don't have ISFShax installed. If you have ISFShax installed, you will never need this. (or you would need to try very hard messing boot1 up).

In case you have a bricked console you would use that once to install ISFShax for convenience and then do the usual stuff from there.

Btw I narrowed down the hot plug problem with minute and can make a minute where hot plug works, but there the SD speed would be slower. (Which is fine for unbricking I guess).

 

[ChibiMofo]

Can we maybe not derail this thread?

The OP derailed his own thread by including that pointless request for the cunt DeadlyFoez to be reinstated, which obviously will never, ever happen.

 

[VinsCool]

Removed; I requested for this thread to be deleted but it seems that wasn't done. Info on this exploit can be found elsewhere.

You did not have to sabotage this thread over something so insignificant but okay...

 

[TheStonedModder]

You did not have to sabotage this thread over something so insignificant but okay...

Makemhz vibes

So many douche bags

 

[SylverReZ]

Here's the full article from another site if you want to read through (here). I've heard about DeadlyFoez, and I don't want to mention him too much, but he causes a lot of trouble for everyone.

Makemhz vibes

So many douche bags

Every console modding scene has a villain just like an anime plot twist. You will find people who are nice and others who come off as extremely distasteful.