Hacking [RELEASE] Wii U NAND Tools

[mr-b]

Hi

I just tried Nandchecker and it found some "incorrect ecc" and "hmac bad" messages - should I be concerned?

>nandbincheck "N:\Wii U NAND Dump\slc.bin"
** nandBinCheck : Wii nand info tool **
   from giantpune
   built: Mar 24 2017 23:49:06
NAND Type: SLC (WiiU)
checking boot1...
Boot1 hash: "3806d41a5c5f139f5b09bbe5b74a5ec45e0f5507"
Boot1 OK!
checking for lost clusters...
total used clusters 2ed7 of 0x8000
found 0 lost clusters
UNK ( 0xffff ) 76 (9d0, 9d1, 9d2, 9d3, 9d4, 9d5, 9d6, 9d7, ba8, ba9, baa, bab, bac, bad, bae, baf, d08, d09, d0a, d0b, d0c, d0d, d0e, d0f, 1c60, 1c61, 1c62, 1c63, 1c64, 1c65, 1c66, 1c67, 1d10, 1d11, 1d12, 1d13, 1d14, 1d15, 1d16, 1d17, 2769, 276a, 276b, 276c, 276d, 276e, 276f, 2bde, 2bdf, 32c0, 32c1, 32c2, 32c3, 32c4, 32c5, 32c6, 32c7, 32c8, 32c9, 32ca, 32cb, 32cc, 32cd, 32ce, 32cf, 3328, 3329, 332a, 332b, 332c, 332d, 332e, 332f, 3528, 3529, 352a, 352b, 352c, 352d, 352e, 352f, 3723, 3724, 3725, 3726, 3727, 37c8, 37c9, 37ca, 37cb, 37cc, 37cd, 37ce, 37cf, 37f8, 37f9, 37fa, 37fb, 37fc, 37fd, 37fe, 37ff, 39b8, 39b9, 39ba, 39bb, 39bc, 39bd, 39be, 39bf, 39c0, 39c1, 39c2, 39c3, 39c4, 39c5, 39c6, 39c7)
free            49a3
verifying ecc...
1 out of 889664 pages had incorrect ecc.
they were spread through 1 clusters in 1 blocks:
 (1170)
1 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 294 files
hmac bad (1)
"swkbd.rpl" is 13f9c0 bytes ( 50 ) clusters

00000000  fff8f5a6 38306cc9 e8a0f568 0823b65b  ....80l....h.#.[
00000010  8c42eeab caf8f5a6 38306cc9 e8a0f568  .B......80l....h
00000020  08000000 00000000 00000000 00000000  ................
00000030  5b0f5b0f 5601a90e 930a6c05 560f560f  [.[.V.....l.V.V.

00000000  ff23b65b 8c42eeab ca000000 00000000  .#.[.B..........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  b804470b ae0cae0c 59025902 75088a07  ..G.....Y.Y.u...

00000000  cedd2a6b a6a6bffc 72251169 b5d1428b  ..*k....r%.i..B.
00000010  88506f38                             .Po8
bad HMAC for "/sys/title/00050010/10004009/code/swkbd.rpl"
hmac bad (1)
"scfm.img" is 8004000 bytes ( 2001 ) clusters

00000000  ff000000 00000000 00000000 00000000  ................
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ff000000 00000000 00000000 00000000  ................
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 fe01010e e10e1e01  ................

00000000  41e507c7 8389facc ced3d51f c14eb6e0  A............N..
00000010  7b1da812                             {...
bad HMAC for "/scfm.img"
2 files had bad HMAC data
checking HMAC for superclusters...
0 superClusters had bad HMAC data

 

[EyeKey]

I would guess that the ecc error is in swkbd.rpl. I don't check whether the ecc error is fixable or not.

 

[Damin72]

Question - Can someone write tools for changing region? Freind accidently change region and can't launch any app.

 

[mr-b]

I would guess that the ecc error is in swkbd.rpl. I don't check whether the ecc error is fixable or not.

Yes it is. So should I do another dump to be sure? Or can certain errors be disregarded?

 

[kublai]

I dumped my 32GB Wii-U NAND and I did the COPY /B FILE1.BIN+FILE1.BIN NAND.BIN to make it into a single file. When I ran the nandbincheck NAND.bin I keep getting this error "Failed to determine dump type" "Error setting path to nand object". My NAND.bin is 31,039,88 bytes. I did not get any errors while dumping my NAND.

 

[EyeKey]

I dumped my 32GB Wii-U NAND and I did the COPY /B FILE1.BIN+FILE1.BIN NAND.BIN to make it into a single file. When I ran the nandbincheck NAND.bin I keep getting this error "Failed to determine dump type" "Error setting path to nand object". My NAND.bin is 31,039,88 bytes. I did not get any errors while dumping my NAND.

That tool is for the SLC, not for the MLC.

 

[Xyphoseos]

Do you know when and what is missing to write SLC/MLC/SLCCMPT without hardmod ?

 

[kublai]

That tool is for the SLC, not for the MLC.

I went back a few pages and saw that. I can stop pulling out what hair I have left. Thanks

 

[Loustik]

@EyeKey hi, you did an awesome job with your stuff thank you, i've tried nandchecker and i've got this :

Microsoft Windows [version 10.0.14393]
(c) 2016 Microsoft Corporation. Tous droits réservés.

C:\Users\teacher>CD..

C:\Users>CD..

C:\>J:

J:\>nandBinCheck.exe slc.full2.img -all
** nandBinCheck : Wii nand info tool **
   from giantpune
   built: Mar 24 2017 23:49:06
oops, this isnt a supercluster 20214000 ffffffff 7ca0
NAND Type: SLC (WiiU)
checking boot1...
Boot1 hash: "3806d41a5c5f139f5b09bbe5b74a5ec45e0f5507"
Boot1 OK!
checking for lost clusters...
found 0 lost clusters
UNK ( 0xffff ) 94 (16ad, 16ae, 16af, 32b7, 34c0, 34c1, 34c2, 34c3, 34c4, 34c5, 34c6, 34c7, 34d0, 34d1, 34d2, 34d3, 34d4, 34d5, 34d6, 34d7, 41d8, 41d9, 41da, 41db, 41dc, 41dd, 41de, 41df, 42c0, 42c1, 42c2, 42c3, 42c4, 42c5, 42c6, 42c7, 42cc, 42cd, 42ce, 42cf, 467c, 467d, 467e, 467f, 4688, 4689, 468a, 468b, 468c, 468d, 468e, 468f, 5148, 5149, 514a, 514b, 514c, 514d, 514e, 514f, 5180, 5181, 5182, 5183, 5184, 5185, 5186, 5187, 55c0, 55c1, 55c2, 55c3, 55c4, 55c5, 55c6, 55c7, 55d0, 55d1, 55d2, 55d3, 55d4, 55d5, 55d6, 55d7, 5660, 5661, 5662, 5663, 5664, 5665, 5666, 5667, 5740, 5741, 5742, 5743, 5744, 5745, 5746, 5747, 5750, 5751, 5752, 5753, 5754, 5755, 5756, 5757, 5850, 5851, 5852, 5853, 5854, 5855, 5856, 5857, 5858, 5859, 585a, 585b, 585c, 585d, 585e, 585f, 5920, 5921, 5922, 5923, 5924, 5925, 5926, 5927, 5938, 5939, 593a, 593b, 593c, 593d, 593e, 593f, 5968, 5969, 596a, 596b, 596c, 596d, 596e, 596f)
free            497d
verifying ecc...
0 out of 889536 pages had incorrect ecc.
they were spread through 0 clusters in 0 blocks:
 ()
0 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 300 files
0 files had bad HMAC data
checking HMAC for superclusters...
0 superClusters had bad HMAC data

J:\>

what do you mean by " oops, this isnt a supercluster 20214000 ffffffff 7ca0"?
Can you tell me if my dump is correct?
Thank you

 

[Kleyon]

@EyeKey, sorry man, another "what does mean that result" question please!

nandbincheck slc.bin
** nandBinCheck : Wii nand info tool **
   from giantpune
   built: Mar 24 2017 23:49:06
NAND Type: SLC (WiiU)
checking boot1...
Boot1 hash: "3806d41a5c5f139f5b09bbe5b74a5ec45e0f5507"
Boot1 OK!
checking for lost clusters...
total used clusters 2ec5 of 0x8000
found 0 lost clusters
UNK ( 0xffff ) 9e (2bcd, 2bce, 2bcf, 2c0e, 2c0f, 2d71, 2d72, 2d73, 2d74, 2d75, 2
d76, 2d77, 2ea0, 2ea1, 2ea2, 2ea3, 2ea4, 2ea5, 2ea6, 2ea7, 2ea8, 2ea9, 2eaa, 2ea
b, 2eac, 2ead, 2eae, 2eaf, 2ef8, 2ef9, 2efa, 2efb, 2efc, 2efd, 2efe, 2eff, 2f00,
 2f01, 2f02, 2f03, 2f04, 2f05, 2f06, 2f07, 37a0, 37a1, 37a2, 37a3, 37a4, 37a5, 3
7a6, 37a7, 37e8, 37e9, 37ea, 37eb, 37ec, 37ed, 37ee, 37ef, 3850, 3851, 3852, 385
3, 3854, 3855, 3856, 3857, 3868, 3869, 386a, 386b, 386c, 386d, 386e, 386f, 38b0,
 38b1, 38b2, 38b3, 38b4, 38b5, 38b6, 38b7, 38bb, 38bc, 38bd, 38be, 38bf, 38e8, 3
8e9, 38ea, 38eb, 38ec, 38ed, 38ee, 38ef, 38f8, 38f9, 38fa, 38fb, 38fc, 38fd, 38f
e, 38ff, 3900, 3901, 3902, 3903, 3904, 3905, 3906, 3907, 3918, 3919, 391a, 391b,
 391c, 391d, 391e, 391f, 3948, 3949, 394a, 394b, 394c, 394d, 394e, 394f, 39a8, 3
9a9, 39aa, 39ab, 39ac, 39ad, 39ae, 39af, 39b8, 39b9, 39ba, 39bb, 39bc, 39bd, 39b
e, 39bf, 39e0, 39e1, 39e2, 39e3, 39e4, 39e5, 39e6, 39e7, 5eeb, 5eec, 5eed, 5eee,
 5eef)
free            498e
verifying ecc...
0 out of 891008 pages had incorrect ecc.
they were spread through 0 clusters in 0 blocks:
 ()
0 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 281 files
hmac bad (1)
"scfm.img" is 8004000 bytes ( 2001 ) clusters

00000000  ff000000 00000000 00000000 00000000  ................
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ff000000 00000000 00000000 00000000  ................
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 2a0ad505 41004100  ........*...A.A.

00000000  3517536b 23c7df6f cb6c767e 0fe6e07d  5.Sk#..o.lv~...}
00000010  20de11c7                              ...
bad HMAC for "/scfm.img"
1 files had bad HMAC data
checking HMAC for superclusters...
0 superClusters had bad HMAC data

4 concerned lines:
hmac bad (1)
"scfm.img" is 8004000 bytes ( 2001 ) clusters
bad HMAC for "/scfm.img"
1 files had bad HMAC data

This SLC.bin is including Haxchi v2.5u2 so maybe that's normal? Same question as all other users: should I dump again slc.bin ? You know, I just want to be sure my dump will be ok to unbrick my WiiU if someday its happens.

 

[piratesephiroth]

@EyeKey, sorry man, another "what does mean that result" question please!

4 concerned lines:
hmac bad (1)
"scfm.img" is 8004000 bytes ( 2001 ) clusters
bad HMAC for "/scfm.img"
1 files had bad HMAC data

This SLC.bin is including Haxchi v2.5u2 so maybe that's normal? Same question as all other users: should I dump again slc.bin ? You know, I just want to be sure my dump will be ok to unbrick my WiiU if someday its happens.

And one interesting point is that when I run nandBinCheck on the dumps everything was perfect except for scfm.img (a 128MB cache file), which gave HMAC errors. it doesn't have HMACs, just zeros.
Well, based on the nature of this file (cache file), that make sense..

 

[Kleyon]

Oh my! Many thanks @piratesephiroth!

 

[Pachee]

No support for non-retail nand?

** nandBinCheck : Wii nand info tool **
   from giantpune
   built: Mar 24 2017 23:49:06
NAND Type: SLC (WiiU)
checking boot1...
Blocks0to1::CheckBoot1 -> Invalid RSA key index 1
Boot1 check failed!
checking for lost clusters...
total used clusters 3612 of 0x8000
found 0 lost clusters
UNK ( 0xffff ) 20 (2b5f, 2e40, 2e41, 2e42, 2e43, 2e44, 2e45, 2e46, 2e47, 2e48, 2e49, 2e4a, 2e4b, 2e4
c, 2e4d, 2e4e, 2e4f, 2e68, 2e69, 2e6a, 2e6b, 2e6c, 2e6d, 2e6e, 2e6f, 7629, 762a, 762b, 762c, 762d, 7
62e, 762f)
free            42bf
verifying ecc...
3 out of 1003584 pages had incorrect ecc.
they were spread through 3 clusters in 3 blocks:
 (2066, 3163, 3637)
3 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 435 files
hmac bad (1)
"0000000f.tik" is 350 bytes ( 1 ) clusters

00000000  ffda29a5 6e5d0ebc 240d1414 0b5ec363  ..).n]..$....^.c
00000010  ed6be211 fcda29a5 6e5d0ebc 240d1414  .k....).n]..$...
00000020  0b000000 00000000 00000000 00000000  ................
00000030  850a7a05 4305bc0a 4a00b50f cc06cc06  ..z.C...J.......

00000000  ff5ec363 ed6be211 fc000000 00000000  .^.c.k..........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  400d400d c3033c0c 8d0e8d0e 97076808  @.@...<.......h.

00000000  04582e84 6d7d6952 43a98fc0 8d00a7fa  .X..m}iRC.......
00000010  939e1006                             ....
bad HMAC for "/sys/rights/ticket/sys/0001/0000000f.tik"
hmac bad (1)
...
bad HMAC for "/scfm.img"
435 files had bad HMAC data
checking HMAC for superclusters...
hmac bad (1)
supercluster 7c00

00000000  ff9eb518 fea38e1b bead2c9b 5fd52c90  ..........,._.,.
00000010  b16b3766 479eb518 fea38e1b bead2c9b  .k7fG.........,.
00000020  5f000000 00000000 00000000 00000000  _...............
00000030  00000000 00000000 00000000 00000000  ................

00000000  ffd52c90 b16b3766 4711a47d f34c8fe8  ..,..k7fG..}.L..
00000010  d3a37c13 7db4db6f e3336072 4311a47d  ..|.}..o.3`rC..}
00000020  f3000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  5832ea91 023d8e7c 6298a6ca 0f14d475  X2...=.|b......u
00000010  71ae0638                             q..8
hmac bad (1)
...
64 superClusters had bad HMAC data
(31744, 31760, 31776, 31792, 31808, 31824, 31840, 31856, 31872, 31888, 31904, 31920, 31936, 31952, 3
1968, 31984, 32000, 32016, 32032, 32048, 32064, 32080, 32096, 32112, 32128, 32144, 32160, 32176, 321
92, 32208, 32224, 32240, 32256, 32272, 32288, 32304, 32320, 32336, 32352, 32368, 32384, 32400, 32416
, 32432, 32448, 32464, 32480, 32496, 32512, 32528, 32544, 32560, 32576, 32592, 32608, 32624, 32640,
32656, 32672, 32688, 32704, 32720, 32736, 32752)

 

[EyeKey]

No support for non-retail nand?

** nandBinCheck : Wii nand info tool **
   from giantpune
   built: Mar 24 2017 23:49:06
NAND Type: SLC (WiiU)
checking boot1...
Blocks0to1::CheckBoot1 -> Invalid RSA key index 1
Boot1 check failed!
checking for lost clusters...
total used clusters 3612 of 0x8000
found 0 lost clusters
UNK ( 0xffff ) 20 (2b5f, 2e40, 2e41, 2e42, 2e43, 2e44, 2e45, 2e46, 2e47, 2e48, 2e49, 2e4a, 2e4b, 2e4
c, 2e4d, 2e4e, 2e4f, 2e68, 2e69, 2e6a, 2e6b, 2e6c, 2e6d, 2e6e, 2e6f, 7629, 762a, 762b, 762c, 762d, 7
62e, 762f)
free            42bf
verifying ecc...
3 out of 1003584 pages had incorrect ecc.
they were spread through 3 clusters in 3 blocks:
 (2066, 3163, 3637)
3 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 435 files
hmac bad (1)
"0000000f.tik" is 350 bytes ( 1 ) clusters

00000000  ffda29a5 6e5d0ebc 240d1414 0b5ec363  ..).n]..$....^.c
00000010  ed6be211 fcda29a5 6e5d0ebc 240d1414  .k....).n]..$...
00000020  0b000000 00000000 00000000 00000000  ................
00000030  850a7a05 4305bc0a 4a00b50f cc06cc06  ..z.C...J.......

00000000  ff5ec363 ed6be211 fc000000 00000000  .^.c.k..........
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  400d400d c3033c0c 8d0e8d0e 97076808  @.@...<.......h.

00000000  04582e84 6d7d6952 43a98fc0 8d00a7fa  .X..m}iRC.......
00000010  939e1006                             ....
bad HMAC for "/sys/rights/ticket/sys/0001/0000000f.tik"
hmac bad (1)
...
bad HMAC for "/scfm.img"
435 files had bad HMAC data
checking HMAC for superclusters...
hmac bad (1)
supercluster 7c00

00000000  ff9eb518 fea38e1b bead2c9b 5fd52c90  ..........,._.,.
00000010  b16b3766 479eb518 fea38e1b bead2c9b  .k7fG.........,.
00000020  5f000000 00000000 00000000 00000000  _...............
00000030  00000000 00000000 00000000 00000000  ................

00000000  ffd52c90 b16b3766 4711a47d f34c8fe8  ..,..k7fG..}.L..
00000010  d3a37c13 7db4db6f e3336072 4311a47d  ..|.}..o.3`rC..}
00000020  f3000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  5832ea91 023d8e7c 6298a6ca 0f14d475  X2...=.|b......u
00000010  71ae0638                             q..8
hmac bad (1)
...
64 superClusters had bad HMAC data
(31744, 31760, 31776, 31792, 31808, 31824, 31840, 31856, 31872, 31888, 31904, 31920, 31936, 31952, 3
1968, 31984, 32000, 32016, 32032, 32048, 32064, 32080, 32096, 32112, 32128, 32144, 32160, 32176, 321
92, 32208, 32224, 32240, 32256, 32272, 32288, 32304, 32320, 32336, 32352, 32368, 32384, 32400, 32416
, 32432, 32448, 32464, 32480, 32496, 32512, 32528, 32544, 32560, 32576, 32592, 32608, 32624, 32640,
32656, 32672, 32688, 32704, 32720, 32736, 32752)

The HMAC key is wrong. How did you even got the OTP for that?

 

[Pachee]

The HMAC key is wrong. How did you even got the OTP for that?

otp.bin is on the same folder. Wii U Nand Extractor is able to extract the files fine.

 

[EyeKey]

otp.bin is on the same folder. Wii U Nand Extractor is able to extract the files fine.

Hmmm... What do you mean by non-retail nand? Kiosk unit? (if so that is why I wondered how you got the OTP)
Yea it looks like you got the right OTP. Maybe the hmac key is in a different offset in those unit OTP? but it sound weird because all the other things that are used seems to be in the same place.

 

[Pachee]

Hmmm... What do you mean by non-retail nand? Kiosk unit? (if so that is why I wondered how you got the OTP)
Yea it looks like you got the right OTP. Maybe the hmac key is in a different offset in those unit OTP? but it sound weird because all the other things that are used seems to be in the same place.

I did dump it with teensy, then the mlc with sd mod, then "accessed the browser" and dumped the otp/seeprom.
The SLC dump is larger than those dumped with mocha. 524288KB/540672KB

 

[Prince ofhell]

i have a wii u bricked for update since the wii u is release can this fix it

 

[SundayWarrior]

Hi. If get slc dump from brick console and drop on nand tools donor otp.bin possible unbrick wiiU?
I dont understud otp.bin have unique hw keys (like a cpu key on x360 theme) or like keys.txt from switch theme (warez, but not unique).
And what can do with mlc dump? Maybe possible drop missing files for chbc?

Now wiiu logo then 160-0101 error, if cut emmc no image on screen = slc have system info, mlc other impotant files and titles(?).

Ps. If that wiiu is trash, i dont disappoint, all works for fun.

Edit/ i find orig otp.bin and have "donor" - two slines of eleven same = otp.bin unique, but maybe this keys enoug for decrypt(?). Waiting teensy...

 

[baraka73]

Hi All,
Can anyone help me, please?
My Wiiu Firmware is Version 5.5.3 and it has bricked by CBHC.
Error Code : 160-0103

I have completed Leeful's hardmod method.
My dump file size is 31 784 435 bytes.

I have tried execute NandBinCheck.exe commnad, but i have got this error:
nandBinCheck.exe nand.bin -all
** nandBinCheck : Wii nand info tool **
from giantpune
built: Mar 24 2017 23:49:06
Failed to determine dump type
"Error setting path to nand object"

wfs-extract is done, but there is one error, and i have only files and folders

I have tried execute sdio_nand_manager and open c:\wiiu.brick.img , but i have got this error:
"NAND dump signature is not matchinge commnad"

NAND Extractor also does not open

I have otp.bin, seeprom.bin, keys.bin, slccmp.bin.
What is wrong? What can i do it?

Best regards
Baraka73