- Joined
- Dec 5, 2009
- Messages
- 915
- Reaction score
- 2,214
- Trophies
- 3
- Age
- 32
- Location
- center of the Sun
- Website
- kuribo64.net
- XP
- 3,125
- Country
Following the latest WiiU gamepad developments, I made a boot ROM dumper.
https://github.com/Arisotura/wupbootdump
This dumper allows to dump your gamepad's boot ROM without a hardware glitching attack.
It still requires some soldering, so you should only attempt this if you're comfortable with soldering.
Why?
The boot ROM itself may be useful for further gamepad-related development, reverse-engineering, emulation, preservation, etc.
This is also a bit of a proof of concept for what is possible with the gamepad. Namely, the UART boot feature could be useful for running custom code, recovering a bricked gamepad, and so on.
How to
You'll need to solder wires to the gamepad's serial header.
The UART boot signal (2) must be tied to ground to enable UART boot.
There are three possible ways to get a connection to ground:
You will also need to ensure your solder joints don't protrude too high, so that you can still connect a battery.
You can test whether everything is working by starting the Gamepad without tying the UART boot signal to ground. The gamepad should start normally.
Once all is connected and good, start the Gamepad by applying power to it.
In UART boot mode, the Gamepad will appear to do nothing. (this is why you should test it in normal mode prior, as mentioned above -- to make sure it is actually working)
Then you can run the dumper:
python dump.py <serialport> bootrom.bin
<serialport> should be the name of your UART device.
The script will upload the payload to the Gamepad. This takes about 6 minutes.
Once that is done, the Gamepad's HOME LED should flash once, to indicate that the dumper is running.
When the script is done, you can turn off your Gamepad. You should get a file named bootrom.bin.
The boot ROM's SHA256 hash should be 1ba084d39f36f3fa2d8d4b671e762e08d8893651f94c8f31a0892dc9e12a7fc1.
(let me know if you get a different hash!)
UART boot howto
The dumper uses the UART boot feature in an atypical way, in order to gain control before the boot ROM is disabled. Hence why it takes so long to upload. If you want to use UART boot normally, things are a bit different (and don't take as long).
The format for UART boot is as follows: first, you send 4 bytes, which are the length of your code blob, LSB first. Then you send your code blob. Once the specified amount is sent, the gamepad will run your code.
The code blob is loaded in RAM at address 0x00000000. The first 64 bytes are the ARM exception vectors.
The serial settings are: 115200 baud, 8N1.
Your code will run right after the boot ROM, with the CPU running at 16 MHz. You will need to initialize the PLL in order to run the CPU faster. Example code: https://github.com/Arisotura/melonboot/blob/main/source/wup/wup.c#L52
Have fun!
https://github.com/Arisotura/wupbootdump
This dumper allows to dump your gamepad's boot ROM without a hardware glitching attack.
It still requires some soldering, so you should only attempt this if you're comfortable with soldering.
Why?
The boot ROM itself may be useful for further gamepad-related development, reverse-engineering, emulation, preservation, etc.
This is also a bit of a proof of concept for what is possible with the gamepad. Namely, the UART boot feature could be useful for running custom code, recovering a bricked gamepad, and so on.
How to
You'll need to solder wires to the gamepad's serial header.
- 1: (black) RXD
- 2: (green) UART boot
- 3: (blue) TXD
- 4: (yellow) Vcc (2.8V)
- 5: (red) ground
The UART boot signal (2) must be tied to ground to enable UART boot.
There are three possible ways to get a connection to ground:
- soldering to TP128 (shown in red), requires opening the gamepad
- scraping off the solder mask near the serial pads, to solder to the ground plane
- if you are using a battery pigtail, you can connect to the black wire
You will also need to ensure your solder joints don't protrude too high, so that you can still connect a battery.
You can test whether everything is working by starting the Gamepad without tying the UART boot signal to ground. The gamepad should start normally.
Once all is connected and good, start the Gamepad by applying power to it.
In UART boot mode, the Gamepad will appear to do nothing. (this is why you should test it in normal mode prior, as mentioned above -- to make sure it is actually working)
Then you can run the dumper:
python dump.py <serialport> bootrom.bin
<serialport> should be the name of your UART device.
The script will upload the payload to the Gamepad. This takes about 6 minutes.
Once that is done, the Gamepad's HOME LED should flash once, to indicate that the dumper is running.
When the script is done, you can turn off your Gamepad. You should get a file named bootrom.bin.
The boot ROM's SHA256 hash should be 1ba084d39f36f3fa2d8d4b671e762e08d8893651f94c8f31a0892dc9e12a7fc1.
(let me know if you get a different hash!)
UART boot howto
The dumper uses the UART boot feature in an atypical way, in order to gain control before the boot ROM is disabled. Hence why it takes so long to upload. If you want to use UART boot normally, things are a bit different (and don't take as long).
The format for UART boot is as follows: first, you send 4 bytes, which are the length of your code blob, LSB first. Then you send your code blob. Once the specified amount is sent, the gamepad will run your code.
The code blob is loaded in RAM at address 0x00000000. The first 64 bytes are the ARM exception vectors.
The serial settings are: 115200 baud, 8N1.
Your code will run right after the boot ROM, with the CPU running at 16 MHz. You will need to initialize the PLL in order to run the CPU faster. Example code: https://github.com/Arisotura/melonboot/blob/main/source/wup/wup.c#L52
Have fun!
