Hardware Should I fix my half bricked WII U?

SDIO

Well-Known Member
Member
Joined
Feb 13, 2023
Messages
2,257
Trophies
0
Age
28
XP
1,374
Country
Germany
You already had Tiramisu? Is that from before the initial corruption happened?
slc.bin and mlc.bin would allow the restore to a consistent state.

There are several options to flash the slc, but none is a clear recommendation. The usual way was through a teensy and soldering a lot of wires but I would consider that obsolete since we have defuse and minute_minute. But I belive minute_minute has the slc flash option disabled for now. To enable it we would have to compile it ourselfs, which shouldn't be a huge deal. But you would have to solder a few wires for defuse to work.
The third option would be to flash it through the recovery menu. The problem there is, that it isn't implemented yet. I could implement it, but I have no way to test it right now.
 

Ysecond

Well-Known Member
OP
Member
Joined
Apr 27, 2023
Messages
186
Trophies
0
Age
26
XP
468
Country
China
1) Run MLC Checker.
2) Use wupserver / wupclient to make a new folder (like w.mkdir("/vol/storage_mlc01/corrupt", 0)).
3. Use wupserver/wupclient to move all folders (but not the files!) MLC Checker reported as corrupt into that new folder (w.mv(oldPath, newPath)).
4. Use wupserver/wupclient to remove all none system titles (like games, updates and DLC. Use delete_title(path) but check the title IDs against https://wiiubrew.org/wiki/Title_database to make sure to not remove system software).
5. In case there are still corrupted files left reinstall the corresponding software with UDPIH.
6. In case there are still corrupted files left tell us which ones but in case all corrupted files are gone:
7. Do
So w.dl("/vol/system/proc/prefs/cafe.xml") then edit the file as told and w.up it back to the Wii U.
8. Execute flush_mlc() and reboot.
I am following your tis and using wupclient to delete the title. But there seem to be many errors, and I will continue to handle them.
You already had Tiramisu? Is that from before the initial corruption happened?
Unfortunately, the backup came after corruption. Refer to 1st floor “I did:”,At that time, I didn't have “system settings” or WIFI. I used https://lazr1026.github.io/tudpih/#/ to install Tiramisu。
But you would have to solder a few wires for defuse to work.
I not a coder,but I enjoy doing some welding work. I have limited abilities, but if possible, I enjoy participating in testing the third option. I don't mind making my SLC MLC worse. :D
Post automatically merged:

(w.mv(oldPath, newPath)).
HI,I am unable to use the move code. Can you please tell me what went wrong?
I want to rename a file or folder.Could you tell me the code?
Thank a lot!
( >>> w.ls() broken/ corrupt/ sys/ usr/ >>> w.mv("/vol/storage_mlc01/sys/title/00050010/10047000", "/vol/storage_mlc01/broken") Traceback (most recent call last): File "<stdin>", line 1, in <module> AttributeError: wupclient instance has no attribute 'mv' >>> ).
 

Attachments

  • before_mlc_checker.txt
    8.1 MB · Views: 36
  • after_mlc_checker.txt
    1.8 MB · Views: 38
Last edited by Ysecond,

Ysecond

Well-Known Member
OP
Member
Joined
Apr 27, 2023
Messages
186
Trophies
0
Age
26
XP
468
Country
China
Hello, everybody,I got some news.
With everyone's help, I have fixed or will soon fix my two WIIUs. Gratitude cannot be expressed in words.
As you know,I messed up a wiiu SLC&MLC, created additional corrupted directories in the usr folder. So i used De_fuse to restore. De_fuse PICO 0.5 support refreshing SLC, MLC....

I restored the original backup. But new error have emerged, The console told me 160-1400.I am very certain that my Disk drive is not damaged. So I checked CM9 and CM10 according to this. But they all work normally. Later, I found an option in Minute_minute that can fix 160-1400. I don't understand the principle, but it does work.
" Backup and Restore >> Set SEEPROM SATA device type >>No device "
If you have an irreparable 160-1400 console, Maybe you can try this.
 

Attachments

  • f18806ac558528aa96a1f38ac07a3a9.jpg
    f18806ac558528aa96a1f38ac07a3a9.jpg
    2.5 MB · Views: 52
  • 2.jpg
    2.jpg
    195 KB · Views: 50

Ysecond

Well-Known Member
OP
Member
Joined
Apr 27, 2023
Messages
186
Trophies
0
Age
26
XP
468
Country
China
In recent days, I have been fixing the third WIIU. My last one. This is a thorough Brick:ohnoes:,Stuck on Logo ,UDPIH is not working。It has a Samsung SLC, I use De_ Fuse connects it to download OTP,I read this OTP by HEX,I feel very sad,because it appears that the OTP data has been corrupted. this is very strange。:ohnoes:
 

Attachments

  • normal OTP.png
    normal OTP.png
    510.7 KB · Views: 41
  • This otp.png
    This otp.png
    68 KB · Views: 42

V10lator

Well-Known Member
Member
Joined
Apr 21, 2019
Messages
2,633
Trophies
1
Age
36
XP
5,486
Country
Germany
it appears that the OTP data has been corrupted
Might be a bug in de_fuse? I mean de_fuse zeroes the OTP area and what we see looks like an (almost completely) zeroed OTP to me, no? So maybe try a few different de_fuse versions (I remember this had been fixed in the past, so maybe we see a regression?).

//EDIT: To make this clear: The OTP / eFuses are not zeroed. That's impossible (it's called one time programmable for a reason) but the Wii U copies the eFuse registers into transient registers and that's where de_fuse kicks in, so the transient registers will be zeroed and the eFuses will no longer be accessible after that. IIRC early de_fuse versions gave a zeroed OTP dump thanks to this but a workaround had been added.

//EDIT²: A zeroed OTP tells the Wii U it is in factory mode, loading an unsigned firmware image from the SD card. That's the whole point of de_fuse.
 

Ysecond

Well-Known Member
OP
Member
Joined
Apr 27, 2023
Messages
186
Trophies
0
Age
26
XP
468
Country
China
Might be a bug in de_fuse? I mean de_fuse zeroes the OTP area and what we see looks like an (almost completely) zeroed OTP to me, no? So maybe try a few different de_fuse versions (I remember this had been fixed in the past, so maybe we see a regression?).

//EDIT: To make this clear: The OTP / eFuses are not zeroed. That's impossible (it's called one time programmable for a reason) but the Wii U copies the eFuse registers into transient registers and that's where de_fuse kicks in, so the transient registers will be zeroed and the eFuses will no longer be accessible after that. IIRC early de_fuse versions gave a zeroed OTP dump thanks to this but a workaround had been added.

//EDIT²: A zeroed OTP tells the Wii U it is in factory mode, loading an unsigned firmware image from the SD card. That's the whole point of de_fuse.
Thank you, your reminder has given me another glimmer of light. I am using De_ Fuse PICO 0.5, maybe I should try another version or wait for an updated version.
Post automatically merged:


//EDIT²: A zeroed OTP tells the Wii U it is in factory mode, loading an unsigned firmware image from the SD card. That's the whole point of de_fuse.
Does it mean that my Wiiu still has the possibility to fixed? Sorry, I need to read multiple times to understand.
 
Last edited by Ysecond,

V10lator

Well-Known Member
Member
Joined
Apr 21, 2019
Messages
2,633
Trophies
1
Age
36
XP
5,486
Country
Germany
maybe I should try another version or wait for an updated version.
To be fair I'm not really familiar with de_fuse nor minute_minute but from looking at minute_minutes source codes it seems there are two ways to dump the otp: "Dump SEEPROM & OTP" and "Dump OTP via PRSHhax".

I'm not sure if I'm understanding the codes correctly but try "Dump OTP via PRSHhax" immediately followed by "Dump SEEPROM & OTP". In case I'm understanding this correctly PRSHhax is the workaround to not get a zeroed dump but it does the dump to RAM only, so you need the normal dump option afterwards to write that good dump from RAM to SD. That said: Does this give you a good dump?

Oh and make sure to use latest versions from https://github.com/shinyquagsire23/wii_u_modchip and https://github.com/shinyquagsire23/minute_minute (can't see releases there so you might need to compile for yourself).
 

Ysecond

Well-Known Member
OP
Member
Joined
Apr 27, 2023
Messages
186
Trophies
0
Age
26
XP
468
Country
China
I'm not sure if I'm understanding the codes correctly but try "Dump OTP via PRSHhax" immediately followed by "Dump SEEPROM & OTP". In case I'm understanding this correctly PRSHhax is the workaround to not get a zeroed dump but it does the dump to RAM only, so you need the normal dump option afterwards to write that good dump from RAM to SD. That said: Does this give you a good dump?
Nice! copy that!I will try it tonight.Thanks!!!
Oh and make sure to use latest versions from https://github.com/shinyquagsire23/wii_u_modchip and https://github.com/shinyquagsire23/minute_minute (can't see releases there so you might need to compile for yourself).
I don't know how to compile, perhaps I should wait for the subsequent release version. Thank you again for your guidance.:D
 

V10lator

Well-Known Member
Member
Joined
Apr 21, 2019
Messages
2,633
Trophies
1
Age
36
XP
5,486
Country
Germany
I don't know how to compile
Looked into it. It's really a mess (needing zsh and stuff) and a Dockerfile would be great to have but oh well. Was finally able to compile minute_minute for you.

Just try that in combination with the de_fuse pico version you're using already. :)

//EDIT: BTW, do you have a link to that de_fuse version you're using?
 

Attachments

  • fw.zip
    162.5 KB · Views: 28

Ysecond

Well-Known Member
OP
Member
Joined
Apr 27, 2023
Messages
186
Trophies
0
Age
26
XP
468
Country
China
Looked into it. It's really a mess (needing zsh and stuff) and a Dockerfile would be great to have but oh well. Was finally able to compile minute_minute for you.

Just try that in combination with the de_fuse pico version you're using already. :)
I don't know what else to say, I just want to say I love you:D
Post automatically merged:

//EDIT: BTW, do you have a link to that de_fuse version you're using?
https://github.com/shinyquagsire23/wii_u_modchip/releases/tag/v0.5
Post automatically merged:

Dump OTP via PRSHhax
You're right. I successfully downloaded the correct OTP.
There is also some bad news, the console seems to have some hardware issues. It seems impossible to read MLC. Perhaps this is the reason for stuck on Logo. :(

The original EMMC, or NAND-AID all the same logs.
 

Attachments

  • error(1).txt
    8.2 KB · Views: 26
Last edited by Ysecond,

V10lator

Well-Known Member
Member
Joined
Apr 21, 2019
Messages
2,633
Trophies
1
Age
36
XP
5,486
Country
Germany
How do you try to read the MLC?
Also what exactly is the error you're facing?

//EDIT: Whoops I (and I guess @SDIO, too) overlooked your error log.

@SDIO: Dump was tried via minute_minute but:
Code:
Initializing MLC...
sdhc_bus_power(0x40000000)
mlc: powerup failed for card
Code:
resetting due to error interrupt
timeout dump: error_intr: 0x0 intr: 0x2
mlc: MMC_SEND_OP_COND failed with 116

//EDIT²: Do we know where the 3.3 V line of the MLC is located at the mainboard (NAND-AID grabs it from the ODD) ? Maybe we should check if there's really no power and if so look why.

//EDIT³: But on the other side @SDIO is correct: The console shouldn't boot that far in case the eMMC really has no power. So this is a weird error and I never saw this before, leaving this for more skilled people than me (CC @shinyquagsire23 and @GaryOderNichts - to the readers: Just ignore this CC. It's just my way of making sure the people get a notification about this topic, so they'll hopefully look into it).
 
Last edited by V10lator,
  • Like
Reactions: Ysecond

Ysecond

Well-Known Member
OP
Member
Joined
Apr 27, 2023
Messages
186
Trophies
0
Age
26
XP
468
Country
China
Without the mlc it shouldn't be able to display the logo
Right!without the mlc or sd card,there is no display the logo。

I dumped MLC by sd cardreader , the header of the file is empty,Is it possible that this is the problem?

Or, it seems that the CPU cannot connect to EMMC?
Dump was tried via minute_minute but:
Right!
 

Attachments

  • 1685130826221.png
    1685130826221.png
    16.7 KB · Views: 32
  • data start here.png
    data start here.png
    31.5 KB · Views: 45

SDIO

Well-Known Member
Member
Joined
Feb 13, 2023
Messages
2,257
Trophies
0
Age
28
XP
1,374
Country
Germany
I think @Lazr1026 saw something similar.
If that was a brand new never touched console, I could Imagine, that this part is only in the slc cache and wasn't evicted yet to the eMMC. But I also could be wrong.

Can you upload the SLC and the OTP somewhere and share the link in a PN with me? If you could also upload the mlc that would be great, then I could run it in the Firmware Emulator. If the mlc still has lots of zeros it could zip very well.
 

Ysecond

Well-Known Member
OP
Member
Joined
Apr 27, 2023
Messages
186
Trophies
0
Age
26
XP
468
Country
China
Can you upload the SLC and the OTP
Yes,I will do that , But before I upload, I will check the correctness of the file. At present, I am unable to extract MLC using OTP. I'll double check if I'm dumping correctly.
Code:
E:\F110original_MLC>wfs-extract --input F110OG1.img --output dump_dir --otp otp.bin --seeprom seeprom.bin
Error: Unexpected WFS version (bad key?)
 

SDIO

Well-Known Member
Member
Joined
Feb 13, 2023
Messages
2,257
Trophies
0
Age
28
XP
1,374
Country
Germany
can you also send me slcmtp, I need it for the emulator? Also I wouldn't post these files publicly
 

Ysecond

Well-Known Member
OP
Member
Joined
Apr 27, 2023
Messages
186
Trophies
0
Age
26
XP
468
Country
China
can you also send me slcmtp, I need it for the emulator? Also I wouldn't post these files publicly
I'm sorry, I didn't know that SLCCMPT files are also need. It has now been uploaded. Thank you!
Code:
https://drive.google.com/
Also I wouldn't post these files publicly
Please don't mind,if needed, you can share it anywhere. :D
 
Last edited by Ysecond,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: I'll just pretend like I know what's going on