Hardware SLC Corruption help request

[AverageHumanPerson]

Hello All, Apologizes if this is the incorrect place to make this post

I am currently in the process of attempting to fix my bricked Wii U and could use some advice or aid.

I believe my issue is SLC corruption, and have followed the guide in the Ultimate Wii U Troubleshooting guide as far as I can go, but I have reached a roadblock.

The nandBinCheck identified a bad HMAC file, but did not show a path to a specific file other than the "/scfm.img" file. I believe this means that the fix used in the SLC thread will not work for my situation.
I lack the understanding of Nintendo's systems and community made tools to be certain however, hence why I am making this thread. What are my next steps?

I did attempt the fix stated in the SLC thread, but it didn't work and might have made things worse.

I will also include any and all information I believe will be useful to anyone attempting to help. Thanks in advance.

Here is the System.xml

<?xml version="1.0" encoding="utf-8"?>
<system type="complex" access="777">
  <version type="unsignedInt" length="4">21</version>
  <cmdFlags type="unsignedInt" length="4">0</cmdFlags>
  <default_os_id type="hexBinary" length="8">000500101000400a</default_os_id>

  <default_title_id type="hexBinary" length="8">0005001010040100</default_title_id>

  <log type="complex" length="0">
    <enable type="unsignedInt" length="4">0</enable>
    <max_size type="unsignedInt" length="4">8388607</max_size>
  </log>
  <standby type="complex" length="0">
    <enable type="unsignedInt" length="4">1</enable></standby>
  <ramdisk type="complex" length="0">
    <cache_user_code type="unsignedInt" length="4">0</cache_user_code>
    <max_file_size type="unsignedInt" length="4">10485760</max_file_size>

    <cache_delay_ms type="unsignedInt" length="4">10000</cache_delay_ms>
  </ramdisk>
  <simulated_ppc_mem2_size type="hexBinary" length="4">00000000</simulated_ppc_mem2_size>

  <dev_mode type="unsignedInt" length="4">0</dev_mode>
  <prev_title_id type="hexBinary" length="8">0000000000000000</prev_title_id>

  <prev_os_id type="hexBinary" length="8">0000000000000000</prev_os_id>
  <default_app_type type="hexBinary" length="4">90000001</default_app_type>

  <default_device_type type="string" length="16" />
  <default_device_index type="unsignedInt" length="4">0</default_device_index>

  <fast_relaunch_value type="unsignedInt" length="4">0</fast_relaunch_value>

  <default_eco_title_id type="hexBinary" length="8">0005001010066000</default_eco_title_id>

</system>

And here is the app.xml of the OSv10 file

<?xml version="1.0" encoding = "utf-8"?>
<app type="complex" access="777">
  <version type="unsignedInt" length="4">15</version>
  <os_version type="hexBinary" length="8">0000000000000000</os_version>
  <title_id type="hexBinary" length="8">000500101000400A</title_id>
  <title_version type="hexBinary" length="2">3d56</title_version>
  <sdk_version type="unsignedInt" length="4">21301</sdk_version>
  <app_type type="hexBinary" length="4">1000000a</app_type>
  <group_id type="hexBinary" length="4">00000000</group_id>
  <os_mask  type="hexBinary" length="32">0</os_mask>
</app>

I forgot to include the nandBinCheck output, so that's here now.

 

[AverageHumanPerson]

I did not, I that first zip you sent there were two files, I believed those analogous to the boot0.img and fw.img files in the standard setup for de_fuse. so I flashed the boot1-memtest-0.img file to the sd card and placed the boot1-memtest-f.img file in the sd card like you would with the fw.img file.

The second time I just replaced the boot1-memtest-f.img file with the memtest-boot1-f.img file on the sd card and just ran it again.

What did I need to do instead?

 

[SDIO]

I didn't mean to include both files in the first zip...
But all of them are meant to be flashed to the sdcard like the boot1. The one ending with 0 writes just zeros to the RAM and the second with the f writes just ones

 

[AverageHumanPerson]

Understood. I flashed the .img file you sent in the second zip file

Output appears to be the same as the others.

[pico] Changed state: WIIU_STATE_NEEDS_DEFUSE -> WIIU_STATE_DEFUSED
[pico] Changed state: WIIU_STATE_DEFUSED -> WIIU_STATE_MONITORING
efcafe020203!CF%10(MEM2U▒U▒U▒U▒U▒U▒U▒[Pico] Switching to data mode...

fe ff ff ff ff dd dd dd dd ee ee ee ee fa fb fc
fd 00 00 00 00 4d 45 4d 30 50 52 53 48 84 80 00
00 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01 5d 5d 00
02 5d 5e 00 04 00 00 00 00 5d 5d 00 04 5d 5d 00
01 5d 5d 00 02 5d 5e 00 04 00 00 00 00 5d 5d 00
04 5d 5d 00 01 5d 5d 00 02 5d 5e 00 04 00 00 00
00 5d 5d 00 04 5d 5d 00 01 5d 5d 00 02 5d 5e 00
04 00 00 00 00 5d 5d 00 04 5d 5d 00 01

 

[SDIO]

So the dram seems to be ok, at least no obvious problem there.
For looking at hex files use a hex editor.
That just 4 bytes would be wrong would be strange, since it is encrypted I would expect everything afterwards in the block to be garbage too. Maybe the file just had a different version.

You could try redNAND. For that you need to use the latest defuse again, so it can load boot1 from slccmpt, so you can use a bigger SD card.
Then use the format redNAND option in the backup and restore menu and configure the rednand.ini to redirect everything and leave SCFM enabled.

redNAND will disable hmac checking on the redirected slc

 

[AverageHumanPerson]

Ok, I have been trying all day to get redNAND to work, but I have yet to. I first tried flashing the slccmpt.img file to my 64GB sd card and running de_fuse that way, but it wouldn't recognize it as a valid SD card. I then used a 2GB card and ran De-Fuse before switching to the 64GB card and running the format redNAND step. I then opened windows as made the rednand.ini file. It was throwing an error about not being able to find a redotp.bin file, so I put a normal otp.bin in the sd card and renamed it to redotp.

It would throw an error immediatly when trying to patch and boot with redNAND saying it couldnlt find either the redotp.bin or the rednand.ini file, even though windows could see those files easily.

Finding information on how to setup redNAND at all was difficult. If possible, could you write out the procedure for flashing the larger SD card and setting up redNAND? There's too many things that im not sure on.

 

[SDIO]

you just flash the minute boot1 to the slccmpt boot1 by using the the restore slccmpt boot1 option in minute.
You don't ned redotp. That's not an error, just an information.
The rednand.ini needs to be in the minute folder

 

[AverageHumanPerson]

I'm still a bit confused. Do I flash the boot 1 to the 64GB card, flash the slccmpt using the restore option with the img file on the SD card, and then format redNAND from the menu?

Or do I need to start with the 2GB card I've been using, and switch to the 64GB card at some point in the process?

Edit:
In the effort to be a bit more helpful then just saying that I have a problem, I'll go ahead and write out the procedure I've been trying:

I first took one of my 2GB cards already with de_fuse working and placed the slccmpt boot 1 img file from the de_fuse download zip file.

I than used that card to de_fuse and when to the backup and restore menu. I dumped both the slc boot 1 and the slccmpt boot 1 so I could restore it back if I needed to.

I then used the restore slccmpt boot 1 option, once this was done I switched the 2GB card out for my 64GB card and selected the format redNAND option.

Once this was done I removed the 64GB card and opened it on my computer, I then made a folder called minute on the SD card and created a file called rednand.ini in the minute folder. This is what I put into the rednand.ini file:

[partitions]
slccmpt=true
slc=true
mlc=true

[scfm]
disable=false
allow_sys=false

I then tried to run the patch and boot rednand option in the main menu, but it immediately failed saying it could not find the rednand.ini file.

Trying to load sdmc:/redotp.bin... NOT FOUND!
minini: Failed to open `sdmc:/minute/rednand.ini`!
Press POWER/Q to continue.

I will note that everything seems to be spelled correctly, there's no space at the start of the .ini file. Would it be possible that windows is writing to the wrong partition?