Successfully dumped WiiU EMMC nand with hardmod.

Discussion in 'Wii U - Hacking & Backup Loaders' started by Leeful, Jan 13, 2017.

  1. Leeful
    OP

    Leeful GBAtemp Regular

    Member
    123
    158
    Sep 4, 2015
    UPDATE: It is now possible to fully UNBRICK the WiiU using a hardmod, teensy and WiiU Nand Tools.

    I have tried a new approach to dumping the Emmc nand and it has worked. With this method I was able to dump the nand to an img file on the PC and then successfully write the img file back to the WiiU.

    The trick was to disconnect the CLK signal to the nand on the motherboard and then the pc was able to read the nand. After you have dumped / wrote your nand.img make sure to reconnect the CKL with a jumper.

    01.jpg 02.jpg 03.jpg 04.jpg 05.jpg 20170113_050250.jpg 20170113_050347.jpg 20170113_050504.jpg 20170113_100648.jpg

    Dumping the nand was the same procedure as with the 3DS hardmod using Win32DiskImager.

    First connect the SD card to your card reader on your PC.
    Press the power button on the WiiU.
    A popup message should appear on the PC saying you need to format the drive. CLICK CANCEL. DO NOT FORMAT THE DRIVE!!!! remember what drive letter it says.
    format.jpg
    Open Win32DiskImager and make sure the Drive letter on the right is the same as the one that popped up!
    Select where you want to save the .img file and click read.
    win32diskimg-Reading.jpg
    The dump size was 29.7gb and took around 2 hours at 5.7MB/sec

    If when you click read and it says "Lock Error" keep trying. it could do it on the first attemp or the third or the twentieth. This was exactly the same with the 3DS. To try and eliminate this problem make sure there are no explorer windows open or anything else that might be trying to read the drive.
    win32diskimg-ERROR.jpg

    When the read is complete close Win32DiskImager and safely eject the drive using "Safely Remove Hardware and Eject Media"
    Hold the power button on the WiiU to turn off the console and don't forget to insert the jumper so that the wiiU can boot normally again.


    PLEASE NOTE this is not a proper step by step tutorial (yet). I'm ony posting my findings and what I did to successfully read and write the nand.

    If someone wants to write up a more detailed tutorial later please feel free (just give me a mention :)

    I WILL NOT BE RESPONSIBLE FOR ANY BRICKS. ONLY ATTEMPT THIS IF YOU KNOW WHAT YOU ARE DOING!!!

    Even though this by itself cannot UNbrick a bricked system. Its a start.

    The next thing to try is the TSOP NAND and then anyone with a backup of BOTH the eMMC and TSOP nands should be able to fully UNbrick their WiiU if anything goes wrong..

    UPDATE:
    Not all Card Readers will work. Here is a list of confirmed Working & non Working Readers:
    Transcend TS-RDP8K - WORKED
    ALL IN 1 HDD Docking Station Model:875 - WORKED
    Logilink Cr0001b - Confirmed WORKING. Thanks @Tommy084
    Anker USB 3.0 AR200 - DID NOT WORK (would not detect drive?)
    Kingwin 5.25 inch bay mounted fan controller/multi card reader - NOT WORKING. Thanks @DocAmes1980

    UPDATE 2:
    I've been playing around with this some more and if you also connect the other 3 DAT lines the read rate goes up to 18.4MB/sec (write rate 10MB/sec) so a full 32GB nand can now be dumped in around 30 minutes instead of 2 hours!
    20170110_233016.jpg card.jpg

    UPDATE 3:
    Here is a video of it working.


    UPDATE 4:
    I can confirm that the mlc backup made with dimoks' sdio_nand_manager works with the hardmod.
    I created a new rednand, dumped the nand images with sdio_nand_manager then straight away made a mlc dump with the hardmod and the SHA256 hashes form both mlc dumps match.

    UPDATE 5:
    Thanks to @DocAmes1980 & @Tommy084 for trying it out and confirming the mod works.
     
    Last edited by Leeful, Mar 26, 2017


  2. DocAmes1980

    DocAmes1980 GBAtemp Advanced Fan

    Member
    511
    312
    Oct 31, 2016
    United States
    I just completed the mod. I used a three way switch to direct the clock signal. One position sends it to the fake SD for read/write mode and the other sends it to the Wii U so the sucker actually boots and plays games. All the continuity checks out but it didn't work in the two readers I tried. One was a SD card reader built in to my laptop. The other was a Kingwin 5.25 inch bay mounted fan controller/multi card reader connected to a internal USB 2.0 header. I might try that transcend reader and report back.

    Pictures:

    https://filetrip.net/view?WIoGQq27MF

    https://filetrip.net/view?dtmauNR2Cp
    [​IMG]
     
    Last edited by DocAmes1980, Jan 23, 2017 - Reason: embedding pictures won't work
    Tommy084 and Kappcy like this.
  3. DocAmes1980

    DocAmes1980 GBAtemp Advanced Fan

    Member
    511
    312
    Oct 31, 2016
    United States
    ignore
     
    Last edited by DocAmes1980, Jan 23, 2017
  4. Jayro

    Jayro MediCat USB and Mini Windows 10 Developer

    Member
    GBAtemp Patron
    Jayro is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    4,956
    2,666
    Jul 23, 2012
    United States
    Octo Canyon
    [ img] your_image_url.jpg [ /img]
     
  5. DocAmes1980

    DocAmes1980 GBAtemp Advanced Fan

    Member
    511
    312
    Oct 31, 2016
    United States
    Thanks. No Joy. I think filetrip.net is just fucked up. Even following a direct link just takes me to the home page.

    Edit: URL is valid but it shows as a broken link. Don't understand why. Oh well.
     
    Last edited by DocAmes1980, Jan 23, 2017
  6. ddurdle

    ddurdle GBAtemp Regular

    Member
    259
    65
    Dec 13, 2015
    Canada
    great work and great progress! A solid contribution to the community.
     
  7. DeadlyFoez

    DeadlyFoez GBAtemp Guru

    Member
    5,436
    1,468
    Apr 12, 2009
    United States
    Good job. I really should get to doing this. I already can read and write the nand chip without any issues, I just haven't jumped into the eMMC yet.
     
  8. Leeful
    OP

    Leeful GBAtemp Regular

    Member
    123
    158
    Sep 4, 2015
    Sorry to hear you couldn't get it working yet. It probably is the card reader that is giving you the trouble.
    Another thing to try is to shorten the length of the wires to try and minimise any interference. (people were always mentioning this with the 3DS but I dont know if it makes any great difference)

    Can you confirm that the switch is working like the image below and that the clk track is definately cut:
    doc-switch.jpg


    What happens when you turn on the WiiU in read/write mode?(it doesn't have to be plugged into a reader)

    On mine when the power button is pressed you can hear the DVD drive make a noise as normal but the wiiU does not boot up. There is no picture sent to the TV and the gamepad will not connect if turned on. (this is handy because when dumping the nand you only need the power cable plugged in so you can easily move the WiiU near a PC.) To turn off, the power button must be held in. When the WiiU boots the next time the warning comes on screen about not shutting down properly like when a crash happens.

    When you checked the continuity did you test between the contacts of the sd card and the resistors on the motherboard? It may sound obvious but I'm just trying to think of any thing that can help.

    Hope you can get it working.:)



    This is good to hear. I have ordered a teensy, 3.3v regulator, pins, wires e.t.c so I'm planning to tackle the tsop nand next.

    Do you have any advice that could help? Does the nand need an external power source or can it be powered by the teensy? Have you posted a tutorial anywhere?
     
    Tommy084 likes this.
  9. DocAmes1980

    DocAmes1980 GBAtemp Advanced Fan

    Member
    511
    312
    Oct 31, 2016
    United States
    Thank you for your response. I'm also guessing that it is the readers that are the issue. I've only read a little bit about the 3DS hard mod but it seems that built in card readers either don't work or are very unlikely to work. Perhaps my wires are too long. They are a little longer than yours because I was hoping I could use the built in readers of my laptop or desktop. I will try a known good reader before making any adjustments.

    Yes, the switch is working exactly as you have labeled. Pin 2 is the clock signal from the eMMC. Pin 1 goes back into the Wii U and jumps the cut trace. Pin 3 goes to the fake SD card. The trace is definitely cut. I checked to confirm there was no continuity between the two points. After wiring up the switch I confirmed that there was continuity between the points when the switch was in position "A". When in position "B" the clock signal has continuity with the appropriate pin on the fake SD card.

    Yes, sir. Exactly as you described. DVD drive does it's usual thing. No signal is sent to the TV. Gamepad doesn't do anything. Holding the power button shuts off the system and upon reboot it gives me the nag screen.

    Yes, I checked from the resistors to the pads of the fake SD card. I also tested the switch in both positions to ensure that it was functioning as expected. Also, you might notice that the solder joints on DAT0 and GND in the picture I uploaded are shitty. They still checked out for continuity but I resoldered them. All joints looked good when I reassembled (ok, the JMP point is ugly but it's solid as the Wii U boots). I'll try a known good reader at some point and see if I get joy. If you find any other readers are working please update.

    Thanks for your help,

    Andy
     
    Tommy084 likes this.
  10. Derpncheez

    Derpncheez Advanced Member

    Newcomer
    68
    1
    Apr 12, 2016
    United States
    This is awesome work! I'm so terrified of bricking my console by installing CFW. Is it safe to say to wait before messing with that? Again, thanks for your contributution!
     
  11. wolf_

    wolf_ GBAtemp Fan

    Member
    302
    64
    Jan 22, 2012
    United States
    if your not worried about coldboot then there is no brick chance
     
    Seki777 and DocAmes1980 like this.
  12. Derpncheez

    Derpncheez Advanced Member

    Newcomer
    68
    1
    Apr 12, 2016
    United States
    I was also thinking of installing RedNand+Mocha, which could lead to a possible brick, no? or maybe I read wrong.
     
  13. DeadlyFoez

    DeadlyFoez GBAtemp Guru

    Member
    5,436
    1,468
    Apr 12, 2009
    United States
    I personally use an infectus to read and write the nand chip. I remove the nand chip from the mother board.

    I used to repair a real lot of wii's back in the day.
     
  14. DocAmes1980

    DocAmes1980 GBAtemp Advanced Fan

    Member
    511
    312
    Oct 31, 2016
    United States
    As far as I know, the only way that you will brick your system while using redNAND is if you update redNAND. It seems unlikely that Nintendo will push out another Wii U update but it's possible. Also, you can block updates to prevent this. That being said, forget redNAND. It is 100% useless for the end user. Not only is it useless but it wastes 32GB of SD card space (only 8GB if it's an 8GB Wii U). Also it can be a pain to deal with. Many threads have been started because a user encountered problems related to redNAND. Sometimes there is junk data that can't be deleted, sometimes redNAND corrupts itself so you lose everything since the last dump. Many users on this forum will violently disagree with me. They say redNAND is great to use because it protects you against bricks. The thing is that using homebrew, CFW, and running backups doesn't expose you to any brick risks. If you look at the list of known bricks only one of them could have been prevented by using redNAND. In that case it was a dev experimenting with some custom shit that bricked his system. Pretty much every other brick that I'm aware of was from the user failing to follow instruction during or after installing coldboothax/CBHC. These type of brick can't be prevented with redNAND because coldboothax/CBHC is applied to sysNAND and screwing up causes the console to fail to boot the Wii U menu. One guy bricked by messing up a hardware mod. Another claims he bricked by installing an update. With the latter there has to be more to the story or maybe his hardware failed and the last thing he did was install an update so he blamed that.

    Even if you decide to install CBHC you'll be fine if you can follow instructions. So far every brick has been 100% user error.
     
  15. TyrelProudpappyD

    TyrelProudpappyD Newbie

    Newcomer
    2
    0
    Jun 8, 2012
    United States
    Columbus, OH
    Gateway for SysNAND CFW? Nice!
     
  16. C0mm4nd_

    C0mm4nd_ Aspirant Wii U homebrew dev :P

    Member
    697
    337
    Oct 9, 2016
    Italy
    And restoring eMMC NAND can't fix a coldboothax brick
     
  17. naddel81

    naddel81 GBAtemp Advanced Maniac

    Member
    1,500
    181
    Dec 14, 2009
    United States
    how come? I thought everything was saved on NAND?!
     
  18. C0mm4nd_

    C0mm4nd_ Aspirant Wii U homebrew dev :P

    Member
    697
    337
    Oct 9, 2016
    Italy
    Wii U has 2 NANDs
    eMMC(with userdata,games,ecc... like the 3DS) TSOP(with sys files like system.xml)

    And for dumping TSOP NAND ehm... you'll need a Teensy and other things, it's more difficoult

    — Posts automatically merged - Please don't double post! —

    It can fix only if you delete the title/format and you did a NAND bak
     
    naddel81 and thaikhoa like this.
  19. tvall

    tvall GBAtemp Regular

    Member
    271
    75
    May 12, 2014
    United States
    the use of nand there is a little confusing.

    so the wiiu has multiple flash chips, the large emmc, and a slc nand (which is actually two, one part for for the vwii mode too).

    the only thing being talked about much here is the emmc. and most of the coldboot bricks involve broken stuff on the slc nand. which also is the one thats more work to flash. mess of data and address pins instead of just clk, cmd, and dat

    edit: ninja'd :ph34r:
     
    naddel81 likes this.
  20. DocAmes1980

    DocAmes1980 GBAtemp Advanced Fan

    Member
    511
    312
    Oct 31, 2016
    United States
    Actually I would say most of the coldboothax bricks are because the user deleted the Haxchi title or formatted the system. Since CBHC I believe all coldboothax bricks have been from one of these two causes. That being said this mod really doesn't do much for you. I just thought it would be fun. I don't even want to spend the $10 on a card reader to confirm that the mod is working since I have no practical use for dumping/restoring the eMMC. I suppose I have to now so I can feel special as one of the few people to risk ruining a perfectly good Wii U to perform a hard mod that I have little to no use for.

    Soldering is fun.