Hacking The Definitive Guide to Wii U Hacking

fiveighteen

Distractible Dabbler
OP
Member
Joined
Jun 30, 2008
Messages
1,768
Trophies
1
XP
1,886
Country
United States
:!: This guide is old, last updated on October 2016.
If you are looking for a 5.5.2 or 5.5.3 hacking guide, you can use this one instead: https://gbatemp.net/threads/guide-noob-guide-to-wii-u-hacking.451297/

if you are on an 5.5.1 or older version, both guides are fine.

■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ The Definitive Guide To Wii U Hacking ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Each section is complete with requirements, download links, and a FAQ section to answer your questions before you can even think of them.

Disclaimer: I'm not responsible for anyone being updated past an exploitable firmware, bricking their console, crashing their PC, etc. Follow these instructions at your own risk. Your mileage may vary based on your operating system and computer specifications.

LATEST FW: 5.5.1
EXPLOITABLE FW: 3.0.0, 3.1.0, 4.0.0, 4.1.0, 5.0.0, 5.1.0, 5.3.2, 5.4.0, 5.5.0, 5.5.1


No, the "System Update" you see in the download log with a red X on it does NOT mean there is a new update out. That only means you are correctly blocking updates.

Check HERE to see if Nintendo has released a new FW.


LATEST DEVELOPMENT NEWS:
10/23/16: Virtual Console Creator has been released.
10/22/16: WiiUbru has released an IOSU Exploit and redNAND for 5.5.1! Read this.
10/19/16: Installing games from SD card to USB or internal memory is now possible. Read here.

05/03/16: Kernel Exploit for 5.5.X has been leaked.
05/01/16: smea has released iosuhax tools (not an IOSU exploit).
01/15/16: Yellows8's MP4 Userland exploit working for 5.4.0, 5.5.0, and 5.5.1. Kernel exploit still private for everything but 5.4.0.


LATEST HOMEBREW:
Constant: The Homebrew App Store has been updated (wiiubru.com)
08/28/16: Loadiine GX2 has been updated to vb80ba75
08/04/16: HID to VPAD has been updated to v0.9b
05/12/16: Saviine has been updated to v1.1.b
05/10/16: TCP Gecko (disc games) has been released
05/07/16: WUP Installer has been updated to v1.0
05/03/16: The Homebrew Launcher has been updated to v1.2 RC3
05/01/16: NNU Patcher has been released
04/25/16: ddd has been updated to v0.3
03/31/16: FTPiiU has been updated to v0.3

LATEST DEFINITIVE GUIDE UPDATES:
07/12/16: Added USB/internal memory game installation and IOSU exploit news. Edited "What games have 5.5.1 on them?"
07/12/16: Added CONSOLE/NNID BANS section
06/17/16: Added iDevice exploit server guide at HACKING METHODS -> How do I host my own exploits/files on my iPhone/iPad/iPod Touch?
05/10/16: Updated USEFUL HOMEBREW -> How do I update my disc games and Loadiine games?

FORUM INFO
How can I help?
This is some of the stuff that I'm currently looking for:
Which threads should I keep an eye on?
PURCHASING A WII U
All Wii U consoles currently will be on or under FW 5.5.1, which is compatible with all exploits.
GETTING TO (AND STAYING ON) AN EXPLOITABLE FIRMWARE
Should I update my Wii U?
All exploits currently in development work on FW 5.5.1, including the long-anticipated IOSU exploit. Check www.loadiine.ovh to make sure that 5.5.1 is still the latest update released, then update as soon as possible. If a new update has been released, DO NOT update, wait until compatibility is tested first.

Updating via an internet connection will put you on the latest FW!
Updating via a disc (found in the section below) will put you on the corresponding FW.

Which FW have exploits available?
3.0.0, 3.1.0, 4.0.0, 4.1.0, 5.0.0, 5.1.0, 5.3.2, 5.4.0:
Reliable userspace exploit
Reliable kernel exploit
Private IOSU exploits
5.5.0, 5.5.1:
Reliable userspace exploit
Reliable kernel exploit
Reliable IOSU exploits​
Which games have 5.5.1 on them?
Paper Mario Color Splash is the only title at this time.
How do I block updates?
Use TubeHax DNS!! This will still allow you to use internet if you want, and only blocks Nintendo's update servers. It is ran by smea, who is very reputable in the 3DS hacking scene.

Set up TubeHax DNS on your Wii U:
1. Go to Wii U Menu/System Settings/Internet/Connect to the Internet
2. Input your router's SSID and password (typically WPA2-PSK AES)
3. Input settings as follows:
IP Address: Auto-obtain
DNS: Don't Auto-obtain
Primary DNS: 107.211.140.065 (TubeHax DNS)
Note: This will leave you unable to access YouTube​
Secondary DNS: 0.0.0.0
Note: This will make your Wii U fail to connect to the internet if TubeHax fails.​
Additional preventative measures:
A. Block by URL Filtering (allows internet access still)
B. Block your Wii U's MAC Address (no internet access at all, can only run self-hosted files)​
Note: Your router settings page is typically http://192.168.1.1 or http://10.0.0.1

A. Block by URL Filtering in your router settings
  • nus.c.shop.nintendowifi.net
  • nus.cdn.c.shop.nintendowifi.net
  • nus.cdn.shop.wii.com
  • nus.cdn.wup.shop.nintendo.net
  • nus.wup.shop.nintendo.net
  • c.shop.nintendowifi.net
  • cbvc.cdn.nintendo.net
  • cbvc.nintendo.net

B. Block your Wii U's MAC Address in your router settings
1. Go to Wii U Menu/System Settings/Internet/View MAC Address
2. Type the string you see into your MAC address filter (Ex: b8-ae-4e-48-36-fe)​
CONSOLE/NNID BANS
Based on your error code, here's what kind of ban you have received. You can call Nintendo and try to have it reversed, but don't count on it.

Code:
102-280X NNID permanent ban
102-281X console permanent ban
102-282X NNID temporary ban
102-283X console temporary ban
FUTURE EXPLOITS/HACKS
What is an IOSU Exploit?
An IOSU Exploit is an exploit that would essentially would allow us full access to the Wii U (like what we could do with the Wii).

The IOSU is a custom OS running on a separate ARM processor and is indeed related to hardware access, crypto, title management and all that. It's also responsible for launching the PPC kernel binary, so it had to be able to access it.
IOSU also has a userland and a kernel.

What is possible with the IOSU Exploit?
EmuNAND/redNAND
Getting keys
USB support for hard drives with Loadiine (and any other app)
SD access in any app
Dumping 1:1 copies of games
Online support for Loadiine games
An easier way of running custom PPC kernels
Modification/backup of vWii mode from within Wii U mode
etc​
What is an emuNAND?
EmuNAND is an emulated NAND that would let us switch between the real NAND of your Wii U (that would stay on an exploitable firmware used for hacking) and the emulated NAND that would be kept up to date. In a similar vein, redNAND is redirected NAND. It's the same thing in principle, but implies a bit more permanence in the method of installation to the console.
HACKING METHODS
How do I host my own exploits/files on a PC or Mac?
Firmware Version Required:
Downloads:
Windows, Linux, OSX: Mongoose Free (Choose "Mongoose Binary")
Windows: Mini Web

Mongoose is my preferred option, but seems to cause some issues for some.

Mini Web is another lightweight option to use on your Windows PC. The only differences are that you can't set your folder; everything has to go into MiniWeb's htdocs folder, and it uses port 8000 instead of port 8080. If you have Skype running, you'll have to close it before starting MiniWeb, then can open it again. (There may be other programs that also use port 8000).

There are, of course, many additional ways you can self-host files (WAMP, XAMPP, etc.), but these are the easiest to set up (no installations). The guide will refer to Mongoose for all steps, but substitute for whatever you are using when necessary.

Windows:
1. Double-click on mongoose-free-5.6.exe to start it
2. Right-click on the Mongoose notification icon (by the date/time)
3. Click "Set shared directory:" and choose the folder where the Homebrew Launcher is located
4. Right-click on the Mongoose notification icon again. Note the URL, this is what you'll be typing into your Wii U.
OSX:
1. Place your downloaded Homebrew Launcher wherever you like and copy Mongoose to that folder
2. Go into "System Preferences/Sharing" and enable file sharing
3. Add the folder where everything is located (from Step 1) to your "Shared Folder" by clicking on the +
4. Click on "Options" and make sure you share files using both SMS and AFP
5. Double-click on the Mongoose app in your hacks folder to start it
6. Click on the Mongoose icon at the top right corner of your screen. Note the URL, this is what you'll be typing into your Wii U.​
FAQ:
It isn't loading on my Wii U. What do I do now?
Right-click on Mongoose and click Exit. Then restart it and try again. If you're on Windows, make sure you allow the connection to go through your Windows Firewall by going to "Control Panel\System and Security\Windows Firewall\Allowed apps" and adding mongoose-free-5.6.exe to the list. Make sure it has check marks for Private and Public.
How do I host my own exploits/files on my Android phone?
Firmware Version Required:
Downloads:

Thanks to @Tesa for this tutorial.

This tutorial is possible on any version which supports kWS (creating the hotspot WILL be different and you'll need to figure out that part on your own).

You'll need to disable your cellular internet connection before doing any of this! Please do NOT forget this. Your Wii U WILL update if you don't do this. This means your phone won't have internet access during the process!

These instructions specifically are for Samsung Galaxy devices. My DROID Maxx did not warn me or disconnect me from my current wireless network. I had to make sure my Mobile Network was disconnected myself.


1. Extract the Homebrew Launcher WWW folder to a folder named "HBL"
2. Copy the "HBL" folder over to the root of your phone storage (The one with the "Android", "Alarms", etc. folders)
3. Create a "Mobile Hotspot" with your phone. Go to your phone settings -> Connections -> More networks and select "Tethering and mobile hotspots"
qTDU1aH.png
4. Enable "Mobile Hotspot", this will warn you that you'll be disconnected from your current wireless network.
NbS0BaD.png
5. You should now be able to access the settings of the mobile hotspot (either by clicking on it or clicking the icon on the top left. This will show you the status, SSID and password.
QmpI4Lj.png
6. Open kWS and you should see this:
oh0XDqL.png
7. Go into Settings and click on "Home directory" in the "General" area. Type in "/sdcard/HBL" (picture is outdated):
SW4RD8O.png
8. Accept and start the server, you should now see your local IP.
HSeMaRN.png
9. Connect your Wii U to your local hotspot.
10. Open your browser and go to the IP shown

As long as your cellular data is OFF there's no way your Wii U will be able to connect to the internet/download updates.
How do I host my own exploits/files on my iPhone/iPad/iPod Touch?
Firmware Version Required:

Thanks to @SkyDX for this tutorial.

Disclaimer: I'm not responsible for anything bad that happens by using this tutorial, this is how I did it on my Jailbroken iPhone 5S on iOS 8.4 and it works fine. If your iOS device or Wii U transfers into an alternate dimension or if Tim Cook suddenly appears on the screen you did something wrong!

Notes:
- This guide should theoretically work on any 7.x, 8.x and 9.x iPhone, iPod Touch or iPad aslong as it's Jailbroken but I myself only have a iPhone 5S on Firmware 8.4 so I can't test it on other configurations!
- Since this requires a Jailbroken device in the first-place I won't go over some basic Jailbreak-things like accessing the root-filesystem and operating Cydia, that should be common knowledge to use it anyway! If there is a huge demand for these steps I'll add them though.
- This guide also assumes that your iOS device and your Wii U are on the same WiFi network.
- I haven't looked into setting up a WiFi Hotspot on iPhone yet so I can't help much with that.

1) Open Cydia and add the following Source: http://ios-webstack.tk/cydia
2) Install the following package from the Source: ios-lighttpd-php-mysql
3) After your device finished the respring open Safari and visit the following URL: http://localhost
4) If you see a example page your server works and is running!
5) Open your Settings App, there should be a new entry called Lighttpd MySQL, tap it and disable both, the MySQL Server and the Lighttpd Sever for now. (Never enable the MySQL server again!)
6) Go to: https://github.com/dimok789/homebrew_launcher/releases on your PC and download the latest webserver files, it should just have a www folder inside the .zip
7) Access the folder /var/www on your iOS device and delete its contents
8) Place everything from inside the www folder you downloaded inside /var/www
9) Enable the Lighttpd Server from the settings again. (Again, don't enable the MySQL Server!)
10) On your Wii U Browser just type in the local IP of you iOS device (for example: 192.168.0.5) and watch the magic happen!
11) As soon as the Homebrew Launcher is loaded, disable the Lighttpd Server again

Notes:
- Never leave the server running all the time and only enable it when you want to load the Homebrew Launcher on the Wii U, disable it again afterwards!
- Leaving the server running anywhere non-stop will not only drain your battery, but also pose a security-risk because hackers can theoretically hack into your device if you run around with a enabled web-server on your phone!
- This is because we never setup security-measures on the server which is fine though, since it's only intended to quickly exploit a Wii U and not run 24/7!
That sounds difficult... Is there a simple website I can go to?
Of course! In fact, there are quite a few!

Firmware Version Required:

Websites:

Visit any of the above websites on your Wii U browser to access the hacks that they have chosen to host!
Note: I'm not responsible for any of these sites. They may contain outdated files. I highly recommend using www.wiiubru.com as it will automatically load the correct exploit and is very dutifully maintained. However, if you have trouble getting any of the sites to load, try another one on the list above.​
START HACKING
Homebrew Launcher
List and launch ELF files located on your SD card or sent through the network. This is the main hub for all of your hacks!
Compatibility:
3.0.0, 3.1.0, 4.0.0, 4.1.0, 5.0.0, 5.1.0, 5.3.2, 5.4.0, 5.5.0, 5.5.1​
Downloads:
Thread:

1. Place at SD:/wiiu/apps/homebrew_launcher/
2. Point your webserver to the www folder included in the download
3. Open the Internet Browser and enter your webserver IP address
Ex: http://192.168.1.238:8080
Note: You can find yours by right-clicking the Mongoose notification icon in Windows​
4. The Homebrew Launcher will run and display all of the hacks that are located at SD:/wiiu/apps/
What about the Kernel Exploit?
The Kernel Exploit is an exploit into the kernel of the system, giving us access to some systems functions for homebrew games/apps. It needs to be ran before any hack; without it, you won't have system permissions to use them. Lucky for us, this is ran automatically every time you run the Homebrew Launcher!
USEFUL HOMEBREW
ddd
Title dumper for code, content, save, aoc, and meta folders. It will automatically generate the cos.xml and app.xml needed by Loadiine when dumping /vol/code.
Compatibility:
Same as HBL​
Downloads:
ddd - Download the latest ddd release as well as titledumper.darwin.vXX.zip, titledumper.linux.x86.vXX.tar.gz, or titledumper.win32.vXX.zip​
Thread:

This section needs some work, i'll get to it soon.

FAQ:
My SD card shows the RPX but no RPL files. Is something wrong?
No, some games don't have RPL files.
I tried to dump Splatoon but it doesn't work. Why not?
Splatoon doesn't work because the 0xA0000000 virtual memory range must be reset to default value.
FTPiiU
Manage your SD card directly from your computer.
Compatibility:
Same as HBL​
Downloads:
FTPiiiU
FTP client (FileZilla)​
Thread:

1. Place at SD:/wiiu/apps/ftpiiu/
2. Run from the Homebrew Launcher
3. Open your FTP client and connect to the IP shown on the TV/GamePad
HID to VPAD
Use USB HID controllers in Wii U games, such as GC adapter, PS3/4 controllers, keyboard, mouse, and more.
Compatibility:
Same as HBL​
Downloads:
Thread:

1. Place at SD:/wiiu/apps/hidtovpad/
2. Run from the Homebrew Launcher
3. You can attach and detach devices at any time, but it may result in a random crash.
Note: When you enter Mii Maker the application will be disabled and HBL will load.​

FAQ:
How are the buttons mapped for the GC-adapter?
Buttons work as you'd expect except for Z. Holding down Z will switch L to gamepad L, R to gamepad R and start to gamepad minus.
Why doesn't my controller work with the game I'm trying to play?
This only patches VPADRead so not every game is supported. Also, the way memory is shared can break newer Wii U games such as Splatoon.
Loadiine GX2
A Wii U game loader via SD with GX2 GUI.
Compatibility:
Same as HBL (NOT all games are working with 4.x)​
Downloads:
Thread:

1. Check the "Official" WiiU Loadiine v1.0 Compatibility Sheet to make sure the game you're trying to run is compatible.
2. Place at SD:/wiiu/apps/loadiine_gx2/
3. Insert the disc of the game you want to use to boot with (if not using Mii Maker mode)
4. Run from the Homebrew Launcher
5. Select your game (Launch Modes can be found in the GUI Settings)
6. If you chose Smash Bros mode and it didn't auto load, exit Mii Maker and then launch Smash Bros. from the Home Menu.
Note: When exiting the game, if you want to play another you must relaunch the Mii Maker and select the other game. If you don't, launching Super Smash Bros will result in a crash.​

FAQ:
My game works, but it doesn't save. Why not?
If you have problems with saves in Smash Bros mode, try deleting your Super Smash Bros. saves. (backup first!)
I launched Super Smash Bros. but it's taking forever to load. Did I do something wrong?
Probably not. Depending on your class of SD card, the load speeds will vary per user. Look for the symbol on your SD card and use the following for a crude guideline of how low you should wait: (Multiply depending on your game size)

Class 2 has a min speed of 2 MB/s. 500MB game = max load time 4 mins 10 seconds.
28px-SDHC_Speed_Class_4.svg.png
Class 4 has a min speed of 4 MB/s. 500MB game = max load time 2 mins 5 seconds.
28px-SDHC_Speed_Class_6.svg.png
Class 6 has a min speed of 6 MB/s. 500MB game = max load time 1 min 23 seconds.
28px-SDHC_Speed_Class_10.svg.png
Class 10 has a min speed of 10 MB/s. 500MB game = max load time 50 seconds.
28px-UHS_Class_1.png
UHS 1 (U1) has a min speed of 10 MB/s. 500MB game = max load time 50 seconds.
28px-UHS_Class_3.png
UHS 3 (U3) has a min speed of 30 MB/s. 500MB game = max load time 17 seconds.
I launched Super Smash Bros. but it froze/crashed! What happened?
If you just exited Super Smash Bros. from playing a game, you have to re-enter Mii Maker and select your game again. If this isn't the case, it means your game may not be compatible. If you're 100% positive it's incompatible, let @thej3ster know at the "Official" WiiU Loadiine v1.0 Compatibility Sheet thread so the sheet can be updated.
Why do I need to use a modified kernel exploit? What's wrong with the original one?
(You need a modified kernel exploit that sets the virtual memory address 0xA0000000 to physical memory address 0x10000000. The official kernel exploit uses 0x31000000.
How do I update my disc games and Loadiine games?
Firmware Version Required:
Same as WUP InstalleR​
Downloads:
JNUSTool (requires Java 8)​
Websites:

Note: Make/keep a backup of your original game files in case something goes wrong!

1. Open the config file in Notepad++, or something similar, and edit the 2nd line to be the hex values of the Common Key (find elsewhere). Then save.
2. Open JNUSTool.jar
3. Select your game. You can change the version number in the dropdown to the right of the title.

For Disc Games:
4. Select Download Encrypted files and wait for it to complete.
5. Copy all files inside the temp_TITLEID folder to SD:\install\
6. Run the Homebrew Launcher and then load WUP Installer it install it

For Loadiine Games:
4. Select Open FST
5. Check the box next to Root and click Download, then wait for it to complete.
6. Copy the TITLE [ID6] folder to SD:\wiiu\games\
How do I create VC games for Loadiine?
0. Dump a VC game of the same system using ddd, or download one from the internet to use as a base.

1. Use the Virtual Console Creator!

NES:
Nothing yet!
SNES:
GBA:
Downloads:

Note: Base games may need to differ depending on their save file type. The Legend of Zelda: Minish Cap seems to work for most of them so far though. Check out the GBA Compatibility Guide.

1. Copy your base game folder, rename it to be the new game name, and create a unique [ID6] for it.
2. Hold shift and right-click in the white space of the "inject_gba-master" folder (not on a file) and select Open Command Window Here
3. Write or paste the following into the command window (first time running only):
Code:
python setup.py install
4. Paste the following into the command window (each rom):
Code:
inject_gba --gui
Note: You can also use it by command line with the following:
Code:
inject_gba --inpsb "alldata.psb.m" --inrom "rom.gba" --outpsb "out\alldata.psb.m

--allow-overwrite and --create-backup options can be added as well.
5. Navigate to and choose your input ROM
6. Navigate to and choose your alldata.psb.m file to be injected into (from copied \content\ folder in Step 1)
7. Choose where you want to store your new alldata.psb.m file (to copied game folder from Step 1)

You will see a message similar to:
Code:
Replacing 'system/roms/ABZMP0.J22.m'
Packing fileinfo struct (289 entries)

8. Move the alldata.psb.m and alldata.bin files to your new game's content folder and overwrite them.
GB Injection into GBA:
Downloads:
Goomba to convert GameBoy games to GBA
Hex editor​

1. Rename your file to rom.gb
2. Download and open Goomba 2.0
3. Select the goomba.gba emulator file
4. Uncheck the "splash screen?" box
5. Make the output filename rom.gba
6. Find the folder with your GB game and click Add to move it to the right side. You can add a bunch of GB games to this emulator if you'd like, but I think it looks nicer to have 1 game per VC title.
7. Click Compile at the bottom
8. Open your rom.gba in a hex editor
9. Scroll to the bottom and pad it with FF until it is 0x00FFFFF long (16,384KB)

Note: an easy way to do this is to put the cursor at the end of the file and then use the "Insert Block..." command to tell it how many bytes to add. Google can tell you how many bytes to pad it with by searching for "0x01000000 - 0xYourOriginalRomSize"

9. Save the file and continue with the normal replacement process.

Note: In my experience, game mods do not work! You'll get a message that says "This game can only be played on a GameBoy Color or GameBoy Advance"
N64:
Note: Check out the N64 Compatibility Guide.
NDS:
Brain Age is the recommended game to use as a base since it has the most screen configuration options.
Check out the NDS Compatibility Guide.
Changing "RenderScale": 2 in the /vol/content/0010/configuration_cafe.json file will make games look much smoother, but you will have to restart the Wii U after quitting the game.

FAQ:
I'm getting a black screen! What am I doing wrong?
Black screen means the game you tried injecting is incompatible with your base game. Try another.
NNU Patcher
Nintendo eShop Update Patcher. Start the Nintendo eShop on a lower firmware, if you are spoofed to the latest one.
Compatibility:
Same as HBL​
Downloads:
Thread:
Note: Make sure you're using Tubehax DNS to keep yourself from updating.

1. Place at SD:/wiiu/apps/nnupatcher/
2. Spoof to the latest FW using WUP Installer
3. Run from the Homebrew Launcher. It should automatically redirect you to the home menu. That's it, you can now use the eShop.
Note: When you enter Mii Maker the application will be disabled and HBL will load.​
Saviine
Dump and inject save files from disc games to use with Loadiine, and vice versa.
Compatibility:
Same as HBL​
Downloads:
Thread:

1. Place at SD:/wiiu/apps/saviine/
2. Back up all of your savedata to USB before using this in case anything goes wrong!
3. Insert the disc of the savedata you want to dump into the Wii U (unless you have eShop version)
4. Run from the Homebrew Launcher

FAQ:
How do I use my dumped savedata with Loadiine?
The file(s) in "saviine_root/dump/[game_title_id]/80000000x (user data)" need to be moved to your "wiiu/saves/<Game Name [ID6]>/80000000x" folder on your SD card. The file(s) in "and/or saviine_root/dump/[game_title_id]/common (common)" need to be moved to your "wiiu/saves/<Game Name [ID6]/common" folder.
Can I inject my Loadiine-played saves back into the Wii U to continue with a disc?
Yes! Follow the injection guide in the Saviine thread.
WUP Installer
Install game updates for disc games, or spoof to latest FW version.

How do I update my disc/eShop games with WUP Installer?
Firmware Version Required:
Same as HBL​
Downloads:
JNUSTool (requires Java 8)
WUP Installer improvement by dimok​
Thread Post:
Note: SD card must be formatted to FAT32. You may want to go to Settings and change your Wii U system sleep to OFF, or at least 2 hours, to prevent it from turning off mid-install!

1. Place at SD:/wiiu/apps/wup installer/
2. Download the update for the game you have
4. Insert an SD card into your PC and format it to FAT32.
5. Create a folder called install on the root of the SD card
6. Copy all files from inside the title folder to the install folder on your SD card ("SD:\install\")
7. Place the SD card into your Wii U
8. Run the HBL and select WUP Installer
9. Once complete, reset the Wii U

Note: You can verify installation by going to System Settings/Data Management.​

FAQ:
I went to Data Management but the update file says Corrupt Data! What do I do?
Delete it and then try your installation again. If that doesn't work, redownload the update, as a file may be corrupt.
I went to Data Management but don't see the update file. Where is it?
Game updates do not show up as separate icons if you bought the eShop version of the game.
How do I spoof my FW to the latest version so I can go online on my disc games?
Compatibility:
Same as WUP Installer​
Downloads:
USA
EUR
JAP
Only use your Wii U's region!​
Thread Post:

FAQ:
Can this be reversed?
NO! We don't know if there will ever be consequences to spoofing. Do so at your own risk!
How can I access the eShop after spoofing?
Use the NNU patcher.
TCP Gecko
Use cheats with Loadiine by poking values into RAM, inject VC games by overwriting entire sections of RAM.

How do I get TCP Gecko to run?
Firmware Version Required:
Same as HBL​
Downloads:
TCP Gecko Client (post)(source)
TCP Gecko for disc games​
Thread Post:
TCP Gecko for disc games​

For Disc Games:
1. Run TCP Gecko via the Homebrew Launcher
2. Launch the game you'd like to play
3. On your PC, open "TCPGeckoClient\Gecko dNet.exe" as administrator (right-click, Run as administrator)
4. Type your Wii U's IP into the connection box on the TCP Gecko Client
Ex: 192.168.1.47​
5. Press Connect (hit ignore on the error)

For Loadiine Games:
1. Run Loadiine via the Homebrew Launcher
2. Make sure pyGecko is enabled in Loadiine's Settings
3. Launch the game you'd like to play
4. On your PC, open "TCPGeckoClient\Gecko dNet.exe" as administrator (right-click, Run as administrator)
5. Type your Wii U's IP into the connection box on the TCP Gecko Client
Ex: 192.168.1.47​
6. Press Connect (hit ignore on the error)

FAQ:
How do I find my Wii U's IP address?
You can find your Wii U's IP address easily on your Wii U.

1. Open the Internet Browser
2. Go to Settings
3. Scroll down and click on Enable Developer Tools
4. Press OK on the popup and Enable on the confirmation

The Wii U's IP address will then be displayed. You can ignore the port. Developer Tools may then be disabled if you choose.
The TCP Gecko Client won't connect to my Wii U. What do I do now?
Make sure you are running as administrator. This is unconfirmed, but try going to "Control Panel\System and Security\Windows Firewall\Allowed apps" and add "gecko dNet.exe," then make sure it has check marks for Private and Public.
How do I extract disc files using TCP Gecko?
Firmware Version Required:
Same as TCP Gecko​
1. Get the TCP Gecko Client to connect.
2. Get to a static menu in the game:
VC Games: Press right trigger to show the VC menu
MK8: Press - at the main menu to get to the Play Stats menu
SSB: Press A on Controls to get to the Controls menu
Hyrule Warriors: Go to the Character Select screen[/B]​
3. Click the FSA tab
4. Click Read FSA[/B]
Note: Wait about 2-10 minutes for the file system to appear (will show Not Responding until then). This will vary greatly depending on your CPU specs. Be patient.
5. Right-click to extract files or folders
Cafiine (Section Needs to be Updated)
Replace files with modified files for disc games

How do I get Cafiine to run?
Firmware Version Required:
3.1.0, 4.1.0, 5.0.0, 5.3.2, 5.4.0​
Downloads:
Websites: (may not contain latest versions)

1. Get the Official Kernel Exploit to run.
2. On your PC, open "C:\WiiU\cafiine12\server\cafiine_server.exe" as administrator (right-click, Run as administrator)
3. Open the Internet Browser
4. Open your bookmark or type your URL (IP+Port) from Mongoose into the URL field (Ex: http://192.168.1.239:8080/)
5. Click Cafiine v1.2 (or navigate to your cafiine folder if not using a root index.html)
6. Set the Cafiine server IP in the application with up/down/left/right, and press A to install Cafiine (should be set to your IP already if you followed steps from the FAQ)[/B]
Note: Wii U will freeze for about 2-5 seconds, then show the home menu settings if it works. If it doesn't work, the TV will go black and the game pad will freeze. Hard reset and start over.​
7. Press Wii U Menu
8. Open your game from disc or one installed to the Wii U's hard drive
9. The Cafiine server on your PC should now show you the files used in the game as they load

FAQ:
The Cafiine server hangs or doesn't list all of the files as they load. What do I do now?
Make sure you're running the server as administrator, and go to "Control Panel\System and Security\Windows Firewall\Allowed apps" and make sure cafiine_server has check marks for Private and Public. Also double check the order you're opening things in. Kexploit -> Server -> Installer.
How do I change the Cafiine IP address to my own so I don't have to scroll so much on the Game Pad?
1).On your PC, open "C:\WiiU\cafiine12\payload532.html" in a text editor (Notepad is fine)
2. Search for:
serverIP if you downloaded the all-in-one package
%uc0a8%u614a%u0064 if you downloaded Cafiine v1.2 separately

3. Replace with a string for the numbers of your IP address in hexadecimal.

Ex: %uc0a8%u614a%u01EF is for my IP address, which is 192.168.1.239.
c0 in hex = 192 in decimal
a8 in hex = 168 in decimal
01 in hex = 1 in decimal
EF in hex = 239 in decimal

You want your IP to be replaced in that string,

Ex: for 192.168.0.17:
192 in decimal = c0 in hex
168 in decimal = a8 in hex
0 in decimal = 00 in hex
17 in decimal = 11 in hex
Your string is %uc0a8%u614a%u0011

Ex: for 10.0.0.3,
10 in decimal = 0a in hex
0 in decimal = 00 in hex
0 in decimal = 00 in hex
3 in decimal = 03 in hex
Your string is %u0a00%u614a%u0003

Replace the string you searched for above with your string and then save it.

When you load Cafiine, the default IP should show your IP and you can simply continue instead of scrolling to enter it.​
How do I dump files with Cafiine?
Firmware Version Required:
3.1.0, 4.1.0, 5.0.0, 5.3.2, 5.4.0​
Websites:

1. Get the Official Kernel Exploit to run.
2. Create a folder in "cafiine12/server/cafiine_root" with the Title ID of the game
3. Create the game folder structure for the file you want
Note: TCP Gecko Read FSA is good for figuring out the folder structure
Ex: 00050000-1010EC00\vol\content\driver\ for the characters in MK8[/B]​
4. Go to the last folder in the series (Ex: "\driver\")
5. Hold Shift and right-click in the folder, choose Open command window here
6. Type fsutil file createnew dummyfile-request 0, where dummyfile is the name of the file you want to dump
Ex: fsutil file createnew Mario.szs-request 0 for Mario in MK8​
7. Start Cafiine
8. When the game goes to load that file, it will dump it to that folder with the name and -dump
Ex: Mario.szs-dump​

FAQ:
When the game gets to the file I want to dump, it freezes! What do I do now?
Use dummyfile-request_slow instead of dummyfile-request in Step 5. This will make the file dump slowly and it may work; no guarantees!
How do I replace files with Cafiine?
Firmware Version Required:
3.1.0, 4.1.0, 5.0.0, 5.3.2, 5.4.0​
Websites:

1. Get the Official Kernel Exploit to run.
2. Create a folder in "cafiine12/server/cafiine_root" with the Title ID of the game
3. Put your edited file in the same directory as the game folder structure
Ex: 00050000-1010EC00\vol\content\driver\Mario.szs to replace Mario in MK8​
4. Start Cafiine
5. When the game goes to load that file, it will use your modified one instead of the one on the disk.
DECRYPTION
How do I use the common key or a title key?
Downloads:

The common key is required to decrypt certain files of the Wii U. It is required to be in the folder of tools that are meant to decrypt their contents.

A title key is specific to each Wii U game and is used to decrypt that game. The title key is usually found packaged with a scene release.

1. Double-click keygen.bat
2. Paste your 16-bit key into the prompt.
3. Rename the created key.bin so that you know what it's for and place it wherever you need it.

FAQ:
I don't get it. Can you give an example?
If the title key of the game I want was 01 23 45 67 89 AB CD EF 00 12 34 56 78 9A BC DE, I'd paste that into the prompt of keygen.bat and it would create a key.bin in the same directory.
How do I get an RPX/RPL(s) and the content folder from a WUD?
Downloads:

You may need to use vgmtoolbox if UWizard doesn't extract the files properly. I will provide guides to both methods here.

UWizard:
1. Make/keep a backup of your original game files in case something goes wrong!
2. Open UWizard and go to the Settings tab
3. Click Import Key next to Wii U Common Key, and then find and open your CommonKey.bin
4. Go to the WUD Manager tab and click Open Wii U Game
5. Click Import under Title Key and then find and open your TitleKey.bin for the opened game (typically found in the NFO)
6. Click Extract Game Files and wait for them to finish

VGMToolbox
1. Make/keep a backup of your original game files in case something goes wrong!
2. Put your Common Key in the "vgmtoolbox_bin_<version>\external\wiiu" folder and rename it to ckey.bin
3. Put your Title Key in the same folder as your WUD and rename it to disckey.bin
4. Open VGMToolbox
5. Expand Misc. Tools/Extraction Tools/Generic/ISO/Archive Extractor
6. Drag your WUD into the white space on the right side and it will load the files
7. Right click on the files or folders you want to extract and click Extract To...

The RPX and RPLs (if it has any) are located in the data/code folder
The content files are located in the data/content folder
GAME HACKS
Mario Kart 8 Trainer
This application has built-in cheating abilities which can be used with a convenient graphical interface.

Splatoon Colorizer
A simple GUI that enables anyone with the ability to install the TCP Gecko code handler on their Wii U to easily change the colors on Splatoon.

XCXGecko: Xenoblade Chronicles X trainer GUI using pyGecko
A simple GUI to make it easier for others to enjoy XCX.

[Compilation] Wii U Save Editors
A compilation of save editors for various games including Bayonetta, Bayonetta 2, Ninja Gaiden 3, Yoshi's Woolly World, Tank! Tank! Tank!
HOMEBREW GAMES
AST-U-ROIDS
A re-creation of the popular arcade game that plays as close to the original as possible.

Space Game
The year is 201X. Hop aboard the H.Y.K.M. interstellar spaceship and defend your precious cargo from the oncoming pirates and naysayers! Use either joystick to move around and dodge enemies, and tap on the screen to fire in the direction of the tap. You are the last hope for the Wii U homebrew scene!

U-Paint
Drawing on the Game Pad with multiple brushes and controls.
CREDITS
Hacking and development:
Marionumber1
NWPlayer123
Mathew_Wi
hykem
Relys
FIX94
smea
golden45
dimok789
Maschell
vgmoose
QuarkTheAwesome
Datalogger

Information and modifications:
TotalInsanity4
EclipseSin
Onion_Knight
nastys
CosmoCortney
hapse
Doumekxkai
Wiiunator
domino-s
Tesa
FoxMcloud5655
the_randomizer
SkyDX
others...
 
Last edited by Cyan, , Reason: Added outdated warning at the top

mariosonicds

Well-Known Member
Member
Joined
Oct 9, 2009
Messages
143
Trophies
0
XP
443
Country
United States
OK idk where to post but trying to read fsa of super smash bros wii u and it crashes when i do a read.... I'm using your tcpgecko which has progressed further than the updated GitHub one.
 

fiveighteen

Distractible Dabbler
OP
Member
Joined
Jun 30, 2008
Messages
1,768
Trophies
1
XP
1,886
Country
United States
Like I said, there are too many versions floating around lol. I'll try to track down which ones I have exactly and then provide the direct links. I came across all of them through the many pages of the Wii U Hacking & Homebrew Discussion thread.

My purpose of this thread also isn't to support every game that has issues in TCPGecko/Cafiine. I have Smash to try testing later, but for the most part nobody should expect me to be able to troubleshoot. :)

Make sure you are somewhere in Smash that is not loading any files... Find a nice static menu screen. You can also try dumping files with Cafiine v1.2 by golden45, but I didn't have any success running it, so my files contain v1.1 at this time.
 
  • Like
Reactions: stsaerox
D

Deleted-355425

Guest
When you say in MK8, is that game required? Only got my wii the other day :P
 

Reecey

Mario 64 (favorite game of all time)
Member
Joined
Mar 7, 2010
Messages
5,867
Trophies
1
Location
At Home :)
XP
3,804
Country
1.3) Create an exception in Windows Defender/Malwarebytes/your virus protection so the exploits don't get quarantined.

This bits a bummer. A bit of advice on this> Windows Defender can be really annoying in fact to the point even if you switch real time protection off, it will run sometimes to clear your windows and even if you make sure you set it to avoid the folders you use for the .html links it still erases them, they will be there but wont work so you have to go about unzipping to the htdocs in xampp folder again for them to work again properly! also make sure you keep a copy of your exploits on an sd card because it will erase your files as well and they wont work even when you unzip to the correct folder. Website apps/blockers such as defender are really quite annoying when it comes to the exploit etc..
 

fiveighteen

Distractible Dabbler
OP
Member
Joined
Jun 30, 2008
Messages
1,768
Trophies
1
XP
1,886
Country
United States
edit: can you re-upload to another cloud service.. even better http://filetrip.net/
I'll make a few mirrors when I'm home from work tonight and find the direct links to the specific files I'm using.

When you say in MK8, is that game required? Only got my wii the other day :P
Mario Kart 8, or any game for that matter, is not required. It was just used as an example. :)

and even if you make sure you set it to avoid the folders you use for the .html links it still erases them, they will be there but wont work so you have to go about unzipping to the htdocs in xampp folder again for them to work again properly!
I agree, it can be frustrating until figuring out how to block them properly. I just created an exception for the entire C:\WiiU\ folder, since I know everything that I put in there will be safe to run anyways.
 
  • Like
Reactions: Flame and Reecey

Reecey

Mario 64 (favorite game of all time)
Member
Joined
Mar 7, 2010
Messages
5,867
Trophies
1
Location
At Home :)
XP
3,804
Country
I'll make a few mirrors when I'm home from work tonight and find the direct links to the specific files I'm using.

Mario Kart 8, or any game for that matter, is not required. It was just used as an example. :)

I agree, it can be frustrating until figuring out how to block them properly. I just created an exception for the entire C:\WiiU\ folder, since I know everything that I put in there will be safe to run anyways.
yeah I tried all this but found myself eventually defender etc. still erases them somehow and they don't work even though they are still present in the folder after the scan finishes. It even somehow erases your files as well.
 

fiveighteen

Distractible Dabbler
OP
Member
Joined
Jun 30, 2008
Messages
1,768
Trophies
1
XP
1,886
Country
United States
yeah I tried all this but found myself eventually defender etc. still erases them somehow and they don't work even though they are still present in the folder after the scan finishes. It even somehow erases your files as well.
I did notice that once before I made my exception. Defender quarantined the HTML file, and even though I went in and told it to "allow" it, the file was blank except for a script header. Always good to keep a backup anyways.. cloud/flash drive/bookmark sources.
 

FR0ZN

Well-Known Member
Member
Joined
Nov 2, 2013
Messages
1,228
Trophies
0
Age
35
XP
2,693
Country
United States
You should show a safe way to install a fakesigned IOS on the vWii ... this blocks the Wii U updates from starting.
 

fiveighteen

Distractible Dabbler
OP
Member
Joined
Jun 30, 2008
Messages
1,768
Trophies
1
XP
1,886
Country
United States
You should show a safe way to install a fakesigned IOS on the vWii ... this blocks the Wii U updates from starting.
Installing a fakesigned IOS on the vWii would be way messier and people would just end up softbricking (or worse). Blocking Nintendo's servers by URL is a much easier solution.

@Flame mirror at FileTrip is up.
 
  • Like
Reactions: Flame

fiveighteen

Distractible Dabbler
OP
Member
Joined
Jun 30, 2008
Messages
1,768
Trophies
1
XP
1,886
Country
United States
Found all original links and posts in which they originated, too. Will try to get Cafiine v1.2 and TCP Gecko FSA with Smash working soon/probably tomorrow.
 

Reecey

Mario 64 (favorite game of all time)
Member
Joined
Mar 7, 2010
Messages
5,867
Trophies
1
Location
At Home :)
XP
3,804
Country
also a tip. I tried mongoose and wamp server but I still found that xampp was the most stable with the self hosting exploit, for some strange reason.
 

MarioBrosThe

Well-Known Member
Member
Joined
Dec 31, 2014
Messages
153
Trophies
0
Age
31
Location
California
XP
189
Country
United States
[/spoiler]
3.1) Double-click on mongoose-free-5.6.exe
3.2) Right click on the Mongoose icon in your status bar
3.3) Click "Set shared directory:"
3.4) Choose the C:\WiiU\ folder
3.5) Right click on Mongoose again and note what the IP and Port of "Go to my address:" is (Ex: http://192.168.1.239:8080/)

I'm stuck on this step, could you explain it a bit more?

EDIT: nvm figured it out
 
Last edited by MarioBrosThe,
  • Like
Reactions: fiveighteen

fiveighteen

Distractible Dabbler
OP
Member
Joined
Jun 30, 2008
Messages
1,768
Trophies
1
XP
1,886
Country
United States
I'm a little confused on the IP to hex thing though, care to help please?
That part is actually optional, but when loading Cafiine you will have to change the default IP to your IP every time, which can be time consuming if your IP differs from the default by a large margin.

Which part are you stuck on? Can you open payload532.html and find %uc0a8%u6129%u01EF? Also, what is your computer's IP address (from Step 3.5)?
 
  • Like
Reactions: MarioBrosThe

MarioBrosThe

Well-Known Member
Member
Joined
Dec 31, 2014
Messages
153
Trophies
0
Age
31
Location
California
XP
189
Country
United States
That part is actually optional, but when loading Cafiine you will have to change the default IP to your IP every time, which can be time consuming if your IP differs from the default by a large margin.

Which part are you stuck on? Can you open payload532.html and find %uc0a8%u6129%u01EF? Also, what is your computer's IP address (from Step 3.5)?
My computers IP is x
 
Last edited by MarioBrosThe,
General chit-chat
Help Users
    KenniesNewName tempBOT: KenniesNewName rolls 1d6 and gets 2 (2).