UDPIH: USB Host Stack exploit + Recovery Menu

It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

  • A Wii U
  • One of the devices listed below
    Note: Any other linux device capable of USB device emulation should work as well.
    Prebuilt releases are only available for the Pico and Zero.
    I will add more devices below which are confirmed to work.

Supported devices:​

  • A Raspberry Pi Pico or Zero
  • A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

  • Download the latest udpih.uf2 from the releases page.
  • Hold down the BOOTSEL button on the board and connect the Pico to your PC.
    Your PC will detect the Pi as a storage device.
  • Copy the .uf2 file to the Pico. It will disconnect after a few seconds.
The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

  • Install the required dependencies:
    Bash:
    sudo apt install build-essential raspberrypi-kernel-headers
  • Clone the repo:
  • Bash:
    git clone https://github.com/GaryOderNichts/udpih.git
    cd udpih
  • Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
  • Now build the kernel module:
  • Bash:
    cd linux
    make
  • You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.
The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

warning
Important notes for this to work:
  • Make sure no other USB Devices are attached to the console.
  • Only use USB ports on the front of the console, the back ports will not work.
  • If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.
  • Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
  • Insert the SD Card into the console and power it on.
  • As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
    This timing is important. If you're already in the menu, the exploit won't work..
  • After a few seconds you should be in the recovery menu.
So what's this recovery menu? The recovery menu allows you to fix several bricks:
screenshot

Wii U Recovery Menu

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title​

Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

  • Wii U Menu (JPN) - 00050010-10040000
  • Wii U Menu (USA) - 00050010-10040100
  • Wii U Menu (EUR) - 00050010-10040200

Dump Syslogs​

Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM​

Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver​

Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration​

Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

Code:
type=eth
For using wifi:

Code:
type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Displays DRC Pin​

Displays the Gamepad Pin used for pairing the gamepad.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.

Install WUP​

Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Credits​

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!
 
Last edited by GaryOderNichts,

ploggy

WAKA! WAKA!
Member
Joined
Aug 29, 2007
Messages
4,357
Trophies
1
XP
6,340
Country
United Kingdom
It would be pretty petty for Nintendo to release an update now that nerfs all the exploits, especially since they were the ones that killed the WiiU.
 

Trashfire

New Member
Newbie
Joined
Jun 15, 2022
Messages
1
Trophies
0
Age
19
Location
Somewhere
XP
2
Country
Antarctica
So does this exploit work with Wii Us that are connected using AV? (gamepad isn't synced so I can't use that)

It turns off like it's supposed to if I don't have the SD card in, but with it in, it remains on the Wii U logo.

And if it doesn't support AV, would it be too much an ask to get a build compiled that changes coldboot to USA Wii U menu and then powers off?
 

BaamAlex

Rülpsen ist Alpha
Member
Joined
Jul 23, 2018
Messages
4,966
Trophies
1
Age
27
Location
Lampukistan
Website
hmpg.net
XP
4,470
Country
Germany
So does this exploit work with Wii Us that are connected using AV? (gamepad isn't synced so I can't use that)

It turns off like it's supposed to if I don't have the SD card in, but with it in, it remains on the Wii U logo.

And if it doesn't support AV, would it be too much an ask to get a build compiled that changes coldboot to USA Wii U menu and then powers off?
For the case it wouldn't support av...where is the problem to get an hdmi cable? A few posts earlier is a build which "supports" tv output. Otherwise you can navigate blind through the menu using this issue.
 

leseratte

Wiimmfi Team
Member
Joined
Jun 2, 2012
Messages
440
Trophies
0
XP
1,629
Country
Germany
Have you ever checked if the Wii might be vulnerable to the same / a similar exploit? That could be useful to fix a bunch of 003-bricked or bannerbricked Wii consoles, too, if that's the case.
 

GaryOderNichts

Well-Known Member
OP
Member
Joined
Aug 9, 2018
Messages
645
Trophies
1
XP
3,840
Country
Germany
Have you ever checked if the Wii might be vulnerable to the same / a similar exploit? That could be useful to fix a bunch of 003-bricked or bannerbricked Wii consoles, too, if that's the case.
From checking IOS58's EHCI and OHCI0 module with my limited Wii knowledge it seems like the vulnerability is not present there.
As far as I know Fullmetal5 also confirmed this.
 

N7Kopper

Proud lover of a three-inch girlfriend
Member
Joined
Aug 24, 2014
Messages
857
Trophies
0
Age
29
XP
1,101
Country
United Kingdom
From checking IOS58's EHCI and OHCI0 module with my limited Wii knowledge it seems like the vulnerability is not present there.
As far as I know Fullmetal5 also confirmed this.
Isn't the sysmenu IOS 80 (for 4.3 anyway, and there's no reason not to be on that these days), not 58? Don't think the USB code is different enough for the vuln, mind.
 

syboo

New Member
Newbie
Joined
Jun 17, 2022
Messages
2
Trophies
0
Location
London
XP
14
Country
United Kingdom
My bad, network.cfg was created in UTF8 it must be in ANSI. Solved.

After that, i download parent.xml file ("/vol/system/proc/prefs/parent.xml"), search for pin_code, and finally i have my console again!

Forget mkey site, if you don't have internet on in your Wii U, this is the easy way.

Thanks for @GaryOderNichts
@GaryOderNichts what an amazing tool that you created ! You saved my Wiiu :)
I try to set up a wup server but with no skills... would you be able to send me a network.cfg file or drive me to a step by step quick tuto? Thanks again.
 

syboo

New Member
Newbie
Joined
Jun 17, 2022
Messages
2
Trophies
0
Location
London
XP
14
Country
United Kingdom
My bad, network.cfg was created in UTF8 it must be in ANSI. Solved.

After that, i download parent.xml file ("/vol/system/proc/prefs/parent.xml"), search for pin_code, and finally i have my console again!

Forget mkey site, if you don't have internet on in your Wii U, this is the easy way.

Thanks for @GaryOderNichts
@GaryOderNichts what an amazing tool that you created ! You saved my Wiiu :)
I try to set up a wup server but with no skills... would you be able to send me a network.cfg file or drive me to a step by step quick tuto? Thanks again.
 

Girtana1

Well-Known Member
Member
Joined
Jun 22, 2016
Messages
103
Trophies
0
Age
42
Location
New York
XP
678
Country
United States
Wow this is awesome, gives me reason to dust off my WiiU after all these years :)
Thank you very much for forking hekate with this as that's much more practical for me, is there or will there be any way of running Mocha or applying other patches with this though?
 
  • Like
Reactions: Kopimist

Mc123

Member
Newcomer
Joined
Jan 29, 2018
Messages
11
Trophies
0
Age
26
XP
126
Country
Canada
Would it be possible to use this to directly load Homebrew Launcher or another homebrew app? Maybe even use this to directly load RedNAND.
 
  • Like
Reactions: Kopimist

GaryOderNichts

Well-Known Member
OP
Member
Joined
Aug 9, 2018
Messages
645
Trophies
1
XP
3,840
Country
Germany
Wow this is awesome, gives me reason to dust off my WiiU after all these years :)
Thank you very much for forking hekate with this as that's much more practical for me, is there or will there be any way of running Mocha or applying other patches with this though?
Would it be possible to use this to directly load Homebrew Launcher or another homebrew app? Maybe even use this to directly load RedNAND.
This is mostly meant for unbricking, booting into homebrew or mocha is not a planned feature.
RedNAND would be interesting for people with dead MLCs though.
 

meeeow

Well-Known Member
Newcomer
Joined
Aug 21, 2021
Messages
74
Trophies
0
XP
323
Country
Germany
So, in principle, would it be possible to load a MLC backup (e.g., dumped via NandDumper) in case you do not have a RedNAND on a SD card already (which I have but have never used it)?

edit:
okay, I checked it: sdio nand manager can write a dump to SD card, thus creating a RedNAND...
 

CMDreamer

Well-Known Member
Member
Joined
Oct 29, 2014
Messages
1,178
Trophies
0
Age
37
XP
2,277
Country
Mexico
Wow, Gary implements a feature many people asked for and this is your reply? Just buy a PI zero / pico for $5 in case you don't own a unpatched switch. 🤦
Now this is also too expensive for you? Then just pretend this USB exploit doesn't exist. It's really not Garys fault for hardware costing money.

//EDIT: Seriously, why do people like you show no respect to developers doing all this in their free time but want more and more instead? Gary had no reason to even release this to the public, could have opened a Wii U repair business and asking $100 just for executing the exploit on your console instead. Is this what you want? All open source devs feeling pissed so they stop doing things for free?

And that's why I added this guy to my ignored users' list. I don't care about whatever he has to say. I recommend you to do the same.

*On topic*
This method has so many possibilities, and if you're (anyone) not able to see it like so, then you should do something else. One thing it is missing though is the possibility to make a NAND dump, hope we get it soon -if possible at all-.
 

Attachments

  • Firefox_Screenshot_2022-06-19T14-07-42.855Z.png
    Firefox_Screenshot_2022-06-19T14-07-42.855Z.png
    6.2 KB · Views: 17

godreborn

Welcome to the Machine
Member
Joined
Oct 10, 2009
Messages
31,504
Trophies
2
XP
20,963
Country
United States
@GaryOderNichts is it possible that the size of the sd card is important? The thing is, I can't boot the recovery menu anymore with my pico. And i have a 400GB card in the console.
I have a 256GB, but I would agree that it's a major pain getting into the recovery menu. sometimes it doesn't work, sometimes black screen, sometimes a garbled message. I think you need to put it in when it says Nintendo on the gamepad, but it's hard to time when you don't really know when to put it in. when the wiiu text displays on the tv screen seems to be too late.
 
General chit-chat
Help Users
  • No one is chatting at the moment.
    KenniesNewName @ KenniesNewName: Bout to get me a new washer and dryer if my bank approves my loan