UDPIH: USB Host Stack exploit + Recovery Menu

It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

  • A Wii U
  • One of the devices listed below
    Note: Any other linux device capable of USB device emulation should work as well.
    Prebuilt releases are only available for the Pico and Zero.
    I will add more devices below which are confirmed to work.

Supported devices:​

  • A Raspberry Pi Pico or Zero
  • A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

  • Download the latest udpih.uf2 from the releases page.
  • Hold down the BOOTSEL button on the board and connect the Pico to your PC.
    Your PC will detect the Pi as a storage device.
  • Copy the .uf2 file to the Pico. It will disconnect after a few seconds.
The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

  • Install the required dependencies:
    Bash:
    sudo apt install build-essential raspberrypi-kernel-headers
  • Clone the repo:
  • Bash:
    git clone https://github.com/GaryOderNichts/udpih.git
    cd udpih
  • Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
  • Now build the kernel module:
  • Bash:
    cd linux
    make
  • You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.
The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

warning
Important notes for this to work:
  • Make sure no other USB Devices are attached to the console.
  • Only use USB ports on the front of the console, the back ports will not work.
  • If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.
  • Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
  • Insert the SD Card into the console and power it on.
  • As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
    This timing is important. If you're already in the menu, the exploit won't work..
  • After a few seconds you should be in the recovery menu.
So what's this recovery menu? The recovery menu allows you to fix several bricks:
screenshot

Wii U Recovery Menu

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title​

Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

  • Wii U Menu (JPN) - 00050010-10040000
  • Wii U Menu (USA) - 00050010-10040100
  • Wii U Menu (EUR) - 00050010-10040200

Dump Syslogs​

Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM​

Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver​

Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration​

Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

Code:
type=eth
For using wifi:

Code:
type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Displays DRC Pin​

Displays the Gamepad Pin used for pairing the gamepad.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.

Install WUP​

Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Credits​

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!
 
Last edited by GaryOderNichts,

BaamAlex

Rülpsen ist Alpha
Member
Joined
Jul 23, 2018
Messages
4,965
Trophies
1
Age
27
Location
Lampukistan
Website
hmpg.net
XP
4,468
Country
Germany
I have a 256GB, but I would agree that it's a major pain getting into the recovery menu. sometimes it doesn't work, sometimes black screen, sometimes a garbled message. I think you need to put it in when it says Nintendo on the gamepad, but it's hard to time when you don't really know when to put it in. when the wiiu text displays on the tv screen seems to be too late.
So it would theoretically better to use my 64gb again? With this it worked like a charm.
 
  • Like
Reactions: godreborn

godreborn

Welcome to the Machine
Member
Joined
Oct 10, 2009
Messages
31,499
Trophies
2
XP
20,945
Country
United States
So it would theoretically better to use my 64gb again? With this it worked like a charm.
I don't know. I didn't have difficulty the first time, but I had major difficulty the second. I just wanted to see if it worked, not use it, since I've never bricked a wiiu.
 

lolorlofl

Well-Known Member
Member
Joined
May 10, 2008
Messages
108
Trophies
0
Website
Visit site
XP
524
Country
Canada
This is awesome! I'm going to try this on a Wii U I have in an odd state. When it boots up it immediately loads the System Update menu, then it crashes completely after a few seconds. When I try this out I will upload the logs to see what exactly is going on with it.

If you're taking feature suggestions, would it be possible to add the functionality to download and reinstall the system firmware from within the app instead of going through the system menu?
 
  • Like
Reactions: godreborn

kaputnik

Well-Known Member
Member
Joined
Sep 10, 2007
Messages
215
Trophies
0
XP
832
Country
Sweden
Wonderful to see the old Wii U still is getting some love. Ordered a Pi Pico just to try this out :D

If I could wish for a feature, it would be NAND dumping (writing is not possible, right?) from the recovery menu. Would be incredibly handy paired with an easy to use exploit like this :)
 

BaamAlex

Rülpsen ist Alpha
Member
Joined
Jul 23, 2018
Messages
4,965
Trophies
1
Age
27
Location
Lampukistan
Website
hmpg.net
XP
4,468
Country
Germany
Wonderful to see the old Wii U still is getting some love. Ordered a Pi Pico just to try this out :D

If I could wish for a feature, it would be NAND dumping (writing is not possible, right?) from the recovery menu. Would be incredibly handy paired with an easy to use exploit like this :)
You can already dump the nand? Not with the recovery menu, but possible.
 

marsuwill752

Well-Known Member
Member
Joined
Jan 17, 2022
Messages
104
Trophies
0
Age
22
XP
226
Country
Canada
Wonderful to see the old Wii U still is getting some love. Ordered a Pi Pico just to try this out :D

If I could wish for a feature, it would be NAND dumping (writing is not possible, right?) from the recovery menu. Would be incredibly handy paired with an easy to use exploit like this :)
You can with wupserver. But I don't know exactly how.
 
  • Like
Reactions: Jiba

jacobsson

Well-Known Member
Member
Joined
Oct 30, 2019
Messages
140
Trophies
0
Age
36
XP
648
Country
Sweden
The exploit seems to do it's thing (no errors) but it's stuck on the wiiu logo. Can't seem get it to display the menu.
I guess it's totally FUBAR?
 
Last edited by jacobsson,

abal1000x

Member
Newcomer
Joined
Jun 5, 2022
Messages
9
Trophies
0
Age
41
Location
indonesia
XP
45
Country
Indonesia
I have 2 Wiiu, one ok and one bricked.

I try to understand the error from the bricked log and compare it both.
But i realize the max is always 99.log. And the md5 is always same, means its the same file.

Does it means there are no further error,
or its just the cafe os doesn't record more than 99,
or recovery_menu only dump the first 99 log only?


In the menu there are the options to install Coldboot Title.
Is it safe to install US Coldboot Title in Japan console, and switch to it?

Is it also safe to reinstall other 'System Title' from the title downloaded from Nus Server?
 
Last edited by abal1000x,

GaryOderNichts

Well-Known Member
OP
Member
Joined
Aug 9, 2018
Messages
644
Trophies
1
XP
3,838
Country
Germany
The exploit seems to do it's thing (no errors) but it's stuck on the wiiu logo. Can't seem get it to display the menu.
I guess it's totally FUBAR?
Make sure all other USB devices are unplugged. Also try performing the exploit from a fully cold state, by removing the power plug first.
Does it means there are no further error,
or its just the cafe os doesn't record more than 99,
or recovery_menu only dump the first 99 log only?
After reaching 99.log the console starts again at 1. Open up the log files and check the date of the log.
In the menu there are the options to install Coldboot Title.
Is it safe to install US Coldboot Title in Japan console, and switch to it?
If you install a coldboot title the console will automatically switch to it.
You can't boot into a menu of a different region though.
 

jacobsson

Well-Known Member
Member
Joined
Oct 30, 2019
Messages
140
Trophies
0
Age
36
XP
648
Country
Sweden
@GaryOderNichts
Thanks, I gave it some more tries from a cold boot state to no avail.
Have you ever encountered a system that can't reach the recovery menu?
I'll have to assume it's a bad NAND, which I presume is a RIP.
 
Last edited by jacobsson,

N7Kopper

Proud lover of a three-inch girlfriend
Member
Joined
Aug 24, 2014
Messages
857
Trophies
0
Age
29
XP
1,101
Country
United Kingdom
If you install a coldboot title the console will automatically switch to it.
You can't boot into a menu of a different region though.
It should go without saying, but some people don't understand things like this, so I'll say:

Don't set a coldboot title that your Wii U cannot boot without sigpatches and region-free! We don't have permanent exploits, you need to pwn it every boot. Just use Tiramisu.
 
General chit-chat
Help Users
  • No one is chatting at the moment.
    KenniesNewName @ KenniesNewName: Elvis movie is really good