UDPIH: USB Host Stack exploit + Recovery Menu

It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

  • A Wii U
  • One of the devices listed below
    Note: Any other linux device capable of USB device emulation should work as well.
    Prebuilt releases are only available for the Pico and Zero.
    I will add more devices below which are confirmed to work.

Supported devices:​

  • A Raspberry Pi Pico or Zero
  • A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

  • Download the latest udpih.uf2 from the releases page.
  • Hold down the BOOTSEL button on the board and connect the Pico to your PC.
    Your PC will detect the Pi as a storage device.
  • Copy the .uf2 file to the Pico. It will disconnect after a few seconds.
The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

  • Install the required dependencies:
    Bash:
    sudo apt install build-essential raspberrypi-kernel-headers
  • Clone the repo:
  • Bash:
    git clone https://github.com/GaryOderNichts/udpih.git
    cd udpih
  • Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
  • Now build the kernel module:
  • Bash:
    cd linux
    make
  • You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.
The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

warning
Important notes for this to work:
  • Make sure no other USB Devices are attached to the console.
  • Only use USB ports on the front of the console, the back ports will not work.
  • If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.
  • Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
  • Insert the SD Card into the console and power it on.
  • As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
    This timing is important. If you're already in the menu, the exploit won't work..
  • After a few seconds you should be in the recovery menu.
So what's this recovery menu? The recovery menu allows you to fix several bricks:
screenshot

Wii U Recovery Menu

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title​

Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

  • Wii U Menu (JPN) - 00050010-10040000
  • Wii U Menu (USA) - 00050010-10040100
  • Wii U Menu (EUR) - 00050010-10040200

Dump Syslogs​

Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM​

Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver​

Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration​

Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

Code:
type=eth
For using wifi:

Code:
type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Displays DRC Pin​

Displays the Gamepad Pin used for pairing the gamepad.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.

Install WUP​

Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Credits​

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!
 
Last edited by GaryOderNichts,

V10lator

Well-Known Member
Member
Joined
Apr 21, 2019
Messages
1,123
Trophies
1
Age
34
XP
2,616
Country
Germany
there shouldn't be any problems when you set the "wrong" coldboot title.
Except that your Wii U is bricked! When you can't boot into whatever you setted as coldboot there's no way out:
  • Tiramisu (or any other CFW) isn't loaded yet.
  • UDPIH needs the pairing menu which isn't avaiable that early.
Really, don't underastimate this issue and play with the coldboot option lazily, IT WILL BRICK YOUR WII U BEYOND REPAIR !

//EDIT: @GaryOderNichts you might want to add a big disclaimer before allowing someone to change the coldboot title.
 
  • Like
Reactions: Girtana1

GaryOderNichts

Well-Known Member
OP
Member
Joined
Aug 9, 2018
Messages
644
Trophies
1
XP
3,830
Country
Germany
After the purchase, I decided to reset the console. The attachment turned out to be stitched. Then I got this error
Sounds like a dying MLC chip. This is a hardware and there is no permanent workaround that can be done at the moment.
To be sure can you attach the logs here?
 

GaryOderNichts

Well-Known Member
OP
Member
Joined
Aug 9, 2018
Messages
644
Trophies
1
XP
3,830
Country
Germany
Code:
00:00:21:133: mmc_core card err: idx=3, lba=55432192, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:530: mmc_core card err: idx=3, lba=55443456, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:575: mmc_core card err: idx=3, lba=55443456, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:575: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:21:625: mmc_core card err: idx=3, lba=55444480, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:685: mmc_core card err: idx=3, lba=55444480, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:686: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:21:686: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00:00:21:729: mmc_core card err: idx=3, lba=55443456, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:770: mmc_core card err: idx=3, lba=55443456, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:770: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:21:821: mmc_core card err: idx=3, lba=55444480, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:878: mmc_core card err: idx=3, lba=55444480, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:878: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:21:878: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00;00;21;758: FS: READ_FILE      upid:[ 2] sts:[MEDIA_ERROR] hnd:[0x3b805ad] dst:[0x3d526140] size:[1] cnt:[1048576] pos:[0]
00;00;21;758: SystemFatal(core1)
This is a dying MLC, which is a hardware issue.
Interestingly it's always HYNIX chips dying lately.
 

Cool_all

Member
Newcomer
Joined
Jun 29, 2022
Messages
9
Trophies
0
Age
28
Location
Russia
XP
9
Country
Russia
Code:
00:00:21:133: mmc_core card err: idx=3, lba=55432192, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:530: mmc_core card err: idx=3, lba=55443456, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:575: mmc_core card err: idx=3, lba=55443456, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:575: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:21:625: mmc_core card err: idx=3, lba=55444480, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:685: mmc_core card err: idx=3, lba=55444480, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:686: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:21:686: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00:00:21:729: mmc_core card err: idx=3, lba=55443456, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:770: mmc_core card err: idx=3, lba=55443456, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:770: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:21:821: mmc_core card err: idx=3, lba=55444480, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:878: mmc_core card err: idx=3, lba=55444480, blks=1024, xfer=0x1, ret=0x00200b40
00:00:21:878: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:21:878: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00;00;21;758: FS: READ_FILE      upid:[ 2] sts:[MEDIA_ERROR] hnd:[0x3b805ad] dst:[0x3d526140] size:[1] cnt:[1048576] pos:[0]
00;00;21;758: SystemFatal(core1)
This is a dying MLC, which is a hardware issue.
Interestingly it's always HYNIX chips dying lately.
can something be done with this?
 

abal1000x

Member
Newcomer
Joined
Jun 5, 2022
Messages
9
Trophies
0
Age
41
Location
indonesia
XP
44
Country
Indonesia
In router world we just need to replace the nand with the alternative which we coould easily find on aliexpress.
I am still new on this WiiU, are there no alternatives for WiiU nand chip?
 

godreborn

Welcome to the Machine
Member
Joined
Oct 10, 2009
Messages
31,318
Trophies
2
XP
20,799
Country
United States
In router world we just need to replace the nand with the alternative which we coould easily find on aliexpress.
I am still new on this WiiU, are there no alternatives for WiiU nand chip?
from what I understand, the problem is there's no way to clone the contents of one flash chip to another, so I don't think it will work. however, I don't know for sure.
 

marsuwill752

Well-Known Member
Newcomer
Joined
Jan 17, 2022
Messages
82
Trophies
0
Age
22
XP
171
Country
Canada
Except that your Wii U is bricked! When you can't boot into whatever you setted as coldboot there's no way out:
  • Tiramisu (or any other CFW) isn't loaded yet.
  • UDPIH needs the pairing menu which isn't avaiable that early.
Really, don't underastimate this issue and play with the coldboot option lazily, IT WILL BRICK YOUR WII U BEYOND REPAIR !

//EDIT: @GaryOderNichts you
It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

  • A Wii U
  • One of the devices listed below
    Note: Any other linux device capable of USB device emulation should work as well.
    Prebuilt releases are only available for the Pico and Zero.
    I will add more devices below which are confirmed to work.

Supported devices:​

  • A Raspberry Pi Pico or Zero
  • A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

  • Download the latest udpih.uf2 from the releases page.
  • Hold down the BOOTSEL button on the board and connect the Pico to your PC.
    Your PC will detect the Pi as a storage device.
  • Copy the .uf2 file to the Pico. It will disconnect after a few seconds.
The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

  • Install the required dependencies:
    Bash:
    sudo apt install build-essential raspberrypi-kernel-headers
  • Clone the repo:
  • Bash:
    git clone https://github.com/GaryOderNichts/udpih.git
    cd udpih
  • Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
  • Now build the kernel module:
  • Bash:
    cd linux
    make
  • You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.
The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​


  • Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
  • Insert the SD Card into the console and power it on.
  • As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
    This timing is important. If you're already in the menu, the exploit won't work..
  • After a few seconds you should be in the recovery menu.
So what's this recovery menu? The recovery menu allows you to fix several bricks:
screenshot

Wii U Recovery Menu

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title​

Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

  • Wii U Menu (JPN) - 00050010-10040000
  • Wii U Menu (USA) - 00050010-10040100
  • Wii U Menu (EUR) - 00050010-10040200

Dump Syslogs​

Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM​

Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver​

Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration​

Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

Code:
type=eth
For using wifi:

Code:
type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Displays DRC Pin​

Displays the Gamepad Pin used for pairing the gamepad.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.

Install WUP​

Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Credits​

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!
The tv don't show anything and the error stay on the gamepad when i put the pico
 
Last edited by marsuwill752,
General chit-chat
Help Users
  • No one is chatting at the moment.
    DEMONGreninjaPG @ DEMONGreninjaPG: what?