It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

• A Wii U
• One of the devices listed below
  Note: Any other linux device capable of USB device emulation should work as well.
  Prebuilt releases are only available for the Pico and Zero.
  I will add more devices below which are confirmed to work.

Supported devices:​

• A Raspberry Pi Pico or Zero
• A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

• Download the latest udpih.uf2 from the releases page.
• Hold down the BOOTSEL button on the board and connect the Pico to your PC.
  Your PC will detect the Pi as a storage device.
• Copy the .uf2 file to the Pico. It will disconnect after a few seconds.

The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

• Install the required dependencies:
  

  sudo apt install build-essential raspberrypi-kernel-headers

• Clone the repo:

• git clone https://github.com/GaryOderNichts/udpih.git
  cd udpih

• Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
• Now build the kernel module:

• cd linux
  make

• You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.

The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB Devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
  This timing is important. If you're already in the menu, the exploit won't work..
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[MXRD4K1LL4]

I'm curious, does this allow region changing or changing the wii u japanese menu to english?

Yes, but consoles would maybe not work normally if you don't put the original version, i could maybe try this, unless maybe someone else tried?

 

[ploggy]

Haha I just realised I've been @ some poor random guy called gary LOL

@GaryOderNichts my Pico has turned up and I've flashed the udpih file to it but I'm still not able to get the RPX Replacement working
The Launch.rpx file, it can be ANY rpx file renamed to launch.rpx right? it's not a specific launch.rpx file that I'm not seeing somewhere?

 

[GaryOderNichts]

Haha I just realised I've been @ some poor random guy called gary LOL

@GaryOderNichts my Pico has turned up and I've flashed the udpih file to it but I'm still not able to get the RPX Replacement working
The Launch.rpx file, it can be ANY rpx file renamed to launch.rpx right? it's not a specific launch.rpx file that I'm not seeing somewhere?

Any rpx named launch.rpx should at least load, yeah.

 

[ychh0]

Hello

I have trouble in starting wupserver.
network.cfg in ANSI format is properly saved to the root of SD and Network Configuration seems to be loaded properly. Several configurations including with/without password and different SSID names were tried but couldn’t get network connection.

Currently I have trouble with initializing Wii U (different system language files were overwritten and it hangs up when initializing screen resolution.) I wonder if starting wupserver function does not work before finalizing initialization. If I get network connection I expect to restore system language files with original ones.

Thanks

 

[GaryOderNichts]

Hello

I have trouble in starting wupserver.
network.cfg in ANSI format is properly saved to the root of SD and Network Configuration seems to be loaded properly. Several configurations including with/without password and different SSID names were tried but couldn’t get network connection.

Currently I have trouble with initializing Wii U (different system language files were overwritten and it hangs up when initializing screen resolution.) I wonder if starting wupserver function does not work before finalizing initialization. If I get network connection I expect to restore system language files with original ones.

Thanks

Make sure you save the file with unix line endings (LF) and not Windows line endings (CRLF).

 

[ychh0]

Make sure you save the file with unix line endings (LF) and not Windows line endings (CRLF).

Thanks. After changing file type from CRLF to LF using notepad++, wupserver started without problem.
Now I'm trying to copy some of original system files in "storage_mlc" folder from PC to "storage_mlc01" folder of Wii U but I couldn't find how to.
To restore Wii U, those system files should be replaced with original ones. Could you let me know how to do using wupclient mod gui?
And I wonder if it's possible to use FTP after launching recovery mode.

Thanks

 

[V10lator]

I wonder if it's possible to use FTP after launching recovery mode.

Feature request: Integrated HBL.

 

[christianacqua]

How to use wupserver? i never used that i can't find any tutorials

 

[MXRD4K1LL4]

How to use wupserver? i never used that i can't find any tutorials

What do you want to do with wupserver first?

 

[GaryOderNichts]

How to use wupserver? i never used that i can't find any tutorials

Could you let me know how to do using wupclient mod gui?

I started writing a wiki page for wupclient usage here.

 

[christianacqua]

What do you want to do with wupserver first?

Just in case of a mlc brick

 

[BaamAlex]

Just in case of a mlc brick

Just don't poke around the file system or delete some system related files and you should be safe. I mean, it is not wrong to have a backup, but still. Use the console like she is intended to and you have nothing to worry about.

 

[DIXES]

I have a mlc (hynix) bricked Wii U (given by a friend), I can't launch the previous installed Haxchi channel, even System Settings won't be opened either now.
But Internet Browser seems to be opened normally, is there a method let me configure Wi-Fi settings using wupclient via udpih?

 

[MXRD4K1LL4]

I have a mlc (hynix) bricked Wii U (given by a friend), I can't launch the previous installed Haxchi channel, even System Settings won't be opened either now.
But Internet Browser seems to be opened normally, is there a method let me configure Wi-Fi settings using wupclient via udpih?

It's possible, but i don't personally know how with wupserver.

 

[DIXES]

I tried using rpx_replacement method to boot Homebrew Launcher (renamed its rpx file to launch.rpx and put in root of sdcard) successfully, but when I choose to load the homebrew, WiiU Nand Dumper (I just want to try it on this mlc bricked unit), it failed to load then back to homebrew launcher screen.

Is it possible setup a redNand for mlc bricked via some homebrew?

 

[CMDreamer]

This might allow me to recover my bricked Wii U with NAND issues by using WupServer? (Like making a NAND backup and then replacing/reinstalling "possible" Wii U packages/apps?).

Up to which level of edition allowance does UDPIH has for a Wii U's NAND?

Also, is there a way to edit/modify a NAND backup to test it for fixes and then, when successful, restore it into the Wii U?

 

[christianacqua]

This might allow me to recover my bricked Wii U with NAND issues by using WupServer? (Like making a NAND backup and then replacing/reinstalling "possible" Wii U packages/apps?).

Up to which level of edition allowance does UDPIH has for a Wii U's NAND?

Also, is there a way to edit/modify a NAND backup to test it for fixes and then, when successful, restore it into the Wii U?

how did u brick ur wiiu?

 

[CMDreamer]

how did u brick ur wiiu?

Don't know how it got bricked, I've buyed it like that. But I'd like to fix it (if possible) and learn in the process (even if it's not fixable).

Can do a hardmod without any problem, I know microsoldering and all that stuff, just don't know much about the software -how does it work- part of it.

 

[V10lator]

@CMDreamer first step would be to grab logs from the console, so we can look if software or hardware brick (a lot of Hynix MLC chips are dying lately).
Can't tell you how to use WUPServer/WUPClient but the logs are at slc:/logs/.

 

[CMDreamer]

@V10lator Thanks a lot for the advice! Will get into it asap.