It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Supported devices:​

• Raspberry Pi Pico (W) / Pico 2 (W)
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

• Raspberry Pi Pico / Pico 2
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
  This timing is important. If you're already in the menu, the exploit won't work.
  Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
  If you get no video output or a distorted screen, your timing was most likely wrong.
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[pumpkinpies]

oh hell ya - bought a used wiiu awhile ago and it was already bricked so wrote that one off.

but just now got it booting again - this is awesome !

Thanks OP !

now to figure out what i need to do to get it hacked in a good way.

Not sure what hack this had in the first place as all i see on the home menu is Super Smash Bros for Wiiu and Splatoon.

Is Tiramisu the latest and greatest CFW to use these days and I am I okay to just follow the guide without doing anything else ?

The console is on 5.5.3U - is it okay stay on this or should i update to the latest ?

 

[gilgamed]

Hi all, hoping you can help an absolute newbie to all of this - forum and github. I have a bricked, completely unmodded WiiU Deluxe (and therefore no backups) which occurred during the official update to 5.5.6. I no longer get a WiiU screen, it's just black. I do hear it booting and the disc drive spinning up. I have the normal red and blue lights. My gamepad gives the normal "could not connect to the console" error, and the device no longer connects to wifi. I've also tried a LAN adapter and changing the battery.

Am I doing this correctly?
1. I've flashed udpih.uf2 onto an RPi Pico
2. The SD card in my WiiU has one file, recovery_menu (renamed from recovery_menu_dc_init since I have display issues). Not sure if I need all the other files listed in the recovery_menu documentation like the ios_kernel, or if I'm supposed to try and build the dockerfile?
3. Since I don't get a WiiU menu icon in the first place, I've been trying to plug in the Pico based off of the disc drive sound I hear in the videos. There's two disc spinup sounds, then another set of two. I've tried inbetween 2 and 3, 2 and 4, and shortly after
4. There's no change in LED color to purple to indicate the recovery menu is running, and no change in display (HDMI to tv).

I have the exact same problem as you. Trying to access the menu via sound but no luck.

Post automatically merged: Oct 12, 2022

Hi all, hoping you can help an absolute newbie to all of this - forum and github. I have a bricked, completely unmodded WiiU Deluxe (and therefore no backups) which occurred during the official update to 5.5.6. I no longer get a WiiU screen, it's just black. I do hear it booting and the disc drive spinning up. I have the normal red and blue lights. My gamepad gives the normal "could not connect to the console" error, and the device no longer connects to wifi. I've also tried a LAN adapter and changing the battery.

Am I doing this correctly?
1. I've flashed udpih.uf2 onto an RPi Pico
2. The SD card in my WiiU has one file, recovery_menu (renamed from recovery_menu_dc_init since I have display issues). Not sure if I need all the other files listed in the recovery_menu documentation like the ios_kernel, or if I'm supposed to try and build the dockerfile?
3. Since I don't get a WiiU menu icon in the first place, I've been trying to plug in the Pico based off of the disc drive sound I hear in the videos. There's two disc spinup sounds, then another set of two. I've tried inbetween 2 and 3, 2 and 4, and shortly after
4. There's no change in LED color to purple to indicate the recovery menu is running, and no change in display (HDMI to tv).

Hey, guys, I'm having the exact have issue. My dad turned the Wii U off during the 5.5.6 update (98% complete as he told me) and now the Wii U turns on but no TV signal and the gamepad won't connect. I tried booting the recovery menu but it's really hard since I only have the disc drive sound to use as reference and I'm not sure how close to the Wii U logo I am since I can't see it.

Do you guys think the recovery menu will even work in this case? Should I keep trying to get the timing right? I saw some people booting the menu blind but my lights don't change from blue to purple so I suppose I'm still missing the timing.

 

[pumpkinpies]

i have a wii u that apparently was turned off while updating (not mine when this happened) and the wii u logo comes up but just hangs there.

I have tried to get into the recovery menu but have not been successful yet - is there any other option available ?

 

[BaamAlex]

is there any other option available ?

What exactly do you want to hear now? There are three ways. Either with a switch console, a rasp pico or rasp zero

 

[GaryOderNichts]

i have a wii u that apparently was turned off while updating (not mine when this happened) and the wii u logo comes up but just hangs there.

I have tried to get into the recovery menu but have not been successful yet - is there any other option available ?

Does the power LED change color? Does the console power off if you don't have an SD card inserted?
Make sure you don't have any other USB devices plugged in an are using the front ports.

 

[pumpkinpies]

What exactly do you want to hear now? There are three ways. Either with a switch console, a rasp pico or rasp zero

i did try with a pico - i was hoping for another way to unbrick the console.

maybe this thread isnt the right place to ask

 

[BaamAlex]

i did try with a pico - i was hoping for another way to unbrick the console.

maybe this thread isnt the right place to ask

Do you use the front usb ports? Are all usb devices unplugged?

 

[pumpkinpies]

Does the power LED change color? Does the console power off if you don't have an SD card inserted?
Make sure you don't have any other USB devices plugged in an are using the front ports.

ok so i just tried it again and the recovery menu came up but the power and eject buttons were not responding. i did notice the led light turned kind of purple.

so i tried again many times due to the timing and noticed the led button turning purple again but my tv was not receiving a signal so not sure what to do now

 

[uklee28]

I cannot get this to work I've tied all kinds of timing and triple checked instruction and comment and every time I plug it in the Wii u shuts off almost immediately I have set up the Pico and a fat32 card and it does not work on my normal Wii or my cbhc bricked one and also tried multiple sd cards

 

[GaryOderNichts]

I cannot get this to work I've tied all kinds of timing and triple checked instruction and comment and every time I plug it in the Wii u shuts off almost immediately I have set up the Pico and a fat32 card and it does not work on my normal Wii or my cbhc bricked one and also tried multiple sd cards

Power off means it can't load the recovery_menu file from the SD Card.
Make sure the SD is FAT32 MBR and the file is called "recovery_menu" without any extension, and is placed on the root.

 

[uklee28]

Power off means it can't load the recovery_menu file from the SD Card.
Make sure the SD is FAT32 MBR and the file is called "recovery_menu" without any extension, and is placed on the root.

hi sorry for late reply and thanks for that i tried reformatting the card again but this time set it to primary instead of logical and it worked kind of i now get a purple light on the front but no picture? im using hdmi

 

[GaryOderNichts]

hi sorry for late reply and thanks for that i tried reformatting the card again but this time set it to primary instead of logical and it worked kind of i now get a purple light on the front but no picture? im using hdmi

That's progress, your console is now in the menu at least.
Try using the recovery_menu_dc_init build by renaming it to recovery_menu.
If that also doesn't work you might be able to navigate the menu blindly based on the screenshot on the first page.

 

[uklee28]

That's progress, your console is now in the menu at least.
Try using the recovery_menu_dc_init build by renaming it to recovery_menu.
If that also doesn't work you might be able to navigate the menu blindly based on the screenshot on the first page.

yes i connected it to my good console and the menu showed on the gamepad so learnt to navigate and set boot title for my cbhc bricked console which i stupidly formatted last year lol now i have two working consoles and it only cost me £6! thank again for your help

 

[CrazySquid]

OMG, I MANAGED TO UNBRICK MY CONSOLE. After more than 1 month of trying... I did it.


...And I can't believe it, but the problem was on Mii Maker. The folder had the app, but the .rpx was gone, alongside the meta folder... which is pretty weird because NOT in my sane juice I would mess with it, this app is not useless like, say, Nintendo TVii. Plus I know that the app was used for HBL.


I honestly don't know what happened because I'm fairly sure I didn't mess with Mii Maker, and even if somehow I choose that folder instead of TVii or Wii U Chat, I would have deleted the whole thing without leaving any file behind.

If you ask how the heck I figured out the problem was on Mii Maker, it's because I had a NAND backup from 2018 and other from 2020. I dumped my current state NAND using wupserver (was a pain in the ass, the transfer speeds were terribly slow, also a lot of crashes), then I decrypted my backuped MLC, and finally I compared both my current NAND files and the old backup, using WinMerge to check files integrity. After installing Mii Maker again... bom, console booted again.

Man, I can't believe I finally have my console working again, I was a freaking month and half thinking on this that I even dreamed with my Wii U lmao.

Just a warning, I think this happened because I used WiiUFtpServer by Laf111, while I can't say for sure his app was the culprit or not, this NEVER happened to me before... which makes me believe it might had been.
I messed with FTP a lot of times, plus, I never touched Mii Maker on my own, I'm fairly sure I deleted the WHOLE TVii and Wii U Chat folders. Nothing more.
So yeah, at least on my side, I'm back to using FTPiiU and WinSCP, I have never got issues with those two aside from having to reconnect from time to time. Besides I'm trying Aroma and has a native FTPiiU plugin maintended by Maschell

Thanks a lot Gary for this app, my Wii U would be in the trash bin if it weren't by you and your recovery menu, really, thanks a lot!

Wish someday the Wii U scene to advance to the point of having a Wii-like brick protection, ala BootMii as boot2 where you could just restore your NAND and everything is dandy again.

That's my experience, hope it helps someone out there.

 

[GaryOderNichts]

OMG, I MANAGED TO UNBRICK MY CONSOLE. After more than 1 month of trying... I did it.


...And I can't believe it, but the problem was on Mii Maker. The folder had the app, but the .rpx was gone, alongside the meta folder... which is pretty weird because NOT in my sane juice I would mess with it, this app is not useless like, say, Nintendo TVii. Plus I know that the app was used for HBL.


I honestly don't know what happened because I'm fairly sure I didn't mess with Mii Maker, and even if somehow I choose that folder instead of TVii or Wii U Chat, I would have deleted the whole thing without leaving any file behind.

If you ask how the heck I figured out the problem was on Mii Maker, it's because I had a NAND backup from 2018 and other from 2020. I dumped my current state NAND using wupserver (was a pain in the ass, the transfer speeds were terribly slow, also a lot of crashes), then I decrypted my backuped MLC, and finally I compared both my current NAND files and the old backup, using WinMerge to check files integrity. After installing Mii Maker again... bom, console booted again.

Man, I can't believe I finally have my console working again, I was a freaking month and half thinking on this that I even dreamed with my Wii U lmao.

Just a warning, I think this happened because I used WiiUFtpServer by Laf111, while I can't say for sure his app was the culprit or not, this NEVER happened to me before... which makes me believe it might had been.
I messed with FTP a lot of times, plus, I never touched Mii Maker on my own, I'm fairly sure I deleted the WHOLE TVii and Wii U Chat folders. Nothing more.
So yeah, at least on my side, I'm back to using FTPiiU and WinSCP, I have never got issues with those two aside from having to reconnect from time to time. Besides I'm trying Aroma and has a native FTPiiU plugin maintended by Maschell

Thanks a lot Gary for this app, my Wii U would be in the trash bin if it weren't by you and your recovery menu, really, thanks a lot!

Wish someday the Wii U scene to advance to the point of having a Wii-like brick protection, ala BootMii as boot2 where you could just restore your NAND and everything is dandy again.

That's my experience, hope it helps someone out there.

Awesome! Thanks for letting me know.
Interesting how HBM seems to crash without Mii Maker, I didn't know that was a thing.

 

[AleksandrSychev]

Hi. My console hangs on the recovery menu. What could be the problem? After 5-6 seconds the menu freezes.

 

[Halleys-queiroz]

My Wii u just turns off, i tried everything, but it doesn’t load the file in sd card

 

[pumpkinpies]

That's progress, your console is now in the menu at least.
Try using the recovery_menu_dc_init build by renaming it to recovery_menu.
If that also doesn't work you might be able to navigate the menu blindly based on the screenshot on the first page.

Hi - i seem to be having the same problem, unit seems to get into the recovery menu as the front led turns purple but i am not getting a picture.

I tried using the recovery_menu_dc_init build and rename it to recovery_menu but am still getting the black screen.

Is there any other suggestions for me to try ?

I could try to navigate the menu blindly but i dont really know what I should be choosing.

From what i understand the unit bricked while doing an update so what would i choose in the menu ? This is a CDN/US model.

 

[viledisgorgement]

My Wii u just turns off, i tried everything, but it doesn’t load the file in sd card

I'm having this problem as well, swapped cables, tried on both a Pico and my hacked switch. Every time it shows successful the Wii U just powers off. Anyone have any ideas?

 

[GaryOderNichts]

I'm having this problem as well, swapped cables, tried on both a Pico and my hacked switch. Every time it shows successful the Wii U just powers off. Anyone have any ideas?

Try a different SD. Make sure there is no dirt in the SD Card slot.