It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Supported devices:​

• Raspberry Pi Pico (W) / Pico 2 (W)
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

• Raspberry Pi Pico / Pico 2
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
  This timing is important. If you're already in the menu, the exploit won't work.
  Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
  If you get no video output or a distorted screen, your timing was most likely wrong.
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[Lazr1026]

but I'm not able to boot into the recovery menu.

How are you sure you arent able to boot it? does the Power LED stay blue or does it become purple?

The late TV might be an issue (also the Nintendo logo is only on the gamepad). What I do is plug in the pico right after the disc check and it works every time.

 

[GammaGulp]

How are you sure you arent able to boot it? does the Power LED stay blue or does it become purple?

The late TV might be an issue (also the Nintendo logo is only on the gamepad). What I do is plug in the pico right after the disc check and it works every time.

Yes, the power LED stays blue. I think I will need to try on a different display just to be safe. Also, there is no GamePad connected to either bricked Wii U console. Hoping that doesn't matter?

 

[Lazr1026]

Yes, the power LED stays blue. I think I will need to try on a different display just to be safe. Also, there is no GamePad connected to either bricked Wii U console. Hoping that doesn't matter?

Have you tried plugging in the pico a little earlier? Timing for pico is earlier than the others.

whether a GamePad is connected or not wont affect this

 

[dustinrue]

I don't remember if the behavior of the disc drive changed or not between firmware versions but for my 5.5.5 system it gives me one really quick sound, followed by a longer sound and then a final short sound. Split second after the sound stops is when I insert the pico. I had some issues initially with it being unable to load the software from the sdcard though and had to reseat it

 

[Sombersnow]

Hello @GaryOderNichts,
I tried your UDPIH recovery menu for my wii u, it did not work.
My wii u has been bricked for around 7 years, how? Well i went on Miiverse for the first time and it froze, i waited for the gamepad to run out of battery and unplugged the console. when i switched on the console it had a solid blue light and the disk drive would spin swice, it would not connect to the tv nor the gamepad (which was working perfectly fine).

Do you have any solutions?
Did i do the UDPIH steps wrong?

A response would be greatly appreciated.

 

[Black_1986]

i tried this on tow wii u my and get inset shutdown used 2 differt sd reader and sd i cant get recovery menu or any thing on working wii u and one with error 160-0103 any help

 

[Lazr1026]

i tried this on tow wii u my and get inset shutdown used 2 differt sd reader and sd i cant get recovery menu or any thing on working wii u and one with error 160-0103 any help

The SD Cards are FAT32 right?

 

[Black_1986]

The SD Cards are FAT32 right?

yes sure and working on my wii u(working one) with all apps formatted thin but file on root

 

[Lazr1026]

yes sure and working on my wii u(working one) with all apps formatted thin but file on root

does the file have an extension like ".bin"? if yes, remove it. the file must be exactly "recovery_menu"

 

[Black_1986]

does the file have an extension like ".bin"? if yes, remove it. the file must be exactly "recovery_menu"

no extension and try multy recovry_menu files from the site for tv only or not change name but not work

 

[GammaGulp]

Have you tried plugging in the pico a little earlier? Timing for pico is earlier than the others.

whether a GamePad is connected or not wont affect this

Yes I've tried plugging it in earlier with no luck. The timing is still very confusing to figure out, though.

Another issue is the HDMI signal. I feel like it displays the Wii U logo too late / much after the sound of the disc drive. This applies to the 4KTV, BenQ monitor, and internal capture card I've tried. Perhaps I should try connecting with an analog signal like composite or component.

 

[Deleted member 586536]

Yes I've tried plugging it in earlier with no luck. The timing is still very confusing to figure out, though.

Another issue is the HDMI signal. I feel like it displays the Wii U logo too late / much after the sound of the disc drive. This applies to the 4KTV, BenQ monitor, and internal capture card I've tried. Perhaps I should try connecting with an analog signal like composite or component.

If you can try seeing if you can force the rgb range to 0-235. Reason I say this is to increase the speed the monitor picks up the signal. As otherwise it tries to autodetect it which takes a little bit more time.
I have a benq2710 monitor, and that's how I got it to pick up faster.

 

[Deekman15]

Is it possible to do this on a Wii U that isn't synced? I am constantly getting the message that says that it "Could not connect to the Wii U console". The gamepad also boots to the quick start menu when turned on which might also be why I can't do this.

 

[godreborn]

Is it possible to do this on a Wii U that isn't synced? I am constantly getting the message that says that it "Could not connect to the Wii U console". The gamepad also boots to the quick start menu when turned on which might also be why I can't do this.

yes, buttons are controlled by the buttons on the console itself.

 

[Deekman15]

yes, buttons are controlled by the buttons on the console itself.

thanks. I'm also running into the issue where the Wii U isnt displaying on my TV. Can I simply just guess when Im supposed to run the UDPIH gadget?

 

[godreborn]

best way is to watch when it appears on the gamepad. that's when I insert the cable. as for not displaying on the tv, I think other people have had this problem, and there's a patch to fix it. if you insert too the cable too late, it either won't work or you'll have a garbled recovery menu. the timing is very specific. I didn't brick my wiiu, but I bought a pico just in case, and I tested it. not just cbhc brick can be fixed with it either. I think parental controls can be reset, and you can access the system software through wup in case you bricked with say a menu that got corrupted.

 

[Deekman15]

best way is to watch when it appears on the gamepad. that's when I insert the cable. as for not displaying on the tv, I think other people have had this problem, and there's a patch to fix it. if you insert too the cable too late, it either won't work or you'll have a garbled recovery menu. the timing is very specific. I didn't brick my wiiu, but I bought a pico just in case, and I tested it. not just cbhc brick can be fixed with it either. I think parental controls can be reset, and you can access the system software through wup in case you bricked with say a menu that got corrupted.

So my Wii U gamepad only displays the quick start menu and I cannot access anything else because it cant connect.

One thing I noticed which is odd is that when I do inject the UDPIH at the right time, it says that it is Finished however it turns my Wii U off for some reason which ruins the connection between the gamepad and console, preventing me from doing anything.

 

[godreborn]

dunno. sounds like a hardware problem though. @GaryOderNichts ?

 

[GaryOderNichts]

Power Off means unable to load the recovery_menu from the SD. Either not FAT32, MBR or wrong filename.

 

[fadafwet]

Hi

I just finis readning all 28 pages of this topic in hope I would find solution to my problem using this great tool you made.
is it possible to know what are the options for those os us who can get into the menu (with the purple light) but cannot see anything on the tv screen not the gamepad.

Which version display on the tv and which on the gamepad
would that help to plug other cable than the hdmi on the console

Are the version on this page any different that the main ones ?
https://github.com/GaryOderNichts/recovery_menu/issues/3

I have try
this file recovery_menu_dc_init (renamed) or that file recovery_menu version 0.4 but I have same thing black screen or white garbage on tv (which seem to be when the menu is loading)
Since my gamepad is in sync with the console If I can get a version that load the menu on the gamepad I think I would work for us who have this issue

I have also try on 2 differents tv (HD and 4K) would that help to try another one ?

Any help would be greatly appreciated
Thank you