It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

• A Wii U
• One of the devices listed below
  Note: Any other linux device capable of USB device emulation should work as well.
  Prebuilt releases are only available for the Pico and Zero.
  I will add more devices below which are confirmed to work.

Supported devices:​

• A Raspberry Pi Pico or Zero
• A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

• Download the latest udpih.uf2 from the releases page.
• Hold down the BOOTSEL button on the board and connect the Pico to your PC.
  Your PC will detect the Pi as a storage device.
• Copy the .uf2 file to the Pico. It will disconnect after a few seconds.

The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

• Install the required dependencies:
  

  sudo apt install build-essential raspberrypi-kernel-headers

• Clone the repo:

• git clone https://github.com/GaryOderNichts/udpih.git
  cd udpih

• Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
• Now build the kernel module:

• cd linux
  make

• You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.

The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB Devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
  This timing is important. If you're already in the menu, the exploit won't work..
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[SDIO]

can you show a picture how well it lines up with the pads? If the cpper in the holes goes over the pads, than this could maybe be easy enough to solder but may be even prevent accidental shorts to the neighboring pad

 

[fringle]

can you show a picture how well it lines up with the pads? If the cpper in the holes goes over the pads, than this could maybe be easy enough to solder but may be even prevent accidental shorts to the neighboring pad

I will do that once I take the Wii U apart. Hopefully next week when I have time. I'm being hopeful the one I'm going to install it on doesn't have the capacitor to remove. Going to install it and de_fuse all in one shot and probably leave de_fuse attached permanently. Will attempt to make an access door out of the bottom vent door when standing vertically.

 

[fringle]

Decided to rip apart the console. Didn't install anything but here are some pictures with it lined up.

 

[SDIO]

Ok that should still be good. The eMMC clk might require a little more work to fill the gap, but in most cases it isn't needed anyway

 

[Jehmyson]

Please...
Can someoney tell me if this method can solve the error: 160-1400/160-1402?

 

[BaamAlex]

Please...
Can someoney tell me if this method can solve the error: 160-1400/160-1402?

These errors are disc drive related.

 

[SDIO]

Please...
Can someoney tell me if this method can solve the error: 160-1400/160-1402?

Probably not. But there is a common error with some resistors on the disc drives data lines, which can cause that error. In the worst case we can disable the disc drive in the seeprom, then you can still use the console, but without disc drive.
Have a look here: https://gbatemp.net/threads/absolute-fix-to-160-1400-error.572879/

 

[Ysecond]

Please...
Can someoney tell me if this method can solve the error: 160-1400/160-1402?

If prompted 160-1400, it means console cannot find disk drive, there are three situations that can cause:
1, The motherboard circuit fails, as SDIO said, have a look here: https://gbatemp.net/threads/absolute-fix-to-160-1400-error.572879/ ,Check CM9 CM10.
2, It may just be that the FPC connection is unstable, please reconnect.
3, The disk drive is dead.
If you replace the disk drive，prompted 160-1402，it means console say：I don't know this disk drive, it's not part of me.
But we can confirm that this is not the motherboard or FPC fault.

 

[Jehmyson]

Nice to know my device still has hope! Thanks guys!!!

 

[jacobsson]

Hi guys! Long time no post. What do you think about this guy, is it a goner?
The log shows some:

FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path null)

And I receive the infamous 160-0103 during the mii creation process. Hynix memory btw.

 

[SDIO]

It only says DATA CORRUPTION ERROR but no MEDIA ERROR so far, so it doesn't need to be a bad eMMC. But seeing that it is a hynix from 2012, it's not to unlikely that the MLC is failing.

Have a look here: https://gbatemp.net/threads/using-nand-aid-to-replace-a-hardware-damaged-mlc-160-0103-error.636361/
Do the dump and post the log from the dump, that wil tell us more about the state of the MLC.

 

[jacobsson]

It only says DATA CORRUPTION ERROR but no MEDIA ERROR so far, so it doesn't need to be a bad eMMC. But seeing that it is a hynix from 2012, it's not to unlikely that the MLC is failing.

Have a look here: https://gbatemp.net/threads/using-nand-aid-to-replace-a-hardware-damaged-mlc-160-0103-error.636361/
Do the dump and post the log from the dump, that wil tell us more about the state of the MLC.

Thanks! Annoyingly the only SD card that would boot the recovery meny is an old 4GB one, all other cards just freezes the menu or turn off the console.

EDIT1: Got the SLC dumped, for now all I can get you at the moment is the slc log.

EDIT2: found a 32GB card that boots the menu, now will the slc + mlc dump fit is the question.

 

[SDIO]

You need a 64 gb card, but formatted as FAT32 to dump the MLC. You can use guiformat for that.

With the 32GB card you could use dump slc + clone mlc function. But then we won't get a log for the mlc, so the only output would be whats on the screen for that.

 

[Coolandmore]

is it possible to use an arduino instead of a pico

 

[fringle]

is it possible to use an arduino instead of a pico

Supported devices:​

• A Raspberry Pi Pico or Zero
• A Nintendo Switch capable of running udpih_nxpayload

Taken from https://github.com/GaryOderNichts/udpih
Maybe it's possible but I don't think it so unless you could port the source yourself.

 

[jacobsson]

You need a 64 gb card, but formatted as FAT32 to dump the MLC. You can use guiformat for that.

With the 32GB card you could use dump slc + clone mlc function. But then we won't get a log for the mlc, so the only output would be whats on the screen for that.

dammit... I can't get my system to boot the menu with most of my cards. I'll come back when I found something that works

 

[SDIO]

Make sure they are formatted correctly. Use guiformat

 

[jacobsson]

Make sure they are formatted correctly. Use guiformat

For some reason GUIFormat didn't do it for me on several attempts on multiple cardss (I used 32K).
Turns out if you have an old PSP laying around, that xmb format utility seems to do it
I'm dumping my SLC + MLC onto a 64GB card now. I'll be back with the logs.

Post automatically merged: Aug 6, 2023

@SDIO
The dump process has results for both SLC and MLC now, but now it seems like it on round 2 dumping the SLC again.
Is this bugged or intentional in order to compare two passes?

 

[SDIO]

The SLC dump has some problems, so don't worry about the errors there's dumping it twice is intentional.

The errors on the MLC on the other hand should worry you. So it looks like the eMMC has problems and should be replaced

 

[jacobsson]

The SLC dump has some problems, so don't worry about the errors there's dumping it twice is intentional.

The errors on the MLC on the other hand should worry you. So it looks like the eMMC has problems and should be replaced

Cool. So I guess an SD-eMMC mod is justified here? I don't mind doing some micro soldering.

EDIT: oh and here are the SLC and MLC logs