It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

• A Wii U
• One of the devices listed below
  Note: Any other linux device capable of USB device emulation should work as well.
  Prebuilt releases are only available for the Pico and Zero.
  I will add more devices below which are confirmed to work.

Supported devices:​

• A Raspberry Pi Pico or Zero
• A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

• Download the latest udpih.uf2 from the releases page.
• Hold down the BOOTSEL button on the board and connect the Pico to your PC.
  Your PC will detect the Pi as a storage device.
• Copy the .uf2 file to the Pico. It will disconnect after a few seconds.

The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

• Install the required dependencies:
  

  sudo apt install build-essential raspberrypi-kernel-headers

• Clone the repo:

• git clone https://github.com/GaryOderNichts/udpih.git
  cd udpih

• Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
• Now build the kernel module:

• cd linux
  make

• You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.

The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB Devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
  This timing is important. If you're already in the menu, the exploit won't work..
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[V10lator]

Would anyone mind offering some guidance on my logs?

00:23:14:873: mmc_core card err: idx=3, lba=55514112, blks=640, xfer=0x1, ret=0x00200b40
00:23:14:874: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:23:14:874: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)

Hardware defective eMMC. See https://gbatemp.net/threads/636361/ for how to fix.

 

[SDIO]

31.log:00:23:14:874: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
31.log:00:23:14:927: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
32.log:00:03:14:058: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
32.log:00:03:14:114: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
33.log:00:02:25:447: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/save/00050000/10107f00/meta/meta.xml
33.log:00:02:25:471: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/save/00050000/1010a600/meta/meta.xml
33.log:00:02:25:941: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/save/00050000/10107f00/meta/meta.xml
33.log:00:02:34:406: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
33.log:00:09:58:389: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
33.log:00:09:58:443: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00:00:09:139: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
00:00:09:899: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
35.log:00:00:05:224: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
00:00:05:984: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
36.log:00:00:05:138: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
00:00:05:900: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)

Your eMMC is failing. See https://gbatemp.net/threads/160-0103-error.636361/ for the current fix procedure. Maybe you are lucy and @Lazr1026 still has a NAND-AID over (if you consider using one).

Post automatically merged: Sep 19, 2023

@SgtMcBadass With ISFShax we now also have the option to Upgrade the Internal Storage and rebuilding the MLC completely, so it is 100% error free or to use redNAND to replace the eMMC with that (by using the SD in the front slot. Keep in mind it is still experimental and therefore no complete tutorial exists. Just to give you a feeling here is how you would setup isfshax: https://gbatemp.net/threads/help-re...erely-damaged-wii-u-nand.639411/post-10242927
And then it depends on what you would want to do. For example you could than follow the instructions on how to UPgrade the Storage, where ISFShax would replace defuse.

In case you want to stick to the old proven Procedure you would follow the Tutorial @V10lator and I already linked

 

[Alex_Pirnelli]

Hi all, I've created the account to ask for help to unbrick my Wii U (5.5.5 Japan)

What I did:
Replaced the translation files in the Wii U using FileZilla and some sort of FTP client running on hacked Wii U. The files I uploaded to Wii U are attached in Russian_ver2.zip

What I received:
Loading stops at Wii U logo (but before that happened I saw that the names of the apps were translated in the Main Menu, then I rebooted the console and it's not loaing now)

What I tried:
1) uploaded the UDPIH to Raspberry Pico
2) loaded recovery_menu from jan-hofmeier since the original one from @GaryOderNichts got stuck after 5 seconds
3) dumped the logs (attached here)
4) checked MLC (attached here - saw 3 errors, but I don't think that's an issue since the console was working before the file replacement)
5) started WUPServer, but wupclient.py doesn't start - I used Python 2.7.18 and updated the IP address, but when I try to start the file, nothing happens, just a 1 ms showing of the console screen and that's all (using cmd.exe didn't help too - no output there after starting the file) and I can't find any GUI WUPClients (could you please send me the link to any?)

Please help me - what my next steps are?

 

[SDIO]

@Alex_Pirnelli use jnus tool to download the Home Button Menu (00050030-1001000A) and then install it via the Recovery

java -jar JNUSTool.jar 000500301001000A -dlEncrypted

THIS IS ONLY FOR JPN WII Us

Explanation:
In the logs I can see that the Home Button Menu (HBM) is crashing. Since that is one of the titles that you replaced files from, it's likely that you corrupted that. If reinstalling that title doesn't help, try reinstalling the other titles you replaced files from.

For the MLC Checker: you don't have corruption (on a FS or MEDIA level). The PlayEvent.dat is just already opened in another process by the Wii U. The other two files are from a vWii title, which is a little special.

For the wupserver: use Python3, Python2 is dead. You would need to run it form the command line with

python -i wupclient.py

 

[Alex_Pirnelli]

use jnus tool to download the Home Button Menu (00050030-1001000A) and then install it via the Recovery

java -jar JNUSTool.jar 000500301001000A -dlEncrypted

THIS IS ONLY FOR JPN WII Us

Hi @SDIO thank you for your response, I've received these files:
Do I need to rename the folder to install and put it to the root of the SD card?
Btw I took the Wii U Common Key literally from the video on YouTube - will it affect the app somehow?

 

[SDIO]

Do I need to rename the folder to install and put it to the root of the SD card?

If you use my fork of the recovery, you can just place the whole tmp folder in the install folder. Thats also how you would install multiple titles, just put all the tmp folders there. For the original recovery from gary, you would need to place the files directly in the install folder.

Btw I took the Wii U Common Key literally from the video on YouTube - will it affect the app somehow?

The Wii U Common Key is common to all retail Wii Us, that's why it is called common key. But getting it from the internet is not really legal. The legal way would be to dump the key yourself (can be extracted from the OTP). But for us it doesn't really matter as it is the same key in the end

 

[Alex_Pirnelli]

@SDIO thanks again, awesome explanations really! Could you please point me to the row in the logs about where you see that the Home Button Menu (HBM) is crashing? so I could compare the logs myself later if I'll be able to reinstall the HBM - I'm trying to dump SLC and MLC at least in the current state, will install the app after that

though looks like I'm getting errors dyrung the SLC dump, like right now I see the row
slc = 118032398 / 536870912, res 00000000, error 80
slc_result: -196635
are those real errors or just a dumping info issue?
and the fffcffeb error was on MLC - but I saw that someone had this issue before and it was working after retrying to dump

Btw, looks like Python3 doesn't like the parenthesis at the print function, that's why I use Python2 - to not to try to debug the whole script

 

[V10lator]

looks like Python3 doesn't like the parenthesis at the print function

Sounds like you're using some really, really old version of WUPClient. Use this one:

Spoiler

 

[Alex_Pirnelli]

Sounds like you're using some really, really old version of WUPClient. Use this one:

Spoiler

Awesome, thanks for the update! Actually I found "wupclientgui Mod" in the corresponding thread, but the link (MEGA) was working for the old version only, maybe you have the recent version of this one too?

 

[SDIO]

When I look at the recent logs (21 and before) I see

Core1: Instruction at 0x0E281DC8 (from SRR0) invalid access of 0x93C9B39E (value from DAR)
00;00;12;738: 
--Proc5-Core1--------- OSContext 0x158A4780 --------------------

00;00;12;738: tag1  = 0x4F53436F (expecting 0x4F53436F)
00;00;12;738: tag2  = 0x6E747874 (expecting 0x6E747874)
00;00;12;738: TBR   = 0x00000000_19D832D5
00;00;12;738: CR    = 0x40000022
00;00;12;738: CTR   = 0x0E1E1304
00;00;12;738: LR    = 0x0E24057C hbm|.text+0x281DA8
00;00;12;739: SRR0  = 0x0E281DC8 hbm|.text+0x281DA8
00;00;12;739: SRR1  = 0x0000F072

00;00;12;739: state = 0x0006

00;00;12;739: r0   = 0x00000004 (             4)  r16  = 0x00000000 (             0)
00;00;12;739: r1   = 0x158a3c58 (     361380952)  r17  = 0x00000000 (             0)
00;00;12;739: r2   = 0x1050a200 (     273719808)  r18  = 0x00000000 (             0)
00;00;12;739: r3   = 0x00000001 (             1)  r19  = 0x00000000 (             0)
00;00;12;739: r4   = 0x93c9b39e (   -1815497826)  r20  = 0x10581f50 (     274210640)
00;00;12;739: r5   = 0x00000010 (            16)  r21  = 0x00000000 (             0)
00;00;12;739: r6   = 0x01000000 (      16777216)  r22  = 0x00000001 (             1)
00;00;12;739: r7   = 0x00ffffff (      16777215)  r23  = 0x01000001 (      16777217)
00;00;12;739: r8   = 0x00000001 (             1)  r24  = 0x12368123 (     305561891)
00;00;12;739: r9   = 0x00000000 (             0)  r25  = 0x000000c8 (           200)
00;00;12;739: r10  = 0x00000001 (             1)  r26  = 0x00000001 (             1)
00;00;12;739: r11  = 0x10543b38 (     273955640)  r27  = 0x00000118 (           280)
00;00;12;739: r12  = 0x00000000 (             0)  r28  = 0x118ba100 (     294363392)
00;00;12;739: r13  = 0x1050a200 (     273719808)  r29  = 0x00000004 (             4)
00;00;12;739: r14  = 0x00000000 (             0)  r30  = 0x93c9b39a (   -1815497830)
00;00;12;739: r15  = 0x00000000 (             0)  r31  = 0x0e1e1304 (     236851972)
00;00;12;739: 
--Stack Trace--------------------------
00;00;12;739: 
Address:      Back Chain    LR Save
00;00;12;739: 0x158a3c58:   0x158a3c70    0x158a3ed4 <unknown>+0x0
00;00;12;740: 0x158a3c70:   0x158a3d30    0x0e24057c hbm|.text+0x24055c
00;00;12;740: 0x158a3d30:   0x158a3e08    0x0e246854 hbm|.text+0x246834
00;00;12;740: 0x158a3e08:   0x158a4400    0x0e24fbc0 hbm|.text+0x24fba0
00;00;12;740: 0x158a4400:   0x158a4410    0x0e23d7b4 hbm|.text+0x23d794
00;00;12;740: 0x158a4410:   0x158a4458    0x0e223450 hbm|.text+0x223430
00;00;12;740: 0x158a4458:   0x158a4588    0x0e03ca7c hbm|.text+0x3ca5c
00;00;12;740: 0x158a4588:   0x158a46d0    0x0e03d444 hbm|.text+0x3d424
00;00;12;740: 0x158a46d0:   0x158a4700    0x0e03e934 hbm|.text+0x3e914
00;00;12;740: 0x158a4700:   0x158a4728    0x0e1d3ebc hbm|.text+0x1d3e9c
00;00;12;740: 0x158a4728:   0x158a4738    0x0e1eb6ccINFO: nn::ipc avoided busy close on /dev/acp_main (moduleId = 301, tag = 0) from pid = 19
 hbm|.text+0x1eb6ac
00;00;12;740: 0x158a4738:   0x158a4748    0x0e1ec1f4 hbm|.text+0x1ec1d4
00;00;12;740: 0x158a4748:   0x158a4760    0x0103c494 coreinit.rpl|__OSTestAssistReadPhysical32+0x6c
00;00;12;740: 0x158a4760:   0x00000000    0x01041d6c coreinit.rpl|OSCheckThreadStackUsage+0xb0
00;00;12;740: 

00;00;12;747: KiCblRegisterBlocks() completed with status 0:-4.
Process 5, Error 0xCAFEBADD
***HBM exiting when not in shutdown.  This is not supported.

The errors during the SLC dump are expected

 

[Alex_Pirnelli]

The errors during the SLC dump are expected

Is it something I need to worry about or it's because of HBM not working? Thanks for the answer in advabce, looks like MLC dump will take way more lot of time, so I'll continue working on the un-bricking in the morning, thanks again for your help!

 

[SDIO]

You shouldn't worry about the errors during slc dump. They have nothing to do with the HBM.

 

[Danook28]

@SDIO
OK so I installed a DIY mlc SD-adapter and flashed my dump to a 32GB card.
The mlc_checker.txt seems to have A LOT of corrupted titles in vol/storage_mlc01/sys/title/ (if that's what the log is saying?)

According to the 160-0103 error guide I can use wup installer in @V10lator's recovery menu to fix these. Fingers crossed!

The red wier GND????

 

[Alex_Pirnelli]

hi @SDIO after reinstalling the HBM the cosole finally unbricked and loaded and it has the apps working on russian (except the HBM itself but it doesn't matter at all) I replaced files for (at least the System Settings app), many thanks for your help! I'll continue checking if the apps are working fine

 

[Portal2038]

Hello everyone!
I have a similar situation with Alex_Pirnelli. I bricked my console when I tried to change the language from Japanese to English..
But the situation is even worse because I don't see the recovery menu (look at the photo).
However I'm guessing it's working because the LED light is purple so at least I can navigate the menu blindly.

What I've done::
1. java -jar JNUSTool.jar 000500301001000A -dlEncrypted and got some files (tmp_000500301001000A) (look at pic2)
2. Got logs from SD card
3. I prepared SD with recovery_menu_dc_init (because recovery_menu doesn't work for me and IDK why)
3. I prepared Rasberry Pi Pico using udpih.uf2 file

Questions:
1. How can I backup the current state? What do I need to click and how long do I need to wait?
2. Does this code (000500301001000A) work for my console? I have a Japanese WiiU.
3. Can you help me with next steps please?
I guess I should put all files from tmp_000500301001000A to SD://install/ and click Install WUP in recovery menu. Am I right?

 

[SDIO]

How can I backup the current state? What do I need to click and how long do I need to wait?

Tbh I don't think it is worth the hassle in the current state.

Does this code (000500301001000A) work for my console? I have a Japanese WiiU.

Yes but I am not sure if that is the corrupted title. I looked through the logs, but I don't see the crash. I would suggest you start with that title and if that doesn't help you try 00050010-10040000

I guess I should put all files from tmp_000500301001000A to SD://install/ and click Install WUP in recovery menu. Am I right?

Yes

 

[Portal2038]

Thank you for answer @SDIO!
I tried install WUP (put the files on SD, pressed on Eject 6 times, pressed on Power 1 time, waited for 5 minutes). It didn't help. Perhaps I pressed the buttons incorrectly because I was doing it blindly. Did I have to press Power multiple times?

Yes but I am not sure if that is the corrupted title. I looked through the logs, but I don't see the crash. I would suggest you start with that title and if that doesn't help you try 00050010-10040000

I also tried to Set Coldboot Title – 00050010-10040000 option (pressed on Power 1 time, pressed on Eject 1 time, pressed on Power 1 time, waited 2-3 minutes). I didn't help too.

By the way, there is nothing new in the logs.. And no new symptoms: just stack on WiiU logo on gamepad and TV.

I will be glad for any new advice.

 

[SDIO]

I thought you had display output when using the DC init recovery?

 

[Portal2038]

I thought you had display output when using the DC init recovery?

Unfortunately no..
I'll try gary and jan-hofmeier recovery menu. And none of them display the recovery menu.

I even tried connecting a component wire - in this case there would be no picture on TV at all.
recovery_menu_dc_init worked a little bit different: instead of the WiiU logo there is garbage on the screen, so I select it.

 

[SDIO]

Try installing the other title I gave you the ID of. (The system menu)