It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Supported devices:​

• Raspberry Pi Pico (W) / Pico 2 (W)
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

• Raspberry Pi Pico / Pico 2
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
  This timing is important. If you're already in the menu, the exploit won't work.
  Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
  If you get no video output or a distorted screen, your timing was most likely wrong.
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[ToothyNom]

@GaryOderNichts is there a way i could check? I am using Mac but it shouldn't affect anything. Pico disconnects after copying the file, and SD card is also formatted and works in 3ds, not sure what else it could be

 

[BaamAlex]

Pico disconnects after copying the file

That's pretty normal. Read the instructions...

 

[Gliitch]

FAT32 format ?
Show us the inside of your SD card.
Try using the pico on a windows laptop

 

[ToothyNom]

@BaamAlex sorry for the lack of clarity that was me saying it probably works. I got thonny installed with MicroPython and ran a sample code just to make sure it really works and it does.

@Gliitch

Unless i can get on windows I can't remove .Spotlight but pico should be looking for recovery_menu so it shouldn't interfere. Also if I understood the writeup correctly even if recovery_menu isn't found it should turn off my wii u yet nothing. Could also be my usb cable being funny, will try to get a hold of another one

 

[TheSunGodNika]

Will there be NAND recovery options on this in the future?

Something like this that boots on the Wii U this early at least needs some SD Card Restore NAND options, so that way it can be a lot easier to restore (Currently you need a hardmod to restore your NAND on the Wii U… sadly)

 

[Lazr1026]

Will there be NAND recovery options on this in the future?

Something like this that boots on the Wii U this early at least needs some SD Card Restore NAND options, so that way it can be a lot easier to restore (Currently you need a hardmod to restore your NAND on the Wii U… sadly)

eMMC (MLC) and vWii (SLCCMPT) might be options in the future but Wii U (SLC) can cause bricks UPDIH cannot recover, as it needs IOSU to be working and thats on the SLC.

 

[Gliitch]

I would gladly do a NAND upgrade to increase WiiU safety if only we had what we need to recreate a new one...
That is really a shame that Nintendo Sony & Cie won't release source code for their older console

 

[BetaCracks]

Hi ! Thanks you so much for your work.
But, It doesn't work for me. I haven't the "Wii u" logo but a full black screen.

I hope you could help me
Sorry for my English

PS: I have made a Factory reset with CBHC (Yes, I am stupid)

 

[Raniere0809]

hello, I have a Wii u EU with error 160-0103 and I could not recover using Udihp, the error appears when starting the console. no access to Wii u menu. sorry for the possibly incorrect english.

 

[BaamAlex]

Then it is your timing. Try it again.

 

[Raniere0809]

Then it is your timing. Try it again.

even getting a success message should i try again? yesterday I performed more than 12 times and got a success message in all, but the error 160-0103 persists.

 

[crazillo]

Congrats on this fantastic tool! I'm glad so many Wii U were successfully unbricked already.

Unfortunately, just like others on the past few pages, I have not been able to get the Recovery Menu displayed on the screen. When using the alternative renamed recovery_menu file, I do get a weird white noisy output to the TV screen. The purple light was on, so I suppose the menu has loaded successfully. The commonality between the posts seems to be that all of us are stuck on the Wii U logo screen, getting no error messages. I'm a bit unsure what else I could do now to trace the problem further? Have also tried the other various methods people posted online (trying to get into the vWii, launching an app or systems settings from the GamePad), but this was all unsuccessful.

Thanks again.

 

[PGSK]

Has anyone tried/had success with using this tool on a Wii U that is stuck with a flashing blue light on the console unit, a black screen on the TV and the gamepad being unable to sync? That's pretty much my situation right now and I'm considering getting a Raspberry Pico to try this out as a last resort before getting a replacement unit...

 

[Raniere0809]

hello, I have an error 160-0103, The recovery menu 0.4 did not work, but I have some logs, is it possible to help me?

 

[Degenx]

Congrats on this fantastic tool! I'm glad so many Wii U were successfully unbricked already.

Unfortunately, just like others on the past few pages, I have not been able to get the Recovery Menu displayed on the screen. When using the alternative renamed recovery_menu file, I do get a weird white noisy output to the TV screen. The purple light was on, so I suppose the menu has loaded successfully. The commonality between the posts seems to be that all of us are stuck on the Wii U logo screen, getting no error messages. I'm a bit unsure what else I could do now to trace the problem further? Have also tried the other various methods people posted online (trying to get into the vWii, launching an app or systems settings from the GamePad), but this was all unsuccessful.

Thanks again.

I have a Wii U that does not display the recover menu but recovery menu is actually loaded. They way to tell is, press the eject button. If it the drive makes noises, then it's not load. If the drive is silent, assuming you have a working disc drive, It is loaded.
You will have to navigate it blind.

On the github page there are screenshots. You'll have to use those are your reference and count the number of presses to access the various features. I was able to dump my log files, load a network config, and start the WUPServer with no menu visable at all. It just takes careful counting of button press to know where you are in the menu structure.

 

[dustinrue]

Alight. After seemingly frying my pi zero w (I could successfully get the menu process to start but couldn't see anything and then my pi zero died) I switched to a pico which worked great. Got the menu first try.

Based on the log output, it seems my eMMC is shot. It is HYNIX based (pnm=HYNIX). What are the current options for this thing to keep it as normal/usable as possible? Is there a way to delete/disable bad saves/data or whatever and have them only on external storage? My system has been a problem for years now and I don't even remember..can I simply have saves exist on external storage and ignore the eMMC?

At any rate, it sounds like there is no way for me to recover or transfer what I have which is, years of effort by the fam in Nintendo Land and other games (they are obviously bummed). So, just looking for opinions on what is left of this thing or how I can keep using it in some way or if it will just continue to get worse?

Also, for the record the life time crash count is over 600 for my console. It was a preordered, 32GB launch system with a mfg date of Sept 6 2012. System info screen shows HYNIX for the storage type as well.

EDIT: Also, big thanks for this tool. I have been holding on to the system in the hopes that one day there would be a way to get at it low level enough to pull off what I can of the game saves and whatever else.

 

[BaamAlex]

can I simply have saves exist on external storage and ignore the eMMC?

The eMMC can't be "ignored" i would say. When you have games on an hdd, the saves are also there. And when your eMMC is almost toast, there is nothing you can do about it. Except it is possible to solder in a new eMMC chip.

 

[godreborn]

Saves will be on the same partition as the game.

 

[dustinrue]

The eMMC can't be "ignored" i would say. When you have games on an hdd, the saves are also there. And when your eMMC is almost toast, there is nothing you can do about it. Except it is possible to solder in a new eMMC chip.

And I suppose disc based games will _only_ save to eMMC right? There is no way to make a disc based game use the external storage.

I am, of course, ignoring obtaining a non-disc version of a game and putting it on external storage. Just trying to gauge what is possible.

Also, I am finding that the S/N of my system is not on the wiki, it starts with FW1008...should I add it to the page?

 

[GammaGulp]

I have 2 unmodded 32GB black Wii Us.

Wii U # 1 is stuck on the Wii U logo at boot and doesn't boot into the menu, just forever stuck on the Wii U logo screen with the white background.

Wii U # 2 loads up the Wii U logo at boot but then suddenly cuts to a black screen.

I believe both Wii U units were sitting in storage for a very long time, probably 5+ years.

I set up UDPIH on a Raspberry Pi Pico I just got in the mail (added network.cfg and recovery_menu to a 64gb FAT32 microSD card inside an SD adapter into the Wii U), but I'm not able to boot into the recovery menu. The Wii Us make 3 disc drive noises while the Wii U logo shows up.

Would it matter if the Wii U's firmware is potentially older due to not being used for more than 5 years? Or am I just not timing this right? I suppose it doesn't help that it takes my 4KTV a few seconds to notice the Wii U's HDMI video signal, so when I get a display, I already see the Wii U logo (and not the Nintendo logo that comes before it).