It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Supported devices:​

• Raspberry Pi Pico (W) / Pico 2 (W)
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

• Raspberry Pi Pico / Pico 2
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
  This timing is important. If you're already in the menu, the exploit won't work.
  Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
  If you get no video output or a distorted screen, your timing was most likely wrong.
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[nelgin]

I don't have a Pi Zero but I do have a Pi 3A+. I've installed the software onto the sdcard and configured the udphi to insert at boot time so I don't have to mess with it. I login and tail /var/log/syslog and dmesg -Tw

Now, the WiiU has the no sync, no display issue. I tried the recover_menu_dc_init but I see nothing in the logs when I connect the Rpi to the WiiU. I do it just as the disk completes spitting (it seems to spin twice).

I know the HDMI and Power cable work because I've tried them with a working Wii U.

I'll test the USBA-Male to Male cable tomorrow but I got it new from Amazon so it should be ok.

Right now, I'm open to other suggestions but I feel I'm at the point where I'm going to have to search for a bad component on the board if I'm ever going to get this working again. It was at some point. I also tried the "move the battery" trick and pretty much everything else.

I forgot to add, the curious thing is, powering on the Wii U will also turn on the gamepad even though it thinks they're not paired.

Finally. any special sort of cable needed? I got a USB A Male to Male connector from Amazon but I see nothing in syslog or dmesg. I went in and added the dwc2 module in both config.txt and in the /etc/modules file per previous postings on the subject.

 

[PCR25]

Does anyone know where I can get valid WUPs for me to use in the recovery menu, because the menus in WUP that I get in the wizard, nuspli, do not recognize my wii U with semi brick, remembering that I follow the rules, I put the WUP in any subfolder in the install folder but still not reading please someone who manages to install WUP on Wii u using the recovery menu help me I will be grateful.

 

[GaryOderNichts]

Does anyone know where I can get valid WUPs for me to use in the recovery menu, because the menus in WUP that I get in the wizard, nuspli, do not recognize my wii U with semi brick, remembering that I follow the rules, I put the WUP in any subfolder in the install folder but still not reading please someone who manages to install WUP on Wii u using the recovery menu help me I will be grateful.

The WUPs from JNUSTool (with -dlEncrypted) work.

 

[Sombersnow]

thanks. I'm also running into the issue where the Wii U isnt displaying on my TV. Can I simply just guess when Im supposed to run the UDPIH gadget?

I have the exact same problem, did it work for you?

 

[Sombersnow]

at what time did you insert it?

 

[BaamAlex]

at what time did you insert it?

Directly after you see the Wii u logo. That worked for me the whole time.

EDIT: See this or this for the "correct" timing.

 

[fadafwet]

Any idea on why it does not show anything on my gamepad
the only thing it does is dislay white garbage on my tv when I have the proper timing

 

[Sombersnow]

Directly after you see the Wii u logo. That worked for me the whole time.

EDIT: See this or this for the "correct" timing.

My console won't display on the monitor, and the gamepad goes to the quick start menu. But when I turn on the gamepad the console turns on too, but my gamepad and console can't connect to each other. Weird.

 

[Jayro]

I'm pretty sure the PSP can be used as a USB payload launcher, as I used it to unbrick my PS3 back in the day. So maybe compiling a PSP payload would be a good idea.

 

[Sombersnow]

Directly after you see the Wii u logo. That worked for me the whole time.

i cant see the wii u logo, gamepad takes me to the quick start menu, console wont connect to tv, but the consoles dvd drive does spin twice

 

[BaamAlex]

i cant see the wii u logo, gamepad takes me to the quick start menu, console wont connect to tv, but the consoles dvd drive does spin twice

Pull the power plug out from the console for a few seconds and then try it again. And remove all usb devices that are attached to the console.

 

[Sombersnow]

Pull the power plug out from the console for a few seconds and then try it again. And remove all usb devices that are attached to the console.

I did that

Post automatically merged: Feb 25, 2023

But the same thing happens, i have no idea if i'm doing the timing wrong or that it does'nt work

 

[ariaden]

I need help I bricked a japanese WII u I was able to acces to the recovery but after selecting the right coldboot and restarting isnt working, I'd like to add tha I was testing AROMA and tried to cange the language with FTPserver

 

[godreborn]

I did that

Post automatically merged: Feb 25, 2023

But the same thing happens, i have no idea if i'm doing the timing wrong or that it does'nt work

It's very specific, the timing. I've had issues with it before, but it does indeed work.

I need help I bricked a japanese WII u I was able to acces to the recovery but after selecting the right coldboot and restarting isnt working, I'd like to add tha I was testing AROMA and tried to cange the language with FTPserver

Undo what you did. Aroma gives you a safeguard.

 

[ariaden]

I have no access to FTP, I restarted the WIIu and got an error screen with the code 160 01 01, I managed to access to the recovery using a raspberry pico but I don't how to fix it from there.

 

[godreborn]

I have no access to FTP, I restarted the WIIu and got an error screen with the code 160 01 01, I managed to access to the recovery using a raspberry pico but I don't how to fix it from there.

No wup server?

 

[ariaden]

I managed to use WUP client and restore MLC files to the defaults but I'm still getting the same 160 01 01 error, please help me understand what to, I´m sharing the logs

 

[noizer]

Any idea on why it does not show anything on my gamepad
the only thing it does is dislay white garbage on my tv when I have the proper timing

white garbage like this?

 

[fadafwet]

View attachment 355683

white garbage like this?

Yes exactly

the light is changing color to purple (red and blue open)
so I am guessing I am able to get into it just no display on tv and gamepad

 

[Sombersnow]

It's very specific, the timing. I've had issues with it before, but it does indeed work.

At what time should I insert it, i've tried so many times. The game pad takes me to the quick start menu, the console has no display on the TV, but the disk drives start's up twice.