It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

• A Wii U
• One of the devices listed below
  Note: Any other linux device capable of USB device emulation should work as well.
  Prebuilt releases are only available for the Pico and Zero.
  I will add more devices below which are confirmed to work.

Supported devices:​

• A Raspberry Pi Pico or Zero
• A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

• Download the latest udpih.uf2 from the releases page.
• Hold down the BOOTSEL button on the board and connect the Pico to your PC.
  Your PC will detect the Pi as a storage device.
• Copy the .uf2 file to the Pico. It will disconnect after a few seconds.

The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

• Install the required dependencies:
  

  sudo apt install build-essential raspberrypi-kernel-headers

• Clone the repo:

• git clone https://github.com/GaryOderNichts/udpih.git
  cd udpih

• Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
• Now build the kernel module:

• cd linux
  make

• You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.

The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB Devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
  This timing is important. If you're already in the menu, the exploit won't work..
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[SDIO]

If you didn't turn off the Wii U yet, after the dump, also dump otp and seeprom, if you haven't done this already.

Yes, I would strongly advise replacing the the eMMC. You can get a NAND-AID kit from here: https://gbatemp.net/threads/survey-about-nand-aids-pre-order-for-just-0-50-eur-available-now.637225/ if you don't want to order from the PCB manufacturer yourself. And don't forget, there is also the "classic" variant of just using a SD to micro-SD adapter.

After the dumpis done, just remove the Power from the Wii U and don't turn it on, till the replacement is complete. Or else you would need to dump again and probably get some additional errors, which make it harder to fix.

After you merged the mlc parts on the PC, you can use wfs-extract to see the extend of the corruption.

Post automatically merged: Aug 6, 2023

Looking at the log we got a bunch of FFFCFFBF = -0x30041 = MediaError, so it's a failing eMMC for sure

 

[noizer]

My Japanese Wii U still get garbage screen.

My Wii U's symptom is When I start up Wii U, Wii U Gamepad start up same time, but gamepad doesn't recognize Wii U.
When there is no SD Card, UDPIH recognize no SD Card. so shutdown the console.
if recovery_menu(original) is in the SD, LED changed purple. but no activity after. I blindly input shutdown menu, but it doesn't work.
if recovery_menu(dc_init) is in the SD, LED changed as well and HDMI shows up garbage screen. and doing same original recovery_menu.
both recovery_menu doesn't work on AV(3 RCA) or Composite(5 RCA) cable. I got a image only on HDMI and dc_init.

I deleted font files on Wii U nand, but that was huge destroy for my Wii U.
Well, nand-aid might be help, but I don't want disassembling Wii U and soldering.

I shoud give up this Wii U Console and buy another cheap one.

 

[jacobsson]

@noizer
I don't know if your Gamepad unpaired for some reason, but you might be able to pair it up again using this recovery_menu mod which dumps the pairing pin to your SD card (then read it on your PC and now that you know the pin you can redo the menu process again and pair it up).

In order to reach the "Pair Gamepad menu" you need to push Eject 5 times, then Power.

0 = spade
1 = heart
2 = diamond
3 = club

EDIT1: unfortunately since your gamepad starts up automatically I guess there is something else wrong
EDIT2: I'll just keep this reply in case anyone else need to blindly pair up their gamepad

 

[Ysecond]

@noizer
I don't know if your Gamepad unpaired for some reason, but you might be able to pair it up again using this recovery_menu mod which dumps the pairing pin to your SD card (then read it on your PC and now that you know the pin you can redo the menu process again and pair it up).

In order to reach the "Pair Gamepad menu" you need to push Eject 5 times, then Power.

0 = spade
1 = heart
2 = diamond
3 = club

EDIT: unfortunately since your gamepad starts up automatically I guess there is something else wrong

“shows up garbage screen”
This is a corrupt MLC, and even SLC has data loss.

 

[noizer]

“shows up garbage screen”
This is a corrupt MLC, and even SLC has data loss.

Thanks for your comment.

I definitely messed up MLC. I wondering how messed up SLC too.

Fortunately, Korea has no official release Wii U, But is not far from Japan. So I just buy another Wii U for about $30 with shipping.

I just seal this corrupted Wii U.

 

[SDIO]

Why did you delete the fonts?
Should be an easy fix if it really just is deleted fonts.
Do you know which fonts you deleted exactly?

As UDPIH is still working this should me an easy fix. I have a modded recovery, which disables the halt on crash, so it should not hang: https://github.com/jan-hofmeier/recovery_menu/releases/tag/v0.5.0-1
But the recovery has a different menu, so you can't just look at the screenshot.

static const Menu mainMenuOptions[] = {
    {"Dump SLC + MLC",              {.callback = option_dumpNand}},
    {"Dump SLC + Clone MLC",        {.callback = option_dumpSlcCloneMlc}},
    {"Clone MLC",                   {.callback = option_cloneMlc}},
    {"Check MLC",                   {.callback = option_checkMLC}},
    {"Set Initinal Launch",         {.callback = option_SetInitialLaunch}},
    {"Flash boot1.img to slcmpt",   {.callback = option_flashBoot1}},
    {"Set Coldboot Title",          {.callback = option_SetColdbootTitle}},
    {"Dump Syslogs",                {.callback = option_DumpSyslogs}},
    {"Dump OTP + SEEPROM",          {.callback = option_DumpOtpAndSeeprom}},
    {"Start wupserver",             {.callback = option_StartWupserver}},
    {"Load Network Configuration",  {.callback = option_LoadNetConf}},
    {"Pair Gamepad",                {.callback = option_PairDRC}},
    {"Install WUP",                 {.callback = option_InstallWUP}},
    {"Edit Parental Controls",      {.callback = option_EditParental}},
    {"Debug System Region",         {.callback = option_DebugSystemRegion}},
    {"System Information",          {.callback = option_SystemInformation}},
    {"Submit System Data",          {.callback = option_SubmitSystemData}},
    {"Shutdown",                    {.callback = option_Shutdown}},
};

And even if it hangs we can just make it copy the font files in the main, which should be able to out race the crash.

 

[Ysecond]

Why did you delete the fonts?
Should be an easy fix if it really just is deleted fonts.
Do you know which fonts you deleted exactly?

As UDPIH is still working this should me an easy fix. I have a modded recovery, which disables the halt on crash, so it should not hang: https://github.com/jan-hofmeier/recovery_menu/releases/tag/v0.5.0-1
But the recovery has a different menu, so you can't just look at the screenshot.

static const Menu mainMenuOptions[] = {
    {"Dump SLC + MLC",              {.callback = option_dumpNand}},
    {"Dump SLC + Clone MLC",        {.callback = option_dumpSlcCloneMlc}},
    {"Clone MLC",                   {.callback = option_cloneMlc}},
    {"Check MLC",                   {.callback = option_checkMLC}},
    {"Set Initinal Launch",         {.callback = option_SetInitialLaunch}},
    {"Flash boot1.img to slcmpt",   {.callback = option_flashBoot1}},
    {"Set Coldboot Title",          {.callback = option_SetColdbootTitle}},
    {"Dump Syslogs",                {.callback = option_DumpSyslogs}},
    {"Dump OTP + SEEPROM",          {.callback = option_DumpOtpAndSeeprom}},
    {"Start wupserver",             {.callback = option_StartWupserver}},
    {"Load Network Configuration",  {.callback = option_LoadNetConf}},
    {"Pair Gamepad",                {.callback = option_PairDRC}},
    {"Install WUP",                 {.callback = option_InstallWUP}},
    {"Edit Parental Controls",      {.callback = option_EditParental}},
    {"Debug System Region",         {.callback = option_DebugSystemRegion}},
    {"System Information",          {.callback = option_SystemInformation}},
    {"Submit System Data",          {.callback = option_SubmitSystemData}},
    {"Shutdown",                    {.callback = option_Shutdown}},
};

And even if it hangs we can just make it copy the font files in the main, which should be able to out race the crash.

You always think more comprehensively than I do

 

[jacobsson]

@SDIO
OK so I installed a DIY mlc SD-adapter and flashed my dump to a 32GB card.
The mlc_checker.txt seems to have A LOT of corrupted titles in vol/storage_mlc01/sys/title/ (if that's what the log is saying?)

According to the 160-0103 error guide I can use wup installer in @V10lator's recovery menu to fix these. Fingers crossed!

 

[noizer]

Why did you delete the fonts?
Should be an easy fix if it really just is deleted fonts.
Do you know which fonts you deleted exactly?

As UDPIH is still working this should me an easy fix. I have a modded recovery, which disables the halt on crash, so it should not hang:
But the recovery has a different menu, so you can't just look at the screenshot.

static const Menu mainMenuOptions[] = {
    {"Dump SLC + MLC",              {.callback = option_dumpNand}},
    {"Dump SLC + Clone MLC",        {.callback = option_dumpSlcCloneMlc}},
    {"Clone MLC",                   {.callback = option_cloneMlc}},
    {"Check MLC",                   {.callback = option_checkMLC}},
    {"Set Initinal Launch",         {.callback = option_SetInitialLaunch}},
    {"Flash boot1.img to slcmpt",   {.callback = option_flashBoot1}},
    {"Set Coldboot Title",          {.callback = option_SetColdbootTitle}},
    {"Dump Syslogs",                {.callback = option_DumpSyslogs}},
    {"Dump OTP + SEEPROM",          {.callback = option_DumpOtpAndSeeprom}},
    {"Start wupserver",             {.callback = option_StartWupserver}},
    {"Load Network Configuration",  {.callback = option_LoadNetConf}},
    {"Pair Gamepad",                {.callback = option_PairDRC}},
    {"Install WUP",                 {.callback = option_InstallWUP}},
    {"Edit Parental Controls",      {.callback = option_EditParental}},
    {"Debug System Region",         {.callback = option_DebugSystemRegion}},
    {"System Information",          {.callback = option_SystemInformation}},
    {"Submit System Data",          {.callback = option_SubmitSystemData}},
    {"Shutdown",                    {.callback = option_Shutdown}},
};

And even if it hangs we can just make it copy the font files in the main, which should be able to out race the crash.

I deleted CafeKr, Cn, Tw ttf files.

Wow... That recovery menu works!! thanks!!

 

[grandosegood]

hi there, would it be possible to please get a prebuilt for Raspberry Pi 2 Model B v 1.1 ? I'm having a hard time finding the other raspberry pi devices at an affordable price. Thanks.

 

[SDIO]

The cheapest option ist the Raspbery Pi Pico

 

[grandosegood]

thanks for reply, it turns out i was looking up another type of device instead.

can this fix the blinking blue light? as far as i know, the console was unmodded, but the circumstances leading up to the blinking blue light are unknown on my console

 

[SDIO]

probably. Blinking blue LED is usually a corrupted fw.img on the slc.

EDIT: oh wait, you are talking about UDPIH. No UDPIH won't work, you need defuse to fix that.

It also uses a pico, but is much more involved and requires soldering

 

[grandosegood]

thanks again, so the only fix for blinking blue light requires soldering (i suck at it sadly)? would you happen to have the link for that? thanks

 

[SDIO]

https://github.com/shinyquagsire23/wii_u_modchip
https://github.com/jan-hofmeier/wii_u_modchip/tree/wiring-diagram/pico_defuse

 

[Fabioperez]

Hi @grandosegood, in this thread https://gbatemp.net/threads/how-to-...wii-u-internal-memory-mlc.636309/page-3#posts
we recovered a console with a blinking blue light between page 3 and 5 if you like to take a look at it, I also made a video which is on YouTube unfortunately it is in Spanish which is my mother tongue I don't know if I can share links to YouTube

 

[grandosegood]

Hi @grandosegood, in this thread https://gbatemp.net/threads/how-to-...wii-u-internal-memory-mlc.636309/page-3#posts
we recovered a console with a blinking blue light between page 3 and 5 if you like to take a look at it, I also made a video which is on YouTube unfortunately it is in Spanish which is my mother tongue I don't know if I can share links to YouTube

thank you very much for the reply @Fabioperez , could you DM me the link for youtube by chance? if it is allowed, I can post it here later.

unfortunately, my soldering skills are not good, so i may end up trying to return the wii u or sell it as parts. i also thought about sending it to an electronics repair shop to see if they can solder the pico.

 

[bradfinch]

You have pic, or video???

I had the same problem with mine an I tried it an it didn't work on mine the exploit it self loaded up but no fix also tried it one my other one that loads up to new user then crashes with the 0103 error I think that the code an ran the exploit an it didn't fix it

Post automatically merged: Sep 1, 2023

I had the same problem with mine an I tried it an it didn't work on mine the exploit it self loaded up but no fix also tried it one my other one that loads up to new user then crashes with the 0103 error I think that the code an ran the exploit an it didn't fix it

Not atm I don't

 

[V10lator]

I think that the code an ran the exploit an it didn't fix it

What code and what exploit? You can't fix a hardware issue in software. See https://gbatemp.net/threads/636361/

 

[SgtMcBadass]

Would anyone mind offering some guidance on my logs? I am stuck on the WiiU screen, I can get a purple light with recovery menu but it never displays the menu on gamepad or TV, still stuck on WiiU or garbled image on the dc_init version.

I was able to blindly dump the logs, any help would be greatly appreciated.