It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Supported devices:​

• Raspberry Pi Pico (W) / Pico 2 (W)
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

• Raspberry Pi Pico / Pico 2
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
  This timing is important. If you're already in the menu, the exploit won't work.
  Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
  If you get no video output or a distorted screen, your timing was most likely wrong.
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[DGP_Maluco]

Yeah the only problem right now seems to be the scfm.img. Lets wait for the result of the slc checker to see what state the SLC is in.
After you installed redNAND you can also do a format redNAND in minute and look how many errors get reported durcing the SLC and the MLC dumping, That would also give us an idea what state the eMMC is in and if it makes sense to replace it.

Do you have any data on the console you want to recover? The most trouble free route would probably be to just delete scfm, erase mlc and then rebuild the MLC. But for that we also need ISFShax

No I don't need any data from it. I just want to get it working again for the kids (and me of course).
While doing "LOAD BOOT1 PAYLOAD" the screen went off and the LED is blue/Purple. will try to boot again (UDPIH)

 

[SDIO]

Did the led blink? Did you put the right fw.img on the SD? (Not the encrypted one)
Does your tv support 1080p?

 

[DGP_Maluco]

Did the led blink? Did you put the right fw.img on the SD? (Not the encrypted one)
Does your tv support 1080p?

Now the blue LED blinks after loading boot1.

It's the latest files or do I have to choose a specific fw.img?
Yes the TV is only Full HD capable

 

[SDIO]

The latest ones should work. In the worst case you have to do it blind

 

[DGP_Maluco]

The latest ones should work. In the worst case you have to do it blind

Ok after the third time setting up the SD Card again I got in.

1. Navigate to Backup and Restore
2. Dump SEEPROM & OTP
3. Dump SLC.RAW
4. Return to Main Menu

On Dump SLC.RAW I'm getting "setting due to timeout" multiple times the image is stretched so I can't read anything before "setting"

 

[SDIO]

can you try another SD? the resetting due to timeout comes from the SD

 

[DGP_Maluco]

can you try another SD? the resetting due to timeout comes from the SD

This is getting worst and worst. No screen output to the tv on the Recovery Menu but I get it on the gamepad. Weird. After launching Load Boot1 Payload the wii u gamepad doesn't show anything neither the TV. I assume it is still working.

EDIT: This is with another MicroSD card. 64GB Samung formatted to FAT32

 

[SDIO]

then try installing ISFShax first, before doing the dump

 

[DGP_Maluco]

then try installing ISFShax first, before doing the dump

Can you tell me the key presses since I'm not getting an image output?

 

[SDIO]

In minute you need to press power 5 times and then eject once to launch the installer.
Give the installer a few seconds to start.
Then press eject 3 times, power once, eject and then wait a few seconds and then press eject two times again and it should turn off.

 

[DGP_Maluco]

In minute you need to press power 5 times and then eject once to launch the installer.
Give the installer a few seconds to start.
Then press eject 3 times, power once, eject and then wait a few seconds and then press eject two times again and it should turn off.

Thanks that worked. It now boots directly to minute and display is working again. What should I do now? Still try to dump slc?

 

[SDIO]

If you have a 64GB sdcard do the format redNAND and look out for errors during the dump

 

[DGP_Maluco]

If you have a 64GB sdcard do the format redNAND and look out for errors during the dump

Is that under “Patch (sd) and boot iOS redNAND”?

Edit: ok found it under backup, performing now

 

[SDIO]

No, it's in backup and restore

 

[DGP_Maluco]

No, it's in backup and restore

Still running

Post automatically merged: Jan 14, 2024

No, it's in backup and restore

Ok it is done, what should I do now?

 

[SDIO]

Ok A few bad pages, but they are mostly close together, so likely just a few blocks failed, which should be ok. How did the MLC dump look?

Did you run the SLC checker in the recovery

 

[DGP_Maluco]

Ok A few bad pages, but they are mostly close together, so likely just a few blocks failed, which should be ok. How did the MLC dump look?

Did you run the SLC checker in the recovery

After those two or three pages everything was ok. The SLC checker didn’t report any errors

 

[SDIO]

You can try to boot the redNAND with this rednand.ini, to see what happens (since redNAND should ignroe the ECC errors):

[partitions]
slccmpt=false
slc=true
mlc=true

[scfm]
disable=false
allow_sys=false

If you didn't get any errors during the MLC dumping it is probably fine. You can delete the scfm.img and try to boot normally. Maybe it boots, maybe it crashes somewhere else, since deleting the scfm.img will cause corruption in the mlc file system.
Or you got straight to the rebuild and erase the mlc and detele scfm and then rebuild the mlc.

 

[DGP_Maluco]

You can try to boot the redNAND with this rednand.ini, to see what happens (since redNAND should ignroe the ECC errors):

[partitions]
slccmpt=false
slc=true
mlc=true

[scfm]
disable=false
allow_sys=false

If you didn't get any errors during the MLC dumping it is probably fine. You can delete the scfm.img and try to boot normally. Maybe it boots, maybe it crashes somewhere else, since deleting the scfm.img will cause corruption in the mlc file system.
Or you got straight to the rebuild and erase the mlc and detele scfm and then rebuild the mlc.

Now I'm not getting an image and the LED is orange. Do I have to repeat the whole process?

 

[SDIO]

orange LED is probably the ISFShax not finding your SD card