It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Supported devices:​

• Raspberry Pi Pico (W) / Pico 2 (W)
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

• Raspberry Pi Pico / Pico 2
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
  This timing is important. If you're already in the menu, the exploit won't work.
  Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
  If you get no video output or a distorted screen, your timing was most likely wrong.
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[V10lator]

It says just "FAILED TO OPEN NETWORK.CFG: fffcffe9"

You're missing the network.cfg file on your SD card, see: https://github.com/GaryOderNichts/recovery_menu?tab=readme-ov-file#load-network-configuration

So, I tried to dump syslogs, OTP + SEEPROM, dang.. It doesn't works either..

Your SD card might simply be write locked, so unlock it:

(note that the Wii U is a bit picky here: In case it looks unlocked already go lock it, then unlock it again)

 

[GaryOderNichts]

hello, I was bricked by the unofficial wii u menu korean language patch.
so I tried a wii u recovery menu, but I failed to unbrick it.
I tried to enter 'Load Network Configuration', Then It doesn't works.
It says just "FAILED TO OPEN NETWORK.CFG: fffcffe9"
So, I tried to dump syslogs, OTP + SEEPROM, dang.. It doesn't works either..
FAILED TO CREATE DIRECTORY : fffcffbe
FAILED TO CREATE OTP.BIN : fffcffbe
how can I solve this problem? I just use the wupserver to remove korean language patch, and insert japanese language..
is there anyone can help?

Is your SD Card write protected? Check the switch on the side. Edit: Didn't see the other reply.
I'm not sure what the korean language patch is. Can you provide more details on what you did exactly?

 

[DGP_Maluco]

hello, I was bricked by the unofficial wii u menu korean language patch.
so I tried a wii u recovery menu, but I failed to unbrick it.
I tried to enter 'Load Network Configuration', Then It doesn't works.
It says just "FAILED TO OPEN NETWORK.CFG: fffcffe9"
So, I tried to dump syslogs, OTP + SEEPROM, dang.. It doesn't works either..
FAILED TO CREATE DIRECTORY : fffcffbe
FAILED TO CREATE OTP.BIN : fffcffbe
how can I solve this problem? I just use the wupserver to remove korean language patch, and insert japanese language..
is there anyone can help?

I had write problems with an SD card, maybe try another one?

 

[kingrhoambosphoramus]

Hey, do you know if UDPIH could work with OSv9? I bricked my Wii U by installing US Wii U menu v0, and I think it changed both default boot title and default OS.
UDPIH doesn't work anymore.

 

[impeeza]

UDPIH doesn't work anymore.

For you or for everyone?

 

[GaryOderNichts]

Hey, do you know if UDPIH could work with OSv9?

There are currently no plans for OSv9 support, sorry. Only way out of this situation would be de_Fuse or restoring a SLC backup using hardmods.

For you or for everyone?

It doesn't work in their case, since they changed their console to autoboot into OSv9.

 

[SDIO]

Hey, do you know if UDPIH could work with OSv9? I bricked my Wii U by installing US Wii U menu v0, and I think it changed both default boot title and default OS.
UDPIH doesn't work anymore.

What exactly is your Wii U doing now? What happens if you hold B on the gamepad during boot?

 

[kingrhoambosphoramus]

What exactly is your Wii U doing now? What happens if you hold B on the gamepad during boot?

nothing.

 

[V10lator]

nothing.

Is the power LED doing anything? Is the fan spinning? Any output on any screen?

 

[Audible4994]

Hello, how can I use udpih_nxpayload.bin file with Switch modded with a chip?

Post automatically merged: Feb 16, 2024

I'm trying to use my Switch for UDPIH but I always see this error message. But I already connected my gamepad to console.

 

[SDIO]

What is the console doing?

 

[V10lator]

I always see this error message.

The gamepad won't work in the recovery menu. You need to look at the TV screen and navigate with the eject and power buttons on the console itself.

in case the TV screen stays black look at the power LED (of the console itself) : Does it change from blue to purple?

 

[Audible4994]

The gamepad won't work in the recovery menu. You need to look at the TV screen and navigate with the eject and power buttons on the console itself.

in case the TV screen stays black look at the power LED (of the console itself) : Does it change from blue to purple?

I changed my sd card it's all okay now, thank you for your answer.

 

[kingrhoambosphoramus]

I meant

Is the power LED doing anything? Is the fan spinning? Any output on any screen?

I meant that it gets stuck on the Wii U logo when booting. Does not do anything else.

 

[SDIO]

Try different timings with udpih and look for the led turning purple.
Also make sure to not have other USB devices connected

 

[HaseoArmahem]

Hello, I'd like to ask help:
Wii u freeze at launch after I enter date(after format), no update(on the first seconds), or at format(at the same time).
The console is formatted so I can't enter in browser or the menu at all as it ask the date and then freeze.
In settings menu via Coldboot can, but it useless as it not updated and formatted.
I get the logs and it say:
--- 2. ODM internal status ---
Current FSM stateDM_STATE_FATAL
Previous FSM stateDM_STATE_FATAL

It seems my drive died. I can try to find the spare one but it seems it can't help as the logical board is unique and is troubled element in my case.
Is there I can do with wii u (and UDPIH) to ignore drive? Or somehow to enter in menu skip first launch menu?

 

[SDIO]

Please zip and upload the whole log folder so we can have a look.

The Disc drive can be disabled in the seeprom. Minute has an option for that and you can load minute with my fork of the recovery.
I can give more detailed instructions later.

 

[HaseoArmahem]

Here is fresh logs(I removed folder and create it via menu.

If I need something additional - please give me info and I'l do it

 

[SDIO]

Please send the whole folder, including the meta.bin

 

[HaseoArmahem]

Please send the whole folder, including the meta.bin

Sorry, here is full folder