It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Supported devices:​

• Raspberry Pi Pico (W) / Pico 2 (W)
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

• Raspberry Pi Pico / Pico 2
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
  This timing is important. If you're already in the menu, the exploit won't work.
  Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
  If you get no video output or a distorted screen, your timing was most likely wrong.
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[SDIO]

That is strange, just two logs, 1 and 5. And I think they are both from the boot into recovery, where the recovery shuts down the Disc drive, which causes the Disc drive errors. Can you try to dump the logs again to see if it produces more?

But I see a lot of

00:00:15:352: MCP: rear usb error

That is not normal. Do you have anything connected to the USB ports?

 

[HaseoArmahem]

That is strange, just two logs, 1 and 5. And I think they are both from the boot into recovery, where the recovery shuts down the Disc drive, which causes the Disc drive errors. Can you try to dump the logs again to see if it produces more?

But I see a lot of

00:00:15:352: MCP: rear usb error

That is not normal. Do you have anything connected to the USB ports?

Yes, I have usb charger for tablet. And it blink some times.
I understand what I need to do: disconnect all the items except SD card and pico drive, load to recovery menu, disconect pico and create new logs. On my way.
I can also try to enter in Wii U menu and select date(it freeze after), or selecet Wii U Settings from ColdBoot - and tap something there if it can help.

 

[SDIO]

Can you try to remove the battery and power, leave it for a minute or so and then try again, with only power and the TV connected?

 

[HaseoArmahem]

Battery - from wii U the small one(for bios and time I guess)?

 

[SDIO]

Yes, the cr2032 from the console, which keeps the rtc

 

[HaseoArmahem]

@SDIO you are the bright mind! So, I open up the cover and find battery with some corrosion on it, get the old one (hoped it work), put in console and it now work and update under process. It freezed at first second of updating, so it work.
I'm not the sharpest tool in the set, but be so stupid and not to try the battery. It is a shame.
Sorry for your time, and big thank you for help.
The battery, the small baterry almoust destroy my day)

UPD: It freeze on update, but I suspect on the bad battery as it lay around, so I just will buy new one and try again. For now the question is in suspend mode as it can be battery again.

 

[SDIO]

Please don't try installing any updates if the console isn't running stable.
Dump the logs aain, maybe we see more now.
The Wii U is able to run without battery, it is only for time keeping. My idea was that something in the RTC chip was messed up and that removing power form it would reset it.

 

[HaseoArmahem]

Ou, I see, I misunderstanding the message. I'm at morning redo the steps and create logs.

The logs new is here.
What I did: remove the battery and leave console for 10 min or more. Then enter in the menu and it freeze after pressing A button on the date(freeze when time need to enter).
Then I try to start UDPIH menu to get logs - it freeze again.
I get the logs on second try. But it freeze right before I press the Shutdown option from menu.
It seems it can freeze even in the recovery menu.
@SDIO maybe I have bad graphic? I never faced with such issues on nintendo consoles, and all what I know is graphics glitches on XBox 360 and it look different.

 

[V10lator]

maybe I have bad graphic?

No, sadly your last log shows a MEDIA ERROR on Hynix, aka a bad eMMC:

00:00:21:528: mmc_core card err: idx=3, lba=60523520, blks=256, xfer=0x1, ret=0x00200b40
00:00:21:549: mmc_core card err: idx=3, lba=60523520, blks=256, xfer=0x1, ret=0x00200b40
00:00:21:549: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:21:560: mmc_core card err: idx=3, lba=60523776, blks=256, xfer=0x1, ret=0x00200b40
00:00:21:581: mmc_core card err: idx=3, lba=60523776, blks=256, xfer=0x1, ret=0x00200b40
00:00:21:581: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:01:13:143: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:23, path:/

So you need to replace that eMMC with an SD card. See https://gbatemp.net/threads/ultimat...reset-black-screen-after-stuck-update.642339/ section Solutions -> Failing eMMC for your options.

 

[HaseoArmahem]

So you need to replace that eMMC with an SD card. See https://gbatemp.net/threads/ultimat...reset-black-screen-after-stuck-update.642339/ section Solutions -> Failing eMMC for your options.

Thank you for help. I'll read the manual and try to apply it.

 

[SDIO]

Yup, that looks like bad eMMC. Install ISFShax asap, before it bricks completely. Don't do anything else with the console until ISFShax is installed.

 

[alban1700]

Hi everyone,

When I switch on the console to configure it, I encounter a problem when creating my Mii and I end up with error 160-0103. I therefore tried the method with the Raspberry Pico and it worked fine (I have no problems with the installation or the procedure). But it didn't change anything, my console still has error 160-0103 when creating my Mii.

Unfortunately, I don't know anything about the console's past and I don't seem to have found MEDIA ERROR in the logs. If I'd known that such an error existed on the Wii U, I'd have been very careful.

 

[SDIO]

If it can boot to the initial setup, then it can't be CBHC brick (that's what setting the Coldboot Title would fix).
So this is most likely a problem with the eMMC. Looking at the logs we indeed don't see MEDIA ERROR but we see DATA CORRUPTION. Very likely this is caused by a bad eMMC.
We probably wouldn't have needed the Pico, since the DNSpresso exploit would also have worked. But since you already have the pico we are going to use that.
To see what state the MLC is in please run the MLC Checker from this recovery menu: https://github.com/jan-hofmeier/recovery_menu/releases and post the log that creates on the SD card.

 

[alban1700]

If it can boot to the initial setup, then it can't be CBHC brick (that's what setting the Coldboot Title would fix).
So this is most likely a problem with the eMMC. Looking at the logs we indeed don't see MEDIA ERROR but we see DATA CORRUPTION. Very likely this is caused by a bad eMMC.
We probably wouldn't have needed the Pico, since the DNSpresso exploit would also have worked. But since you already have the pico we are going to use that.
To see what state the MLC is in please run the MLC Checker from this recovery menu: https://github.com/jan-hofmeier/recovery_menu/releases and post the log that creates on the SD card.

Thank's a lot for helping. I've done it and i find 10 errors.

 

[SDIO]

OK there are some 30041, which equals a MEDIA error, so the eMMC seems to be failing. Can you check in the System Information in the recovery what brand it is and what the MfG date of the MLC is?

To solve this, it would be best to install ISFShax and to rebuild the MLC either on redNAND or an internal SD card, as we can expect the eMMC to become worse, even tho the corruption currently is very limited

 

[alban1700]

OK there are some 30041, which equals a MEDIA error, so the eMMC seems to be failing. Can you check in the System Information in the recovery what brand it is and what the MfG date of the MLC is?

To solve this, it would be best to install ISFShax and to rebuild the MLC either on redNAND or an internal SD card, as we can expect the eMMC to become worse, even tho the corruption currently is very limited

Thanks. I took a picture of the information system

 

[SDIO]

yeah ok hynix. So you should definitly replace it.
If you can solder I recommend: Upgrade Wii U Internal Storage / replace failing eMMC You can get a NAND-AID from @V10lator
If you can't solder, then I recommend: Fixing system memory error 160-0103 (failing eMMC) without soldering

 

[alban1700]

Thank you for your help. It's sad that the UDPIH didnt worked for me :/

 

[ononpnrpqcpa]

I am trying to install aroma from udpih(I have no gamepad). I've found that with a custom build of recovery menu I can launch a launch.rpx file. Unfortunately the link given here is dead:

It should work, at least from the testing I've done.
I uploaded another build on discord which might work: https://cdn.discordapp.com/attachments/279783073497874442/992148005052493915/recovery_menu

Can you please reupload it? Thank you very much
I've solved, see here

 

[Danook28]

Can i paybass the wiiu gamepad
Usa gamepad
Japan gamepad
On (03) eruop console????

Can use picofly fly chip same raspierry pico????