It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Supported devices:​

• Raspberry Pi Pico (W) / Pico 2 (W)
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

• Raspberry Pi Pico / Pico 2
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
  This timing is important. If you're already in the menu, the exploit won't work.
  Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
  If you get no video output or a distorted screen, your timing was most likely wrong.
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[Antoineok]

Again...when the usb key can emulate usb devices and thus usb descriptors...then yes.

but how do i know if it can emulate usb devices?

 

[BaamAlex]

but how do i know if it can emulate usb devices?

You need a raspberry pi pico or zero. These devices can do that.

 

[Antoineok]

You need a raspberry pi pico or zero. These devices can do that.

an raspberry pi 3 B+ won't work i guess

 

[BaamAlex]

an raspberry pi 3 B+ won't work i guess

Obviously not. Otherwise it would be in the list of supported devices.

 

[Antoineok]

Obviously not. Otherwise it would be in the list of supported devices.

so basically, every devices that support usb emulation would work?

 

[godreborn]

an raspberry pi 3 B+ won't work i guess

just buy the pico. that's what I'm doing, and I don't even have a bricked wiiu. it's mostly just to have. it's less than $10 with shipping and tax included. btw, I was successful at compiling the recovery menu using docker.

 

[BaamAlex]

just buy the pico. that's what I'm doing

And who knows how long we can buy these chips xD

Even the teensy (from the old cbhc unbrick guide) is hard to find these days

 

[linuxares]

Great job! Also fantastic for unbricking!

 

[Dust2dust]

Nice to see such development still taking place on the Wii U scene! Now to find out how many people held on to their CBHC bricked Wii U. I would have, if I had bricked, being the obsessive collector that I am.

 

[netsparro]

Life saving tutorial , thank you

 

[lordelan]

Brilliant release, thanks! <3

 

[V10lator]

hey, i have a question, would it be possible to modify a real usb key for that? i mean, editing a real usb key descriptor instead of using a pico or a zero

In theory this could work but would be pretty hard to do. Why? Cause AFAIK (correct me if I'm wrong) for the exploit to work there are multiple descriptors needed to be faked in a row. So yea, you could modify real keys to show the faked descriptors but you would have to exchange them real quick (microsecond accuracy) in the right order.

//EDIT:

And who knows how long we can buy these chips xD

Glass is half empty, we're all gonna die!
Seriously, stop that kind of attitude: This is a great exploit! Nothing more to say!

 

[brickmaker]

Thanks Gary! You helped justify my collection of dead (sleeping) consoles :0

 

[fvig2001]

Cool. Hope this opens up region changing firmware

 

[ChiefReginod]

Absolute legend. Doing more than your part to deal with all the Wii U brick threads clogging up the board.

But seriously, this is the light at the end of a long, dark tunnel for a lot of people.

 

[MikaDubbz]

What does this mean?
Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

WOW!

I thought I wouldn't have any interest in another exploit for the system, given the hacked out state my Wii U is in, but discovering today that I can dig up my original first Wii U that I foolishly bricked years ago in my haste is amazing. Perhaps I can save a few saves I've long since lost now too, I know my Xenoblade Chronicles X file was quite far, and losing that data always put me off from starting all over from square one. Then maybe I can re-gift my extra Wii U to a good friend of mine, I'm sure he'd love that. Of course he'd still need to get another GamePad, as I don't have two of those.

 

[SuperDan]

Gary !!!!!! Just WoW very impressed !!!

 

[gudenau]

Back inhe day I tried something very similar to this, I was just using insanely long descriptions hopping for an out of bounds write.

 

[CMDreamer]

Great stuff!

Looks very promising, as it might allow me to unbrick my Wii U, which doesn't load the main menu.

Is it possible to add the capability to make a dump of the Wii U's NAND? (It would be very handy).

Thanks a lot!

 

[Xyphoseos]

Note: Any other linux device capable of USB device emulation should work as well.
Prebuilt releases are only available for the Pico and Zero.
I will add more devices below which are confirmed to work.

Hi, just to know, should I understand that I can do this with my raspberry pi 3b+ but not now?