It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Supported devices:​

• Raspberry Pi Pico (W) / Pico 2 (W)
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

• Raspberry Pi Pico / Pico 2
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
  This timing is important. If you're already in the menu, the exploit won't work.
  Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
  If you get no video output or a distorted screen, your timing was most likely wrong.
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[tech3475]

A RPI pico is $5 in an authorized store here. Why would I want to solder and do all the stuff to homebrew my switch and then do things a $5 chip can already do?

And why would I solder to avoid soldering? If I solder a microchip in my switch, I would just do the solderful method to unbrick Wii Us.

For you, obviously the Pico makes more sense.

However, there are many others who have access to either a Switch vulnerable to the solderless RCM based exploit or who did go through the effort of hardware modifying their Switch.

So should the exploit be ported, for these people it would potentially be a free alternative.

 

[Velocities]

This is like the perfect timing, I've got a bricked Wii U 3 weeks ago from someone who messed around with ftpeverywhere and deleted a lot of system folders inside. The person don't remember what exactly was deleted, the Wii U refuses to boot ofc. But fortunately a full nand backup was made before tiramisu was installed.

So simple question is this possible to restore the full system (nand) with this tool because it seems completely different from CBHC Bricks ?

Thank anyway and Gary deserves a lot of coffees !!

 

[Ondrashek06]

or who did go through the effort of hardware modifying their Switch.

Then why would they use the solderless method if they already CAN solder?

 

[GaryOderNichts]

This is like the perfect timing, I've got a bricked Wii U 3 weeks ago from someone who messed around with ftpeverywhere and deleted a lot of system folders inside. The person don't remember what exactly was deleted, the Wii U refuses to boot ofc. But fortunately a full nand backup was made before tiramisu was installed.

So simple question is this possible to restore the full system (nand) with this tool because it seems completely different from CBHC Bricks ?

Thank anyway and Gary deserves a lot of coffees !!

You cannot write a nand image directly to the console (yet?).
You can use wupserver and connect to it using wupclient, and upload individual files to the system.
It would be really useful to know what files they've deleted

 

[Ondrashek06]

So simple question is this possible to restore the full system (nand) with this tool because it seems completely different from CBHC Bricks

I don't think this can recover a NAND backup... All I think it does is just setting the boot title back to the wii u menu instead of CBHC.

 

[Ondrashek06]

You cannot write a nand image directly to the console (yet?).
You can use wupserver and connect to it using wupclient, and upload individual files to the system.
It would be really useful to know what files they've deleted

But can't you, like, mount the NAND and extract the individual files from it and then send them over?

 

[tech3475]

Then why would they use the solderless method if they already CAN solder?

What?

Are you asking why would someone choose a softmod/solderless method when a hardmod/soldering based method exists which they are capable of performing?

 

[Foxi4]

I’m kind of surprised this wasn’t discovered earlier if the USB stack is truly running before anything else - seems like a pretty obvious entry point to miss. In any case, this is very exciting and could mean recovery for many otherwise bricked systems destined for the scrap bin. Good job!

 

[VinsCool]

Very impressive!

It took a while, but the WiiU security is finally broken down for good with this one!

 

[Digital_Cheese]

Edit: I’m an idiot. This apparently isn’t brick protection really. You may go into ignoring this comment or read if you want to see the original.

Holy shit. This is amazing. Now that Wii U’s can be unbricked, we can experiment with a whole lot more now. And here I thought it couldn’t get much better after the Tirasuma release

 

[Deleted member 586536]

Holy shit. This is amazing. Now that Wii U’s can be unbricked, we can experiment with a whole lot more now. And here I thought it couldn’t get much better after the Tirasuma release

though it's not a full unbrick, if ISOU is somehow bricked, that is extreme sol still. (without hardmodding) At least now most coldboot bricks are fixable, which is what has taken most wiiu's down

 

[Digital_Cheese]

though it's not a full unbrick, if ISOU is somehow bricked, that is extreme sol still. (without hardmodding) At least now most coldboot bricks are fixable, which is what has taken most wiiu's down

Yea. Still better tho xD

 

[Maschell]

Holy shit. This is amazing. Now that Wii U’s can be unbricked, we can experiment with a whole lot more now. And here I thought it couldn’t get much better after the Tirasuma release

NO. It's still very easy to brick the Wii U in a way it's NOT recoverable with this exploit. THIS IS NO BRICK PROTECTION.

 

[dojafoja]

Once upon a time, I bricked a WiiU by screwing around with SSL certificates. I tossed it in the trash long ago and bought another one but just curious if a brick like that could be fixed with this method? I'm pretty sure I'm not the only one who bricked this way and many might still have their console lying around.

 

[Digital_Cheese]

NO. It's still very easy to brick the Wii U in a way it's NOT recoverable with this exploit. THIS IS NO BRICK PROTECTION.

Oooooooo ok.

 

[GaryOderNichts]

Once upon a time, I bricked a WiiU by screwing around with SSL certificates. I tossed it in the trash long ago and bought another one but just curious if a brick like that could be fixed with this method? I'm pretty sure I'm not the only one who bricked this way and many might still have their console lying around.

Yes, you could've also saved it with bluubomb.
Either use wupserver and upload the original certificate, or reinstall the SSL module using the "Install WUP" option.

 

[BaamAlex]

Now that Wii U’s can be unbricked

Unbricked is the wrong description for that i would say. It is more like a "rescue ring" (i guess?) which doesn't pull you out of the water (or in this case out of your situation when your wii u is fubar'd). And it's more interesting for cbhc-related "bricks". Not tiramisu. Theoretically, you can't really brick with tiramisu because the title can't be "accidentally deleted" because it is a system title....or eaten by a dog

I mean, you can brick a tiramisu'd console when you mess up with ftpiiu everywhere for example. But it is very unlikely as long as you know what you're doing.

Speaking of which... @Maschell what happens with the console when you delete the title in which is tiramisu installed? Does your console brick?

 

[Digital_Cheese]

Unbricked is the wrong description for that i would say. It is more like a "rescue ring" (i guess?) which doesn't pull you out of the water (or in this case out of your situation when your wii u is fubar'd). And it's more interesting for cbhc-related "bricks". Not tiramisu. Theoretically, you can't really brick with tiramisu because the title can't be "accidentally deleted" because it is a system title....or eaten by a dog

I mean, you can brick a tiramisu'd console when you mess up with ftpiiu everywhere for example. But it is very unlikely as long as you know what you're doing.

Speaking of which... @Maschell what happens with the console when you delete the title in which is tiramisu installed? Does your console brick?

O nice. As for the Tiramisu, I was saying that I am impressed we even got to that point and thought there couldn’t be much more to make it better

 

[V10lator]

Speaking of which... @Maschell what happens with the console when you delete the title in which is tiramisu installed? Does your console brick?

When coldbooted: Yes. Exact same brick as with CBHC (system.xml pointing to a none-existing boot title). You can't deinstall Health & Safety through (except with FTP).

 

[GaryOderNichts]

You can now use an unpatched Nintendo Switch for this!
https://github.com/GaryOderNichts/udpih_nxpayload