Front-page Hacking  Updated

UDPIH: USB Host Stack exploit + Recovery Menu

It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!


Requirements​

  • A Wii U
  • One of the devices listed below
    Note: Any other linux device capable of USB device emulation should work as well.
    Prebuilt releases are only available for the Pico and Zero.
    I will add more devices below which are confirmed to work.

Supported devices:​

  • A Raspberry Pi Pico or Zero
  • A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

  • Download the latest udpih.uf2 from the releases page.
  • Hold down the BOOTSEL button on the board and connect the Pico to your PC.
    Your PC will detect the Pi as a storage device.
  • Copy the .uf2 file to the Pico. It will disconnect after a few seconds.
The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

  • Install the required dependencies:
    Bash: 
    sudo apt install build-essential raspberrypi-kernel-headers
  • Clone the repo:
  • Bash: 
    git clone https://github.com/GaryOderNichts/udpih.git
cd udpih
  • Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
  • Now build the kernel module:
  • Bash: 
    cd linux
make
  • You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.
The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

warning
Important notes for this to work:
  • Make sure no other USB Devices are attached to the console.
  • Only use USB ports on the front of the console, the back ports will not work.
  • If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.
Click to expand...
  • Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
  • Insert the SD Card into the console and power it on.
  • As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
    This timing is important. If you're already in the menu, the exploit won't work..
  • After a few seconds you should be in the recovery menu.
So what's this recovery menu? The recovery menu allows you to fix several bricks:
screenshot

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:
  • Wii U Menu (JPN) - 00050010-10040000
  • Wii U Menu (USA) - 00050010-10040100
  • Wii U Menu (EUR) - 00050010-10040200
On non-retail systems the following additional options are available:
  • System Config Tool - 00050010-1F700500
  • DEVMENU (pre-2.09) - 00050010-1F7001FF
  • Kiosk Menu - 00050010-1FA81000
Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:
Code: 
type=eth

For using wifi:
Code: 
type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Credits​

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!
 
Last edited by GaryOderNichts,
  • Like
  • Love
  • Wow
Reactions: johsam, rommy667, 3EGaming and 173 others
Click to expand...
MXRD4K1LL4

MXRD4K1LL4

Well-Known Member
Member
Level 3
Joined
Jan 17, 2022
Messages
139
Trophies
0
XP
377
Country
Canada
[/QUOTE]
Yes, you can
GaryOderNichts said:
It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

  • A Wii U
  • One of the devices listed below
    Note: Any other linux device capable of USB device emulation should work as well.
    Prebuilt releases are only available for the Pico and Zero.
    I will add more devices below which are confirmed to work.

Supported devices:​

  • A Raspberry Pi Pico or Zero
  • An unpatched Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

  • Download the latest udpih.uf2 from the releases page.
  • Hold down the BOOTSEL button on the board and connect the Pico to your PC.
    Your PC will detect the Pi as a storage device.
  • Copy the .uf2 file to the Pico. It will disconnect after a few seconds.
The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

  • Install the required dependencies:
    Bash: 
    sudo apt install build-essential raspberrypi-kernel-headers
  • Clone the repo:
  • Bash: 
    git clone https://github.com/GaryOderNichts/udpih.git
cd udpih
  • Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
  • Now build the kernel module:
  • Bash: 
    cd linux
make
  • You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.
The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​


  • Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
  • Insert the SD Card into the console and power it on.
  • As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
    This timing is important. If you're already in the menu, the exploit won't work..
  • After a few seconds you should be in the recovery menu.
So what's this recovery menu? The recovery menu allows you to fix several bricks:
screenshot

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title​

Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

  • Wii U Menu (JPN) - 00050010-10040000
  • Wii U Menu (USA) - 00050010-10040100
  • Wii U Menu (EUR) - 00050010-10040200

Dump Syslogs​

Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM​

Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver​

Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration​

Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

Code: 
type=eth
For using wifi:

Code: 
type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Displays DRC Pin​

Displays the Gamepad Pin used for pairing the gamepad.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.

Install WUP​

Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Credits​

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!
Click to expand...

If I install raspberry os on VMware or other emulator, could it work?
 
V10lator

V10lator

Well-Known Member
Member
Level 16
Joined
Apr 21, 2019
Messages
2,639
Trophies
1
Age
36
XP
5,501
Country
Germany
Ondrashek06 said:
> unpatched switch

You DO know how rare they are nowadays, right? They go for around $600.
Click to expand...
Wow, Gary implements a feature many people asked for and this is your reply? Just buy a PI zero / pico for $5 in case you don't own a unpatched switch. 🤦‍
Now this is also too expensive for you? Then just pretend this USB exploit doesn't exist. It's really not Garys fault for hardware costing money.

//EDIT: Seriously, why do people like you show no respect to developers doing all this in their free time but want more and more instead? Gary had no reason to even release this to the public, could have opened a Wii U repair business and asking $100 just for executing the exploit on your console instead. Is this what you want? All open source devs feeling pissed so they stop doing things for free?
 
  • Like
Reactions: panamex, andreiarturo, sergio_prado and 6 others
abal1000x

abal1000x

Well-Known Member
Member
Level 8
Joined
Jun 5, 2022
Messages
1,059
Trophies
0
XP
1,364
Country
Gaza Strip
I don't have a switch. Want to know, whether switch also has this exploit of swap and unchecked length of usb descriptor?
 
O

Ondrashek06

Well-Known Member
Member
Level 12
Joined
Dec 27, 2019
Messages
1,157
Trophies
0
XP
3,251
Country
Czech Republic
It's actually cool that you can do this with using just a $5... thing and finally finding a way to restore bricked Wii Us without soldering, I really like this.

However what I do not understand is doing that with a very rare console unit which goes for around 100 times that.
 
GaryOderNichts

GaryOderNichts

Well-Known Member
OP
Member
Level 16
Joined
Aug 9, 2018
Messages
792
Trophies
1
XP
5,497
Country
Germany
Ondrashek06 said:
However what I do not understand is doing that with a very rare console unit which goes for around 100 times that.
Click to expand...
There are a lot of people who own an unpatched switch and maybe also a bricked Wii U which can use this.
If you don't own one, then just use the Pi. No one is forcing you (and I also don't recommend) to buy an unpatched switch just to use this exploit.
 
  • Like
Reactions: Harukiii, sergio_prado, zerofalcon and 9 others
Arck

Arck

Well-Known Member
Member
Level 6
Joined
Mar 13, 2016
Messages
955
Trophies
0
XP
878
Country
about to try to unbrick a WiiU with a Switch, is it impossible if the WiiU has no GamePad paired? I don't remember if the gamepad it had was unpaired with the WiiU replacement I had
 
GaryOderNichts

GaryOderNichts

Well-Known Member
OP
Member
Level 16
Joined
Aug 9, 2018
Messages
792
Trophies
1
XP
5,497
Country
Germany
Arck said:
about to try to unbrick a WiiU with a Switch, is it impossible if the WiiU has no GamePad paired? I don't remember if the gamepad it had was unpaired with the WiiU replacement I had
Click to expand...
You don't need a GamePad, you navigate the menu using the physical buttons on the console itself (POWER and EJECT).
You do need a TV hooked up though, otherwise you can't really navigate the menu.
 
Last edited by GaryOderNichts,
  • Like
Reactions: Arck and godreborn
godreborn

godreborn

Welcome to the Machine
Member
Level 33
Joined
Oct 10, 2009
Messages
38,471
Trophies
3
XP
29,138
Country
United States
GaryOderNichts said:
You don't need a GamePad, you navigate the menu using the physical buttons on the console itself.
You do need a TV hooked up though, otherwise you can't really navigate the menu.
Click to expand...
damn, that's awesome! till he asked that question, not having a controller or specific controller paired wasn't something I thought of. you thought of everything. :)
 

Site & Scene News

Go to forum More news

Popular threads in this forum

A really, REALLY old browser exploit (for 5.3.2)?

Gaming  Online services for the 3DS and Wii U have been shutdown. Here is how to get back online!

Hacking Hardware  Wii U No Display (Logs dumped)

Hacking Gaming  Xenoblade Chronicles X - Lifeline and Enhancement Mod

Super Mario Maker Save Collection (All Event and Staff Courses Preserved, 3DS Mario Challenge Port, and More)

Watch videos on Wii U, offline, saved on SD?

Can you hack your wii u with something other than sd card

Hacking Hardware  Broken WII U, MLC replaced with an SD card De_fuse 0.8 not working

General chit-chat
Help Users
  • No one is chatting at the moment.
    Metoroid0 @ Metoroid0: im more interested in metroid prime 4