It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Supported devices:​

• Raspberry Pi Pico (W) / Pico 2 (W)
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

• Raspberry Pi Pico / Pico 2
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
  This timing is important. If you're already in the menu, the exploit won't work.
  Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
  If you get no video output or a distorted screen, your timing was most likely wrong.
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[BaamAlex]

I have a 256GB, but I would agree that it's a major pain getting into the recovery menu. sometimes it doesn't work, sometimes black screen, sometimes a garbled message. I think you need to put it in when it says Nintendo on the gamepad, but it's hard to time when you don't really know when to put it in. when the wiiu text displays on the tv screen seems to be too late.

So it would theoretically better to use my 64gb again? With this it worked like a charm.

 

[godreborn]

So it would theoretically better to use my 64gb again? With this it worked like a charm.

I don't know. I didn't have difficulty the first time, but I had major difficulty the second. I just wanted to see if it worked, not use it, since I've never bricked a wiiu.

 

[lolorlofl]

This is awesome! I'm going to try this on a Wii U I have in an odd state. When it boots up it immediately loads the System Update menu, then it crashes completely after a few seconds. When I try this out I will upload the logs to see what exactly is going on with it.

If you're taking feature suggestions, would it be possible to add the functionality to download and reinstall the system firmware from within the app instead of going through the system menu?

 

[kaputnik]

Wonderful to see the old Wii U still is getting some love. Ordered a Pi Pico just to try this out

If I could wish for a feature, it would be NAND dumping (writing is not possible, right?) from the recovery menu. Would be incredibly handy paired with an easy to use exploit like this

 

[BaamAlex]

Wonderful to see the old Wii U still is getting some love. Ordered a Pi Pico just to try this out

If I could wish for a feature, it would be NAND dumping (writing is not possible, right?) from the recovery menu. Would be incredibly handy paired with an easy to use exploit like this

You can already dump the nand? Not with the recovery menu, but possible.

 

[kaputnik]

You can already dump the nand? Not with the recovery menu, but possible.

Of course, but would love to be able to just insert a fresh SD card with only the recovery menu binary and dump the NAND, keeping it all separated from the regular SD card

 

[BaamAlex]

???
I don't understand what you mean?

 

[kaputnik]

???
I don't understand what you mean?

Never mind, it's just a convenience thing

 

[MXRD4K1LL4]

Wonderful to see the old Wii U still is getting some love. Ordered a Pi Pico just to try this out

If I could wish for a feature, it would be NAND dumping (writing is not possible, right?) from the recovery menu. Would be incredibly handy paired with an easy to use exploit like this

You can with wupserver. But I don't know exactly how.

 

[MXRD4K1LL4]

You can with wupserver. But I don't know exactly how.

You should wait for Gary to come reply

 

[jacobsson]

The exploit seems to do it's thing (no errors) but it's stuck on the wiiu logo. Can't seem get it to display the menu.
I guess it's totally FUBAR?

 

[abal1000x]

.

 

[Cool_all]

Help solve problem 160-0103. I do everything according to the instructions but it does not work.

 

[V10lator]

I do everything according to the instructions but it does not work.

What exactly did you try and what exactly doesn't work?

 

[GaryOderNichts]

The exploit seems to do it's thing (no errors) but it's stuck on the wiiu logo. Can't seem get it to display the menu.
I guess it's totally FUBAR?

Make sure all other USB devices are unplugged. Also try performing the exploit from a fully cold state, by removing the power plug first.

Does it means there are no further error,
or its just the cafe os doesn't record more than 99,
or recovery_menu only dump the first 99 log only?

After reaching 99.log the console starts again at 1. Open up the log files and check the date of the log.

In the menu there are the options to install Coldboot Title.
Is it safe to install US Coldboot Title in Japan console, and switch to it?

If you install a coldboot title the console will automatically switch to it.
You can't boot into a menu of a different region though.

 

[Cool_all]

What exactly did you try and what exactly doesn't work?

I chose the item "Set Coldboot Title" Then I chose my region and rebooted the prefix. And it loaded again with an error.

 

[abal1000x]

.

 

[jacobsson]

@GaryOderNichts
Thanks, I gave it some more tries from a cold boot state to no avail.
Have you ever encountered a system that can't reach the recovery menu?
I'll have to assume it's a bad NAND, which I presume is a RIP.

 

[N7Kopper]

If you install a coldboot title the console will automatically switch to it.
You can't boot into a menu of a different region though.

It should go without saying, but some people don't understand things like this, so I'll say:

Don't set a coldboot title that your Wii U cannot boot without sigpatches and region-free! We don't have permanent exploits, you need to pwn it every boot. Just use Tiramisu.

 

[BaamAlex]

Don't set a coldboot title that your Wii U cannot boot without sigpatches and region-free!

Gary said it already. We can't boot into a menu of a different region. So, there shouldn't be any problems when you set the "wrong" coldboot title.