It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

• A Wii U
• One of the devices listed below
  Note: Any other linux device capable of USB device emulation should work as well.
  Prebuilt releases are only available for the Pico and Zero.
  I will add more devices below which are confirmed to work.

Supported devices:​

• A Raspberry Pi Pico or Zero
• A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

• Download the latest udpih.uf2 from the releases page.
• Hold down the BOOTSEL button on the board and connect the Pico to your PC.
  Your PC will detect the Pi as a storage device.
• Copy the .uf2 file to the Pico. It will disconnect after a few seconds.

The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

• Install the required dependencies:
  

  sudo apt install build-essential raspberrypi-kernel-headers

• Clone the repo:

• git clone https://github.com/GaryOderNichts/udpih.git
  cd udpih

• Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
• Now build the kernel module:

• cd linux
  make

• You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.

The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB Devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
  This timing is important. If you're already in the menu, the exploit won't work..
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[abal1000x]

Just buy pico. Its cheap and worth every penny. Maybe because its community based, the detail of the datasheet of Rp2040 is superior compared to others. And its the first time Raspberry made their own chip, with their own design. The only problem is their Voltage Reference. But its okay, its their first launch, there will be mistakes in here and there.

 

[ii-Xaophu]

The Pi 4 supports USB device emulation. Untested though, but should work with the same instructions as the zero.

Thanks for clarifying, I already had a pi4 from about a year ago, which is why I was asking. Gonna test it out when I can actually get a cable for it, so thank you.

 

[GerbilSoft]

Here's a few new things coming in a future update to recovery_menu:

New font: Terminus 8x16 bold (gamepad) and 12x24 bold (TV). The previous 8x8 font was nearest-neighbor scaled on the TV, which looked ugly.

Set Coldboot Title now shows some additional titles if running on dev or kiosk hardware:

There's a new "System Information" screen that shows useful system info: (The "11.0.0" is an oddity of the version.bin title installed by Kiosk Menu.)

And soon, a simple region unbrick option:

 

[GerbilSoft]

That was easier than I thought. https://github.com/GaryOderNichts/recovery_menu/pull/11

Here, we set the system to productArea = KOR and gameRegion = TWN. (Don't try this at home! ...though if you do, the next version of recovery_menu will help you fix it.)

Select "Set Region to USA" and apply the changes:

Now we reload the menu to verify that it worked:

Some notes:

• If no Wii U Menu is installed, it won't allow any region changes. This normally only happens on devkits using PCFS or freshly formatted with a DDI flash.
• gameRegion doesn't have to match the Wii U Menu exactly. For example, on a USA system, if gameRegion is set to JPN/USA/EUR, and platformArea is USA, this will be considered valid. The repair option always resets gameRegion to just productArea, though.

EDIT: I noticed the bit of corruption in the status bar after fixing the region code. Will fix that momentarily.

 

[Mc123]

Is there any plans to add a homebrew loader in the next versions. Much like Priiloader on Wii

 

[zantzue]

Is there any plans to add a homebrew loader in the next versions. Much like Priiloader on Wii

That would be awesome.

 

[edison658]

Hi, thanks for this great tool.

I just bought a wii u with Error 160-0101 to test it.
And now wii u back to life in only two tests (one because µsd not recognized)...


Is it possible to unintall colboot ? (I plan to install tiramisu).

If possible may be add in the menu the option to uninstall coldboot safely.

 

[BaamAlex]

Is it possible to unintall colboot ?

Depends. Is cbhc installed? Or what is installed on the bricked console?

 

[Deleted member 571007]

Is it possible to unintall colboot ? (I plan to install tiramisu).

If you have something like CBHC installed, then yes. There is an option that allows you to change the Cold Boot title away from CBHC back to the regular Wii U Menu. From there you can remove CBHC entirely and proceed to install Tiramisu.

This is my understanding of it. If I'm wrong, someone feel free to correct me.

 

[BaamAlex]

This is my understanding of it. If I'm wrong, someone feel free to correct me.

For removing cbhc you don't need the recovery menu. You just start the installer and press b instead of a.

 

[edison658]

Depends. Is cbhc installed? Or what is installed on the bricked console?

I thint The wii u had been formatted by the owner so he bricks console (chbc).
i use udpih-usb-host-stack-exploit & recovery-menu to unbricking CBHC bricks (set coldboot title to Wii U Menu).
Nothing is installed on it.

Now i would like to unhack the wii u to make it clean.
Is there a procedure to remove all the hack?

 

[Deleted member 571007]

For removing cbhc you don't need the recovery menu. You just start the installer and press b instead of a.

Ah yea true. I was just thinking in the case of a Wii U that was bricked which had CBHC installed. That was what my mind defaulted to cuz the thread is mainly about reversing bricks rather than just uninstalling something lol

 

[BaamAlex]

I thint The wii u had been formatted by the owner so he bricks console (chbc).

When he didn't use the installer...then yes. Otherwise no.

 

[edison658]

Indeed i was wrong. Console is already stock now. So i can proceed with tiramitsu.

I can't wait to see how this powerful tool will evolve.

 

[godreborn]

I thint The wii u had been formatted by the owner so he bricks console (chbc).
i use udpih-usb-host-stack-exploit & recovery-menu to unbricking CBHC bricks (set coldboot title to Wii U Menu).
Nothing is installed on it.

Now i would like to unhack the wii u to make it clean.
Is there a procedure to remove all the hack?

Yeah, the hacks on the wiiu don't have to be permanent, so they're easy to undo if you want.

 

[GerbilSoft]

That is in fact the reason why System Format bricks if run on a console that has CBHC. The NDS titles are considered regular user titles, not system, so they get deleted as part of System Format. The system doesn't reset the startup title option because that usually isn't changeable on retail, so when the system reboots after formatting, it tries loading the CBHC title, which fails.

Tiramisu, on the other hand, installs into Health & Safety, which is a system title and therefore isn't erased when doing a System Format.

 

[GaryOderNichts]

Recovery Menu Version 0.3​

Changelog:

• Improved visuals, including a better readable font (Thanks @GerbilSoft)
• Support for setting the coldboot title to debug titles, if running in debug mode (Thanks @GerbilSoft)
• Added a new "System Information" menu (Thanks @GerbilSoft)
• Added a new "Debug System Region" menu, allowing you to verify the system region and directly fixing region bricks (Thanks @GerbilSoft)
• The disc drive is now powered off while in the menu
• The power led is used for displaying debug patterns before the menu is loaded
• The "Display DRC Pin" option was replaced with a "Pair Gamepad" option, allowing you to directly pair a gamepad while in the menu
• The "System Information" menu displays information about the MLC including the manufacturer

For additional information refer to the README.md.

 

[christianacqua]

Guys how do i delete a directory with wupserver?

 

[CrazySquid]

This is amazing! Thanks for all the effort Gary!
Only problem I'm having is that while I can boot the menu using my Nintendo Switch, my Wii U becomes unresponsive and I can't do anything once I'm there.
I'm trying to reinstall Wii U Chat since I was messing with it (Tried to change the icon of the app for Potatehax, but somehow I bricked, maybe because I delete Nintendo TVii files from there as well when I was FTPing).

EDIT: I have Tiramisu installed, maybe that's making the Wii U to be unresponsive in the recovery menu?
EDIT2: I can succesfully boot into vWii using Tiramisu.
EDIT3: I'm an idiot and realized that you shouldn't be using the gamepad, but the console buttons lmao.

 

[GaryOderNichts]

This is amazing! Thanks for all the effort Gary!
Only problem I'm having is that while I can boot the menu using my Nintendo Switch, my Wii U becomes unresponsive and I can't do anything once I'm there.
I'm trying to reinstall Wii U Chat since I was messing with it (Tried to change the icon of the app for Potatehax, but somehow I bricked, maybe because I delete Nintendo TVii files from there as well when I was FTPing).

EDIT: I have Tiramisu installed, maybe that's making the Wii U to be unresponsive in the recovery menu?
EDIT2: I can succesfully boot into vWii using Tiramisu.
EDIT3: I'm an idiot and realized that you shouldn't be using the gamepad, but the console buttons lmao.

Are you using the bu- Just read EDIT3
Good luck with unbricking!