It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Supported devices:​

• Raspberry Pi Pico (W) / Pico 2 (W)
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch capable of running udpih_nxpayload

Instructions​

Device Setup​

Follow the setup guide for the device you want to use below:

• Raspberry Pi Pico / Pico 2
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• Nintendo Switch

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your prepared UDPIH device.
  This timing is important. If you're already in the menu, the exploit won't work.
  Depending on the device, you might have to plug it in sooner or later. This might take several attempts.
  If you get no video output or a distorted screen, your timing was most likely wrong.
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Load BOOT1 payload
Loads a payload from the root of the SD Card named boot1.img and executes it from within boot1.
If the file is named boot1now.img it gets loaded automatically when starting the recovery_menu after a 5 second timeout.

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[Robotron2000]

My system was working fine and was modded but you needed to activate the mod after boot otherwise the system was just fine. I went to use it the other day and now it just freezes at the WiiU splash screen so I tried this to dump some logs.
The only error I can see is Miiverse related and I am unsure how to fix this.

 

[GaryOderNichts]

My system was working fine and was modded but you needed to activate the mod after boot otherwise the system was just fine. I went to use it the other day and now it just freezes at the WiiU splash screen so I tried this to dump some logs.
The only error I can see is Miiverse related and I am unsure how to fix this.

That does not seem like a complete logs folder. Was that the only file in there? Can you try copying them again?

 

[Robotron2000]

That does not seem like a complete logs folder. Was that the only file in there? Can you try copying them again?

Sorry about that, I selected a file instead of the folder.

 

[GaryOderNichts]

I tinkered a bit with wupserver/client, edited the system.xml file, replaced the safe.rpx with the one from "PayloadfromRPX"... and managed to manually use Tiramisu again despite WUP installing the original Health and Safety app before this.

With this, I booted into vWii by pressing "+" at launch and tested my disc drive... it is working flawlessly, like, I played using my old Wii Sports disc and it works wonders, not a single issue... so... is it really my disc drive what is failing? I know the Cafe OS logs seem to indicate that, but since it works perfectly fine in vWii it doesn't make much sense to me.
Homebrew Launcher isn't working though, it shows a black screen when trying to launch it.
@GaryOderNichts

Okay I just realized something...
Since the recovery_menu always powers off the disc drive, ODM will always go into a fatal state on the recovery menu.
So all your logs regarding the disc drive are probably from the recovery menu itself.
This was my bad, will take a look at your logs again.

 

[GaryOderNichts]

Sorry about that, I selected a file instead of the folder.

Your system fails to load the default fonts on startup due to data corruption.

00:00:08:065: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
00:00:08:065: failed to read file /vol/storage_mlc01/sys/title/0005001b/10042400/content/CafeCn.ttf, err -196635
00;00;07;945: ***LoadShared - WaitLoadComplete(0,8388608) failed with error -196635 on file "CafeCn.ttf".
00:00:08:351: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
00:00:08:352: failed to read file /vol/storage_mlc01/sys/title/0005001b/10042400/content/CafeStd.ttf, err -196635
00;00;08;232: ***LoadShared - WaitLoadComplete(0,2442464) failed with error -196635 on file "CafeStd.ttf".

There is also this log from a while back when launching Amiibo Settings:

00:00:30:565: mmc_core card err: idx=3, lba=56693760, blks=1024, xfer=0x1, ret=0x00200b40
00:00:30:607: mmc_core card err: idx=3, lba=56693760, blks=1024, xfer=0x1, ret=0x00200b40
00:00:30:607: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:30:623: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)

This unfortunately is another broken HYNIX MLC :/

 

[Robotron2000]

Your system fails to load the default fonts on startup due to data corruption.

00:00:08:065: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
00:00:08:065: failed to read file /vol/storage_mlc01/sys/title/0005001b/10042400/content/CafeCn.ttf, err -196635
00;00;07;945: ***LoadShared - WaitLoadComplete(0,8388608) failed with error -196635 on file "CafeCn.ttf".
00:00:08:351: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
00:00:08:352: failed to read file /vol/storage_mlc01/sys/title/0005001b/10042400/content/CafeStd.ttf, err -196635
00;00;08;232: ***LoadShared - WaitLoadComplete(0,2442464) failed with error -196635 on file "CafeStd.ttf".

There is also this log from a while back when launching Amiibo Settings:

00:00:30:565: mmc_core card err: idx=3, lba=56693760, blks=1024, xfer=0x1, ret=0x00200b40
00:00:30:607: mmc_core card err: idx=3, lba=56693760, blks=1024, xfer=0x1, ret=0x00200b40
00:00:30:607: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:30:623: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)

This unfortunately is another broken HYNIX MLC :/

Thanks for your analyses of this. From what I have read this appears to be happening more and more.
Guess I'll box it up and maybe someday there will be a solution.

 

[CrazySquid]

Okay I just realized something...
Since the recovery_menu always powers off the disc drive, ODM will always go into a fatal state on the recovery menu.
So all your logs regarding the disc drive are probably from the recovery menu itself.
This was my bad, will take a look at your logs again.

Ah, that makes sense! I watched the video you posted in the first post, and I saw that when you pushed the eject button in the recovery menu your disc drive still tried to eject discs. My disc drive doesn't do anything when I push the eject button while in the recovery menu, now I understand.

By the way, I have deleted the contents of the logs folder and now I have a few new fresh logs generated, considering the ODM thing, I did what you said about the recovery menu and yes, the ODM_STATE_FATAL error is not present anymore once I dumped them without entering the recovery menu before. I will just leave the logs here, maybe it will be easier to look at them now that there are fewer and only from the console in a non-booteable state.
Thanks a lot!

 

[Mc123]

Are you familiar with https://lazr1026.github.io/tudpih/#/. It apparently suppose to install Tiramisu with UDPIH for those who can't use the browser.

 

[Robotron2000]

Can a hardmod restore the HYNIX MLC?
This is what I have backed up.

 

[CrazySquid]

Can a hardmod restore the HYNIX MLC?
This is what I have backed up.

While is true that restoring a NAND backup can fix your problem if you have data corruption, your NAND has reached the end of its lifespan as far as I can see. Gary pointed to a line in the log that says

00:00:30:623: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)

If I understand correctly, "MEDIA ERROR" means that your chip is damaged and can't retain the integrity of data anymore, so I don't think restoring the NAND will help.

This seems further implied when random data like amiibo settings or the fonts of Cafe OS became corrupted with no apparent reason.

 

[Robotron2000]

While is true that restoring a NAND backup can fix your problem if you have data corruption, your NAND has reached the end of its lifespan as far as I can see. Gary pointed to a line in the log that says

00:00:30:623: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)

If I understand correctly, "MEDIA ERROR" means that your chip is damaged and can't retain the integrity of data anymore, so I don't think restoring the NAND will help.

This seems further implied when random data like amiibo settings or the fonts of Cafe OS became corrupted with no apparent reason.

So the only real solution is a new base unit or chip replacement which is not happening. It doesn't even make sense to buy a replacement unit because who knows how long that will last.

Thanks for the feedback.

 

[hauntedmound]

i have a very big problem some time ago i went in the mlc folder and deleted the font files i dont have any autoboot cfw i only have mocha i dont know if wupserver can fix the wiiu i will attach the logs (i dont have any nand backup)

 

[Mc123]

So the only real solution is a new base unit or chip replacement which is not happening. It doesn't even make sense to buy a replacement unit because who knows how long that will last.

Thanks for the feedback.

I suggested before to have a homebrew loader throught UDPIH. If it work, we could probably use RedNAND to have a MLC-bricked Wii U to sort of work again.

 

[BaamAlex]

I suggested before to have a homebrew loader throught UDPIH. If it work, we could probably use RedNAND to have a MLC-bricked Wii U to sort of work again.

But that's not a real solution i would say. The console boots...somehow...but what when your rednand "dies"? Creating a new one is not possible when your real chip is already dead

 

[Mc123]

But that's not a real solution i would say. The console boots...somehow...but what when your rednand "dies"? Creating a new one is not possible when your real chip is already dead

But what if you have a NAND backup?

 

[GaryOderNichts]

Ah, that makes sense! I watched the video you posted in the first post, and I saw that when you pushed the eject button in the recovery menu your disc drive still tried to eject discs. My disc drive doesn't do anything when I push the eject button while in the recovery menu, now I understand.

Ah yeah, the disc drive only powers down since version 0.3.

By the way, I have deleted the contents of the logs folder and now I have a few new fresh logs generated, considering the ODM thing, I did what you said about the recovery menu and yes, the ODM_STATE_FATAL error is not present anymore once I dumped them without entering the recovery menu before. I will just leave the logs here, maybe it will be easier to look at them now that there are fewer and only from the console in a non-booteable state.

Went through your new logs and your console always crashes in HBM.

Core1: Instruction at 0x0E103D1C (from SRR0) invalid access of 0x0000035C (value from DAR)
00;00;23;505:
--Proc5-Core1--------- OSContext 0x100457E0 --------------------

00;00;23;505: tag1  = 0x4F53436F (expecting 0x4F53436F)
00;00;23;505: tag2  = 0x6E747874 (expecting 0x6E747874)
00;00;23;505: TBR   = 0x00000000_4FE1D912
00;00;23;505: CR    = 0x22000022
00;00;23;505: CTR   = 0x0E103834
00;00;23;505: LR    = 0x0E103D1C hbm|.text+0x103CFC
00;00;23;505: SRR0  = 0x0E103D1C hbm|.text+0x103CFC
00;00;23;505: SRR1  = 0x0000F072

Did you do any modification to the console which might cause this?

Are you familiar with https://lazr1026.github.io/tudpih/#/. It apparently suppose to install Tiramisu with UDPIH for those who can't use the browser.

Yeah, that should work.

i have a very big problem some time ago i went in the mlc folder and deleted the font files i dont have any autoboot cfw i only have mocha i dont know if wupserver can fix the wiiu i will attach the logs (i dont have any nand backup)

You can grab a WUP for the fonts using JNUSTool (Title ID: 0005001B10042400), place the files into the install folder, and use the "Install WUP" option to reinstall them.

I suggested before to have a homebrew loader throught UDPIH. If it work, we could probably use RedNAND to have a MLC-bricked Wii U to sort of work again.

If we ever have a method to properly coldboot redNAND, that would be an option for MLC-bricked Wii Us.

 

[CrazySquid]

Went through your new logs and your console always crashes in HBM.

Core1: Instruction at 0x0E103D1C (from SRR0) invalid access of 0x0000035C (value from DAR)
00;00;23;505:
--Proc5-Core1--------- OSContext 0x100457E0 --------------------

00;00;23;505: tag1  = 0x4F53436F (expecting 0x4F53436F)
00;00;23;505: tag2  = 0x6E747874 (expecting 0x6E747874)
00;00;23;505: TBR   = 0x00000000_4FE1D912
00;00;23;505: CR    = 0x22000022
00;00;23;505: CTR   = 0x0E103834
00;00;23;505: LR    = 0x0E103D1C hbm|.text+0x103CFC
00;00;23;505: SRR0  = 0x0E103D1C hbm|.text+0x103CFC
00;00;23;505: SRR1  = 0x0000F072

Did you do any modification to the console which might cause this?

Thanks for checking them! Hm... Just to be sure do you mean software-wise right? Because I did not touch anything hardware related.

I was using WiiUFTPServer (not FTPiiU) before all of this because I wanted to change the Wii U Chat icon with a Custom Mocha one (Used PotatoHax to inject Haxchi there).
Long story short, I ended up corrupting Wii U chat because I didn't do things well with the .tga file, so it showed a "???" mark in the Wii U Chat slot in the menu.
Since it was corrupted I ended up deleting Wii U Chat using WiiUFTPServer and I also saw that there was the Nintendo TVii folder, so I removed that as well since it wasn't being used in the menu anyway.
I was confident about this since I had deleted a lot of stuff in the past, even Parental Controls... and my Wii U didn't brick, the icons just dissapeared and that's all. I ended up restoring those apps later on because my console would crash when creating new users.
But, aside of that, I didn't do anything more, that's why I'm a bit shocked that after removing those folder my console stopped working, because I have done the same thing in the past and nothing happened.

EDIT: The only difference this time was that instead of using FTPiiU I was using WiiUFTPServer. And used FIleZilla instead of WinSCP, since I couldn't get WinSCP to work with WiiUFTPServer, but that's all.

EDIT2: https://github.com/Laf111/WiiUFtpServer/issues/26 It seems that deleting files using WiiUFTPServer with FileZilla corrupts the file system.... uh.... not sure if that issue there is accurate, but maybe is related to my problem? After all, I have deleted files using FileZilla and WiiUFTPServer, the only diffence being that I did it on my MLC and not SDCard.
This did not happen when I used FTPiiU with WinSCP.

EDIT3: I Found this error in my logs:

00:00:22:283: FSA: *WARNING!* Data buffer for read request from pid 0xc is not aligned on a 64-byte boundary.
FSA: It should be 64-byte aligned for file system performance.00:00:22:303: FSA: *WARNING!* Data buffer for read request from pid 0xc is not aligned on a 64-byte boundary.

Seems file-system related... I'm starting to think that my problem could be related to the issue above.

Another thing is that I haven't done any HBM modification whatsoever, in fact, I don't have a clue what HBM is, but that's all I did to my console, I had not messed around with fonts or other stuff.

 

[KillerK1]

gary you are amazing - perfect timing for me as I redid coldboot after the 5.5.6 update and the file was corrupted on my sd card and it bricked - super quick fix much appreciated

Post automatically merged: Oct 6, 2022

Also a buddy has a Wii u console that keeps trying to reformat upon startup but failing, could this work for that also?

 

[BaamAlex]

gary you are amazing - perfect timing for me as I redid coldboot after the 5.5.6 update and the file was corrupted on my sd card and it bricked - super quick fix much appreciated

Post automatically merged: Oct 6, 2022

Also a buddy has a Wii u console that keeps trying to reformat upon startup but failing, could this work for that also?

Reformat? An hdd or what?

 

[KillerK1]

Sorry he just wrote “Console turns on but starts a memory format that never completes”. Apologize should have got more details before asking