Unable to dump OTP.bin with de_fuse

MarcoC

Member
OP
Newcomer
Joined
Nov 9, 2024
Messages
16
Trophies
0
XP
52
Country
Italy
Got a WiiU with static red LED and I installed pico to de_fuse it.
When I try to dump OTP via PRSHhax I get this error:

Found existing entry: boot_info, data: 10008000, size: 00000058, is_set: 80000000
prsh: checksum header: old=9254f7bf new=8f14dbd2
prsh: checksum prst: old=505276c9 new=505276c9
Dumping OTP using boot1 prod v8377 (slot0=v8377, slot1=v8377), and offset 0x0d40ac6d...

WARNING: SEEPROM slot0 boot1 version v17079 does not match NAND version v8377!
Exploit might not work!


WARNING: SEEPROM slot1 boot1 version v17079 does not match NAND version v8377!
Exploit might not work!

If this is the first time you're dumping otp.bin, ignore this message.
However, if you reflashed boot1, you might have to guess which boot1
version was originally on NAND and will match the SEEPROM version.
prsh: Header at 10005a54, PRST at 10007ff0, 1 entries (32 capacity):
0: boot_info 0x58 d40ac6d
GPU clocked at: 544.999877MHz
Unmounting SLC...
Shutting down MLC...
Shutting down SD card...
sdhc_bus_power(0x0)
Shutting down interrupts...
Shutting down caches and MMU...
Resetting (prshhax)...

boot1 never jumped to payload! Offset or SEEPROM version might be incorrect.
(try it again just in case, sometimes the resets can get weird)
Press POWER/Q to continue.

I tried to dump the memory of the cry_pto (I cannot post without _ :-() module following the suggestion of another post but when I tried with nandBinCheck against my SLC dump there were 64 bad hmac.

Is there something I can try?
I also have another WiiU in really bad conditions always with static red led, should I try to de_fuse that WiiU to dump OTP/SLC and move them to this WiiU?
 

SDIO

Well-Known Member
Member
Joined
Feb 13, 2023
Messages
3,057
Trophies
2
Age
29
XP
2,347
Country
Germany
red means that boot1 isn't executed. So PRSHhax can't work. And the other method would also require the system to boot further to copy the keys to memory.
This can either be caused by a corrupted boot1 on the SLC or by a version mismatch of the boot1 and the boot1 version in the SEEPROM. The SEEPROMs are all encrypted using the same key. So you can get the seeprom key from another consoles OTP to decrypt your SEEPROM and look at the version there.
The NAND bin check will fail the HMAC check because it's missing the correct HMAC key, but it should still be able to tell you the boot1 version.
 

MarcoC

Member
OP
Newcomer
Joined
Nov 9, 2024
Messages
16
Trophies
0
XP
52
Country
Italy
Thanks for the explanation.

Boot1 version
NAND Type: SLC (WiiU)
checking boot1...
Boot1 hash: "3806d41a5c5f139f5b09bbe5b74a5ec45e0f5507"
Boot1 OK!

I dumped the seeprom.bin but it seems just 00. So I don't know how to go ahead from here...
Immagine.png
 

SDIO

Well-Known Member
Member
Joined
Feb 13, 2023
Messages
3,057
Trophies
2
Age
29
XP
2,347
Country
Germany
Do you have any history on the console? What happened to it? This is very strange...
We could try rebuilding a seeprom for your console, but we need to be careful, because I think a bad SEEPROM could also break defuse.
What is the manufacturer the DRAM on the board?
 

Lazr1026

Well-Known Member
Member
Joined
Oct 30, 2020
Messages
171
Trophies
0
Age
18
XP
894
Country
United States
here's a SEEPROM from a (dead, I think) WUP-50. It'll work here
 

Attachments

  • seeprom.zip
    379 bytes · Views: 5

MarcoC

Member
OP
Newcomer
Joined
Nov 9, 2024
Messages
16
Trophies
0
XP
52
Country
Italy
WARNING: SEEPROM slot0 boot1 version v5135 does not match NAND version v8377!
Exploit might not work!


WARNING: SEEPROM slot1 boot1 version v5135 does not match NAND version v8377!
Exploit might not work!
boot1 never jumped to payload! Offset or SEEPROM version might be incorrect.
(try it again just in case, sometimes the resets can get weird)
Same error when I try to dump OTP via PRSHhax (boot1 version now is different from original message). Should I try to dump a partial OTP using the crypto_dump method ?
 

Lazr1026

Well-Known Member
Member
Joined
Oct 30, 2020
Messages
171
Trophies
0
Age
18
XP
894
Country
United States
wait, no, go do Backup and Restore -> Sync boot1 versions to seeprom
Post automatically merged:

argh that wont work either. restore the seeprom and when it asks you to sync the boot1 versions, dont.
 

SDIO

Well-Known Member
Member
Joined
Feb 13, 2023
Messages
3,057
Trophies
2
Age
29
XP
2,347
Country
Germany
The first test would be if it goes to blue LED without defuse
Post automatically merged:

To see what boot1 version you have installed, you can run nandBinCheck on the SLC.RAW. It will say hmac error on all superblocks, but it should detect the boot1 version
EDIT: NVM we see the boot1 version on the SLC from the minute output in the first post.

Also make sure to have a backup of the SLC
 

MarcoC

Member
OP
Newcomer
Joined
Nov 9, 2024
Messages
16
Trophies
0
XP
52
Country
Italy
after I turned the console off and on again the SEEPROM was changed again and only contains 00
Post automatically merged:

If can be useful this is the log when I restore the seeprom

Making mandatory OTP/SEEPROM backups...
Dumping OTP to `sdmc:/backup_otp_0.bin`...
Dumping SEEPROM to `sdmc:/backup_seeprom_0.bin`...
Write sdmc:/seeprom.bin to SEEPROM?
[POWER/Q] No | [EJECT/P] Yes...
Restoring SEEPROM from `sdmc:/seeprom.bin`...
Verifying seeprom.bin...
SEEPROM failed to verify!
(Check your otp.bin?)
Hardware params calc: 71d26d1f stored: 6bdc60f6
Primary boot1 params calc: 51be263a stored: 4e3b4f9c
Secondary boot1 params calc: df82c4b5 stored: 89dfca4d
Decrypted boot1 versions: v20027 (4e3b) and v35295 (89df)
Decrypted boot1 sectors: 0x4f9c and 0xca4d

SEEPROM failed to verify!
(A valid otp.bin is required)
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • BigOnYa @ BigOnYa:
    Ken, your not trapped, you just don't want to come out.
    +1
  • K3Nv2 @ K3Nv2:
    Bigonya is in the closet now he's in the closet too
    +2
  • SylverReZ @ SylverReZ:
    Nah, I'm not in the closet, only you two. :)
  • K3Nv2 @ K3Nv2:
    SylverReZ is in denial about being in the closet but he's in the closet too
    +1
  • SylverReZ @ SylverReZ:
    Ken is in denial about being in the closet but he's always been in there with Biggie.
  • K3Nv2 @ K3Nv2:
    So he pulls out his gun!
  • BigOnYa @ BigOnYa:
    I just went into the closet to look for hidden Xmas gifts, and now Ken won't let me out. Halp!
  • K3Nv2 @ K3Nv2:
    Bigonya is in denial about the closet but he can leave when he wants to too
  • BigOnYa @ BigOnYa:
    Why does it smell like baby oil in here?
  • JollyBaker @ JollyBaker:
    I have a rare condition where I piss oil, sorry
  • K3Nv2 @ K3Nv2:
    He admitted to being in the closet now he likes the closet
  • JollyBaker @ JollyBaker:
    yeah i found this closet in the woods too
  • JollyBaker @ JollyBaker:
    now i'm a closeted homosexual...
  • JollyBaker @ JollyBaker:
    minus the "ed homo"
  • JollyBaker @ JollyBaker:
    i'm a fuckin CLOSETSEXUAL BITCH
  • JollyBaker @ JollyBaker:
    someone kill me before i go too deep please
  • K3Nv2 @ K3Nv2:
    It's not about sexual orientation it's just comfy in here
  • JollyBaker @ JollyBaker:
    although i probably already did
  • JollyBaker @ JollyBaker:
    oh yeah
  • JollyBaker @ JollyBaker:
    it is comfy
  • K3Nv2 @ K3Nv2:
    Shoutbox is the closet btw
  • JollyBaker @ JollyBaker:
    idk what that is
  • JollyBaker @ JollyBaker:
    oh it's a chatroom
  • K3Nv2 @ K3Nv2:
    No it's the closet
  • JollyBaker @ JollyBaker:
    oh i see
    JollyBaker @ JollyBaker: oh i see