Hacking Hardware Homebrew Wii U Unbricking Help

[Bman3990wx]

Hello

I recently got a Wii U without the gamepad and when I turn it on, it displays the Wii U logo and locks up after that with no startup music. I have tried the UDPIH method and it has weird results. The LED turns a dark purple for about 1 second then I can't tell if it is going back to a very light purple or the blue (It looks like the blue, but I can't really tell). The TV screen doesn't change. I also tried poking around with the eject and power buttons to see if it was just working without showing anything on the TV, but I cannot seem to use the shutdown option (as a test) so I doubt it's working at all.

Moving on from that, I took the PI Pico and installed the de_fuse mod. Turning this on gives me the minute menu and I was able to dump a working slc.raw, slccmpt.raw, and an OTP.bin (I was able to successfully decrypt and extract the SLC dump with the OTP.bin using the Nand extract software on pc). I also made a rednand from the minute menu. At this point I am kinda lost on what if anything I can do with this system to get it working?

I can't tell if I'm missing anything or if the Homebrew tools need more time to mature, but I don't seem to be able to get a straight MLC dump (outside the rednand creation, but even with that I can't figure out a way of retrieving an MLC dump with the partition it made. It seems the only thing I can do with it at this time is dump the entire SD card it made for safe keeping). It also doesn't seem like I can do much with the SLC dumps that I have as I don't seem to be able to modify them and re-inject them into the system (if that would even help?).

Would you all happen to know anything else I could do to get this system back up and running? Or do I just need to shelf this for a few months and let the Homebrew get better?

 

[SDIO]

you can extract the logs from the SLC and post them. Then we can see whats wrong.

 

[Bman3990wx]

Oh yea sorry. Here they are.

 

[SDIO]

The meta.bin is missing.

But it looks like a faulty eMMC:

00:00:01:859: mmc_core card err: idx=3, lba=54658928, blks=16, xfer=0x1, ret=0x00200b40
00:00:01:860: ISFS: fs_ops.c(3733)Can not change the owner Id of a non-empty file
00:00:01:860: ISFS: fs_ops.c(6719)Could not set attribute, rc=-524312
00:00:01:878: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050010/10048100/code/app.xml

and

00:00:04:392: mmc_core card err: idx=3, lba=55641088, blks=1024, xfer=0x1, ret=0x00200b40
00:00:04:429: mmc_core card err: idx=3, lba=55641088, blks=1024, xfer=0x1, ret=0x00200b40
00:00:04:429: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:04:501: [WD]>>>> Linkup msg from Net
00:00:04:510: wlc_mlme_join_cmd called with Command 0x3 Length 0x21
00:00:04:739: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00:00:04:739: failed to read file /vol/storage_mlc01/sys/title/0005001b/10042400/content/CafeCn.ttf, err -196673
00;00;04;620: ***LoadShared - WaitLoadComplete(0,8388608) failed with error -196673 on file "CafeCn.ttf".

and

00:00:05:727: mmc_core card err: idx=3, lba=54545152, blks=128, xfer=0x1, ret=0x00200b40
00;00;05;616: OSSetting_SynchronousPrinting DISABLED
00;00;05;620: OSSetting_CrashDumpType 0, MINI dump after crash
00:00:05:745: mmc_core card err: idx=3, lba=54545152, blks=128, xfer=0x1, ret=0x00200b40
00:00:05:745: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:05:746: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00;00;05;623: TCL(1): init DONE
00:00:05:824: mmc_core card err: idx=3, lba=54545152, blks=128, xfer=0x1, ret=0x00200b40
00:00:05:842: mmc_core card err: idx=3, lba=54545152, blks=128, xfer=0x1, ret=0x00200b40
00:00:05:842: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:05:843: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)

in 0.log, 99.log looks similar.

You first need to replace the eMMC, you cain either do it with a new eMMC, but that requires good soldering skills as the eMMC is a BGA package or you can replace it with an SD card. You still need to soldar for that, but there a normal soldering iron is enough, as you don't need to remove the old eMMC.

Also see this: https://gbatemp.net/threads/how-i-fixed-160-0103-system-memory-error.626448/
and this: https://gbatemp.net/threads/wii-u-n...nd-replacement-interposer-public-test.630798/

 

[Bman3990wx]

yeaaaa that's about what I thought. I was reading about the SD card replacement solution. Is it possible to do that without a proper MLC backup per my case or do I need to read into doing mlc backups on a raspberry pi? Also with the Nand being out, how does recovering that to an sd card work when in theory, the backup would be just as corrupt?

 

[SDIO]

You would read the eMMC using a Pi or a Cardreader and write it to an SD. Then we use udpih to replace the broken files. From the logs it should be able to run the recovery menu. In the worst case it should be able to run a modified IOSU from minute minute from where we could fix the broken files but we should be able to find a way.

 

[Bman3990wx]

Just an update, last night I ordered the things I need to make an sd card adapter. I'm gonna try and do the more DIY route and repurpose an sd to micro sd card adapter instead of getting a PCB made. Just waiting on some better wire, a capacitor, and I figured I could cut up one of those micro sd to full size sd card adapters for the MLC dump. Hopefully I can give it a shot tomorrow after work.

 

[Ysecond]

Just an update, last night I ordered the things I need to make an sd card adapter. I'm gonna try and do the more DIY route and repurpose an sd to micro sd card adapter instead of getting a PCB made. Just waiting on some better wire, a capacitor, and I figured I could cut up one of those micro sd to full size sd card adapters for the MLC dump. Hopefully I can give it a shot tomorrow after work.

hey man！What step have you taken?