Hacking Hardware Homebrew Wii U Unbricking Help

[V10lator]

@Flame all good from my end. It's true that this user seems to have some anger issues but I don't feel attacked by that.

In fact others and me tried to see where the anger here stems from, found a thread where he described the issue with his Wii U and am now in a slow process to see how we can get this console up&running again (it's not a defective eMMC like the problem of the OP was).

//EDIT: Still a bit unsure if @indigenous is an alt of tiger111 or not (writing style is so similar, error with the console exactly the same and so on) so @indigenous in case you're a real person DM me and I'll tell you the same I told tiger (moving this from GBATemp to a Discord server for more direct support cause that's needed in these special cases).

 

[MattTheTekie]

You need the encrypted one. I am not if WiiUDownloader also downloads the ticket. Does it have a title.tik? For the system titles you have to use the command line. There you can specify the title and that it should be downloaded encrypted.

java -jar JNUSTool.jar 0005001b10042400 -dlEncrypted

Hello there! I got a Wii U in a similar situation, and I got a pico, I attached the logs, but I get a different error. Any help would be apreichated.


`
0:00:18:250: [BOSS] BG stress mode is disabled.

00;00;18;129: WPAD: Application Init

00;00;19;036: rpl_entry

00;00;19;036: OSDynLoad_Acquire() use [2701564]

00;00;19;036: ErrEula: client version 3.

00;00;19;036: ErrEula: thread=0x4c606540, stackSize= 64 KB, stackBase=0x4c60652c, stackEnd=0x4c5f652c (ErrEulaCreate)

00;00;19;597: == sysapp == new path

00;00;19;597: ==== sysapp:dump data 0 ====

00;00;19;597:

00;00;19;597: ==== sysapp:dump data 0 ====

00;00;19;597:

00;00;19;648: ==== sysapp:dump data 0 ====

00;00;19;648:

DRMAPP: built Feb 4 2021 16:43:44

00;00;21;336: ACP: detecting USB storage in CheckTitleNotReferAcctLaunch.

00;00;21;524: ACP shim: USB storage is not found.

00;00;21;524: ACP: USB storage detection done in CheckTitleNotReferAcctLaunch

00:00:21:706: MCP: PID 10 requested to enable power transitions

00:00:21:706: MCP_PowerButtonControl(1) returned 0

00:00:21:760: ACP: set boot flag: 0x00000000

00;00;22;103: ACP: detecting USB storage in AssignTitlePatch.

00;00;22;104: ACP shim: USB storage is not found.

00;00;22;104: ACP: USB storage detection done in AssignTitlePatch

DRMAPP: Finalize

00:00:23:412: mmc_core card err: idx=3, lba=54831104, blks=1024, xfer=0x1, ret=0x00200b40

00:00:23:585: mmc_core card err: idx=3, lba=54838272, blks=1024, xfer=0x1, ret=0x00200b40

00:00:23:639: mmc_core card err: idx=3, lba=54838272, blks=1024, xfer=0x1, ret=0x00200b40

00:00:23:640: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]

00:00:23:640: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, pathnull)

00:00:23:712: mmc_core card err: idx=3, lba=54838272, blks=1024, xfer=0x1, ret=0x00200b40

00:00:23:766: mmc_core card err: idx=3, lba=54838272, blks=1024, xfer=0x1, ret=0x00200b40

00:00:23:766: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]

00:00:23:767: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, pathnull)

00;00;23;648: FS: READ_FILE upid:[ 2] sts:[MEDIA_ERROR] hnd:[0x3b805cc] dst:[0x3d6d94c0] size:[1] cnt:[1048576] pos:[0]

00;00;23;648: SystemFatal(core1)

00;00;23;648: Aborting/Abandoning Driver "SNDD_RAMP" (master 2)

00;00;23;648: Aborting/Abandoning Driver "SNDD" (master 2)

00;00;23;648: Aborting/Abandoning Driver "CCR_MIC" (master 2)

00;00;23;648: Aborting/Abandoning Driver "NTAG" (master 2)

00;00;23;648: Aborting/Abandoning Driver "UHS" (master 2)

00;00;23;648: Aborting/Abandoning Driver "KPAD" (master 5)

00;00;23;648: Aborting/Abandoning Driver "WBC" (master 5)

00;00;23;648: Aborting/Abandoning Driver "FS" (master 5)

00;00;23;648: Aborting/Abandoning Driver "SND" (master 5)

00;00;23;648: Aborting/Abandoning Driver "UVD" (master 5)

00;00;23;648: Aborting/Abandoning Driver "ACP" (master 5)

00;00;23;648: Aborting/Abandoning Driver "GX2" (master 1)

00;00;23;648: Aborting/Abandoning Driver "WPAD" (master 1)

00;00;23;648: Aborting/Abandoning Driver "PAD" (master 1)

00;00;23;648: Aborting/Abandoning Driver "CLIPBOARD" (master 1)

00;00;23;648: Aborting/Abandoning Driver "BUTTON" (master 1)

00;00;23;648: Aborting/Abandoning Driver "ACPLOAD" (master 1)

00;00;23;648: Aborting/Abandoning Driver "TEST" (master 1)

00;00;23;648: Aborting/Abandoning Driver "INPT" (master 1)

00;00;23;648: Aborting/Abandoning Driver "SETTING" (master 1)

00;00;23;648: Aborting/Abandoning Driver "IPC" (master 1)

00;00;23;648: Aborting/Abandoning Driver "CACHE" (master 1)

00;00;23;648: Aborting/Abandoning Driver "MEM" (master 1)

00;00;23;649: Aborting/Abandoning Driver "NETWORK" (master 1)

00;00;23;649: Aborting/Abandoning Driver "NSYSUVD" (master 1)

00;00;23;649: Aborting/Abandoning Driver "AVM" (master 1)

00;00;23;649: Aborting/Abandoning Driver "DC" (master 1)

00;00;23;649: Aborting/Abandoning Driver "TCL" (master 1)

00;00;23;649: Aborting/Abandoning Driver "TVE" (master 1)

00;00;23;649: Aborting/Abandoning Driver "VPAD" (master 1)

00;00;23;649: Aborting/Abandoning Driver "CCR" (master 1)

INFO: nn::ipc avoided busy close on /dev/acp_main (moduleId = 301, tag = 0) from pid = 21

00;00;23;790: *** Process 7 exited with interrupt handler for vector 2 registered on core 1.

00;00;23;790: *** Process 7 exited with interrupt handler for vector 3 registered on core 1.

00;00;23;790: *** Process 7 exited with interrupt handler for vector 4 registered on core 1.

00;00;23;790: *** Process 7 exited with interrupt handler for vector 5 registered on core 1.

00;00;23;790: *** Process 7 exited with interrupt handler for vector 6 registered on core 1.

00;00;23;790: *** Process 7 exited with interrupt handler for vector 8 registered on core 1.

00;00;24;261: SystemFatal - Core 1 resume in error display (6)

00;00;24;261: SystemFatal - Core 2 resume in error display (6)

00;00;24;261: SystemFatal - Core 2 resume in error display (6)

00;00;24;261: !!!Abandoned Interrupt 5 for process 65535

00;00;24;261: !!!Abandoned Interrupt 2 for process 65535

00;00;24;261: Process 6 Delayed Start Acquire

00;00;24;278: OSSetting_SynchronousPrinting DISABLED

00;00;24;282: OSSetting_CrashDumpType 0, MINI dump after crash

00;00;24;321: TCL(6): init DONE

00;00;24;462: VPADInit() depricated, no need to call

00;00;24;463: VPAD Init end, BPERF: (0/24582177) Title PID=6

00;00;24;464:

<><><><><><><> fatal error process called <><><><><><><>

00;00;24;464: TYPE: Corruption(2)

00;00;24;464: CODE: 1600103

00;00;24;464: Process: 2

00;00;24;464: Internal Code: 269280488

00;00;24;464: Function __FSCheckAndSwitchErrorProc, Line:107



00;00;24;560: ERPRC: System version: 5.5.5 U

00;00;24;560: ERPRC: Serial number: FW410183102

00;00;24;560: ERPRC: Model number: WUP-101(02)

00;00;24;571: CSC: Product Code: WUP-N-HASE, Title Version (major): 13

00;00;24;586: CSC: Repaired: FALSE, Wagon: FALSE

00;00;24;590: CSC: InitialLaunch stage: 0

00;00;24;592: CSC: USB Storage Connected: FALSE, Device Type: NAND

00:00:24:747: NET: >>> Received request to kill all sockets.

00:00:24:747: NET: Socket binding (resource: 0x00001a80)

00:00:24:748: NET: Change admin state (2 -> 2)(iface:0 link:2)

00:00:24:748: NET: Change admin state (0 -> 2)(iface:1 link:2)

00:00:24:748: IFNET_ETH: Configuring link adminState to DOWN.

00;00;24;636: CSC: TV Port: HDMI, TV Aspect Ratio: 16:9

00;00;24;643: CSC: TV Resolution: TV_1080P

00;00;24;643: CSC: CODE: [HASE-001X-XX75]

00;00;24;644: ERPRC: Console status code: HASE-001X-XX75

2022-05-22 11:10:54 - log collection event from pid 20

00:00:24:776: MCP: life time number of fatal errors - 5
`

Post automatically merged: Jun 29, 2023

files.catbox.moe/2f8v52.7z

 

[SDIO]

00:00:23:412: mmc_core card err: idx=3, lba=54831104, blks=1024, xfer=0x1, ret=0x00200b40
00:00:23:585: mmc_core card err: idx=3, lba=54838272, blks=1024, xfer=0x1, ret=0x00200b40
00:00:23:639: mmc_core card err: idx=3, lba=54838272, blks=1024, xfer=0x1, ret=0x00200b40
00:00:23:640: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:23:640: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00:00:23:712: mmc_core card err: idx=3, lba=54838272, blks=1024, xfer=0x1, ret=0x00200b40
00:00:23:766: mmc_core card err: idx=3, lba=54838272, blks=1024, xfer=0x1, ret=0x00200b40
00:00:23:766: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:23:767: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00;00;23;648: FS: READ_FILE      upid:[ 2] sts:[MEDIA_ERROR] hnd:[0x3b805cc] dst:[0x3d6d94c0] size:[1] cnt:[1048576] pos:[0

That's a bad eMMC. You need to replace itm either with a SD or another eMMC. There is no point in trying to fix titles before the the eMMC isn't replaced, as it will only get worse and make the repair more complicated

 

[MattTheTekie]

00:00:23:412: mmc_core card err: idx=3, lba=54831104, blks=1024, xfer=0x1, ret=0x00200b40
00:00:23:585: mmc_core card err: idx=3, lba=54838272, blks=1024, xfer=0x1, ret=0x00200b40
00:00:23:639: mmc_core card err: idx=3, lba=54838272, blks=1024, xfer=0x1, ret=0x00200b40
00:00:23:640: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:23:640: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00:00:23:712: mmc_core card err: idx=3, lba=54838272, blks=1024, xfer=0x1, ret=0x00200b40
00:00:23:766: mmc_core card err: idx=3, lba=54838272, blks=1024, xfer=0x1, ret=0x00200b40
00:00:23:766: mdblk: err=-131099, mid=0x90, prv=0x5c, pnm=[HYNIX ]
00:00:23:767: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
00;00;23;648: FS: READ_FILE      upid:[ 2] sts:[MEDIA_ERROR] hnd:[0x3b805cc] dst:[0x3d6d94c0] size:[1] cnt:[1048576] pos:[0

That's a bad eMMC. You need to replace itm either with a SD or another eMMC. There is no point in trying to fix titles before the the eMMC isn't replaced, as it will only get worse and make the repair more complicated

Can we try?

 

[SDIO]

I won't waste my time and effort for a lost cause and making things worse. And I don't think you should either. Maybe someone else will.
Without replacement it will just get worse. Every write will make it worse. The only sensible thing wo do would be to dump otp and slc + mlc (with the custom recovery) and then turning the Wii U off till it is replaced. As the state of the SLC and the MLC are connected through the SLC cache, you also can't simply use and older MLC dump to go back, you would also need to flash the SLC, which is a lot of work.

 

[MattTheTekie]

I won't waste my time and effort for a lost cause and making things worse. And I don't think you should either. Maybe someone else will.
Without replacement it will just get worse. Every write will make it worse. The only sensible thing wo do would be to dump otp and slc + mlc (with the custom recovery) and then turning the Wii U off till it is replaced. As the state of the SLC and the MLC are connected through the SLC cache, you also can't simply use and older MLC dump to go back, you would also need to flash the SLC, which is a lot of work.

Is this not a matter of replacing the files like the previous user, or is it worse then that? I won't drag you into it. I just wanted to know.

 

[SDIO]

The actual physical Memory Chip is failing. It's a Hardware problem. You won't fix that in Software.

 

[MattTheTekie]

The actual physical Memory Chip is failing. It's a Hardware problem. You won't fix that in Software.

I figured, I can't move the folders no matter what I do. I know it would get worse, but am I doing this right? I'l stop buggin ya.
>>> w.mv("sys/title/00050010/10048100", "test")
WARNING: MOVING A FILE OR FOLDER CAN BRICK YOUR CONSOLE, ARE YOU SURE (Y/N)?
y
moving /vol/storage_mlc01/sys/title/00050010/10048100 to /vol/storage_mlc01/test failed : 0xfffcffde

 

[SDIO]

you can't move it from sys to the root, as sys is it's own quota. Also why do you think parental controls is the problem?

 

[MattTheTekie]

you can't move it from sys to the root, as sys is it's own quota. Also why do you think parental controls is the problem?

I never said parental control is a problem and there not set?

Post automatically merged: Jun 29, 2023

you can't move it from sys to the root, as sys is it's own quota. Also why do you think parental controls is the problem?

What do i do to move
/vol/storage_mlc01/title/00050010/10048100 to a "safe" place?

 

[SDIO]

Then why are you tying to move it?
Whatever you are trying to do here stop, this won't end well.

 

[MattTheTekie]

Il stop.

Post automatically merged: Jun 29, 2023

Then why are you tying to move it?
Whatever you are trying to do here stop, this won't end well.

I was trying to delete the thing and reinstall it, but im thinking the system knew the nand was borked and stopped itself.

 

[SDIO]

I was trying to delete the thing and reinstall it

but why?

 

[MattTheTekie]

but why?

I wanted to try anyway, but i'd have to pay someone to install nand-aid. So I tried a cheap fix first--you never know what you'l get out of it. I'l have to go for nand-aid.

Post automatically merged: Jun 30, 2023

but why?

I'm not having any bad blocks only errors in the mlc when dumping via UDPIH. Do you think the NAND is bad or do you think the NAND's FS is just corrupt? I got someone who can help out if I need it with NAND-AID.

 

[lufeig]

Posting just thank everyone involved in this post, directly and indirectly!

I've just purchased a japanese Wii U, bricked it trying to change its language, and thanks to the information shared in various messages on the first page, I managed to unbrick it without having to hardmod it to restore a nand dump.

I downloaded the encrypted Wii U Menu using JNUSTool and wrote it using the UDPIH recovery menu.

Thank you very much!!!

 

[SDIO]

I'm not having any bad blocks only errors in the mlc when dumping via UDPIH. Do you think the NAND is bad or do you think the NAND's FS is just corrupt? I got someone who can help out if I need it with NAND-AID.

Sorry for the late answer, gbatemp doesn't notify if the answers get merged, so I didn't get a notification.

The recovery menu NAND-Dumper won't report bad blocks for a bad hynix, it will only report errors. The algorithm is to first try to copy large blocks, if that fails a error is reported and then it copies one sector at a time. For some reason the eMMC or FSA doesn't report errors on these single sector reads. And only errors on single sector reads would be counted as bad blocks.

From the logs you showed I am pretty sure your eMMC is bad. And if you see errors during the mlc dump (slc dump errors are expected) then you can be sure your eMMC is bad.

 

[MattTheTekie]

Sorry for the late answer, gbatemp doesn't notify if the answers get merged, so I didn't get a notification.

The recovery menu NAND-Dumper won't report bad blocks for a bad hynix, it will only report errors. The algorithm is to first try to copy large blocks, if that fails a error is reported and then it copies one sector at a time. For some reason the eMMC or FSA doesn't report errors on these single sector reads. And only errors on single sector reads would be counted as bad blocks.

From the logs you showed I am pretty sure your eMMC is bad. And if you see errors during the mlc dump (slc dump errors are expected) then you can be sure your eMMC is bad.

I've been able to fill it up to less then 5G (currently) no issues. I have cfw and themes, etc, even the vwii is full of roms, but I get you. Thank you for you're insight.

Post automatically merged: Jul 8, 2023

Posting just thank everyone involved in this post, directly and indirectly!

I've just purchased a japanese Wii U, bricked it trying to change its language, and thanks to the information shared in various messages on the first page, I managed to unbrick it without having to hardmod it to restore a nand dump.

I downloaded the encrypted Wii U Menu using JNUSTool and wrote it using the UDPIH recovery menu.

Thank you very much!!!

I did too (mine was american tho) but it wasnt the menu that was the issue for me. It was 5 other apps.

Post automatically merged: Jul 8, 2023

This thread was very helpful. I wouldn't of been able to do this without it.

Post automatically merged: Jul 8, 2023

Sorry for the late answer, gbatemp doesn't notify if the answers get merged, so I didn't get a notification.

The recovery menu NAND-Dumper won't report bad blocks for a bad hynix, it will only report errors. The algorithm is to first try to copy large blocks, if that fails a error is reported and then it copies one sector at a time. For some reason the eMMC or FSA doesn't report errors on these single sector reads. And only errors on single sector reads would be counted as bad blocks.

From the logs you showed I am pretty sure your eMMC is bad. And if you see errors during the mlc dump (slc dump errors are expected) then you can be sure your eMMC is bad.

errors = bad blocks in this case. im suprised its not dead the way its filled up. not sure what to say.