Warning

Use this at your own risk. Messing with the isfs superblocks is dangerous and can brick your Wii U. Make sure to make a SLC backup before installing isfshax. If something goes wrong, you will need defuse to restore this backup. The superblock linked here was tested and confirmed working. Installing an broken superblock will brick your Wii U.
Also while ISFShax is installed standby services and with that the quick start menu won't work. (Your Wii U will hang once you turn it off till you remove power if standby services are enabled).
Also keep in mind: if you are restoring an old SLC backup, which was taken before installing ISFShax, ISFShax will remove by restoring that backup.

To protect against Nintendo pushing a boot1 update (very unlikely, but you newer know), which would brick a console with ISFShax, system updates get blocked by the wafel_isfshax_patch.ipx plugin. If you need to do a system update, you can use the v1.0 of said plugin, which doesn't contain the update block. Game updates are not affected.

Update

04.04.2024 - Add Fastboot
13.03.2024 - System updates now get blocked by the wafel_isfshax_patch.ipx plugin.
29.12.2023 - Standby Services are now supported. For that to work you need to have the latests ISFShax superblock installed and need to use the latest minute fw.img and wafel_core.ipx. Also autoboot needs to be enabled.

What is this for?

ISFShax exploits boot1 with specially crafted ISFS (the filesystem of the SLC) superblock. Once it is installed ISFShax provides similar capabilities to defuse once it is installed. Since it launches before IOSU, so it can be used to apply early patches to IOSU and can be used to fix most bricks. But it won't protect you of bricks caused by: breaking boot1, seeprom bricks or installing a broken ISFShax superblock. ISFShax also doesn't help you if you already bricked the Wii U.
Usecases are:

• Rebuilding / upgrading the MLC
• Removing 64GB MLC limit and disabling SCFM
• Brick protection (e.g. before doing region change)
• Cold booting redNAND (useful when when the eMMC is failing)
• It gives a minimal CFW, which can launch old homebrew using the homebrew launcher (not sure how usefull since we have Aroma and Tiramisu)
• Stop the Wii U from turning the Tablet on during boot (using a stroopwafel plugin)

Choosing the Exploit

There are multiple ways to launch the ISFShax installer:
If you already have Tiramisu or Aroma installed and can launch it follow the Instructions for [Tiramisu]
If the Browser still works and you can launch the browser exploit u.wiidb.de follow the Instructions for [Browser]
If you can't access the Browser, but Settings still work follow Instructions for [DNSpresso]
If you your Wii U crashes in the initial setup on Mii creation follow Instructions for [DNSpresso]
If your Wii U can't launch the browser anymore or can't connect to the internet follow the Instructions for [UDPIH]
Steps without a prefix apply to all.

Preparing the SD card

Make sure the SD card is formatted FAT32 (already the case if you are using it for Tiramisu). You can use guiformat for that.

Get the following files and put them in the root of the SD. Choose the release tagged with "Latest" for each.

1. ISFShax installer (ios.img) from https://github.com/isfshax/isfshax_installer/releases
2. ISFShax superblock.img and superblock.img.sha from https://github.com/isfshax/isfshax/releases
3. Put the stroopwafel wafel_core.ipx from https://github.com/jan-hofmeier/stroopwafel/releases in wiiu/ios_plugins
4. Put the wafel_isfshax_patch.ipx stroopwafel plugin from https://github.com/isfshax/wafel_isfshax_patch/releases in wiiu/ios_plugins
5. [Tiramisu | Browser | DNSpresso] minute fw_encrypted.img from https://github.com/jan-hofmeier/minute_minute/releases and rename to fw.img
6. [Browser | DNSpresso] fw_img_payload from https://github.com/wiiu-env/fw_img_payload/releases extract the zip and put the wiiu folder, containing the payload.elf on the SD
7. [DNSpresso] Extract the root.rpx from https://github.com/wiiu-env/PayloadFromRPX/releases and rename it to launch.rpx and place it in the root of the SD card
8. [UDPIH] minute fw.img and boot1.img from https://github.com/jan-hofmeier/minute_minute/releases
9. [UDPIH] recovery_menu from https://github.com/jan-hofmeier/recovery_menu/releases

The structure on the SD should look like this:

boot1.img (only for UDPIH)
fw.img
ios.img
recovery_menu   (only for UDPIH)
superblock.img
superblock.img.sha
wiiu
    ios_plugins
         wafel_core.ipx
         wafel_isfshax_patch.ipx

Launching into minute

This step heavily depends on the used Exploit.

Spoiler: Tiramisu

1. Hold B on the Gamepad while booting (if coldboot is enabled) or launching the H&S app
2. A black and white menu should show up asking you to choose a payload.
3. Select fw_img_loader

Spoiler: Browser

1. Open the Browser and browse to u.wiidb.de
2. Click on "HAXX"

Spoiler: DNSpresso

If you can a access the settings just follow these instructions (you already have the right files on the SD): https://gbatemp.net/threads/dnspresso-a-wii-u-dns-exploit.642123/
If you are stuck on the Mii creation in the Inital setup:

1. If you already connected your Wii U to your AP / Router, turn the AP / Router or the Wifi on it off.
2. When the setup asks you if you already have a NNID, say yes (even if you don't have one)
3. Now it tries to connect to the Internet, but will fail and ask you to take you back to the Wifi settings, follow back to thge settings.
4. Turn your Router / AP on again and give it time to start.
5. If you don't already have your Wifi configured there, connect to it now, but enter a wrong password.
6. Edit your wifi connection and configure 85.215.57.182 as Primary DNS, if you entered a wrong password before set the right one now.
7. Press (B) Back and select Connection Test.

Spoiler: UDPIH

1. Load the recovery using UDPIH: https://gbatemp.net/threads/udpih-usb-host-stack-exploit-recovery-menu.613369/ (don't replace the recovery_menu)
2. Unplug the Pico
3. select the "Load BOOT1 payload" and proceed. (If you don't have screen output: 18x eject, 1x power, 1 eject, 1 power)

Now you should see the minute main menu. If not something went wrong, make sure you have the correct fw.img file on the SD.
In minute you move the cursor with the power button and enter with the eject button (swapped compared to the recovery menu).

Note minute only outputs 1080p through HDMI, no picture on the gamepad, and nothing on the analog outputs.
Some people reported that the screen output is not working for them when minute was loaded from the recovery. If you made sure nothing else is the problem (right fw.img, TV supports 1080p HDMI), you can still follow along blindly by pressing the approriate buttons. Make sure to wait long enough between the presses, so the system has time to load. Without display output skip the first backup and go directly to Installing ISFShax.

Backup

1. Navigate to Backup and Restore
2. Dump SEEPROM & OTP
3. Dump SLC.RAW
4. Return to Main Menu

Installing ISFShax

1. Choose Boot `ios.img` (5x Power, 1x Eject)
2. Now the ISFShax installer should launch (this takes a few seconds)
3. Follow the Instructions on the screen, the buttons are the same as in minute. (3x Eject, 1x Power, 3x Eject)
4. The console should now turn off.
5. [Tiramisu | Browser | DNSpresso] replace the (encrypted) fw.img on the SD with the fw.img (NOT the encrypted one) from https://github.com/jan-hofmeier/minute_minute/releases
6. If the install was successfull the Wii U should directly start into minute once you turn it on again.

Backup ISFShax

Dump the SLC.RAW again. This will overwrite the previous SLC.RAW file on the SD. This is required if you need to restore the SLC for unbricking, without loosing ISFShax. Keep that backup in a safe place.

Booting

If you came here from the redNAND or the MLC rebuild tutorial continue with that tutorial now.

For now your Wii U needs the SD card to boot. From there it loads minute (fw.img), which then applies the required patches from SD card. (IOSU needs to be patched, so it doesn't fall over the ISFShax superblock).
To boot into the Wii U OS select Patch (sd) and boot IOS (slc)

Aroma / Tiramisu

1. To install Aroma or Tiramisu put the corresponding files on the SD.
   Tiramisu: https://tiramisu.foryour.cafe/
   Aroma: https://aroma.foryour.cafe/ (You don't need to have install Tiramisu to have Aroma, also the FTPiiU plugin will become handy later)
2. Put the wafel_payloader.ipx in the ios_plugins folder https://github.com/jan-hofmeier/wafel_payloader/releases
3. Put the root.rpx from PayloadFromRPX in the wiiu folder on the SD https://github.com/wiiu-env/PayloadFromRPX/releases

Note: if you are already coldbooting Tiramisu / Aroma via the PayloadLoaderInstaller, you have to disable the coldboot in the PayloaderLoaderInstaller first. For more detailed instructions on this, see this post by ZaMaster: https://gbatemp.net/threads/how-to-set-up-isfshax.642258/post-10343876

Booting without SD

This step is optional but highly recommended. Now the Wii U doesn't show anything on the screen without the SD. That could lead to confusion if the SD ever gets lost or corrupts.
To make it from the internal memory we need to install the minute fw.img and the ios_plugins to the SLC. This can be accomplished using FTPiiU Everywhere, which can be launched from Tiramisu and is already part of the Aroma Package (enable Everywhere in the settings) or you can use the haxcopy homebrew https://github.com/mackieks/haxcopy/releases
Using haxcopy is recommended for most users, but if you copy a wrong plugin to the slc or need to delete one for whatever reason you still have to use FTP for that.

Spoiler: haxcopy

1. create a folder hax on the SD card (this will be copied to the slc)
2. copy the fw.img to the hax folder
3. create a subfolder ios_plugins in the hax folder
4. rename the wafel_core.ipx to 0core.ipx and copy it to the hax/ios_plugins folder
5. rename the wafel_isfshax_patch.ipx to 6isfshax.ipx and copy it to the hax/ios_plugins folder
6. if you want to coldboot aroma or tiramisu, rename the wafel_payloader.ipx to 9payldr.ipx and copy it to the hax/ios_plugins folder
7. If you need any other plugins like the wafel_unlimit.ipx, you have to rename and copy it to the hax/ios_plugins folder
8. Copy the haxcopy app to the wiiu/apps folder (like you usually install homebrew)
9. Put the SD in the Wii U and run haxcopy to copy the hax folder to the slc.

Spoiler: FTP

On Aroma you have to make sure access to system files is enabled:

1. Open the Aroma Plugin Configuration Menu using L + Down + SELECT (-) on the GamePad or Pro Controller (or B + Down + Minus (-) for WiiMotes)
2. Open the FTPiiU option, then settings and set ‘Allow access to system files’ to ‘true’ by pressing A

Uploading the files:

1. (Tiramisu only) Make sure FTPiiU Everywhere is running on the Wii U
2. Using a FTP client on the PC browse to /storage_slc/
3. If you see a scfm.img file and sys folder go into the sys folder. If you see a bunch of folders (config import logs proc rights security title tmp) just go to the next step.
4. create a subfolder hax and enter it
5. Make sure your FTP client is in binary mode (not ASCII mode)
6. upload the minute fw.img to the /storage_slc/sys/hax folder
7. create another subfolder ios_plugins in /storage_slc/sys/hax
8. enter that /storage_slc/sys/hax/ios_plugins folder
9. rename the wafel_core.ipx to 0core.ipx and upload it
10. rename the wafel_isfshax_patch.ipx to 6isfshax.ipx and upload it
11. if you want to coldboot aroma or tiramisu, rename the wafel_payloader.ipx to 9payldr.ipx and upload it
12. If you need other plugins like the wafel_unlimit.ipx, you have to rename and upload them too

Now the Wii U should autoboot if no SD card is inserted.
If a SD card is inserted the minute menu should show up (even if the SD doesn't contain a fw.img). In that menu you can select the Patch (slc) and boot IOS (slc) to load the plugins from the slc and boot (no need to have them on the SD anymore).

The Wii U will first try to load the fw.img from the SLC and if that fails it falls back to the SD.
If you installed a broken fw.img which doesn't load, you can force isfshax to load the fw.img from sd by repeatly pressing power till the menu shows up.

Warning: A factory reset will delete the hax folder. Without the fw.img on the SD the Wii U will then just have a black screen with a orange LED

Optional Autobooting with SD

To make the Wii U autoboot with an SD card inserted you need to create the file sd:/minute/minute.ini with the following content:

[boot]
autoboot=1
autoboot_timeout=3

You can adjust the timeout (in seconds) to your liking. The autoboot option specifies which entry from the minute menu will be loaded. 1 corresponds to Patch (slc) and boot IOS (slc), which loads the ios_plugins from the SLC. If you haven't installed them to the SLC or want to load them from the sd for another reason you can change that value to 3 which corresponds to Patch (sd) and boot IOS (slc)

As an Alternative check out the Fastboot option below.

Optional: Fastbooting (Advanced)

To make the Wii U boot as fast as possible, without showing minute, you can now use the fw_fastboot.img. This won't work with redNAND
It is hardcoded to go straight to the first option (booting the slc, with patches from SLC). It won't display anything and ignore any autoboot configuration in the minute.ini.

1. First make sure the system can boot using the first option in minute. (see booting without SD)
2. Replace the the fw.img in the hax folder on the SLC with the fw_fastboot.img (renamed to fw.img)

In case you ever get stuck and need to load the full minute from SD you can do this:

1. Place the minute fw.img on the SD card
2. repeatedly press the power button until the minute menu shows up on the screen.

Uninstalling ISFShax

DON'T just restore an older SLC backup, as that would break SCFM!

• Make sure your Wii U doesn't depend on any patches (linke wafel_unlimit_mlc.ipx or redNAND). You can check that by booting with only the wafel_core.ipx and the wafel_isfshax_ipx plugins in the ios_plugins directory on the SD and using the Patch (sd) and boot IOS (slc) option
• Delete the /storage_slc/sys/hax folder if you set up the slc booting
• run the ISFShax installer again from minute and follow the on screen instructions to uninstall.

Credits

• @rw-r-r_0644 for finding and implementing isfshax
• @GaryOderNichts and ashquarky for their direct contributions and help
• @vgmoose for all the support and for the Wii U that replaced the one Idestroyed during early isfshax testing
• @Maschell for his help and all other contributions to the Wii U scene
• hexkyz for the warmboot boot1 exploit which made all of this possible
• @shinyquagsire23 for de_Fuse, minute and stroopwafel
• Salt Team for the original minute CFW
• dimok789, FIX94 and others for the iosuhax CFW
• fail0verflow for mini
• and all other contributors to the Wii U scene!

 

[SDIO]

Try uploading the fw.img again.
Can you show a screenshot of how you set up the files on the slc?

 

[fvig2001]

Here are the screenshots. This was done using Patch (sd) and boot IOS (slc)->tiramisu->ftp, which boots up my actual nand. I probably will be able to check again probably after 24 hours since it's pretty late here.

The strange thing for me was that the folders and files were already there. I had refreshed winscp to make sure it was correct. I had retried it and still orange with sd card removed.

Is there an effect if I stupidly did this instruction on the rednand first?

Thanks

 

[XDeltaOne]

Yes, Aroma and Tiramisu work as usual (and you don't even need sigpatches, as that is already done by stroopwafel)

If I used Aroma Autoboot, is it okay if I leave the setup as is or do I then remove Autoboot because of the Rednand?

 

[SDIO]

Did you make sure to upload the files in binary mode and not in ASCII Mode?

Post automatically merged: Nov 5, 2023

If I used Aroma Autoboot, is it okay if I leave the setup as is or do I then remove Autoboot because of the Rednand?

You can leave it. If you only do MLC redirection and do the rebuild MLC step it will actually remove the aroma autoboot, when the Wii u menu is installed. But there is no harm in reenabeling it after.
The only problem you could run into when doing MLC only redirection is, that you have tiramisu only installed in the redNAND with enabled autoboot and then try to boot the sys nand (or vice versa) then it will boot straight into the H&S app and you can't escape it. But then that can be easily fixed by just removing the autoboot again, so I wouldn't worry about that.

 

[CrazySquid]

Amazing! Just a question, but will this allow us to restore both MLC and SLC? Just like the Wii with BootMii could restore it's NAND?

 

[SDIO]

Yes it is possible to restore the NAND, but it is risky and more complicated because of SCFM, so that should only be the last resort. You should always ask before restoring the backup in almost all cases there is a safer way.

Things to keep in mind while restoring:

• If the SLC backup didn't already have ISFShax installed, you will loose ISFShax by restoring and leaving you in a potential bricked state.
• The SLC holds a cache for the MLC, so you generally need to backup and restore both together. You would first restore the MLC and immediately after the SLC. The only exception to that is if the backup was taken using the recovery, in that case you can restore the MLC alone and then delete SCFM.img using minute.
• To restore the SLC you need an Image which includes the spare data, this image is 528MiB big. The rednand slc partitions are without this spare data, these are only 512MiB. Same for the SLC.bin from the recovery dumper, it doesn't have the spare data. The spare data can be rebuild using the PC tool nandFixer
• restore redNAND in minute only restores the MLC, not the SLC

 

[eof07]

Make sure you have the right fw.img file on the SD. The one wich is NOT encrypted

that worked help is much appreciated thx

 

[XDeltaOne]

Yes it is possible to restore the NAND, but it is risky and more complicated because of SCFM, so that should only be the last resort. You should always ask before restoring the backup in almost all cases there is a safer way.

Things to keep in mind while restoring:

• If the SLC backup didn't already have ISFShax installed, you will loose ISFShax by restoring and leaving you in a potential bricked state.
• The SLC holds a cache for the MLC, so you generally need to backup and restore both together. You would first restore the MLC and immediately after the SLC. The only exception to that is if the backup was taken using the recovery, in that case you can restore the MLC alone and then delete SCFM.img using minute.
• To restore the SLC you need an Image which includes the spare data, this image is 528MiB big. The rednand slc partitions are without this spare data, these are only 512MiB. Same for the SLC.bin from the recovery dumper, it doesn't have the spare data. The spare data can be rebuild using the PC tool nandFixer
• restore redNAND in minute only restores the MLC, not the SLC

Hey, I'm sorry that I have to ask such a stupid question again, but I created a rednand over a minute, but when I want to boot it I always get stuck in the Wii U logo, can you help me with that, I have one more question: can I enlarge the MLC Nand? And for some reason the Wii U became slower when I loaded normally using the Nand.

 

[SDIO]

Hey, I'm sorry that I have to ask such a stupid question again, but I created a rednand over a minute, but when I want to boot it I always get stuck in the Wii U logo

did I get you right, that you were using the "format rednand" option in minute and then configured mlc and slc to true in the ini and left scfm enabled? (best would be if you show your rednand.ini) If all that is true then there seems to be a problem with the format rednand, as someone else is having the same problem.
For now you can set up a fresh MLC, for taht format the mlc partition to NTFS, disable scfm in the ini and run the MLC setup like described in the tutorial.

can I enlarge the MLC Nand?

Only while reformatting and reinstalling it. But for now it looks like you have to do that anyway. Till the format problem is investigated.

And for some reason the Wii U became slower when I loaded normally using the Nand.

What exactly do you mean by that? What is taking longer?

 

[XDeltaOne]

did I get you right, that you were using the "format rednand" option in minute and then configured mlc and slc to true in the ini and left scfm enabled? (best would be if you show your rednand.ini) If all that is true then there seems to be a problem with the format rednand, as someone else is having the same problem.
For now you can set up a fresh MLC, for taht format the mlc partition to NTFS, disable scfm in the ini and run the MLC setup like described in the tutorial.


Only while reformatting and reinstalling it. But for now it looks like you have to do that anyway. Till the format problem is investigated.


What exactly do you mean by that? What is taking longer?

I used this config.
[partitions]
slccmpt=true
slc=true
mlc=true
[scfm] disable=false
allow_sys=false

I noticed that the homebrew on my Wii U takes longer to load, but I think it's Aroma.

 

[fate6]

as someone else is having the same problem.

Chiming in that I also formatted rednand with minute and enabled all partitions and scfm but get stuck on the wii u logo, swapped back to just running slc but wanted rednand working to try and mess around with converting my JP system into an NA one.

 

[XDeltaOne]

did I get you right, that you were using the "format rednand" option in minute and then configured mlc and slc to true in the ini and left scfm enabled? (best would be if you show your rednand.ini) If all that is true then there seems to be a problem with the format rednand, as someone else is having the same problem.
For now you can set up a fresh MLC, for taht format the mlc partition to NTFS, disable scfm in the ini and run the MLC setup like described in the tutorial.


Only while reformatting and reinstalling it. But for now it looks like you have to do that anyway. Till the format problem is investigated.


What exactly do you mean by that? What is taking longer?

I saw that you can delete this file SCFM with minute, are you sure it's easy?

 

[JIaroJIy4]

Sorry for dumbass question - probably it's addressed at minute environment or de_fuse - have anybody tested overclocking the GPU? Question is - is there even any benefit in 3D titles or in 99,5% cases system is bottlenecked by the CPU?
I can potentially test it (Wii U is attached to 144Hz capable capture card), but I just wonder if it has any real merit.

 

[Lapin]

Try uploading the fw.img again.
Can you show a screenshot of how you set up the files on the slc?

I'm having the same issue. I managed to install ISFShax, then replace the fw.img with the non-encrypted one and when I boot I don't see anything on the screen and the gamepad won't connect. I have every required file on the root of the SD and the stroopwafel ones on the required folder. Help.

 

[SDIO]

I saw that you can delete this file SCFM with minute, are you sure it's easy?

No don't delete it. Disable scfm via the ini.

probably it's addressed at minute environment or de_fuse - have anybody tested overclocking the GPU? Question is - is there even any benefit in 3D titles or in 99,5% cases system is bottlenecked by the CPU?

I am not sure if that requires defuse, haven't looked into it. But from what I saw it can improve the performance of certain games like BoW

I managed to install ISFShax, then replace the fw.img with the non-encrypted one and when I boot I don't see anything on the screen

Try copying the file again. Make sure it is the right (not the encrypted) one. Savely Eject it in Windows, not just remove it.

If nothing of that helps try a file system check on the card (and coping the file again after the check) and if that doesn't help, try another card.

 

[XDeltaOne]

No don't delete it. Disable scfm via the ini.


I am not sure if that requires defuse, haven't looked into it. But from what I saw it can improve the performance of certain games like BoW


Try copying the file again. Make sure it is the right (not the encrypted) one. Savely Eject it in Windows, not just remove it.

If nothing of that helps try a file system check on the card (and coping the file again after the check) and if that doesn't help, try another card.

Hi, I wouldn't have done that easily either because it would have been too risky for me anyway.

Post automatically merged: Nov 9, 2023

Can I also deactivate it on the internal storage?

 

[SDIO]

Deactivating it would require a format of the internal storage and always running with the no scfm patch. Once the mlc was booted once with scfm on, it need the scfm.
Guess you could do a rednand config which redirects no partition, but disables scfm and then erase the MLC to reinstall it, but I didn't test that. There is also the wafel_unlimit_mlc.ipx stroopwafel plugin, which also disables scfm and gives you an extra GB of storage or so.
But I don't recommend disabeling scfm on the internal storage

 

[Lapin]

Try copying the file again. Make sure it is the right (not the encrypted) one. Savely Eject it in Windows, not just remove it.

If nothing of that helps try a file system check on the card (and coping the file again after the check) and if that doesn't help, try another card.

Thanks, but none of this worked. I managed to sort out that it boots into minute but I don't have any image on the TV or gamepad. By pressing the power button twice and then the eject button I can go to the correct option (3) and it boots into the WiiU menu. I'm now trying to see if I can progress with the tutorial for fixing the memory error 160-0103 but having a screenshot of the minute menu would really be helpful because I can't see what I'm doing.
EDIT: I managed to progress a little by going in blindly but the "Booting without SD" part doesn't work for me. The sys directory didn't exist in the /storage_slc, so I had to create it (not sure if I should). I copied the files and followed the instructions but if I select the first option in the minute menu, Patch (slc) and boot IOS (slc), the WiiU doesn't boot. The third option, Patch (sd) and boot IOS (slc), works.
I'm now considering uninstalling ISFShax but I can't without a video or full description of what options to choose, because, again, I can't see anything on the minute menu.
EDIT2: After much experimenting, I did find a way to see the minute menu. If I select the third option, I can enter the WiiU menu, which has Tiramisu installed. Now pressing B while entering the health and safety app I can see the environment loader and from there choose fw_img_loader and now the minute menu is visible. Doesn't sort out the problem but it's a fix.

 

[SDIO]

That's probably a problem with the display init specific to your TV. When you launch it from the fw_img_loader the DIsplay was already initialized by IOSU.
The problem with screenshot would be that they become outdated as I add features.
For each release of minute you can find the commit on left, for the now current release it says 7aeece8 for example. If you click on that it brings you to the commot and there you can cllick browse files. You can then go to the source folder where you find the main.c

In the main.c you find the definition of the main menu, something like that:

   {
            {"Patch (slc) and boot IOS (slc)", &main_quickboot_patch_slc},
            {"Patch (sd) and boot IOS redNAND", &main_quickboot_patch_rednand},
            {"Patch (sd) and boot IOS (slc)", &main_quickboot_patch}, // options
            {"Patch (sd) and boot sdmc:/ios_orig.img", &main_swapboot_patch}, // options
            {"Patch (sd) and boot sdmc:/ios_orig.img redNAND", &main_swapboot_patch_rednand},
            {"Boot 'ios.img'", &main_quickboot_fw},
            {"Boot IOP firmware file", &main_boot_fw},
            {"Boot PowerPC ELF file", &main_boot_ppc},
            {"Backup and Restore", &dump_menu_show},
            {"Interactive debug console", &main_interactive_console},
            {"PRSH tweaks", &prsh_menu},
            {"Display crash log", &main_get_crash},
            {"Clear crash log", &main_reset_crash},
            {"Restart minute", &main_reload},
            {"Hardware reset", &main_reset},
            {"Power off", &main_shutdown},
            {"Credits", &main_credits},
            //{"ISFS test", &isfs_test},
    },
    15, // number of options
    0,
    0
};

Also note I had set the number of options to 15 instead of 17 in that release, so the menu will miss the last two options.

You find a similar definition of the Backup and Restore sub menu in the dump.c. But when dumping you also have to confirm a few things sometimes. So you would need to look a the code to know when to press which button...

 

[CrazySquid]

Hm... I think it's impossible for ISFSHax to work with Quick Start Menu and standby features?