Tutorial  Updated

How To: Upgrading / Rebuilding Wii U Internal Memory (MLC)

Warning

This tutorial is only for advanced users and has a serious risk of bricking the console. Make sure you read it completely before executing any step and that you understand every step and its implications. With de_Fuse everything should be unbrickable if you know how.

You should at least have a backup of SLC and SLCCMPT, as we can’t rebuild them at the moment. (can be done in minute_minute, so there is no excuse). We had two cases where the SLC corrupted for an unknown reason, so a backup is essential.

What is this for?

This tutorial goes into rebuilding the MLC from scratch on a clean media. This can become useful, if
  • the MLC (eMMC) chip died or corrupted the filesystem
  • the SCFM (SLC cache for MLC) became inconsistent
  • you want to upgrade the capacity of the internal storage.
  • you want to set up a redNAND without SCFM
If you have a bad eMMC chip, but the recovery still works (which is most likely), then there are also ways to fix it without a complete reformat.
If the LED is blinking blue, you have a SLC problem and not a MLC problem, so this tutorial won't help with that.

It will format your MLC, so all data on the internal Wii U memory will be lost.

Update

13.03.2024 - The wafel_setup_mlc.ipx now uses a built in IOSU function to create system folders, that should make sure the permissions are right, which caused problems with game updates in the past. It will also recreate the update folder (so system updates won't be blocked by that)

Prerequisites

Backing up save games


Do a backup of what you want to preserve, like savegames and Miis.
For Backing up Save games, it is recommended to use SaveMii. That requires that you have Tiramisu or Aroma running.
You can also move your savgames (or whole games) to USB, which should still be readable. When recreating the users after the rebuild, you just have to be carefull to create the users in the right order, to make the ID’s match. A backup by other means (Like savemii) is still recommended.
If you are using this tutorial to fix a failing eMMC you might not be able to use the other Backup options. In that case use the Dump MLC option in the Recovery. You can extract your data from there using wfs-extract.

Storage Options

The Wii U has two ways of connecting internal memory, each with its own drawbacks:
  • SDIO – On retail consoles the internal memory is a eMMC chip connected through an internal SDIO bus to the Latte chip. This SDIO bus can also use SD cards (hence the name SD IO). Access to media connected on the SDIO is cached through a file on the SLC, presumably to reduce writes on the MLC. This cache is called SCFM and it is the reason why you always need to backup / restore SLC and MLC together and doesn’t allow easy swapping of multiple SDs.
    IOSU also only supports 3 sizes of media on this bus: <=8GB, 32GB and 64GB. The size will be limited to the biggest it fits, the rest is unusable. This bus is limited to 26MB/s (4bit@52Mhz). For replacing the eMMC with an micro SD you can use MLC2SD or a similar Interposer. Soldering and micro SD adapter using wires, works too.
    It is recommended to use a 64GB Sandisk Max Endurance card (But similar card should also be fine), since the Wii U is known for writing much.

  • SATA – The Disc drive is connected through SATA, the connectors are different but the electrical signals are still the same. Some Kiosk consoles used this Interface to connect to a HDD. The type of the SATA device can be configured in the SEEPROM, so we can configure our retail consoles to also use a SATA HDD / SSD.
    NOTE: @QuarkTheAwesome is building an SATA adapter for that purpose, available soon™.

    The advantage of using this interface is, that the size isn’t limited (well WFS is limited to 2TB) and it doesn’t use SCFM, which makes some things easier and improves performance in some circumstances. The obvious disadvantage is that you can’t use your disc drive anymore. Without the Disc Drive vWii System Menu doesn't work. vWii Injectes / Wii VC from the eShop can still be used, but only when installed to USB. Also you still might need to disable the MLC on the SDIO bus, or else the wii u might still use the SDIO one if the SATA device takes too long to init.

  • redNAND – redirects the read / writes to one or more of the internal storage devices to paritions on the SD card. You can create an arbitrary size MLC partition on the SD card and set it up using this tutorial. SCFM can be easily disabled for the redNAND. The 64GB limit does not exist for redNAND if the SCFM is disabled. For redNAND we have a dedicated Tutorial here: https://gbatemp.net/threads/fixing-...-soldering-using-rednand-with-isfshax.642268/

Does that mean we can’t get more than 64GB on the SDIO bus? No, BUT it requires ISFShax / defuse to boot the console every time. @GaryOderNichts created a patch to remove the limits and always use the maximum size of the SDIO media and it also disables SCFM, because SCFM doesn’t work with more than 64GB and disabling SCFM improves performance and reduces wear on the SLC, at the cost of increasing wear of the MLC media. I packaged this patch in wafel_unlimit_mlc.

Rebuilding the MLC

Now that you decided what media you want to use as MLC, we can start with the actual process:
  1. Download all the mlc system titles for your region from NUS. This can be done conveniently with MLCRestorerDownloader by @Xpl0itU. Copy the otp.bin from the SD to the folder with the MLCRestorer Downloader so it can get the common key from there.

    You will get the output/MLC/{region} directory, which then contains a directory for each title. In total there should be 52 titles totaling ~1.1GiB.

    If your console has an old firmware it might also be necessary to get the latest SLC titles.

  2. On the root of your SD card (the one that will go in the front slot, not the MLC replacement) create a folder wafel_install. Then copy all 52 titles to the wafel_install folder, so it now contains the 52 subfolders, one for each title. If you want to reinstall / update SLC titles, you would also put them there.

  3. Attach your MLC media of choice. (If you are using SATA got to Backup and Restore, then at Set SATA Device in SEEPROM select GEN2-HDD (Kiosk CAT-I with HDD)).
    For installing MLC2SD look here: https://gbatemp.net/threads/using-n...emmc-fix-160-0103-system-memory-error.636361/ at the Soldering section.

  4. If you install to eMMC / MLC2SD, got to Backup and Restore and select Erase MLC and Delete scfm.img. If the Erase MLC fails, you can ignore that if it wasn't formatted as MLC before (from a failed install or so).

  5. Put the wafel_setup_mlc.ipx on the SD card in /wiiu/ios_plugins. If you want more than 64GB on SDIO you also need to put the wafel_unlimit_mlc.ipx there. If you install with wafel_unlimit_mlc.ipx, it will be permanently required and therefore also permanently requires ISFShax or defuse.

  6. [Optional, only when using defuse] Open the serial monitor on the PC (Putty / minicom) for defuse to see the setup progress. There will be no display output in the Wii U itself. I attached the whole serial log of a successfull install as a reference.

  7. Select Patch (sd) and boot IOS (slc) in minute to start the setup of your fresh MLC.During the setup you won't see anything on the screen. You have to go by the power led.
    The power LED will flash blue, while it is installing the titles.
    if something goes wrong the LED will turn orange, but it will continue as long as it is blinking.
    The LED will become static once it finished. You can now power off the console.
    If the led is blinking red, something fatal happend. Ask for help.
    During the setup a short log gets written to the SD: wafel_setup_mlc.log.
    In the end it will enable the initial setup on the next boot.

  8. Remove the wafel_setup_mlc.ipx from /wiiu/ios_plugins on the SD.

  9. Boot the console. Patch (sd) and boot IOS (slc)

  10. If everything worked, the initial setup should launch.

ISFShax only: Finalizing

If you are using the wafel_unlimit_mlc.ipx you need to keep ISFShax installed. If you haven't done already complete the "Booting without SD" step form the ISFShax tutorial but also add the wafel_unlimit_mlc.ipx renamed to 9unlimit.ipx to the /storage_slc/sys/hax/ios_plugins directory.
If you are not using the wafel_unlimit_mlc.ipx you can either uninstall ISFShax or keep it as a brick protection. If you keep it complete the "Booting without SD" step form the ISFShax tutorial.
The Wii U should now boot automatically if you don't have an SD in.
You probably also want to enable the autobooting now.

See Also

https://gbatemp.net/threads/wii-u-internal-storage-upgrades-are-possible.635629/

Pictures

512 GB SD card:
img_20230702_021647-jpg.381270


@QuarkTheAwesome 120 GB SSD:
img_2709-jpg.381271


Thanks

 

Attachments

  • serial-log.txt
    87.6 KB · Views: 56
Last edited by SDIO,

Fabioperez

Active Member
Newcomer
Joined
Jul 31, 2022
Messages
32
Trophies
0
Age
40
Location
San Gil
XP
227
Country
Colombia
No, JNUS is this: https://github.com/Maschell/JNUSTool/releases/tag/0.3b

IOSU is OSv10, so title ID 000500101000400A
I already have it but I get an error when trying to open it. It has three files, one is the executable jar, another is the config and another I edited the config file with the commonkey but nothing or I don't know how I have to put the commonkey
config

1http://ccs.cdn.wup.shop.nintendo.net/ccs/download
2[COMMONKEY] ## commonkey here no brackets?
3updatetitles.csv
4https://tagaya.wup.shop.nintendo.net/tagaya/versionlist/EUR/EU/latest_version
5https://tagaya-wup.cdn.nintendo.net/tagaya/versionlist/EUR/EU/list/%d.versionlist

my wii u is USA edit line 4 and 5?

Edit: @V10lator I already got it to work but it opens is a list of games I don't see the iosu or how it works jnus thanks
 

Attachments

  • 13.jpg
    13.jpg
    32.9 KB · Views: 50
Last edited by Fabioperez,

fringle

Well-Known Member
Member
Joined
Apr 16, 2009
Messages
704
Trophies
1
XP
1,108
Country
Canada
I already have it but I get an error when trying to open it. It has three files, one is the executable jar, another is the config and another I edited the config file with the commonkey but nothing or I don't know how I have to put the commonkey
config

1http://ccs.cdn.wup.shop.nintendo.net/ccs/download
2[COMMONKEY] ## commonkey here no brackets?
3updatetitles.csv
4https://tagaya.wup.shop.nintendo.net/tagaya/versionlist/EUR/EU/latest_version
5https://tagaya-wup.cdn.nintendo.net/tagaya/versionlist/EUR/EU/list/%d.versionlist

my wii u is USA edit line 4 and 5?

Edit: @V10lator I already got it to work but it opens is a list of games I don't see the iosu or how it works jnus thanks
Just use the command line or create a batch file with the following command:

java -jar JNUSTool.jar 000500101000400A
 
  • Like
Reactions: Fabioperez

SDIO

Well-Known Member
OP
Member
Joined
Feb 13, 2023
Messages
2,375
Trophies
0
Age
28
XP
1,631
Country
Germany
i am trying to revive a wii u with blinking blue light.
Blue blinking means boot1 has problems loading IOSU from the the SLC. This is not a MLC problem, so you can remove the SD replacment and connect the eMMC clk back.
Also we shouldn't try to install anything yet, so please remove all ios_plugins except the stroopwafel.ipx.

In 2.jpg we can see the opt.bin is missing. We need that, for both minute to load anything from slc, also to boot an iosu and to extract the slc.
You can dump it with minute. Got to the Backup and Restore menu and select "Dump OTP with PRSH hax".
With the otp dumped you can then select the first option (Patch and boot IOS) again and see how far it gets. Depending on the errors we will decide what to do next.
 

Fabioperez

Active Member
Newcomer
Joined
Jul 31, 2022
Messages
32
Trophies
0
Age
40
Location
San Gil
XP
227
Country
Colombia
Blue blinking means boot1 has problems loading IOSU from the the SLC. This is not a MLC problem, so you can remove the SD replacment and connect the eMMC clk back.
Also we shouldn't try to install anything yet, so please remove all ios_plugins except the stroopwafel.ipx.

In 2.jpg we can see the opt.bin is missing. We need that, for both minute to load anything from slc, also to boot an iosu and to extract the slc.
You can dump it with minute. Got to the Backup and Restore menu and select "Dump OTP with PRSH hax".
With the otp dumped you can then select the first option (Patch and boot IOS) again and see how far it gets. Depending on the errors we will decide what to do next.
Thanks, I already removed the SD module but when I did, it released 3 fuse points. I am taking everything apart again to rewire the rasberry pi pico. I don't think I'll be able to finish that job, as soon as I get everything back together I'll release de_fuse 0.7.1, extract otp.bin so I can move on, thanks.



edit 1

I have progress

1 I already did the soldering again and there was an error in them, fortunately it seems that there were no short circuits

I can also see the minute menu on both the TV monitor and the putty console. Apparently it was that mistake. I'm going to download otp.bin even though I already had it, only I downloaded it from the following backup and restore path and in the first option DUMP SEEPROM & OTP, every time I get it it writes me as de_fuseotp.bin I'll try the second option suggested by @SDIO I keep writing when I have more progress

[auto merge]1690417064[/auto merge]

@SDIO @V10lator @fringle @Ysecond as I see that this console is not in 5.5.x
 

Attachments

  • Patch and boot IOS.txt
    7.8 KB · Views: 37
Last edited by Fabioperez,

Ysecond

Well-Known Member
Member
Joined
Apr 27, 2023
Messages
186
Trophies
0
Age
26
XP
481
Country
China
as I see this console is not in 5.5.x
It looks like one of my consoles, but I haven't taken practical action yet,wait for SDIO guidance slightly, He/ She previously successfully guided the fixing of blinking blue lights. :)

EDIT:
My console:
Code:
ancast: ...00900000 -> 01900000
ancast: ...00a00000 -> 01a00000
ancast: done reading
ancast: decrypting slc:/sys/title/00050010/1000400a/code/fw.img...
ancast: fini
ancast: IOS image might not be 5.5?
wafel_setup_mlc.ipx
wafel_unlimit_mlc.ipx
ancast: pre-parsing plugin `sdmc:/wiiu/ios_plugins/wafel_core.ipx`
 
  • Like
Reactions: Fabioperez

SDIO

Well-Known Member
OP
Member
Joined
Feb 13, 2023
Messages
2,375
Trophies
0
Age
28
XP
1,631
Country
Germany
That looks better now, the otp is now correct and it can load the iosu from the slc. You don't see more output on the console, because it is to old. But what else is happening? Is the wii u just sitting there with a purple led or is it producing screen output or turning on the gamepad the gamepad?

If it is just sitting there: make sure the eMMC is connected back correctly.
Dump the slc again using minute, copy it to the PC an extract it with the Wii U NAND Extractor: https://github.com/koolkdev/wiiu-nandextract/releases/tag/0.1.0 you need to have the correct otp.bin in the same directory as the exe.
Then send us
  • /sys/logs (whole folder)
  • /sys/title/00050010/1000400a/code/app.xml
  • /sys/config/system.xml
Then run nandBinCheck from here: https://github.com/koolkdev/wiiuqt/releases/tag/v0.2 on your slc dump and show us the output.
 

Fabioperez

Active Member
Newcomer
Joined
Jul 31, 2022
Messages
32
Trophies
0
Age
40
Location
San Gil
XP
227
Country
Colombia
That looks better now, the otp is now correct and it can load the iosu from the slc. You don't see more output on the console, because it is to old. But what else is happening? Is the wii u just sitting there with a purple led or is it producing screen output or turning on the gamepad the gamepad?

If it is just sitting there: make sure the eMMC is connected back correctly.
Dump the slc again using minute, copy it to the PC an extract it with the Wii U NAND Extractor: https://github.com/koolkdev/wiiu-nandextract/releases/tag/0.1.0 you need to have the correct otp.bin in the same directory as the exe.
Then send us
  • /sys/logs (whole folder)
  • /sys/title/00050010/1000400a/code/app.xml
  • /sys/config/system.xml
Then run nandBinCheck from here: https://github.com/koolkdev/wiiuqt/releases/tag/v0.2 on your slc dump and show us the output.
@SDIO, I am writing to let you know that I am still working on this, I do not have the gamepad at hand because the battery is damaged and I asked for a replacement, I wait for it to arrive more or less two months, I am working on a battery mod while the new one arrives, everything that is seen in putty does not load on the TV monitor, the wii u stops there with the purple led, I will perform the SLC download again and perform the requested extraction
Post automatically merged:

@ I already made the backup of SLC again, download the indicated tools and in wii u nand extractor I enter the sys folder but the log folder does not appear the other requested files app.xml and system.xml if I found them I attach them as an image of the file tree of my SLC

On the other hand, with the nand checker I have problems I try to run it but it does nothing, I am running it by copying otp.bin and SLC.RAW in the same folder where the nand checker files are located, attached image of the files found in the nand checker folder

Edit 1
I attached info.txt which was what was shown on the screen when I made the backup of SLC, I also made backup SLCCMPT nand extractor and checker I am doing them with SLC

Edit 2
take the SLC file and drag it to the nand bin checker executable a console window opened but no file is generated so what I did was make a screen recording and frame by frame take images and the result is in the attached image number 5, a "bad hmac" error is observed
 

Attachments

  • 1.jpg
    1.jpg
    45.9 KB · Views: 51
  • 2.jpg
    2.jpg
    83.2 KB · Views: 49
  • files nand extractor.zip
    943 bytes · Views: 28
  • info.txt
    6.1 KB · Views: 23
  • 5.jpg
    5.jpg
    118.8 KB · Views: 48
Last edited by Fabioperez,

SDIO

Well-Known Member
OP
Member
Joined
Feb 13, 2023
Messages
2,375
Trophies
0
Age
28
XP
1,631
Country
Germany
Strange that the log folder doesn't exist. Maybe the Wii U never worked and therefore never created logs. Do you know it's history?
From the system.xml I can see that the console still uses OSv9 <default_os_id type="hexBinary" length="8">0005001010004009</default_os_id> That is probably the reason why it didn't boot, in your last attempt, because minute_minute is hardcoded to load OSv10 (what it did, but it probably doesn't work with your old firmware).
I have the strong suspicion, that your OSv9 is corrupted.

You can extract the OSv9 from your slc dump /sys/title/00050010/10004009 and then take a look at its app.xml to see it's version (int the <title_version> tag). The verion will either be 1005 or 1006
You can then use JNUS to download the OSv9 (change the last part for the right version):
Code:
java -jar JNUSTool.jar 0005001010004009 1006
You can then copy the fw.img from that download to the SD and name it ios_orig.img and then select the second option in minute and see what happen.
Also you can compare the files you downloaded to the ones extracted from your slc to see if there is any difference.


EDIT: nandBinCheck showed that the fw.img of OSv9 is corrupted, as I predicted. So what I wrote above should be on the right track.
 

Fabioperez

Active Member
Newcomer
Joined
Jul 31, 2022
Messages
32
Trophies
0
Age
40
Location
San Gil
XP
227
Country
Colombia
You can extract the OSv9 from your slc dump /sys/title/00050010/10004009 and then take a look at its app.xml to see it's version (int the <title_version> tag). The verion will either be 1005 or 1006
<?xml version="1.0" encoding = "utf-8"?>
<app type="complex" access="777">
<version type="unsignedInt" length="4">14</version>
<os_version type="hexBinary" length="8">0000000000000000</os_version>
<title_id type="hexBinary" length="8">0005001010004009</title_id>
<title_version type="hexBinary" length="2">03ee</title_version>
<sdk_version type="unsignedInt" length="4">20605</sdk_version>
<app_type type="hexBinary" length="4">1000000a</app_type>
<group_id type="hexBinary" length="4">00000000</group_id>
</app>

<title_version>03ee
 

SDIO

Well-Known Member
OP
Member
Joined
Feb 13, 2023
Messages
2,375
Trophies
0
Age
28
XP
1,631
Country
Germany
Thats hex, so in decimal it's 1006, whch is the latest version. So yoou can just omit this parameter and jnus will get the latest, which is 1006 (0x03ee) for you
 

Fabioperez

Active Member
Newcomer
Joined
Jul 31, 2022
Messages
32
Trophies
0
Age
40
Location
San Gil
XP
227
Country
Colombia
Thats hex, so in decimal it's 1006, whch is the latest version. So yoou can just omit this parameter and jnus will get the latest, which is 1006 (0x03ee) for you
wow my level of ignorance

edit1
I already downloaded with jnus, I had to edit the config file with the common key in case anyone is interested, I continue testing in 2 hours, I have to make lunch for my son

edit2 @SDIO
Patch and boot IOS
> Patch and boot ios_orig.img
Boot 'ios.img'
Boot IOP firmware file
Boot PowerPC ELF file
Backup and Restore
Interactive debug console
PRSH tweaks
Display crash log
Clear crash log
Restart minute
Hardware reset
Power off
Credits
ancast: no patch file `ios_orig.patch`, stubbing...
ancast: reading 0x77b200 bytes from ios_orig.img
ancast: ...00000000 -> 01000000
ancast: ...00100000 -> 01100000
ancast: ...00200000 -> 01200000
ancast: ...00300000 -> 01300000
ancast: ...00400000 -> 01400000
ancast: ...00500000 -> 01500000
ancast: ...00600000 -> 01600000
ancast: ...00700000 -> 01700000
ancast: done reading
ancast: decrypting ios_orig.img...
ancast: fini
ancast: IOS image might not be 5.5?
ancast: pre-parsing plugin `sdmc:/wiiu/ios_plugins/wafel_core.ipx`
ancast: loading plugin `sdmc:/wiiu/ios_plugins/wafel_core.ipx`
GPU clocked at: 544.999877MHz
Unmounting SLC...
Shutting down MLC...
sdhc_bus_power(0x0)
Shutting down SD card...
sdhc_bus_power(0x0)
Shutting down interrupts...
Shutting down caches and MMU...
Vectoring to 0x01000300...
Searching for OTP store in patch...
Searching for OTP store in plugins...
OTP store at: 27e23204
we in here kern 0x27e00fc0, base 0x27e00000
Inserted 27e00000 before e0000000 and after 20000000!
Inserted 27e00000 before e0000000 and after 27e00000!
Inserted 27e00000 before e0000000 and after 05200000!
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x1d000000 0x1d000000 0x00000920 0x00000920 0x000000 0x4
NOTE 0x0008f4 0x1d000920 0x1d000920 0x000002ac 0x000002ac 0x000000 0x4
LOAD 0x000034 0x1d000000 0x1d000000 0x00000bcc 0x00800000 0x000000 0x4000
LOAD 0x000ba0 0x04000000 0x08280000 0x0001450c 0x0001450c 0x300005 0x4
LOAD 0x0150ac 0x04020000 0x082a0000 0x00003f8c 0x00003f8c 0x300004 0x4
LOAD 0x019038 0x04024000 0x082a4000 0x00000748 0x00000748 0x300006 0x40
LOAD 0x019780 0x04025000 0x082a5000 0x00000000 0x00009590 0x300006 0x40
LOAD 0x019780 0x05000000 0x081b0000 0x0004fc80 0x0004fc80 0x100005 0x4
LOAD 0x069400 0x05050000 0x08200000 0x0000cacc 0x0000cacc 0x100004 0x40
LOAD 0x075ecc 0x0505d000 0x0820d000 0x00002af8 0x00002af8 0x100006 0x40
LOAD 0x0789c4 0x05060000 0x08210000 0x00000000 0x0003b300 0x100006 0x40
LOAD 0x0789c4 0x08120000 0x08120000 0x00014000 0x00014000 0x000005 0x10
LOAD 0x08c9c4 0x08140000 0x08140000 0x00001dc0 0x00001dc0 0x000004 0x10
LOAD 0x08e784 0x08142000 0x08142000 0x00009000 0x00009000 0x000006 0x10
LOAD 0x097784 0x0814c000 0x0814c000 0x00000000 0x00054f0c 0x000006 0x4000
LOAD 0x097784 0x10000000 0x10000000 0x00000000 0x00100000 0x100006 0x1
LOAD 0x097784 0x10100000 0x10100000 0x00032830 0x00032830 0x400005 0x4
LOAD 0x0c9fb4 0x10140000 0x10140000 0x000037e4 0x000037e4 0x400004 0x4
LOAD 0x0cd798 0x10144000 0x10144000 0x000000f0 0x000000f0 0x400006 0x4
LOAD 0x0cd888 0x10145000 0x10145000 0x00000000 0x004390f4 0x400006 0x1000
LOAD 0x0cd888 0x10800000 0x10800000 0x000c176c 0x000c176c 0x500005 0x4
LOAD 0x18eff4 0x10900000 0x10900000 0x000277ac 0x000277ac 0x500004 0x20
LOAD 0x1b67a0 0x10928000 0x10928000 0x000016cc 0x000016cc 0x500006 0x4
LOAD 0x1b7e6c 0x1092a000 0x1092a000 0x00000000 0x014e4c8c 0x500006 0x200
LOAD 0x1b7e6c 0x11f00000 0x11f00000 0x0006b100 0x0006b100 0x600005 0x4
LOAD 0x222f6c 0x11f80000 0x11f80000 0x00010f48 0x00010f48 0x600004 0x4
LOAD 0x233eb4 0x11f91000 0x11f91000 0x0002707c 0x0002707c 0x600006 0x4
LOAD 0x25af30 0x11fb9000 0x11fb9000 0x00000000 0x001c8150 0x600006 0x1000
LOAD 0x25af30 0x12300000 0x12300000 0x000d3a94 0x000d3a94 0x700005 0x4
LOAD 0x32e9c4 0x12400000 0x12400000 0x0001e2d8 0x0001e2d8 0x700004 0x4
LOAD 0x34cc9c 0x1241f000 0x1241f000 0x000000a8 0x000000a8 0x700006 0x4
LOAD 0x34cd44 0x12420000 0x12420000 0x0005bb9d 0x0005bb9d 0x700006 0x4
LOAD 0x3a88e4 0x1247c000 0x1247c000 0x00000000 0x0023a064 0x700006 0x20
LOAD 0x3a88e4 0x1db00000 0x1db00000 0x00000000 0x01a00000 0x500006 0x1
LOAD 0x3a88e4 0x1fe00000 0x1fe00000 0x00000000 0x00200000 0x100006 0x1
LOAD 0x3a88e4 0x20000000 0x20000000 0x00000000 0x07e00000 0x500006 0x1
LOAD 0x000000 0x27e00000 0x27e00000 0x00200000 0x00200000 0x100007 0x1
LOAD 0x000000 0x05200000 0x27e00000 0x00000000 0x00100000 0x100007 0x1
LOAD 0x000000 0x10600000 0x27e00000 0x00000000 0x00100000 0x100007 0x1
LOAD 0x3a88e4 0xe0000000 0x12800000 0x0006f430 0x0006f430 0x800005 0x4
LOAD 0x417d14 0xe0080000 0x12880000 0x00013eb8 0x00013eb8 0x800004 0x4
LOAD 0x42bbcc 0xe0094000 0x12894000 0x0000008c 0x0000008c 0x800006 0x4
LOAD 0x42bc58 0xe0095000 0x12895000 0x000004e4 0x000004e4 0x800006 0x4
LOAD 0x42c13c 0xe0096000 0x12896000 0x00000000 0x000abef8 0x800006 0x40
LOAD 0x42c13c 0xe1000000 0x12a00000 0x000658c0 0x000658c0 0x900005 0x4
LOAD 0x4919fc 0xe1080000 0x12a80000 0x0001b184 0x0001b184 0x900004 0x4
LOAD 0x4acb80 0xe109c000 0x12a9c000 0x00000fb4 0x00000fb4 0x900006 0x4
LOAD 0x4adb34 0xe109d000 0x12a9d000 0x00000000 0x0023b774 0x900006 0x20
LOAD 0x4adb34 0xe2000000 0x12d00000 0x00116cac 0x00116cac 0xb00005 0x4
LOAD 0x5c47e0 0xe2140000 0x12e40000 0x00018a04 0x00018a04 0xb00004 0x4
LOAD 0x5dd1e4 0xe2159000 0x12e59000 0x0000014c 0x0000014c 0xb00006 0x4
LOAD 0x5dd330 0xe215a000 0x12e5a000 0x0000087c 0x0000087c 0xb00006 0x4
LOAD 0x5ddbac 0xe215b000 0x12e5b000 0x00000000 0x002eaa8c 0xb00006 0x40
LOAD 0x5ddbac 0xe3000000 0x13400000 0x00131fe8 0x00131fe8 0xc00005 0x4
LOAD 0x70fb94 0xe3140000 0x13540000 0x0001f420 0x0001f420 0xc00004 0x4
LOAD 0x72efb4 0xe3160000 0x13560000 0x0000013c 0x0000013c 0xc00006 0x4
LOAD 0x72f0f0 0xe3161000 0x13561000 0x00000ccc 0x00000ccc 0xc00006 0x4
LOAD 0x72fdbc 0xe3162000 0x13562000 0x00000000 0x0010f9e8 0xc00006 0x40
LOAD 0x72fdbc 0xe4000000 0x13800000 0x00011038 0x00011038 0xd00005 0x4
LOAD 0x740df4 0xe4040000 0x13840000 0x00005838 0x00005838 0xd00004 0x4
LOAD 0x74662c 0xe4046000 0x13846000 0x00000074 0x00000074 0xd00006 0x4
LOAD 0x7466a0 0xe4047000 0x13847000 0x00000000 0x000a7fc0 0xd00006 0x20
LOAD 0x7466a0 0xe5000000 0x13a00000 0x0000eb14 0x0000eb14 0xa00005 0x4
LOAD 0x7551b4 0xe5040000 0x13a40000 0x00002d38 0x00002d38 0xa00004 0x4
LOAD 0x757eec 0xe5043000 0x13a43000 0x00000594 0x00000594 0xa00006 0x4
LOAD 0x758480 0xe5044000 0x13a44000 0x00000000 0x00034600 0xa00006 0x20
LOAD 0x758480 0xe6000000 0x13a80000 0x0000eeb8 0x0000eeb8 0x200005 0x4
LOAD 0x767338 0xe6040000 0x13ac0000 0x000019d0 0x000019d0 0x200004 0x4
LOAD 0x768d08 0xe6042000 0x13ac2000 0x00003084 0x00003084 0x200006 0x4
LOAD 0x76bd8c 0xe6046000 0x13ac6000 0x00000000 0x0000c1f4 0x200006 0x4
LOAD 0x76bd8c 0xe7000000 0x082c0000 0x00001000 0x00001000 0x200006 0x4
LOAD 0x76cd8c 0xeff00000 0xfff00000 0x00000000 0x00008000 0x100006 0x1
LOAD 0x76cd8c 0xffff0000 0xffff0000 0x0000d868 0x0000d868 0x000007 0x4
kern_main symbol at: 27e00fc0
our module mem size is: 00177000
wafel_core: found OTP read pattern 1 at 08120268...
wafel_core: found OTP read at 08120220.
Firmware not 5.5.x! All you get is the OTP patch, sorry.
stroopwafel kern_main done

Edit 3 picture files SD
 

Attachments

  • 7.jpg
    7.jpg
    45.6 KB · Views: 47
Last edited by Fabioperez,

SDIO

Well-Known Member
OP
Member
Joined
Feb 13, 2023
Messages
2,375
Trophies
0
Age
28
XP
1,631
Country
Germany
I didn't expect anything interesing on the console, since stroopwafel dosn't support that for OSv9. But I hoped the console would boot.
I assume it is still sitting there with no screen output?
Post automatically merged:

You can also try to rename the OSv9 fw.img to ios.img on the sd and try the third option from the menu "Boot 'ios.img". You can also try running the "Dump OTP with PRSH hax" option and when that is done, without rebooting agin try the "Boot ios.img" again.
In case none of this works do the following:
Download OSv9, but this time with the encrypted option:
Code:
java -jar JNUSTool.jar 0005001010004009 -dlEncrypted
This will create a tmp_0005001010004009 folder. Put that in the wafel_install folder on the sd and make sure there is nothing else in the wafel_install folder.
Then put the wafel_install.ipx in the wiiu/ios_plugins folder.
After that put the fw.img of the latest OSv10 renamed to `ios_orig.img` on the SD.
Boot to minute and select the second option. You should now see more output. The LED should change to blue blinking and after that to static blue. Then you can turn off the Wii U. If it turn orange or red send me the wafel_setup_mlc.log file that will be created on the SD.
Then start the Wii U without defuse (just remove USB and 3V3 from the Pico) and see what happens.
 

Attachments

  • wafel_install.ipx.zip
    46.2 KB · Views: 31
Last edited by SDIO,

Fabioperez

Active Member
Newcomer
Joined
Jul 31, 2022
Messages
32
Trophies
0
Age
40
Location
San Gil
XP
227
Country
Colombia
No esperaba nada interesante en la consola, ya que stroopwafel no es compatible con OSv9. Pero esperaba que la consola arrancara.
¿Supongo que todavía está sentado allí sin salida de pantalla?
[combinacion automatica]1690569815[/combinacion automatica]
También puede intentar cambiar el nombre de OSv9 fw.img a ios.img en la sd y probar la tercera opción del menú "Boot 'ios.img". También puede intentar ejecutar la opción "Volcar OTP con PRSH hax" y, cuando termine, sin reiniciar de nuevo, intente "Arrancar ios.img" nuevamente.
@SDIO

ancast: leyendo 0x77b200 bytes de ios.img
ancast: ...00000000 -> 01000000
ancast: ...00100000 -> 01100000
ancast: ...00200000 -> 01200000
ancast: ...00300000 -> 01300000
ancast: ...00400000 -> 01400000
ancast: ...00500000 -> 01500000
ancast: ...00600000 -> 01600000
ancast: ...00700000 -> 01700000
ancast: terminado de leer
ancast: descifrando ios.img...
ancast: fini
GPU sincronizada a: 544.999877MHz
Desmontando SLC...
Cerrando MLC...
sdhc_bus_power(0x0)
Apagando la tarjeta SD...
sdhc_bus_power(0x0)
Apagando interrupciones...
Cerrando cachés y MMU...
Vectorizando a 0x01000300...
Buscando tienda OTP en IOS...


se quedó allí bloqueado

En caso de que nada de esto funcione, haga lo siguiente:
Descarga OSv9, pero esta vez con la opción encriptada: [CÓDIGO]java -jar JNUSTool.jar 0005001010004009 -dlEncrypted[/CÓDIGO]
Esto creará una carpeta tmp_0005001010004009. Pon eso en la carpeta wafel_install en la sd y asegúrate de que no haya nada más en la carpeta wafel_install.
Luego coloca wafel_install.ipx en la carpeta wiiu/ios_plugins.
Después de eso, cambie el nombre de fw.img del último OSv10 a `ios_orig.img` en la SD.
Arranca al minuto y selecciona la segunda opción. Ahora debería ver más salida. El LED debe cambiar a azul parpadeante y luego a azul estático. Luego puedes apagar la Wii U. Si se vuelve naranja o roja, envíame el archivo wafel_setup_mlc.log que se creará en la SD.
Luego, inicie la Wii U sin desactivar (solo quite el USB y el 3V3 del Pico) y vea qué sucede.
sigo con esto estoy descargando los archivos

@SDIO
It did what you said blinking blue then solid blue I press the power button but it doesn't turn off I'm afraid to disconnect it by force it's like in a loop

initializing /dev/net/ifmgr/ncl... 00000000 00000000 00000002 00000002
[NET-NC]: ifOperStatus:0 != oper_state:2 (linkstate:2 ifAdminStatus:0 ipaddr:0x0)
initializing /dev/net/ifmgr/ncl... 00000000 00000000 00000002 00000002
alive
[NET-NC]: ifOperStatus:0 != oper_state:2 (linkstate:2 ifAdminStatus:0 ipaddr:0x0)
initializing /dev/net/ifmgr/ncl... 00000000 00000000 00000002 00000002
[NET-NC]: ifOperStatus:0 != oper_state:2 (linkstate:2 ifAdminStatus:0 ipaddr:0x0)
initializing /dev/net/ifmgr/ncl... 00000000 00000000 00000002 00000002
alive
[NET-NC]: ifOperStatus:0 != oper_state:2 (linkstate:2 ifAdminStatus:0 ipaddr:0x0)
initializing /dev/net/ifmgr/ncl... 00000000 00000000 00000002 00000002
00:05:22:841: MCP: Power button pressed
00:05:22:842: MCP: Power transitions are explicitly disabled.
[NET-NC]: ifOperStatus:0 != oper_state:2 (linkstate:2 ifAdminStatus:0 ipaddr:0x0)
initializing /dev/net/ifmgr/ncl... 00000000 00000000 00000002 00000002
 
Last edited by Fabioperez,

Fabioperez

Active Member
Newcomer
Joined
Jul 31, 2022
Messages
32
Trophies
0
Age
40
Location
San Gil
XP
227
Country
Colombia
you have to force it off when the led is static, it's fine.

also I don't speak spanish
@SDIO YOU ARE THE LORD AND MASTER OF THE WII U
Sorry for the capital letters but I'm very excited and I'll start, I'll tell you the story of this wii u I bought it and the seller told me that it had no video output but he never told me that the blue led was blinking

i sorry the conversation was with google translator
thank you

Edit
thank you @shinyquagsire23 for de tool de_fuse
thank you @V10lator first steeps
thank you @Ysecond
Thank you @fringle
 

Attachments

  • WhatsApp Image 2023-07-28 at 3.25.15 PM (1).jpeg
    WhatsApp Image 2023-07-28 at 3.25.15 PM (1).jpeg
    56.6 KB · Views: 46
  • WhatsApp Image 2023-07-28 at 3.25.15 PM.jpeg
    WhatsApp Image 2023-07-28 at 3.25.15 PM.jpeg
    84.9 KB · Views: 45
  • WhatsApp Image 2023-07-28 at 3.25.14 PM.jpeg
    WhatsApp Image 2023-07-28 at 3.25.14 PM.jpeg
    44.5 KB · Views: 46
Last edited by Fabioperez,

Fabioperez

Active Member
Newcomer
Joined
Jul 31, 2022
Messages
32
Trophies
0
Age
40
Location
San Gil
XP
227
Country
Colombia
has parental control
and it seems that it is in 1.0.2
Post automatically merged:

what was the solution?
In case none of this works do the following:
Download OSv9, but this time with the encrypted option:
Code:
java -jar JNUSTool.jar 0005001010004009 -dlEncrypted
This will create a tmp_0005001010004009 folder. Put that in the wafel_install folder on the sd and make sure there is nothing else in the wafel_install folder.
Then put the wafel_install.ipx in the wiiu/ios_plugins folder.
After that put the fw.img of the latest OSv10 renamed to `ios_orig.img` on the SD.
Boot to minute and select the second option. You should now see more output. The LED should change to blue blinking and after that to static blue. Then you can turn off the Wii U. If it turn orange or red send me the wafel_setup_mlc.log file that will be created on the SD.
Then start the Wii U without defuse (just remove USB and 3V3 from the Pico) and see what happens.
Was the user already on there or was it completely new? What is the firmware version?
I had a user created and the version is 1.0.2
 

Attachments

  • WhatsApp Image 2023-07-28 at 3.32.27 PM.jpeg
    WhatsApp Image 2023-07-28 at 3.32.27 PM.jpeg
    95 KB · Views: 47

SDIO

Well-Known Member
OP
Member
Joined
Feb 13, 2023
Messages
2,375
Trophies
0
Age
28
XP
1,631
Country
Germany
Ok so this console was probably broken from the factory or maybe the slc corrupted over a long time, where it sat somewhere unused I suspect.

The other Wii U we had with a blinking led was also on 1.0.x.
I bought one with the same blinking LED symptom, but didn't have a chance to look at it yet


EDIT: did you look from which manufacturer the SLC chip is?
 

Fabioperez

Active Member
Newcomer
Joined
Jul 31, 2022
Messages
32
Trophies
0
Age
40
Location
San Gil
XP
227
Country
Colombia
Ok so this console was probably broken from the factory or maybe the slc corrupted over a long time, where it sat somewhere unused I suspect.
Yes, I imagine that it had been stored for a long time, I bought it about 1 year ago
The other Wii U we had with a blinking led was also on 1.0.x.
I bought one with the same blinking LED symptom, but didn't have a chance to look at it yet
I hope I can revive it
EDIT: did you look from which manufacturer the SLC chip is?
No, but I intend to disassemble it to remove the raspberry pi pico when I do so I will inform you which manufacturer is the SLC


I imagine that the next step is to connect it to the internet to update itDo you know how to remove parental control or with gary's recovery menu tool I think you have to look at that code
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    SylverReZ @ SylverReZ: @AncientBoi, Dont forget your meds.