Hi there!
I am the new one - registered a Account to share my thoughts.
I am at the same point with my bricked Wii U (not booting due to a format with activated coldboothax)
I do have the equivalent dumps from rednand :
- slc
- slccmtp
- opt
- mlc
- eeprom
yesterday i managed to dump slc and slccmtp with a teensy 2.0++ and NANDway (had to desolder the chip as no reading with chip on board - had this on PS3 Phat sometimes too)
Found the current research here and i am Impressed - thanks for that.
Seems that rednand gives us a (atm) non-restorable full backup
- iwas blue eyed and thaught i do not have to care as i do have a dump *bummer*
Unfortuanally, when decrypting the dump i only earned crap (dump ran without problems, Flash was correct identified,....)
when i decrypt the slc.img from rednand all looks fine (searched for Text "default_" in Hexed" - also checked if i dumped the correct Flash Area (decrypted the Vwii dump with slc key to probe)
Anyone can confirm that a dump with Teensy should/would work indeed?
For the ecc calculation:
(Sorry, i am not a coder, i want to share what i found during my research)
Perhaps the first attemp could be ECC calulation on a working console? - there should be a Function accessible in OS which could be used to parse a rednand dump.
wiiubrew mentions ECC as ?non tested?:
http://wiiubrew.org/wiki/Hardware/NAND_Interface
Also there should be functions on Wii (which seems to use the same ECC calculation i guess) - see
https://github.com/crowell/gbadev/blob/master/armboot/nand.c
Perhaps one of the Coders could provide a Backup tool to dump the whole NAND incl. ECC to have complete backups in the Future - already done on Wii, see
http://wiibrew.org/wiki/Wiinandfuse
On PC side i found no specific tools for Wii U, only some Infos abount Hamming Code and Reed Solomon:
https://hackerfall.com/story/nand-flash-dealing-with-a-flawed-medium
https://pypi.python.org/pypi/unireedsolomon
I guess the ECC on the Wii U side is provided by Hardware (ARM), so there would be only trial and error to achieve the right chunk/block sizes and Algos
Also there would be no custom boot1 without a "parachute" on sysrom
My next step is to flash the mlc dump and crossing fingers that the console would boot, but i think the ticket for the content on the mlc is missing in flas