It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

• A Wii U
• One of the devices listed below
  Note: Any other linux device capable of USB device emulation should work as well.
  Prebuilt releases are only available for the Pico and Zero.
  I will add more devices below which are confirmed to work.

Supported devices:​

• A Raspberry Pi Pico or Zero
• A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

• Download the latest udpih.uf2 from the releases page.
• Hold down the BOOTSEL button on the board and connect the Pico to your PC.
  Your PC will detect the Pi as a storage device.
• Copy the .uf2 file to the Pico. It will disconnect after a few seconds.

The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

• Install the required dependencies:
  

  sudo apt install build-essential raspberrypi-kernel-headers

• Clone the repo:

• git clone https://github.com/GaryOderNichts/udpih.git
  cd udpih

• Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
• Now build the kernel module:

• cd linux
  make

• You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.

The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB Devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
  This timing is important. If you're already in the menu, the exploit won't work..
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[SDIO]

@skawo I see a lot of these messages:

04:29:53:689: wlc_mlme_join_cmd called with Command 0x3 Length 0x21
04:29:54:694: NET: Change admin state (1 -> 2)(iface:0 link:2)
04:29:57:695: NET: Change admin state (2 -> 1)(iface:0 link:2)
04:29:57:695: [WD]>>>> Linkup msg from Net
04:29:57:705: wlc_mlme_join_cmd called with Command 0x3 Length 0x21
04:29:58:710: NET: Change admin state (1 -> 2)(iface:0 link:2)
04:30:04:551: NET: Change admin state (2 -> 1)(iface:0 link:2)
04:30:04:551: [WD]>>>> Linkup msg from Net
04:30:04:560: wlc_mlme_join_cmd called with Command 0x3 Length 0x21
04:30:04:564: NET: Change admin state (2 -> 2)(iface:1 link:2)
04:30:04:565: NET: Change admin state (1 -> 1)(iface:0 link:3)
04:30:04:661: [WD]>>>> Linkup msg from Net
04:30:04:671: wlc_mlme_join_cmd called with Command 0x3 Length 0x21
04:30:05:675: NET: Change admin state (1 -> 2)(iface:0 link:2)
04:30:08:676: NET: Change admin state (2 -> 1)(iface:0 link:2)
04:30:08:676: [WD]>>>> Linkup msg from Net
04:30:08:685: wlc_mlme_join_cmd called with Command 0x3 Length 0x21
04:30:09:256: FAIL: PPC Core 0 Heartbeat Failed!  Restarting...

Can you try to remove the 2,4Ghz Wifi module and see if that changes anything?

 

[skawo]

Certainly
If I'm not mistaken, that's this one, right?

Would be weird if it was that, though, since I could connect to wupserver over wifi fine...

 

[Ysecond]

Launching UDPIH DC_INIT shows me a garbled screen over HDMI

like this？

 

[skawo]

It looks exactly like the in this post here:
https://gbatemp.net/threads/udpih-usb-host-stack-exploit-recovery-menu.613369/page-30#post-10086825

Recovery menu DOES work, though, it just outputs the garbled screen.
Didn't see any solution to this being posted, hence why I re-asked.

Post automatically merged: Nov 29, 2023

Can you try to remove the 2,4Ghz Wifi module and see if that changes anything?

Tried it; nothing changed.
Tried to start the WiiU without the other two modules and that did nothing, either.
Also tried to reflow the HDMI scaler chip and that did nothing as well.

 

[Ysecond]

If this were my console, I would not hesitate to install all the system title. I don't think reinstall all the title will make the situation worse.
But you should wait for more professional guidance.

 

[skawo]

Well, having no video makes that kind of tedious, and in theory recovery menu should at least display something even if the OS is cooked, I thought :s

 

[SDIO]

Maybe installing ISFShax before makes sense, in case something goes wrong. Also with minute you would see it the HDMI hardware is working

 

[skawo]

Sure. How would I go about doing that without any display?

 

[SDIO]

Count the key pressed

 

[skawo]

Oh, I see now the presses are listed. OK, will try that.

Edit 1: OK, installed ISFS Hax, and the WiiU does properly output via HDMI in minute.
I guess I reinstall the system menu now?

Edit: Using the MLC RestoreDownloader to download all the titles. Should I format the MLC, or should I just install over what's there?

 

[SDIO]

whatever you prefere. You can always format it later. If you format the mlc, you would delete the scfm.img and erase the eMMC in minute

 

[skawo]

Hm, well, decided to just format for ease of install, but when I attempt to launch wafel_setup_mlc it just stops on this screen and the LED doesn't change:

 

[SDIO]

you are missing the isfshax patch ipx

 

[skawo]

Oh, whoops~
OK, it's installing.

EDIT: Well, it installed - correctly, I assume, the LED stayed blue all the way through. I then deleted the setup ipx and tried to boot - no dice.

The GamePad turns on, the WiiU LED stays purple and screen stays like below :s

 

[SDIO]

can you dump the logs again? Minute should have an option for that

 

[skawo]

I don't think any new log files have appeared, but here you go.

 

[SDIO]

maybe reinstall OSv10, in case there is something wrong with that

 

[skawo]

During the mlc rebuild I did also plop in all the SLC titles, so it should already be reinstalled?

I could reinstall it again... how to best go about installing a single title like that from minute?

 

[SDIO]

Hm you could solder a pico to the debug pads to get the syslog that way. Would be the same like defuse but you only need the debug ones (and GND) and not the other connectens that defuse would need (I think).

Else I don't have another id rn.

 

[skawo]

Hmm, well, I'll think about it.

Dunno if it's worth the effort, tbh, since it seems now that the problem
is something deeply rooted in hardware rather than software.