Front-page Hacking  Updated

UDPIH: USB Host Stack exploit + Recovery Menu

It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!


Requirements​

  • A Wii U
  • One of the devices listed below
    Note: Any other linux device capable of USB device emulation should work as well.
    Prebuilt releases are only available for the Pico and Zero.
    I will add more devices below which are confirmed to work.

Supported devices:​

  • A Raspberry Pi Pico or Zero
  • A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

  • Download the latest udpih.uf2 from the releases page.
  • Hold down the BOOTSEL button on the board and connect the Pico to your PC.
    Your PC will detect the Pi as a storage device.
  • Copy the .uf2 file to the Pico. It will disconnect after a few seconds.
The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

  • Install the required dependencies:
    Bash: 
    sudo apt install build-essential raspberrypi-kernel-headers
  • Clone the repo:
  • Bash: 
    git clone https://github.com/GaryOderNichts/udpih.git
cd udpih
  • Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
  • Now build the kernel module:
  • Bash: 
    cd linux
make
  • You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.
The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

warning
Important notes for this to work:
  • Make sure no other USB Devices are attached to the console.
  • Only use USB ports on the front of the console, the back ports will not work.
  • If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.
Click to expand...
  • Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
  • Insert the SD Card into the console and power it on.
  • As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
    This timing is important. If you're already in the menu, the exploit won't work..
  • After a few seconds you should be in the recovery menu.
So what's this recovery menu? The recovery menu allows you to fix several bricks:
screenshot

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:
  • Wii U Menu (JPN) - 00050010-10040000
  • Wii U Menu (USA) - 00050010-10040100
  • Wii U Menu (EUR) - 00050010-10040200
On non-retail systems the following additional options are available:
  • System Config Tool - 00050010-1F700500
  • DEVMENU (pre-2.09) - 00050010-1F7001FF
  • Kiosk Menu - 00050010-1FA81000
Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:
Code: 
type=eth

For using wifi:
Code: 
type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Credits​

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!
 
Last edited by GaryOderNichts,
  • Like
  • Love
  • Wow
Reactions: johsam, rommy667, 3EGaming and 173 others
Click to expand...
Ylzen

Ylzen

New Member
Newbie
Level 1
Joined
Nov 10, 2023
Messages
4
Trophies
0
Age
31
XP
24
Country
United States
SDIO said:
That's neither the error code for eMMC corruption, nor is it the CBHC error code (so changing the CB title won't help)
Maybe it is SLC corruption, I don't know the error code for that from the top of my head. Please dump and upload the logs.
From the logs we can probably see what's wrong.
Click to expand...
i upload my logs, i get that wii u in that condition so i dont know if is jalibroken or what happen with it, let me know if you see anything wrong in the logs, thanks in advance
 

Attachments

  • logs.zip
    216.9 KB · Views: 11
S

SDIO

Well-Known Member
Member
Level 8
Joined
Feb 13, 2023
Messages
2,290
Trophies
0
Age
28
XP
1,403
Country
Germany
OK, no SLC corruption, which is good.
The error seems to be caused by the save of the wii u menu being corrupted. That doesn't mean the mlc is failing.
This recovery gives you the "MLC Checker" option. Run it and post the log. Then we can see if that is just a sngle corruption event of if there is a problem with the eMMC hardware: https://github.com/jan-hofmeier/recovery_menu/releases

Here is the error from your logs:
Code: 
00:00:11:758: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
00:00:11:758: [ACP]ERROR:CopyFileInternal:1305: Failed to read /vol/storage_mlc01/sys/title/00050010/10040100/meta/iconTex.tga (-196635)
00:00:11:759: [ACP]ERROR:CopyFileInternal:1339: failed to copy /vol/storage_mlc01/sys/title/00050010/10040100/meta/iconTex.tga to /vol/storage_mlc01/usr/save/00050010/10040100/meta/iconTex.tga (-196635)
00:00:11:760: [ACP]ERROR:ConvertFSAStatusToNnResult:194: Data Corrupted FSA Error at mlc (-196635)
00;00;11;639: ACP: ##### FATAL ERROR at ACPRepairSaveMetaDir (-1607210624)#####

If it was a just single corruption event, we can just delete that file.
 
  • Like
Reactions: Ylzen
Ylzen

Ylzen

New Member
Newbie
Level 1
Joined
Nov 10, 2023
Messages
4
Trophies
0
Age
31
XP
24
Country
United States
If it was a just single corruption event, we can just delete that file.
[/QUOTE]
I check the mlc and just 1 error is the same of the log , how can delete that file?
 

Attachments

  • 20231110_211116.jpg
    20231110_211116.jpg
    3.2 MB · Views: 21
some1ne

some1ne

Well-Known Member
Member
Level 6
Joined
Sep 12, 2009
Messages
578
Trophies
1
Website
www.youtube.com
XP
903
Country
United States
V10lator said:
There is just one GND connection between the Pico and the Wii U, see https://github.com/shinyquagsire23/wii_u_modchip/tree/main/pico_defuse#wiring

I guess this has the same pinout than the tiny? If so havea look at https://github.com/shinyquagsire23/wii_u_modchip/pull/6 (note that you somehow have to define WAVESHARE_TINY so the changed pin layout gets used).

View attachment 397660
View attachment 397661

As SDIO said you don't need to connect the 3.3 V line but in case you decide to do it add a diode so current can flow from the Wii U to the zero board but not the other way around. Don't care about voltage drop, the RP2040 chip works between 1.8 and 3.3 V- ;)
Click to expand...
I wired the pico just like your diagram using the custom code for the different pins, except for 3.3V and GND, but defuse doesn't seem to be working. I checked all pico connections with a multimeter and everything seems fine.

1699697180054.png


This is what I get from the serial communication:
1699698913481.png


I'm using a 1gb sd card for this, wrote boot1.img to it and formatted as FAT32 using the default windows formatter.
 
Last edited by some1ne,
S

SDIO

Well-Known Member
Member
Level 8
Joined
Feb 13, 2023
Messages
2,290
Trophies
0
Age
28
XP
1,403
Country
Germany
You can
Ylzen said:
If it was a just single corruption event, we can just delete that file.
Click to expand...

When I looked todays at the message agin I noticed that it's not the save that is corrupted but the file in the title, that it wants t copy to the save. The easiest is to just reinstall the title (Wii U menu)

Get the JNUSTool: https://github.com/Maschell/JNUSTool/releases/tag/0.3b and add the common key to the config file.
Then you can download the Wii U menu with
Code: 
java -jar JNUSTool.jar 0005001010040100 -dlEncrypted
WARNING for everyone else reading this: This is the title that broke on Ylzens Wii U, on other Wii Us other titles might be the problem and this title only applies to US Wii Us, it would brick other Wii Us.

You then copy then create a "install" forlder on the SD and copy the tmp_0005001010040100 inside. Then boot the recovery again and select install wup. Once that is done use the shutdown option and try to boot again normally.
Post automatically merged:

Some1CP said:
I wired the pico just like your diagram using the custom code for the different pins, except for 3.3V and GND
Click to expand...
You need to connect the GND of the Pico with the GND from the Wii U
 
  • Like
Reactions: some1ne
some1ne

some1ne

Well-Known Member
Member
Level 6
Joined
Sep 12, 2009
Messages
578
Trophies
1
Website
www.youtube.com
XP
903
Country
United States
SDIO said:
You dumped otp via PRSHhax, right?

Now dump the SLC. Then use the wiiu nand extractor: https://github.com/GaryOderNichts/wiiu-nandextract-c/releases/tag/v2 to extract it.
Then upload the sys/logs folder from the extract.
Click to expand...
Yes, I used the option that mentioned PRSHhax, inside the Backup and Restore menu.

When trying to run the extractor, I get this error message:

Code: 
PS D:\Downloads\wiiunand> .\extractor.exe .\SLC.RAW abc
this is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclusterthis is not a superclustercan't find superblock!
PS D:\Downloads\wiiunand>

I have put otp.bin in the same folder as SLC.RAW

I'm currently trying to dump the SLC again.

EDIT:
Dumped the SLC again, same error happens. New and old dump have the same hash.
 
Last edited by some1ne,
some1ne

some1ne

Well-Known Member
Member
Level 6
Joined
Sep 12, 2009
Messages
578
Trophies
1
Website
www.youtube.com
XP
903
Country
United States

Attachments

  • logs.zip
    268.1 KB · Views: 10
S

SDIO

Well-Known Member
Member
Level 8
Joined
Feb 13, 2023
Messages
2,290
Trophies
0
Age
28
XP
1,403
Country
Germany
OK as expected the eMMC is failing.
These errors are from just one log
Code: 
44.log:00:00:04:983: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:044: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/10042400/code/app.xml
44.log:00:00:05:075: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:126: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/1005f000/code/app.xml
44.log:00:00:05:162: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/1005c000/code/app.xml
44.log:00:00:05:187: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:228: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:269: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:309: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:317: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:332: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:339: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:423: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/00050010/1004c100/code/app.xml
44.log:00:00:05:458: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/00050010/1004d100/code/app.xml
44.log:00:00:05:599: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:635: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/00050010/1005a100/code/app.xml
44.log:00:00:05:675: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/save/system/acp
44.log:00:00:06:163: [ACP]ERROR:CheckExistence:898: failed to check existence of /vol/storage_mlc01/usr/save/system/acp/ (status = -196673)
44.log:00:00:06:356: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:5, path:/usr/save/system/acp
44.log:00:00:06:358: [ACP]ERROR:MakeQuota:2009: Failed to make a quota /vol/storage_mlc01/usr/save/system/acp/ (status = -196673, quota size = 8388608)
44.log:00:00:06:358: [ACP]ERROR:CreateSystemSaveDir:1170: Failed to create system save directories
44.log:00:00:06:399: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
44.log:00:00:06:443: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/nsec/app
44.log:00:00:06:485: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:10, path:/usr/save/system/act/persisid.dat
44.log:00:00:06:522: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:10, path:/usr/save/system/act/transid.dat
44.log:00:00:06:528: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:06:564: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:10, path:/usr/save/system/act/uuid.dat
44.log:00:00:06:610: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:10, path:/usr/save/system/act/common.dat
44.log:00:00:06:647: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:10, path:/usr/save/system/act/uuid.dat.tmp
44.log:00:00:06:684: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:27, path:/usr/save/system/act
44.log:00:00:06:699: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:06:736: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/10042400/code/app.xml
44.log:00:00:06:968: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:010: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/10056000/code/app.xml
44.log:00:00:07:076: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/1005c000/code/app.xml
44.log:00:00:07:112: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/1005f000/code/app.xml
44.log:00:00:07:130: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:142: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:174: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:189: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:216: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:251: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/00050030/100111ff/code/app.xml
44.log:00:00:07:264: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:278: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:320: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/00050030/10017109/code/app.xml
44.log:00:00:07:334: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:351: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:415: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:459: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/title/00050000/10105700/code/app.xml
44.log:00:00:07:495: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/title/00050000/10105a00/code/app.xml
44.log:00:00:07:512: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:570: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:7, path:(null)
44.log:00:00:07:609: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/title/0005000e/10102000/code/app.xml
44.log:00:00:07:634: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:668: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/title/0005000e/1015d300/code/app.xml

So I would suggest replacing the eMMC. If you don't want to source a eMMC and do BGA soldering you can get a NAND-AID (you can ask @V10lator for one, but shipping the letter from germany can take a while) and then rebuild the MLC on a 64GB SD card in the NAND-AID: https://gbatemp.net/threads/how-to-upgrading-rebuilding-wii-u-internal-memory-mlc.636309/
Instead of buying a NAND-AID you could also just use a micro SD adapter and solder wires from the pads on the MB to the contacts of the adapter.

Without soldering there is also redNAND: https://gbatemp.net/threads/fixing-...-soldering-using-rednand-with-isfshax.642268/ (you can launch minute from defuse, so you don't need ISFShax for now).
But since you have already disassembled the console and soldered the pico, you probably want to go for the proper fix by replacing the eMMC internally
 
some1ne

some1ne

Well-Known Member
Member
Level 6
Joined
Sep 12, 2009
Messages
578
Trophies
1
Website
www.youtube.com
XP
903
Country
United States
SDIO said:
OK as expected the eMMC is failing.
These errors are from just one log
Code: 
44.log:00:00:04:983: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:044: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/10042400/code/app.xml
44.log:00:00:05:075: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:126: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/1005f000/code/app.xml
44.log:00:00:05:162: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/1005c000/code/app.xml
44.log:00:00:05:187: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:228: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:269: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:309: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:317: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:332: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:339: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:423: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/00050010/1004c100/code/app.xml
44.log:00:00:05:458: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/00050010/1004d100/code/app.xml
44.log:00:00:05:599: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:05:635: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/00050010/1005a100/code/app.xml
44.log:00:00:05:675: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/save/system/acp
44.log:00:00:06:163: [ACP]ERROR:CheckExistence:898: failed to check existence of /vol/storage_mlc01/usr/save/system/acp/ (status = -196673)
44.log:00:00:06:356: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:5, path:/usr/save/system/acp
44.log:00:00:06:358: [ACP]ERROR:MakeQuota:2009: Failed to make a quota /vol/storage_mlc01/usr/save/system/acp/ (status = -196673, quota size = 8388608)
44.log:00:00:06:358: [ACP]ERROR:CreateSystemSaveDir:1170: Failed to create system save directories
44.log:00:00:06:399: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:11, path:(null)
44.log:00:00:06:443: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/nsec/app
44.log:00:00:06:485: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:10, path:/usr/save/system/act/persisid.dat
44.log:00:00:06:522: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:10, path:/usr/save/system/act/transid.dat
44.log:00:00:06:528: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:06:564: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:10, path:/usr/save/system/act/uuid.dat
44.log:00:00:06:610: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:10, path:/usr/save/system/act/common.dat
44.log:00:00:06:647: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:10, path:/usr/save/system/act/uuid.dat.tmp
44.log:00:00:06:684: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:27, path:/usr/save/system/act
44.log:00:00:06:699: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:06:736: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/10042400/code/app.xml
44.log:00:00:06:968: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:010: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/10056000/code/app.xml
44.log:00:00:07:076: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/1005c000/code/app.xml
44.log:00:00:07:112: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/0005001b/1005f000/code/app.xml
44.log:00:00:07:130: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:142: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:174: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:189: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:216: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:251: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/00050030/100111ff/code/app.xml
44.log:00:00:07:264: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:278: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:320: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/sys/title/00050030/10017109/code/app.xml
44.log:00:00:07:334: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:351: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:415: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:459: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/title/00050000/10105700/code/app.xml
44.log:00:00:07:495: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/title/00050000/10105a00/code/app.xml
44.log:00:00:07:512: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:570: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:7, path:(null)
44.log:00:00:07:609: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/title/0005000e/10102000/code/app.xml
44.log:00:00:07:634: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)
44.log:00:00:07:668: FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2228230, cmd:25, path:/usr/title/0005000e/1015d300/code/app.xml

So I would suggest replacing the eMMC. If you don't want to source a eMMC and do BGA soldering you can get a NAND-AID (you can ask @V10lator for one, but shipping the letter from germany can take a while) and then rebuild the MLC on a 64GB SD card in the NAND-AID: https://gbatemp.net/threads/how-to-upgrading-rebuilding-wii-u-internal-memory-mlc.636309/
Instead of buying a NAND-AID you could also just use a micro SD adapter and solder wires from the pads on the MB to the contacts of the adapter.

Without soldering there is also redNAND: https://gbatemp.net/threads/fixing-...-soldering-using-rednand-with-isfshax.642268/ (you can launch minute from defuse, so you don't need ISFShax for now).
But since you have already disassembled the console and soldered the pico, you probably want to go for the proper fix by replacing the eMMC internally
Click to expand...
Luckily I already ordered some NAND-AIDs from V10lator expecting that the emmc would be dead. Can I remove the Pico after doing the linked tutorial for rebuilding the NAND on a micro SD card?
 
S

SDIO

Well-Known Member
Member
Level 8
Joined
Feb 13, 2023
Messages
2,290
Trophies
0
Age
28
XP
1,403
Country
Germany
There is something strange about your slc as both the first extractor and the check had problems with it. But since your Wii U boots into the Factory Reset screen and the other extractor worked, I assume it's a problem with the tools and not your SLC
 
some1ne

some1ne

Well-Known Member
Member
Level 6
Joined
Sep 12, 2009
Messages
578
Trophies
1
Website
www.youtube.com
XP
903
Country
United States
SDIO said:
There is something strange about your slc as both the first extractor and the check had problems with it. But since your Wii U boots into the Factory Reset screen and the other extractor worked, I assume it's a problem with the tools and not your SLC
Click to expand...
Oh by the way, the Wii U stuck in the factory reset screen is another one. This one we're talking about just stays stuck on a black screen.
 
S

SDIO

Well-Known Member
Member
Level 8
Joined
Feb 13, 2023
Messages
2,290
Trophies
0
Age
28
XP
1,403
Country
Germany
What is the power LED doing when booted without defuse? (you can just remove the USB from the pico, since you didn't connect 3V3 it will then just boot without defuse)
And yes, after the rebuild it will work without defuse, as long you don't use the unlimit plugin.
 
  • Like
Reactions: some1ne
some1ne

some1ne

Well-Known Member
Member
Level 6
Joined
Sep 12, 2009
Messages
578
Trophies
1
Website
www.youtube.com
XP
903
Country
United States
SDIO said:
What is the power LED doing when booted without defuse? (you can just remove the USB from the pico, since you didn't connect 3V3 it will then just boot without defuse)
And yes, after the rebuild it will work without defuse, as long you don't use the unlimit plugin.
Click to expand...
The LED stays solid blue without defuse.

Great, I have some spare 64gb SD cards here. The only problem is that apparently the Wii U firmware is 1.1gb and I don't think I have a 2GB card. Can I swap it for an SDHC card in the front slot after defuse has booted up?
 

Site & Scene News

Go to forum More news

Popular threads in this forum

Very annoying that Nintendo never fixed this bug

Pretendo not working with updated games?!

Can you hack your wii u with something other than sd card

Hacking Emulation Homebrew  Could you explain to me why there are no standalone emulators on Wiiu using aroma?

Wii U (bricked) Mii Maker

Installing a dumped Disc Title as digital on Wii U?

A Tale of Two vWii Systems

Nand-Aid Alignment Error

General chit-chat
Help Users
  • BakerMan @ BakerMan:
    IT'S LIKE THAT ALMOST EVERY FUCKING METEOR SHOWER TOO
  • BigOnYa @ BigOnYa:
    You need to setup a time lapse camera, be neat
  • BigOnYa @ BigOnYa:
    I actually use a pic of it on my pc desktop cause its cool looking
  • Xdqwerty @ Xdqwerty:
    Apparently the pro versión of pizza boy is back aswell
  • Xdqwerty @ Xdqwerty:
    Gonna download the update
  • Xdqwerty @ Xdqwerty:
    Only 2 antiviruses detected the APK as a virus on virustotal so it Must be safe
  • Xdqwerty @ Xdqwerty:
    Cuz false positive
  • Xdqwerty @ Xdqwerty:
    Wait
  • Xdqwerty @ Xdqwerty:
    Eh nvm
  • BakerMan @ BakerMan:
    sadly, the clouds are setting in now

    hey BigOnYa the clouds are coming from the south, maybe check again
  • Xdqwerty @ Xdqwerty:
    Good night it's 11 pm
  • BakerMan @ BakerMan:
    night
  • BigOnYa @ BigOnYa:
    @BakerMan Nuh I'm in for the night playing Fallout 4, ill look tomorrow night
  • BigOnYa @ BigOnYa:
    Ok had let dog out, and yea still can't see it, oh well. Maybe tom night.
  • K3Nv2 @ K3Nv2:
    Ballocks these drives aren't allowing raid
  • BigOnYa @ BigOnYa:
    That sucks, well you will get double the space then atleast.
  • K3Nv2 @ K3Nv2:
    @Sicklyboy needs to come back
  • BigOnYa @ BigOnYa:
    Did you try Raid 10?
  • K3Nv2 @ K3Nv2:
    I did raid69
  • BigOnYa @ BigOnYa:
    https://forums.tomshardware.com/threads/m-2-ssd-and-a-raid-10.2449805/
  • K3Nv2 @ K3Nv2:
    The physical disk keeps disabling in bios
  • BakerMan @ BakerMan:
    hey ken did you see the aurora tonight?
  • BakerMan @ BakerMan:
    also sorry it was too cloudy, that sucks
  • SylverReZ @ SylverReZ:
    @K3Nv2, This chat is sponsored by Raid Shadow Legends.
  • K3Nv2 @ K3Nv2:
    So I guess raid0 doesn't allow mismatched storage oh well
     +1
    K3Nv2 @ K3Nv2: So I guess raid0 doesn't allow mismatched storage oh well +1