It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

• A Wii U
• One of the devices listed below
  Note: Any other linux device capable of USB device emulation should work as well.
  Prebuilt releases are only available for the Pico and Zero.
  I will add more devices below which are confirmed to work.

Supported devices:​

• A Raspberry Pi Pico or Zero
• A Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

• Download the latest udpih.uf2 from the releases page.
• Hold down the BOOTSEL button on the board and connect the Pico to your PC.
  Your PC will detect the Pi as a storage device.
• Copy the .uf2 file to the Pico. It will disconnect after a few seconds.

The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

• Install the required dependencies:
  

  sudo apt install build-essential raspberrypi-kernel-headers

• Clone the repo:

• git clone https://github.com/GaryOderNichts/udpih.git
  cd udpih

• Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
• Now build the kernel module:

• cd linux
  make

• You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.

The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

Important notes for this to work:

• Make sure no other USB Devices are attached to the console.
• Only use USB ports on the front of the console, the back ports will not work.
• If your console has standby mode enabled, pull the power plug and turn it on from a full coldboot state.

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
  This timing is important. If you're already in the menu, the exploit won't work..
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title
Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

On non-retail systems the following additional options are available:

• System Config Tool - 00050010-1F700500
• DEVMENU (pre-2.09) - 00050010-1F7001FF
• Kiosk Menu - 00050010-1FA81000

Dump Syslogs
Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM
Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver
Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration
Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Pair Gamepad
Displays the Gamepad Pin and allows pairing a Gamepad to the system. Also bypasses any region checks while pairing.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.
Note that rebooting the system might be required to use the newly paired gamepad.

Install WUP
Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Edit Parental Controls
Displays the current Parental Controls pin configuration.
Allows disabling Parental Controls.

Debug System Region
Fixes bricks caused by setting productArea and/or gameRegion to an invalid value. Symptoms include being unable to launch System Settings or other in-region titles.

System Information
Displays info about several parts of the system.
Including serial number, manufacturing date, console type, regions, memory devices...

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

 

[porkiewpyne]

You don't need a GamePad, you navigate the menu using the physical buttons on the console itself (POWER and EJECT).
You do need a TV hooked up though, otherwise you can't really navigate the menu.

Wait we need a TV too??? Oh nooo the travesty! This is a tragedy!

/s

 

[ploggy]

I could be wrong but I think it maybe be possible to use a PSP for this too with irshell?

 

[GaryOderNichts]

Wait we need a TV too??? Oh nooo the travesty! This is a tragedy!

/s

Right this is insanse! They cost like 600 bucks!

 

[MXRD4K1LL4]

Wait we need a TV too??? Oh nooo the travesty! This is a tragedy!

/s

You don't necessarily need a tv depending on your ressources

It's been a while without any major exploits in the Wii U scene, so I present to you:

USB Descriptor Parsing Is Hard (UDPIH)​

An exploit for the Wii U's USB Host Stack. Pronounced like "mud pie" without the M.

The write-up can be found here!

What does this mean?​

Since the USB Stack is running before anything on the PPC side of the Wii U is booted, this allows unbricking things like CBHC bricks without any soldering!

Requirements​

• A Wii U
• One of the devices listed below
  Note: Any other linux device capable of USB device emulation should work as well.
  Prebuilt releases are only available for the Pico and Zero.
  I will add more devices below which are confirmed to work.

Supported devices:​

• A Raspberry Pi Pico or Zero
• An unpatched Nintendo Switch capable of running udpih_nxpayload

Instructions​

Pico​

• Download the latest udpih.uf2 from the releases page.
• Hold down the BOOTSEL button on the board and connect the Pico to your PC.
  Your PC will detect the Pi as a storage device.
• Copy the .uf2 file to the Pico. It will disconnect after a few seconds.

The Pico is now flashed and can be used for udpih. Continue with "Booting the recovery_menu" below.

Raspberry Pi Zero (Linux)​

• Install the required dependencies:
  

  sudo apt install build-essential raspberrypi-kernel-headers

• Clone the repo:

• git clone https://github.com/GaryOderNichts/udpih.git
  cd udpih

• Download the latest arm_kernel.bin.h from the releases page and copy it to the arm_kernel directory.
• Now build the kernel module:

• cd linux
  make

• You can now run sudo insmod udpih.ko to insert the kernel module into the kernel.

The Zero is now ready to be used for udpih.
Note that you'll need to insert the module again after rebooting the Zero. You will need 2 USB cables, one for powering the Zero and one which can be connected to the Wii U.

Continue with "Booting the recovery_menu" below.

Booting the recovery_menu​

• Copy the latest release of the recovery_menu to the root of your FAT32 formatted SD Card.
• Insert the SD Card into the console and power it on.
• As soon as you see the "Wii U" logo on the TV or Gamepad plug in your Zero/Pico.
  This timing is important. If you're already in the menu, the exploit won't work..
• After a few seconds you should be in the recovery menu.

So what's this recovery menu? The recovery menu allows you to fix several bricks:

Wii U Recovery Menu​

A simple recovery menu running on the IOSU for unbricking.

Options​

Set Coldboot Title​

Allows changing the current title the console boots to.
Useful for unbricking CBHC bricks.
Possible options are:

• Wii U Menu (JPN) - 00050010-10040000
• Wii U Menu (USA) - 00050010-10040100
• Wii U Menu (EUR) - 00050010-10040200

Dump Syslogs​

Copies all system logs to a logs folder on the root of the SD Card.

Dump OTP + SEEPROM​

Dumps the OTP and SEEPROM to otp.bin and seeprom.bin on the root of the SD Card.

Start wupserver​

Starts wupserver which allows connecting to the console from a PC using wupclient.

Load Network Configuration​

Loads a network configuration from the SD, and temporarily applies it to use wupserver.
The configurations will be loaded from a network.cfg file on the root of your SD.
For using the ethernet adapter, the file should look like this:

type=eth

For using wifi:

type=wifi
ssid=ssidhere
key=wifikeyhere
key_type=WPA2_PSK_AES

Displays DRC Pin​

Displays the Gamepad Pin used for pairing the gamepad.
The numeric values represent the following symbols: ♠ = 0, ♥ = 1, ♦ = 2, ♣ = 3.

Install WUP​

Installs a valid signed WUP from the install folder on the root of your SD Card.
Don't place the WUP into any subfolders.

Credits​

• @Maschell for the network configuration types
• @dimok789 for mocha
• @hexkyz for hexFW
• @rw-r-r-0644 for the lolserial code

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene!

If it works with switch, couldn't it work on Wii, or PC? Idk if it can be used the same but

 

[GaryOderNichts]

You don't necessarily need a tv depending on your ressources


If it works with switch, couldn't it work on Wii, or PC? Idk if it can be used the same but

I'm going to quote my previous reply to your message:
"you'll need a [...] USB controller [that] can act as a USB device."
The Wii and most PCs are not going to have that.

 

[MXRD4K1LL4]

I could be wrong but I think it maybe be possible to use a PSP for this too with irshell?

I guess, but the software is in development and is testing devices I guess so I'd wait like a week for the whole thing finished

 

[Arck]

The power LED of my WiiU is blinking in blue, I guess it can't be unbricked at all :/ (not sure how I bricked it in the past)

 

[GaryOderNichts]

The power LED of my WiiU is blinking in blue, I guess it can't be unbricked at all :/ (not sure how I bricked it in the past)

Do you get to the screen with the "Wii U" logo?

 

[MXRD4K1LL4]

I'm going to quote my previous reply to your message:
"you'll need a [...] USB controller [that] can act as a USB device."
The Wii and most PCs are not going to have that.

Yeah.. I just don't really know what devices have that. Like if a phone can send file with usb c to usb a it would count or needs really like uh another emulation thing.. I'm just really worried because my Wii I got system damaged and bricked after 1 week if usage and I'm looking a lot for my family to have a good summer so sorry everyone if I am asking lot questions but that's it

 

[ploggy]

I guess, but the software is in development and is testing devices I guess so I'd wait like a week for the whole thing finished

Oh its not for me personally, I have a Switch and a Zero if I ever needed to use it, I'm just thinking about the lolz using a PSP to exploit a Switch... Handheld - Handheld

 

[Arck]

Do you get to the screen with the "Wii U" logo?

nope just the light blinking in blue when powered on, the monitor can't even find a signal. I can hear the fan but that's about it.

 

[godreborn]

nope just the light blinking in blue when powered on, the monitor can't even find a signal. I can hear the fan but that's about it.

Sounds like hardware failure.

 

[Arck]

Sounds like hardware failure.

sadly yes, I really can't remember how I bricked it. I guess that WiiU is a literal brick. It's the one I use as a support for my Switch and I have a working one so not a big issue, but still unbricking it could have been nice

 

[MXRD4K1LL4]

nope just the light blinking in blue when powered on, the monitor can't even find a signal. I can hear the fan but that's about it.

I don't think this software could run, maybe if you had a backup and paste it on the band it could work, but I don't know what you can really actually do

 

[Deleted member 510354]

Are patched erista consoles that can boot hekate supported by the UDPIH payload or really just unpatched ones as stated?

 

[MXRD4K1LL4]

Are patched erista consoles that can boot hekate supported by the UDPIH payload or really just unpatched ones as stated?

If your switch is hacked, yes it would work

 

[GaryOderNichts]

Are patched erista consoles that can boot hekate supported by the UDPIH payload or really just unpatched ones as stated?

Patched erista units should work. All mariko units use xusb though, which is untested. They might work as well though, I'll have to wait until someone tests it out

 

[lyokohack]

hi i tried with a patched switch and i have this error in udpih_nxpayload under the switch

0x6 0x100 0x0 0x18
Error ...3

and I copy recovery_menu and I have Fat32 in my card
and the exploit doesn't run anymore

 

[Deleted member 510354]

Patched erista units should work. All mariko units use xusb though, which is untested. They might work as well though, I'll have to wait until someone tests it out

I tested it with my patched erista and it worked! Thank you very much for your work and your quick answer

Just one suggestion: maybe you could disable the option to Reboot to RCM, if a patched Erista unit is detected in a future update (if you plan to do one). If I remember correctly your code is based on hekate and there's also some kind of protection that you can't enable AutoRCM on a patched console. Rebooting to RCM is also disabled in Lockpick_RCM and I think it's a nice feature.

 

[MXRD4K1LL4]

I tested it with my patched erista and it worked! Thank you very much for your work and your quick answer

Just one suggestion: maybe you could disable the option to Reboot to RCM, if a patched Erista unit is detected in a future update (if you plan to do one). If I remember correctly your code is based on hekate and there's also some kind of protection that you can't enable AutoRCM on a patched console. Rebooting to RCM is also disabled in Lockpick_RCM and I think it's a nice feature.

Did the console had hwfly or sx chip? (Just a question)