Hacking WiiU stack in bootlogo

[JRuka]

Hello everyone!

Today I decided to turn on my WiiU screen printed Wind Waker HD after years.

I decided this to check if there was the problem that is plaguing several Hynix emmc consoles.

It should be noted that my WiiU was modified (before it was permanently switched off) only via Haxchii (without ColdBoot) and with a 32gb micro SD from Sandisk.

When I turned on the console I could see that it is permanently stuck on the WiiU logo without being able to do anything else.

I have already tried to start the recovery menu of GaryOder but without any success but I have seen in the log generated that there are no errors or problems in the mmc and I can normally make a dump of the otp and the seeprom. The main error reported in the logs is 103-1601. I also tried to connect via the wupserver to the WiiU to dump the system.xml but without any success and noting that the wupclient stops due to a problem on w.open ("/dev/fsa", 0).

I hope you can help me.

 

[SDIO]

So you were able to launch the recovery menu?
Could you send me your logs as a PM and I can look through them.

 

[JRuka]

So you were able to launch the recovery menu?
Could you send me your logs as a PM and I can look through them.

Unfortunately I can't send private messages as I'm a newbie and have the limit

btw i share log here

Edit: Idk why I can't insert the attachment to my answer
Edit2: I was successfully able to connect via wupserver and download the system.xml file

 

[SDIO]

From the logs it looks like Nintendo TVii is corrupted.

 00:00:05:487: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: -1245211, cmd:25, path: /sys/title/00050030/1001320a/code/app.xml
00:00:05:490: FSA: ### DATA CORRUPTION ERROR ###, dev:m1c01, err: -1245211, cmd:25, path: /sys/title/00050030/1001420a/code/app.xml
00:00:05:500: FSA: ### DATA CORRUPTION ERROR ##H, dev:mc01, err: -1245211, cmd:25, path: /sys/title/00050030/1001620a/code/app.xml
00:00:05:503: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: - 1245211, cmd: 25, path:/ sys/title/00050030/1001820a/code/app.xm1
00:00:05:506: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: -1245211, cmd:25, path: /sys/title/00050030/1001920a/code/app. xml
00:00:05:508: FSA: ### DATA CORRUPTION ERROR ###, dev:mic01, err: - 1245211, cmd: 25, path:/sys/title/00050030/1001720a/code/app.xml
00:00:05:510: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: -1245211, cmd:11, path: (null)
00:00:05:512: FSA: ### DATA CORRUPTION ERROR ###, dev:mic01, err: -1245211, cmd:25, path: /sys/title/00050030/1001220a/code/app. xml
00:00:05:515: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: -1245211, cmd:25, path: /sys/title/00050030/1001020a/code/app.xml
00:00:05:518: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err: -1245211, cmd:25, path: /sys/title/00050030/1001120a/code/app.xml
00:00:05:532: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: -1245211, cmd:25, path: /sys/title/00050030/1005d20a/code/ app. xml
00:00:05:535: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: -1245211, cmd:25, path: /sys/title/00050030/ 1001520a/code/app. xml
00:00:05:538: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err: -1245211, cm:25, path: /sys/title/00050030/1001a00a/code/app.xml
00:00:05:544: MCP: ECO mode is enabled

It might be save to just delete the app.xml but I am not sure, maybe its better to delete it and replace it with a fresh copy.
What does System Information in the recovery Menu say about the eMMC? I am interested in the CID and the Manucaturer

 

[JRuka]

From the logs it looks like Nintendo TVii is corrupted.

 00:00:05:487: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: -1245211, cmd:25, path: /sys/title/00050030/1001320a/code/app.xml
00:00:05:490: FSA: ### DATA CORRUPTION ERROR ###, dev:m1c01, err: -1245211, cmd:25, path: /sys/title/00050030/1001420a/code/app.xml
00:00:05:500: FSA: ### DATA CORRUPTION ERROR ##H, dev:mc01, err: -1245211, cmd:25, path: /sys/title/00050030/1001620a/code/app.xml
00:00:05:503: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: - 1245211, cmd: 25, path:/ sys/title/00050030/1001820a/code/app.xm1
00:00:05:506: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: -1245211, cmd:25, path: /sys/title/00050030/1001920a/code/app. xml
00:00:05:508: FSA: ### DATA CORRUPTION ERROR ###, dev:mic01, err: - 1245211, cmd: 25, path:/sys/title/00050030/1001720a/code/app.xml
00:00:05:510: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: -1245211, cmd:11, path: (null)
00:00:05:512: FSA: ### DATA CORRUPTION ERROR ###, dev:mic01, err: -1245211, cmd:25, path: /sys/title/00050030/1001220a/code/app. xml
00:00:05:515: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: -1245211, cmd:25, path: /sys/title/00050030/1001020a/code/app.xml
00:00:05:518: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err: -1245211, cmd:25, path: /sys/title/00050030/1001120a/code/app.xml
00:00:05:532: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: -1245211, cmd:25, path: /sys/title/00050030/1005d20a/code/ app. xml
00:00:05:535: FSA: ### DATA CORRUPTION ERROR ###, dev:mc01, err: -1245211, cmd:25, path: /sys/title/00050030/ 1001520a/code/app. xml
00:00:05:538: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err: -1245211, cm:25, path: /sys/title/00050030/1001a00a/code/app.xml
00:00:05:544: MCP: ECO mode is enabled

It might be save to just delete the app.xml but I am not sure, maybe its better to delete it and replace it with a fresh copy.
What does System Information in the recovery Menu say about the eMMC? I am interested in the CID and the Manucaturer

Today I disassembled the WiiU, the emmc is a Hynix (H26M64007BNB).

Unfortunately I can't see anything in the recovery mode menu for my WiiU settings so I had to go intuition based on Gary's github.

 

[SDIO]

You find it in System Information in the recovery menu, I need the CID for the date

 

[JRuka]

You find it in System Information in the recovery menu, I need the CID for the date

I know, but when I put recovery_menu in root of micro SD card, WiiU doesn't show anything on gamepad.

 

[SDIO]

It should be on the tv screen or is the screen output also not working? DId you try the recovery_menu_dc?

 

[JRuka]

It should be on the tv screen or is the screen output also not working? DId you try the recovery_menu_dc?

I also tried recovery_menu_dc with a Wii AV cable but still nothing on screen.

 

[SDIO]

I am working on something that could help us with that. But I need a few more days, if it is an option for you to wait till the weekend.
You can try to replace the file if you want to risk it, but I would feel more comfortable if you wait a little bit and I have the tools ready to dump everything

 

[JRuka]

I am working on something that could help us with that. But I need a few more days, if it is an option for you to wait till the weekend.
You can try to replace the file if you want to risk it, but I would feel more comfortable if you wait a little bit and I have the tools ready to dump everything

There's no problem and I'm in no hurry so we await developments

 

[SDIO]

00:00:05:135: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050010/10049200/code/app.xml\
00:00:05:488: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050030/1001320a/code/app.xml\
00:00:05:491: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050030/1001420a/code/app.xml\
00:00:05:493: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050030/1001620a/code/app.xml\
00:00:05:496: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:\
00:00:05:498: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050030/1001920a/code/app.xml\
00:00:05:501: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050030/1001720a/code/app.xml\
00:00:05:503: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050030/1001220a/code/app.xml\
00:00:05:506: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050030/1001020a/code/app.xml\
00:00:05:512: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050030/1001120a/code/app.xml\
00:00:05:518: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050030/1005d20a/code/app.xml\
00:00:05:521: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/sys/title/00050030/1001520a/code/app.xml\
00:00:05:523: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-124521\
00:00:05:554: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)\
00:00:06:765: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/usr/save/system/acp\
00:00:06:766: [ACP]ERROR:CheckExistence:898: failed to check existence of /vol/storage_mlc01/usr/save/system/acp/ (status = -196635)\
00:00:06:773: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:5, path:/usr/save/system/acp\
00:00:06:774: [ACP]ERROR:MakeQuota:2004: Failed to make a quota /vol/storage_mlc01/usr/save/system/acp/ (status = -196635, quota size = 8388608)\
00:00:06:774: [ACP]ERROR:ConvertFSAStatusToNnResult:194: Data Corrupted FSA Error at mlc (-196635)\
00:00:06:774: [ACP]ERROR:CreateSystemSaveDir:1254: Failed to create system save directories\
00:00:07:029: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:10, path:/usr/save/system/act/persisid.dat\
00:00:07:034: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:10, path:/usr/save/system/act/transid.dat\
00:00:07:039: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:10, path:/usr/save/system/act/uuid.dat\
00:00:07:050: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:10, path:/usr/save/system/act/common.dat\
DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:10, path:/usr/save/system/act/uuid.dat.tmp\
00:00:07:058: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:27, path:/usr/save/system/act\
00:00:07:132: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:7, path:(null)\
00:00:07:988: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)\
;00;07;868: ***LoadShared - WaitLoadComplete(0,8388608) failed with error -1966300:00:08:730: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211,
cmd:11, path:(null

I just grepped for ERROR on the file you sent me and it looks really bad.

What kills it doesn't seem to be the app.xml from TVii but this font:

00:00:07:988: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)\
00:00:07:988: failed to read file /vol/storage_mlc01/sys/title/0005001b/10042400/content/CafeCn.ttf, err -196635\
00\
;00;07;868: ***LoadShared - WaitLoadComplete(0,8388608) failed with error -1966300:00:08:730: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)\
00:00:08:730: failed to read file /vol/storage_mlc01/sys/title/0005001b/10042400/content/CafeTw.ttf, err -196635\

But I am less concerned about the font, and more about this error:

00:00:06:765: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:25, path:/usr/save/system/acp\
00:00:06:766: [ACP]ERROR:CheckExistence:898: failed to check existence of /vol/storage_mlc01/usr/save/system/acp/ (status = -196635)\
00:00:06:773: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:5, path:/usr/save/system/acp\
00:00:06:774: [ACP]ERROR:MakeQuota:2004: Failed to make a quota /vol/storage_mlc01/usr/save/system/acp/ (status = -196635, quota size = 8388608)\
00:00:06:774: [ACP]ERROR:ConvertFSAStatusToNnResult:194: Data Corrupted FSA Error at mlc (-196635)\
00:00:06:774: [ACP]ERROR:CreateSystemSaveDir:1254: Failed to create system save directories\

It seems that not only the content of files is corrupted but also the file system structure. If the file system is too far gone, we can't fix it with current tools.

I think the best way to proceed would be to first get a good complete NAND Dump. I am working on adding it to the recovery menu.
If we have the dumps, the MLC should be replaced. I didn't see any MEDIA ERROR, but it is very unlikly that this level of corruption is caused by a power outage and sometimes the MEDIA ERROR go away and there seem to be some logs missing.

If we have it running on new media, we would need to try to delete anything that is corrupted and copy it back, either from another console or NUS. But it is quite possible that the file system is already to far gone and it will only corrupt further when we try to delete and replace stuff.

EDIT: please don't the console on unless instructed to prevent further corruption.