Skip to content

Latest commit

 

History

History
204 lines (165 loc) · 11.4 KB

README.md

File metadata and controls

204 lines (165 loc) · 11.4 KB
Raw

Welcome to the de_Fuse NAND stuff guide. While it does still require soldering, it is far easier than soldering directly to the TSOP/eMMC and is MUCH faster (10-20min vs. over a day!).

I've also included instructions on how to dump/restore MLC and dump OTP/SEEPROM just to show how powerful this tool is (and to make it a complete NAND Dumping guide for consoles that cannot boot into UDPIH or the traditional nanddumper).

Please note that UDPIH is worth a try before trying this (uses a pico as well so you'd have to buy one anyway).

What you need {docsify-ignore}

  • Raspberry Pi Pico ($4 usually)
  • An SD Card. Cannot be SDHC or SDXC. I personally use a 2GB card from a 3DS.
  • Some soldering experience
  • Recommended to have an SLC/SLCCMPT backup but you can get by with fixing whatever mistake you did without one.

Set up the SD Card {docsify-ignore}

  1. Download the latest release of de_Fuse and extract it to your computer.
  2. Flash the boot1.img to the SD Card using Win32Disk Imager or dd (macOS users are on their own).
  3. Format the rest of the SD Card to FAT32.
  4. Copy fw.img and (optionally) otp.bin to the root of your SD Card.
    • You will need otp.bin if you want to boot a patched OS with de_Fuse.

Set up the Pico {docsify-ignore}

  1. Hold the BOOTSEL button while plugging the Pico into your PC.
  2. Copy the pico_defuse.uf2 file to the RPI-RP2 storage device.

Wire it all up! {docsify-ignore}

Here is a diagram showing where everything is (Thanks JadeStrike!):

This is what it could look like when finished:

Booting the console into a de_Fused state {docsify-ignore}

  1. Insert the SD Card into the Wii U
  2. Connect the WIi U to Power
  3. Connect the Wii U to a display over HDMI or to your PC with PuTTY or minicom.
  4. Power it on. You should see the minute_minute menu.

Restoring an SLC/SLCCMPT {docsify-ignore}

  1. Copy the slc.bin or slccmpt.bin to the root of your SD Card.
  2. Rename it so the extention is .raw (ie slc.raw).
  3. Boot the console into a de_Fused state.
  4. Navigate to Backup and Restore using the POWER button and press EJECT to select it.
  5. Navigate to Restore SLC.RAW (or Restore SLCCMPT.RAW) and select it.
  6. Wait for the restore to finish.
  7. Once finished, press POWER to go back to the Backup and Restore menu.
  8. Navigate to Return to Main Menu and then Power off.
  9. Try booting the console. Can be de_Fused or a "normal" boot (if you got this far im sure you can figure out what that means).

Dumping an SLC/SLCCMPT {docsify-ignore}

  1. Boot the console into a de_Fused state.
  2. Navigate to Backup and Restore using the POWER button and press EJECT to select it.
  3. Navigate to Backup SLC.RAW (or Backup SLCCMPT.RAW) and select it.
  4. Wait for the dump to finish.
  5. Once finished, press POWER to go back to the Backup and Restore menu.
  6. Navigate to Return to Main Menu and then Power off.
  7. Copy the dump to your PC.
    • What you do from here to fix the backup is out of the scope of this guide. However, you likely don't have an otp.bin dump either if you followed this section, so follow the Dumping OTP section to get one.

Dumping MLC {docsify-ignore}

!> This requires at least a 64GB/16GB SD Card on 32GB/8GB models respectively.

!> The SD Card will be formatted.

  1. Boot the console into a de_Fused state.
  2. Take out the current SD Card and insert the SD Card you will be using.
  3. Navigate to Backup and Restore with POWER and select it with EJECT.
  4. Navigate to Format redNAND and select it.
  5. Press EJECT.
    • It is optional to dump SLC/SLCCMPT.
  6. Wait for the redNAND creation to finish (might take a few hours).
  7. Press POWER to go back to the Backup and Restore menu.
  8. Navigate to Return to Main Menu and then Power off.
  9. Insert the redNAND SD Card into your PC.
  10. Dump the 3rd partition of the SD Card (will be roughly 8GB/32GB) to a file on your PC using the same tools you used to flash the boot1.img.
    • What you do from here to fix the backup is out of the scope of this guide.
  11. You now have an MLC dump! Yay!

Restoring MLC {docsify-ignore}

!> This requires at least a 64GB/16GB SD Card on 32GB/8GB models respectively and to have already been formatted with a redNAND (The section above).

  1. Boot the console into a de_Fused state.
  2. Insert the redNAND SD Card into the console.
  3. Navigate to Backup and Restore with POWER and select it with EJECT.
  4. Navigate to Restore redNAND and select it.
  5. Press EJECT to continue with the restore.
  6. Wait for it to finish (might take a few hours).
  7. Press POWER to go back to the Backup and Restore menu.
  8. Navigate to Return to Main Menu and then Power off.

Dumping OTP {docsify-ignore}

  1. Boot the console into a de_Fused state.
  2. Navigate to Backup and Restore using the POWER button and press EJECT to select it.
  3. Navigate to Dump OTP via PRSHhax and select it.
  4. Wait for the PRSHhax exploit to run. After it you should see a message saying "otp.bin successfully dumped".
  5. Navigate to Power off
  6. Copy the otp.bin to your PC.
  7. You now have an otp.bin dump! Yay!

Dumping SEEPROM {docsify-ignore}

  1. Boot the console into a de_Fused state.
  2. Navigate to Backup and Restore using the POWER button and press EJECT to select it.
  3. Navigate to Dump SEEPROM and OTP and select it.
  4. Press POWER to go back to the Backup and Restore menu.
  5. Navigate to Return to Main Menu and then Power off.
  6. Copy the seeprom.bin to your PC.
  7. You now have a seeprom.bin dump! Yay!

Credits {docsify-ignore}

  • shinyquagsire23 for de_Fuse, minute_minute, and generally just being helpful when I had troubles restoring.
CLICK HERE FOR OLD RPI FLASHER GUIDE

Read this!!! {docsify-ignore}

This guide is now outdated since there is a software exploit that allows unbricking without soldering! There is a guide for it here. UDPIH will not work if you somehow deleted OSv10 (00050010-1000400A), so you must hardmod the system.

Start

Hello and welcome to the new and improved freddy fazbears pizza Wii U Unbrick Guide. This Guide only covers the SLC (Wii U).

Usually if you need to restore vWii NAND, there is vWii NAND Restorer (Needs backup) or vWii Decaffenator (Doesn't need backup)

Wii U doesnt have something like that yet though. so we have to open up the console and solder some wires to the NAND.

To unbrick the Wii U we will use an Rasberry Pi. I have only ever used an RPi0 and been successful (RPi2B did not work) but the pinouts should be the same on every RPi. If you want to use a Teensy to unbrick, refer to this guide

What you need

  • An slc.bin dump from before the brick, or an otp.bin dump.
  • A Raspberry Pi and MicroSD for the Raspberry Pi.
  • Decent soldering equipment.
  • Decent soldering skills.
  • Ability to follow instructions.
  • A Lot of time.
  • A Decent understanding of Linux.
  • Last but not least, A Brain.

Setting up the software

  1. Set up RPIOS on a MicroSD. (Guide: https://www.raspberrypi.com/documentation/computers/getting-started.html)
  2. Power on your RPI and connect it to the internet.
  3. Open up a terminal (CTRL ALT T) and run wget https://raw.githubusercontent.com/Lazr1026/unbrick/main/pinand.sh && chmod +x pinand.sh
  4. Now run ./pinand.sh.

Solder the RPI to Wii U board

  1. Take apart the Wii U, look up a teardown.

  • Make sure you are VERY CAREFUL when soldering to these points. one mess up and your console may be dead for good.
    Solder Points:
    RPI:

    Wii U Board:

  • It should look like this when finished.

Fixing the NAND

Note: Now depending on what the hell you did, you could be doing something WAY different (ie. only restoring certain pages). We will be flashing back an entire SLC image here.

FIXING THE NAND WITH ONLY OTP.BIN

Download Eyekeys NAND Tools and extract the zip somewhere on your PC.

  1. Put the Wii U back together enough to get everything plugged in (Disc Drive, Power Button, Fan, Heatsink.)
  2. Power on the Wii U.
  3. Turn on the RPI.
  4. Open up a terminal and run sudo ./pinand 50 read_id, you should get something like this.
  5. Run sudo ./pinand 50 read_full 0 262144 slc.bin.
  6. Wait for it to finish reading. (DO NOT UNPLUG THE WII U OR RPI.)
  7. Turn off the Wii U and RPI, insert the RPI' MicroSD in your PC.
  8. Copy the slc.bin from sd:/home/[USER] to the NAND Tools folder on your PC. (Hint: Now would be a REALLY good time to copy otp.bin to the folder as well.)
  9. Open a Command Prompt and run nandCbhcRemover.exe slc.bin. See the next section for flashing the NAND back to the Wii U.

FIXING THE NAND WITH ONLY SLC.BIN

  1. Insert the RPI' MicroSD in your PC.
  2. Copy slc.bin to sd:/home/[USER]. (OTP Only Users: Click Replace when asked.)
  3. Insert the RPI' MicroSD into the RPI.
  4. Turn on the Wii U.
  5. Turn on the RPI.
  6. Open a terminal and type in sudo ./pinand 50 read_id. You should get something like this.
  7. Run sudo ./pinand 50 erase_blocks 0 4096 && sudo ./pinand 50 write_full 0 262144 slc.bin.
  8. Wait for it to finish, this will take a LONG time (around 2 days for an RPi0). (DO NOT UNPLUG THE WIIU OR THE RPI.)

After Flashing

  1. Turn off the Wii U.
  2. Turn off the RPI.
  3. Put the Wii U back together enough to test if it boots, plug in Disc Drive, Power Button, Fan, Heatsink.
  4. Turn on the Wii U, connect an HDMI or AV (or if your Gamepad is still paired, that works too).
  • If it loads to Wii U Menu, congrats, desolder the wires on the Wii U Board and put the system back together. You have successfully done the RPI Hardmod Method.
  • If it does not load to Wii U Menu and Errors, then you did something wrong, or you used the wrong backup. Try Flashing again, or join Ivy's Stuff and ask for help in #help

Credits:

rw-r-r-0644 - sending me an edited pinand and fixing it.
GaryOderNichts - Emotional support while doing the hardmod.
Nightkingale - Same thing as Gary.
The 4TU Discord server - For being awesome. ;)
RPi Forums - Having a thread on Bit-Banging a TSOP NAND.
agilly1989 - Sent me the forum and emotional support.
All of my other friends on Discord - You know who you are.

You can find the source on Github.