UDPIH and recovery_menu


There’s been a lot of buzz recently about the UDPIH exploit for Wii U (and its associated recovery_menu frontend), but included in this buzz is a lot of misinformation as to what UDPIH is capable of doing.

(tl;dr recovery_menu can fix certain types of bricks, but if the eMMC chip is actually failing, the only fix is to replace it.)

Wii U Recovery Menu 0.3 by GaryOderNichts

What UDPIH v0.2 and recovery_menu v0.4 *can* do:

  • Change the startup title. On retail systems, this is useful if the Coldboot Haxchi hack was uninstalled incorrectly (e.g. System Format or deleting the Haxchi title), resulting in a 160-0101 or 160-0103 error because IOSU cannot find the CBHC startup title. Changing the startup title back to Wii U Menu fixes this brick.
  • Dump system logs.
  • Dump OTP + SEEPROM. (Dumping SLC and MLC is a TODO item.)
  • Start wupserver for file transfers over the network.
  • Load network configuration from SD card in case the system’s network configuration is incorrect and you cannot access network configuration for some reason. (This may be needed in order to use wupserver.)
  • Pair a Gamepad. This gamepad pairing bypasses all region and dev/retail checks, so it allows “any” gamepad to be paired. (Wii U Menu may complain later if the gamepad doesn’t match the type it expects, though.)
  • Install WUP. This lets you install (validly signed) Wii U packages from the SD card. This *can* let you reinstall parts of the Wii U OS that may be corrupted for whatever reason. Obtaining those packages is an exercise left to the reader.
    • Note that reinstalling IOSU (aka OSv10) is probably not a good idea, since if something goes wrong, it would prevent usage of UDPIH, and it would not help with an eMMC brick because IOSU is stored on SLC, not MLC.
  • Edit Parental Controls. This lets you remove parental controls settings, in case that’s blocking you from accessing System Settings.
  • Debug System Region. This lets you fix most types of region bricks caused by incorrectly editing sys_prod.xml. It works by checking the installed Wii U Menu region and comparing it to the region settings in sys_prod.xml; if it doesn’t match, it prompts you if you want to reset the region settings.
  • System Information. This displays system model and serial number information, including the manufacturer of the eMMC chip.

What UDPIH v0.2 and recovery_menu v0.4 *cannot* do:

  • “Rewrite the OS”. Changing the startup title is not rewriting the OS; the closest equivalent on PC would be changing the boot order. Parts of the OS *can* be reinstalled by using the “Install WUP” function, but you would need to obtain the validly-signed packages elsewhere.
    • As mentioned before, reinstalling IOSU (aka OSv10) would not be a good idea because if something goes wrong, it would prevent usage of UDPIH, and IOSU is stored on SLC, not MLC, so it wouldn’t help with an eMMC brick.
  • Repair broken eMMC chips. This requires physically removing and replacing the eMMC, which requires significant effort.
  • Turn your Wii U into a Switch.

I’ve personally contributed to several of these functions, including Debug System Region and System Information. (Also changing the font to Terminus, with proper scaling on both the Gamepad and TV.)

Wii U Error Code: 157-1104 (region brick)
An error message displayed by the Wii U if attempting to launch a title with an incorrect region setting.
recovery_menu Debug System Region (early version)
An early version of recovery_menu’s “Debug System Region” screen fixing a (deliberate) region brick.
recovery_menu System Information showing details on a CAT-I Kiosk unit.
recovery_menu System Information showing details on a CAT-I Kiosk unit.

You might notice the “Wii U Menu version” above is listed as “11.0.0 U”. Kiosk menus have a completely distinct version compared to the regular Wii U Menu. (The latest version as far as I know is 14.0.0.)

The System Information screen above also shows that this system has a Toshiba MLC (eMMC) chip, which is currently known to be the most reliable. Other known manufacturers for the Wii U’s eMMC chip are Samsung (second-most reliable) and Hynix (worst).

The Hynix eMMCs in particular have been failing quite a bit recently. The syslogs dumped from those systems using UDPIH/recovery_menu show numerous bad sector errors, which cannot easily be fixed by software. At least one user on GBAtemp managed to replace the eMMC with a 32 GB SDHC card successfully, but not without issues. In particular, the SLC contains a file called scfm.img, which is a cache of the MLC file system. If this cache gets out of sync with the actual MLC contents, the system will have significant problems. It might be possible to clear the cache using UDPIH/recovery_menu later on.


Leave a Reply

Your email address will not be published. Required fields are marked *

 

This site uses Akismet to reduce spam. Learn how your comment data is processed.