A console hacker named WinCurious obtained some discarded SD cards from a Nintendo factory that the company used for the factory setup process of Wii and Wii U systems. According to DeadlyFoez, the cards contained a boot image that Nintendo used for the factory setup of the Wii U console. They were able to recover data on some of the damaged SD cards, after which another member of their team discovered an exploit that could be used to restore software-bricked Wii U consoles.
The first challenge they faced was that all the cards were damaged, with approximately 25% of them having a destroyed die and flash memory IC. However, the remaining 75% only had PCB damage — some of them required resoldering work or PCB replacement, while others needed only straightening before they could be read. After the repairs were completed, the next step was to read the contents of the SD cards.
Unfortunately, it’s not as simple as plugging the SD cards into a reader and then copying and pasting them to another drive on your Windows PC. One solution to this was to use an external programmer to read the NAND flash memory directly, but this wasn’t viable because DeadlyFoez did not have one that was compatible with the TSOP 48 chips used on the Nintendo SD cards. The dumped data would not represent what was actually on the card because it didn’t go through its controller chip.
Thankfully, WinCurious had an idea — they suggested using a donor SD card and replacing its NAND chip with a TSOP 48 clip. They would then remove the NAND chips from the SD cards that they wanted to read (but had damaged or defective PCBs) and place them on a working SD card. This workaround enabled the group to access the data on the discarded memory cards, albeit with difficulty.
“I can not express how incredibly difficult it is to solder these TSOP 48 clips onto anything at all. They melt at a rather lower temperature. If the solder is melted, then the plastic of these will be soft and malleable. In most cases, the solder pads of the PCB are the same size as the pins of the clip, making it impossibly difficult to see even with magnification,” says DeadlyFoez. “To solder these on you must tin the pads of the PCB first, then place the TSOP 48 clip directly on top of the peaks of the tinned pads. Finally, you must reflow the solder. The right way to do it would be with a reflow oven and using solder paste with a stencil, but I do not have those. I do have my infrared preheater, which works well enough for these things.”
Nevertheless, the system was successful, enabling them to recover 14 SD cards. From here, another member of the group, Rairii, snooped around the dumped data and discovered an SDBoot1 image. This vulnerability was initially discovered during the Wii U's factory setup, allowing the group to run their code when the console boots. They then wrote an exploit to take advantage of this, called “paid the beak”, and uploaded it on GitHub.
Since SDBoot1 runs even on consoles with empty flash memory, it can recover almost any Wii U that has suffered from a software brick. The only devices it cannot save are those that have experienced issues with Seeprom or have suffered actual hardware failure. Note that you’d still need a rare Nintendo jig, a Raspberry Pi Pico, or a PICAXE 08M2 microcontroller to trigger UNSTBL_PWR on your console for it to boot from the SD card.
Once you have them all, you can now put the card on your Wii U, use the jig or its alternative, and turn on your Wii U console. From there, it should load whatever you put on the SD card, allowing you to do anything you want on your old hardware. Another mod chip, called de_Fuse, can also perform a similar function and even recover Seeprom failures, but it requires more advanced skills and knowledge. This technique makes playing with the Wii U’s hardware a little more accessible, allowing more people to experiment with it without having to disassemble their consoles and use specialized soldering skills.
Follow Tom's Hardware on Google News to get our up-to-date news, analysis, and reviews in your feeds. Make sure to click the Follow button.
