Came across this Wii U console. It appears to be bricked as it boots up to the Nintendo Wii U Logo and immediately goes into factory reset where it gets stuck and stays for an hour before the console automatically powers down. It looks like this:



Unfortunately because it didn't come with its associated GamePad I am unable to see the error message and there is no way to sync a different Gamepad to the console in this state. So we are going to go to plan B. I will be hacking the console by exploiting the USB Host Stack descriptor parsing, which will allow me to get into a recovery menu and then dump the log file to get a look at what is happening. 

So the question is, is the console bricked or is the console dead? There are a couple things that could be wrong, as I do not know the history of this console.

1. Bricked console due to corrupt firmware or failed custom firmware loading
2. eMCC chip is defective or has failed and caused corruption. The early 32GB version of these consoles used Hynix chips that had a known problem and would go bad after a few years.

Waiting on a Raspberry Pi Pico that I need to diagnose the console. I will post back with my findings. I am hoping this is fixable and this console can be saved.

My Raspberry Pi Pico finally arrived and I was able to load a handy tool created by someone who goes by GaryOderNichts, his tool udpih can be found on his github.

After loading the tool I was able to get into the recovery menu for the Wii U and dump the log files of the console. Lets take a look at see what is happening. 

The following are the only error messages found in the log:
00;00;08;607: Read SysConfig Error code: category:32,code:-21
00:00:13:897: UHS0 Error: UhsFreeMem(pMem=0x102c0480) failed with error -4
00:00:13:897: UHS0 Error: file uhs_device.c, function UhsDeviceHandleTeardown, line 432, status 0:-4, info 271320192(0x102c0480)
00:00:13:897: UHS0 Error: UhsFreeMem(pMem=0x102c0540) failed with error -4.
00:00:13:897: UHS0 Error: file uhs_device.c, function UhsDeviceHandleTeardown, line 432, status 0:-4, info 271320384(0x102c0540)
00:00:13:897: UHS0 Error: UhsFreeMem(pMem=0x102c0680) failed with error -4.
00:00:13:897: UHS0 Error: file uhs_device.c, function UhsDeviceHandleTeardown, line 432, status 0:-4, info 271320704(0x102c0680)

Unfortunately this doesn't tell me much. I was expecting to see eMMC error codes. There are none in this log file.

Error codes related to the eMMC failing or being corrupt would look something like this:
FSA: ### MEDIA ERROR ###, dev:mlc01, err:-2528230, cmd:11, path:(null)

It would appear I have to do some further digging as I do not know what these other errors mean. It is possible they are of no importance.

Edit: Attached log file.

Making progress here, unfortunately its not looking good. While the log files show no sign of a failed/corrupt eMMC. The eMMC in this Wii U is indeed a Hynix from 2012, which are the ones that are suspected of having an issue failing after a few years.

Here is the system information:
 

I am going to attempt a full NAND dump of the console. This should be able to identify for me whether the corruption is in the SLC (which caches/reads its data from the eMMC) or if the corruption is from the eMMC itself. 

Since things are pointing at a failed eMMC. There are some hardmod solutions to remedy this problem with the console. I don't know if I am going to attempt to do that type of repair or not. While I like the idea of keeping a Wii U working, hardmods tend to throw a wrench into the equation for your everyday user and this console would effectively end up staying with me for the rest of its life. I would have preferred a repair where it could have gone to someone else to use.

So it turns out dumping the full NAND from a Wii U, even though its only 32GB in size is extremely slow. Looks like this is going to take a couple hours to complete.

For those looking to do this, you will need a 64GB SD Card, formatted as FAT32. You will need to use a third party formatting tool to achieve this as Windows cannot format a drive above 32GB as FAT32.

For those interesting in doing this, I am providing the recovery menu file that allows for a full NAND dump.

The full NAND dump took just over 2 hours of time and confirms that something is corrupt. The eMMC may be corrupt/failing, however without the log showing specific eMMC errors I wonder if the problem is that someone messed with and corrupted the firmware on this console. It is possible to cause this if power is loss to the console during a firmware update. The MLC logfile shows thousands of read errors from the eMMC.

I will have to do some more research to see if its possible to reload the firmware. If it is possible to reload the firmware on the console, it would be interesting to see if it corrects the problem.

After doing some research it looks like there is a hardmod available using what is being called a NAND-AID. Voultar is the creator behind it. Kudos to him for a brilliant design. This NAND-AID replaces the failed eMMC with a Micro-SD card. I have ordered a NAND-AID and am waiting for it to arrive.

This type of repair does require disassembling the console and modification/soldering to the original board. However its a permanent fix to the problem and once the console is back together no one would know the hardmod was done without opening the console up and looking. I am going to undertake the repair based on this information 

After several hours of playing around I was able to finally confirm that this console does indeed have a failing eMMC. At the start of the journey the only screen I would see when powering the Wii U on was the factory reset screen. After reloading the firmware on the console I am finally able to see an error screen. See picture below:


Additionally in the new log files that were created, I am seeing the following errors:

00:00:40:425: FSA: ### DATA CORRUPTION ERROR ###, dev:mlc01, err:-1245211, cmd:11, path:(null)

This error indicates that the eMMC is corrupt and is failing. This is good news in a way. I can now proceed to the repair using the NAND-AID. Unfortunately it probably won't arrive until the end of next week. In the meantime I will probably try working on another Wii U I came across. I will start a new thread for that to keep these separate though.

Edit: After doing more research it appears my original assumption was incorrect. "DATA CORRUPTION ERROR" Doesn't necessarily indicate that the eMMC is failing. It could just be corrupt data due to power loss during an update. Attached all log files

I did some more investigating, I used wfs-tools and looked at the dumped NAND from this console and there seems to me alot of system file corruption, albeit this is the first Wii U i have worked on like this so maybe this isn't that much. With the output from wfs-extract, I was able to determine that the Mii Maker App is corrupt, so I used jnustool and downloaded it from Nintendo. Afterwards i used the recovery menu and install WUP to overwrite the app to the eMMC. This in theory should fix the app. The problem is, this console freezes during this process. So I believe this indicates the eMMC is failing and this is not simply data corruption from power loss. So I will be using the NAND-AID to repair this console. It should arrive by the end of the week.

For those curious why a failing eMMC can be read from, it is because its designed to be this way. When an eMMC has failed it often will enter into a read only state, thus allowing data to be recovered from it. It is only when you attempt to write to the eMMC that you end up with serious problems, such as the console freezing or crashing. This is why the Wii U has no problem with me reading all data from the eMMC including the corrupted data, but when I attempt to write to it the console freezes.

Here is the full readout of the dump:

---

Error: Failed to read /"sys\\title\\00050010\\10040100\\content\\Common\\Sound\\Men\\stream\\BGM_SET_ACS.bfstm"
Error: Failed to read /"sys\\title\\00050010\\10040100\\content\\Us\\Model\\AccountTvCap_Us.szs"
Error: Failed to read /"sys\\title\\00050010\\10040100\\content\\Us\\Model\\ConfigTvCap_Us.szs"
Error: Failed to read /"sys\\title\\00050010\\10043100\\content\\drc_fw.bin"
Error: Failed to read /"sys\\title\\00050010\\10044100\\content\\lang_00.bin"
Error: Failed to read /"sys\\title\\00050010\\10044100\\content\\lang_01.bin"
Error: Failed to read /"sys\\title\\00050010\\10044100\\content\\lang_02.bin"
Error: Failed to read /"sys\\title\\00050010\\10044100\\content\\lang_03.bin"
Error: Failed to read /"sys\\title\\00050010\\10047100\\content\\Common\\Sound\\Set\\stream\\BGM_SET_ACS.bfstm"
Error: Failed to read /"sys\\title\\00050010\\10048100\\code\\pcl.rpx"
Error: Failed to read /"sys\\title\\00050010\\10048100\\content\\Common\\Package\\Pcl.pack"
Error: Failed to read /"sys\\title\\00050010\\10048100\\content\\Common\\Sound\\Pcl\\cafe_barista_pcl.bfsar"
Error: Failed to read /"sys\\title\\00050010\\10048100\\content\\Common\\Sound\\Pcl\\stream\\BGM_PCL.bfstm"
Error: Failed to read /"sys\\title\\00050010\\10048100\\content\\UsFrench\\Message\\AllMessage.szs"
Error: Failed to read /"sys\\title\\00050010\\10048100\\content\\UsPortuguese\\Message\\AllMessage.szs"
Error: Failed to read /"sys\\title\\00050010\\10048100\\content\\UsSpanish\\Message\\AllMessage.szs"
Error: Failed to read /"sys\\title\\00050010\\10048100\\meta\\bootDrcTex.tga"
Error: Failed to read /"sys\\title\\00050010\\10048100\\meta\\bootTvTex.tga"
Error: Failed to read /"sys\\title\\00050010\\10049100\\code\\acs.rpx"
Error: Failed to read /"sys\\title\\00050010\\10049100\\content\\Common\\Package\\Acs.pack"
Error: Failed to read /"sys\\title\\00050010\\10049100\\content\\Common\\Sound\\Acs\\cafe_barista_acs.bfsar"
Error: Failed to read /"sys\\title\\00050010\\10049100\\content\\Us\\Model\\AccountTvCap_Us.szs"
Error: Failed to read /"sys\\title\\00050010\\1004a100\\content\\arclayout\\layout.sgarc.cmp"
Error: Failed to read /"sys\\title\\00050010\\1004a100\\content\\arcmain\\main.sgarc.cmp"
Error: Failed to read /"sys\\title\\00050010\\1004a100\\content\\sound\\stream\\BGM_STR_BARISTA_ACS_SUGAR_DRC.dspadpcm.bfstm"
Error: Failed to read /"sys\\title\\00050010\\1004a100\\content\\sound\\stream\\BGM_STR_MII_EDIT_ORCH_TV.dspadpcm.bfstm"
Error: Failed to read /"sys\\title\\00050010\\1004a100\\content\\sound\\stream\\BGM_STR_TOP_MENU_DRC.dspadpcm.bfstm"
Error: Failed to read /"sys\\title\\00050010\\1004a100\\meta\\bootSound.btsnd"
Error: Failed to read /"sys\\title\\00050010\\1004a100\\meta\\bootTvTex.tga"
Error: Failed to read /"sys\\title\\00050010\\1004b100\\code\\libxml2.rpl"
Error: Failed to read /"sys\\title\\00050010\\1004b100\\code\\mvplayer.rpl"
Error: Failed to read /"sys\\title\\00050010\\1004b100\\meta\\bootDrcTex.tga"
Error: Failed to read /"sys\\title\\00050010\\1004b100\\meta\\bootTvTex.tga"
Error: Failed to read /"sys\\title\\00050010\\1004c100\\code\\ply.rpx"
Error: Failed to read /"sys\\title\\00050010\\1004c100\\content\\Common\\Package\\Ply.pack"
Error: Failed to read /"sys\\title\\00050010\\1004c100\\content\\Common\\Sound\\Ply\\stream\\BGM_PLY.bfstm"
Error: Failed to read /"sys\\title\\00050010\\1004c100\\content\\UsSpanish\\Message\\AllMessage.szs"
Error: Failed to read /"sys\\title\\00050010\\1004e100\\content\\layout\\LangWinNull.arc"
Error: Failed to read /"sys\\title\\00050010\\1004e100\\content\\message\\PC\\EU_Spanish\\recipe.msbt"
Error: Failed to read /"sys\\title\\00050010\\1004e100\\content\\message\\PC\\JP_Japanese\\recipe.msbt"
Error: Failed to read /"sys\\title\\00050010\\1004e100\\content\\message\\PC\\US_English\\recipe.msbt"
Error: Failed to read /"sys\\title\\00050010\\1005a100\\content\\art\\Audio\\stream\\BGM_DOORS_CONNECTING_RECIEVE_TV.dspadpcm.bfstm"
Error: Failed to read /"sys\\title\\00050010\\1005a100\\content\\art\\Audio\\stream\\BGM_DOORS_CONNECTING_TV.dspadpcm.bfstm"
Error: Failed to read /"sys\\title\\00050010\\1005a100\\content\\art\\FE\\FEGroupBoot_res.data"
Error: Failed to read /"sys\\title\\00050010\\1005a100\\content\\art\\FE\\FEGroupMainUI_res.data"
Error: Failed to read /"sys\\title\\00050010\\1005a100\\content\\art\\FE\\MissedCallDialog.data"
Error: Failed to read /"sys\\title\\00050010\\1005a100\\content\\art\\FE\\RequestReceivedDialog.data"
Error: Failed to read /"sys\\title\\00050010\\1005a100\\content\\art\\global.data"
Error: Failed to read /"sys\\title\\00050010\\1005a100\\content\\materials\\material_new.data"
Error: Failed to read /"sys\\title\\00050010\\10062100\\content\\Common\\audio\\stream\\BGM_WAGONU_MOVING.aac"
Error: Failed to read /"sys\\title\\00050010\\10062100\\content\\Common\\audio\\wagonU_sound.bfsar"
Error: Failed to read /"sys\\title\\00050010\\10062100\\content\\Common\\lodging\\convert_test\\WagonMap2\\WagonMap2.szs"
Error: Failed to read /"sys\\title\\00050010\\10062100\\content\\Common\\lodging\\convert_test\\WagonMap2\\WiiBg00.szs"
Error: Failed to read /"sys\\title\\00050010\\10062100\\content\\Common\\lodging\\convert_test\\WagonMap2\\WiiBg01.szs"
Error: Failed to read /"sys\\title\\00050010\\10062100\\content\\Common\\lodging\\convert_test\\WagonMap2\\WiiUBg01.szs"
Error: Failed to read /"sys\\title\\00050010\\10062100\\content\\Common\\lodging\\convert_test\\WagonMap2\\WiiUBg05.szs"
Error: Failed to read /"sys\\title\\0005001b\\1004f000\\content\\00\\Common\\Iwnn\\dic\\JA\\32\\njubase1.a"
Error: Failed to read /"sys\\title\\0005001b\\1004f000\\content\\00\\Common\\Iwnn\\dic\\JA\\32\\njubase2.a"
Error: Failed to read /"sys\\title\\0005001b\\1004f000\\content\\00\\Common\\Iwnn\\dic\\NL\\NL\\njubase1.a"
Error: Failed to read /"sys\\title\\0005001b\\1004f000\\content\\00\\Common\\Iwnn\\dic\\NL\\NL\\njubase2.a"
Error: Failed to read /"sys\\title\\0005001b\\1004f000\\content\\00\\Common\\Iwnn\\dic\\NL\\NL\\njubase3.a"
Error: Failed to read /"sys\\title\\0005001b\\1004f000\\content\\00\\Common\\Iwnn\\dic\\PT\\PT\\large\\njubase3.a"
Error: Failed to read /"sys\\title\\0005001b\\10056000\\content\\FFLResHigh.dat"
Error: Failed to read /"sys\\title\\00050030\\1001110a\\meta\\bootDrcTex.tga"
Error: Failed to read /"sys\\title\\00050030\\1001210a\\code\\surf.rpx"
Error: Failed to read /"sys\\title\\00050030\\1001310a\\code\\libwk_peer_access.rpl"
Error: Failed to read /"sys\\title\\00050030\\1001310a\\code\\libwkc.rpl"
Error: Failed to read /"sys\\title\\00050030\\1001310a\\code\\libxml2.rpl"
Error: Failed to read /"sys\\title\\00050030\\1001310a\\content\\fonts\\bffnt\\CafeStd_25.bffnt"
Error: Failed to read /"sys\\title\\00050030\\1001310a\\content\\memo\\memo.arc"
Error: Failed to read /"sys\\title\\00050030\\1001310a\\content\\skin\\Skin.dat"
Error: Failed to read /"sys\\title\\00050030\\1001410a\\code\\libwkc.rpl"
Error: Failed to read /"sys\\title\\00050030\\1001410a\\content\\layouts\\parts\\BtnBasic_00.arc"
Error: Failed to read /"sys\\title\\00050030\\1001410a\\content\\sound\\stream\\BGM_WOOD_BOOT_0.dspadpcm.bfstm"
Error: Failed to read /"sys\\title\\00050030\\1001410a\\content\\sound\\stream\\BGM_WOOD_MAIN.dspadpcm.bfstm"
Error: Failed to read /"sys\\title\\00050030\\1001510a\\code\\frd.rpx"
Error: Failed to read /"sys\\title\\00050030\\1001510a\\code\\title.fst"
Error: Failed to read /"sys\\title\\00050030\\1001510a\\content\\Common\\Package\\Frd.pack"
Error: Failed to read /"sys\\title\\00050030\\1001510a\\content\\Common\\Package\\Frd2.pack"
Error: Failed to read /"sys\\title\\00050030\\1001510a\\content\\Common\\Sound\\Frd\\cafe_barista_frd.bfsar"
Error: Failed to read /"sys\\title\\00050030\\1001510a\\content\\Common\\Sound\\Frd\\stream\\BGM_FRD.bfstm"
Error: Failed to read /"sys\\title\\00050030\\1001510a\\content\\UsEnglish\\Message\\AllMessage.szs"
Error: Failed to read /"sys\\title\\00050030\\1001510a\\meta\\bootLogoTex.tga"
Error: Failed to read /"sys\\title\\00050030\\1001510a\\meta\\bootMovie.h264"
Error: Failed to read /"sys\\title\\00050030\\1001510a\\meta\\bootTvTex.tga"
Error: Failed to read /"sys\\title\\00050030\\1001510a\\meta\\iconTex.tga"
Error: Failed to read /"sys\\title\\00050030\\1001610a\\code\\libwk_peer_access.rpl"
Error: Failed to read /"sys\\title\\00050030\\1001610a\\code\\libwkc.rpl"
Error: Failed to read /"sys\\title\\00050030\\1001610a\\code\\wave.rpx"
Error: Failed to read /"sys\\title\\00050030\\1001610a\\content\\memo\\memo.arc"
Error: Failed to read /"sys\\title\\00050030\\1001610a\\content\\preload.oma"
Error: Failed to read /"sys\\title\\00050030\\1001610a\\content\\sound\\stream\\Olive_boot.dspadpcm.bfstm"
Error: Failed to read /"sys\\title\\00050030\\1001610a\\content\\sound\\stream\\Olive_Main.dspadpcm.bfstm"
Error: Failed to read /"sys\\title\\00050030\\1001610a\\content\\sound\\stream\\Olive_Syokai02.dspadpcm.bfstm"
Error: Failed to read /"sys\\title\\00050030\\10017109\\code\\recipe.rpx"
Error: Failed to read /"sys\\title\\00050030\\1001710a\\code\\recipe.rpx"
Error: Failed to read /"sys\\title\\00050030\\1001710a\\content\\layout\\BtnBack00.arc"
Error: Failed to read /"sys\\title\\00050030\\1001710a\\content\\layout\\BtnClose00.arc"
Error: Failed to read /"sys\\title\\00050030\\1001710a\\content\\sound\\wiiu_recipe.bfsar"
Error: Failed to read /"sys\\title\\00050030\\1001710a\\meta\\bootDrcTex.tga"
Error: Failed to read /"sys\\title\\00050030\\1001810a\\meta\\bootTvTex.tga"
Error: Failed to read /"sys\\title\\00050030\\1001910a\\code\\mvplayer.rpl"
Error: Failed to read /"sys\\title\\00050030\\1001910a\\code\\mw_shamo_x264.rpl"
Error: Failed to read /"sys\\title\\00050030\\1001910a\\meta\\bootDrcTex.tga"
Error: Failed to dump folder /"usr\\boss\\00050010\\10040100\\user"
Error: Failed to dump folder /"usr\\save\\00050010\\1004d100\\user"

---

As I stated earlier in the post there is a bunch of corruption. In a nut shell this console has basically only system file corruption, which can be seen by the sys/title/00050010-sys/title/00050030. These numbers can be referenced against the title database here and this is what I used to determine what these numbers mean.   

The NAND-AID arrived in the mail today, so I have started the repair. I plan on making a guide for this and posting it at a later date,The guide for this can be found here so that those who may not be familiar with soldering or electronic repair can follow it and repair their Wii U.

That being said, there are a several steps that need to be done to accomplish this repair and they have to be done in the correct order otherwise you will not be able to get to certain areas to solder. Example: You cannot solder the SD Card Slot on the NAND-AID before soldering the NAND-AID to the ground pad on the Wii U board, because the SD Card Slot will cover the ground pad on the NAND-AID.
 

• The Wii U almost completely needs to be disassembled.
• Use an X-acto Knife to cut the R26 at the eMMC, this disables the eMMC
• NAND-AID Must be soldered into place using ground pad
• NAND-AID Data connections need to be soldered to resistors on board
• SD Card Slot must be soldered to the NAND-AID (ONLY AFTER YOU INSTALL NAND-AID TO GROUND PAD)
• Solder Capacitor (10UF Ceramic Capacitor) to NAND-AID
• 3V Wire must be soldered to NAND-AID & System board
• Solder the DSB pad to short the eMMC

Before we get started, lets take a look at a picture to get an idea of where this stuff is going to go on the Wii U board. The picture is color coded with the text below. Click Here if you need an even larger picture

Orange box is where you need to cut the R26 trace to disable the eMMC. Use an X-acto knife to cut this. Do not cut through the entire board. You only need to cut the trace between the 2 solder points. Use a multi-meter to test for continuity. If you have none, then you successfully cut the trace.

Red Box is the ground pad, where the NAND-AID will be soldered to first. This simply holds it in place. It will take some heat to get the solder flowing, so don't be alarmed if you have to hold your soldering iron on this location for 30-45 seconds. I recommend you add some flux/solder to the pad and get the solder flowing before placing the NAND-AID over it and attempting to solder it in place

Blue Box are the data connections that need to be soldered to the NAND-AID

Now that we know what we are going to do. Lets begin by placing the NAND-AID in place and soldering it to the ground pad. There we go, a NAND-AID soldered to the ground pad!!


Lets solder the Data connections. You will need a Microscope to do this work or if you are really good a magnifying glass might work. I am not that good so I used a Microscope. I recommend testing for continuity on all the resistors with a multi-meter to verify the solder connected the NAND-AID to each resistor. Again resistors are outlined in a blue box. The orange box is the R26 trace that you should have cut with an X-acto knife. It should now look like this!


Making progress here! Lets get the SD Card Slot soldered in place...

Okay SD Card Slot is soldered in place!! 


The last stuff I have to do is solder the 3V wire, the Capacitor and the DSB pad, which shorts the eMMC to ground. and we are finally finished!!!


The soldering work is complete. Now I have to write the MLC.bin image I created to a 32GB SD Memory Card and insert it into the console and I will be back to where I was, with a corrupted console, but now it has a working eMMC replacement so I can start fixing the corruption.
 

I took the original mlc.bin file I created from the original 15 parts I dumped from the console and wrote it to a 32GB Micro SD Card. I chose a Samsung Pro Endurance model for this and its now installed in the NAND-AID!!!
 





Now lets get this console put back together just enough to start repairing the corruption.   

Console is back together and I have reloaded the firmware and we now have a working Wii U console!!! 


I am going to play Hyrule Warriors and make sure the game updates/loads properly. This is a good sign, its downloading the update...



Installing the update now, almost done!!!


and finally the game loads! HURRAY!

The System information menu now shows the console has a replaced MLC and the firmware has been updated from version 5.5.5U to version 5.5.6U.



I believe this console is ready for a new home. Glad I was able to save it. The Wii U is a gem that many of gamers haven't had the opportunity to play or enjoy. Additionally there is a bunch of great games that are unfortunately stuck on the console.Two that immediately come to mind are Legend of Zelda The Wind Waker HD & Legend of Zelda Twilight Princess HD, not to mention the huge amount of GBA/DS and other virtual console titles that have yet to be ported to switch.