A console hacker named WinCurious obtained some discarded SD cards from a Nintendo factory that the company used for the factory setup process of Wii and Wii U systems. According to DeadlyFoez, the cards contained a boot image that Nintendo used for the factory setup of the Wii U console. They were able to recover the data on some of the damaged SD cards, after which another member of their team was able to find an exploit that could be used to restore software-bricked Wii U consoles.
The first challenged that they faced was that all of the cards were damaged, with about 25% of them having a destroyed die and flash memory IC. However, the remaining 75% only had PCB damage — some of them required resoldering work or PCB replacement, while others needed only straightening before they could start reading their contents. After the repairs had been completed, the next step was to read the SD cards’ contents.
Unfortunately, it’s not as simple as plugging the SD cards into a reader and then copying and pasting them to another drive on your Windows PC. One solution to this was to use an external programmer to read the NAND flash memory directly, but this wasn’t viable because DeadlyFoez did not have one that was compatible with the TSOP 48 chips used on the Nintendo SD cards, and the dumped data would not represent what was actually on the card because it didn’t go through its controller chip.
Thankfully, WinCurious had an idea — they suggested using a donor SD card and replacing its NAND chip with a TSOP 48 clip. They would then remove the NAND chips on the SD cards that they wanted to read (but had damaged or defective PCBs) and put them on the working SD card. This workaround allowed the group to access the data on the discarded memory cards, but not without difficulty.
“I can not express how incredibly difficult it is to solder these TSOP 48 clips onto anything at all. They melt at a rather lower temperature. If the solder is melted, then the plastic of these will be soft and malleable. In most cases, the solder pads of the PCB are the same size as the pins of the clip, making it impossibly difficult to see even with magnification,” says DeadlyFoez. “To solder these on you must tin the pads of the PCB first, then place the TSOP 48 clip directly on top of the peaks of the tinned pads. Finally, you must reflow the solder. The right way to do it would be with a reflow oven and using solder paste with a stencil, but I do not have those. I do have my infrared preheater, which works well enough for these things.”
Nevertheless, the system worked, allowing them to recover 14 SD cards. From here, another member of the group, Rairii, snooped around the dumped data and discovered an SDBoot1 image. This was used in the initial factory setup for the Wii U, and it had a vulnerability that allowed the group to run their own code when the console boots. They then wrote an exploit to take advantage of this, called “paid the beak”, and uploaded it on GitHub.
Since SDBoot1 runs even on consoles with empty flash memory, it can recover almost any Wii U that has suffered from a software brick. The only devices it cannot save are those that have had issues with Seeprom or had actual hardware failure. Note that you’d still need a rare Nintendo jig, a Raspberry Pi Pico, or a PICAXE 08M2 microcontroller to trigger UNSTBL_PWR on your console for it to boot from the SD card.
Once you have them all, you can now put the card on your Wii U, use the jig or its alternative, and turn on your Wii U console. From there, it should load whatever you put on the SD card, allowing you to do anything you want on your old hardware. Another mod chip called de_Fuse can also do something similar and even recover Seeprom failures, but it requires more advanced skills and knowledge. This technique makes playing with the Wii U’s hardware a little bit more accessible, allowing more people to experiment with it without having to physically break their consoles open and use special soldering skills.
Follow Tom’s Hardware on Google News to get our up-to-date news, analysis, and reviews in your feeds. Make sure to click the Follow button.
