NEWS | Wii U NAND Corruption Issue Potentially Resolved Using Raspberry Pi Pico and A Clever Exploit

WHAT felt like a ticking timebomb waiting to set off, the dreaded Wii U NAND corruption issue that is affecting some users seems to have been resolved with a piece of software and microcontroller dev board without the need to do a hard or soft-mod to the system.

Last week, YouTuber Voultar set out to investigate the issue and during the weekend published a 10-minute video to show how to get a Wii U to boot up again using an exploit developed by GitHub user GaryOderNichts and a Rasberry Pi Pico that could potentially fix most Wii U consoles affected by the memory corruption. Check out the video below.

Basically, the video details what is needed to gain access to a custom Wii U Recovery menu without hard or soft-modding the system, namely using a Raspberry Pi Pico with the exploit loaded up to start running a custom program through the Wii U's front USB port. 

While many news outlets were quick to report the issue, details of this fix were actually made available last year in June in GaryOderNichts’ blog. 

The blog post explains the exploit method, dubbed USB Descriptor Parsing Is Hard (UDPIH), takes advantage of a bug in the Wii U's USB Host Stack, which handles USB devices plugged into external USB ports. In this case, using the Pico to emulate a USB device, allows full control over descriptors when emulating a USB client to initiate a custom transfer event to transfer any amount of data anywhere.

The Raspberry Pi Pico itself is a microcontroller board designed featuring a custom-designed RP2040 microcontroller chip aimed at providing low-cost, high-performance microcontroller solutions for makers and hobbyists. 

The dev board offers a wide range of features, including 26 GPIO pins, programmable I/O, hardware PWM, and support for a variety of protocols. The Pico is further compatible with popular development tools and supports programming in C and MicroPython. It also offers a range of expansion possibilities through its numerous interfaces, such as SPI, I2C, UART, and USB. 

The blog post went on to explain how a bug is triggered by a lack of verification in the UHS, specifically, when the wTotalLength does not match the total length of the initial configuration descriptor, which determines the buffer size and can therefore be made larger, causing out-of-bounds byte swaps

By taking advantage of a bug in the Descriptor parsing feature, this can be exploited by swapping two bytes in the next heap block's magic, and a configuration buffer can be allocated in the middle of the heap, which can be used to execute the arbitrary code, in this case, by utilising the UDPIH method and booting up a custom recovery menu running on the IOSU for unbricking. 

Amazingly, while the video shows how easy the method looks in fixing the issue, it does involve some timing to get it working. With a new report stating that the issue now stems from a chip issue, this early attempt to fix Wii U consoles only just goes to show how resilient the gaming community is when it comes to stepping up to find a solution to a dire situation when it comes to preserving their beloved gaming consoles. — Geeks Republika