1711606802250.png

Warning

Use this at your own risk. Messing with the isfs superblocks is dangerous and can brick your Wii U. Make sure to make a SLC backup before installing isfshax. If something goes wrong, you will need defuse to restore this backup. The superblock linked here was tested and confirmed working. Installing an broken superblock will brick your Wii U.
Also keep in mind: if you are restoring an old SLC backup, which was taken before installing ISFShax, ISFShax will remove by restoring that backup.

To protect against Nintendo pushing a boot1 update (very unlikely, but you newer know), which would brick a console with ISFShax, system updates get blocked by the wafel_isfshax_patch.ipx plugin. If you need to do a system update, you can use the v1.0 of said plugin, which doesn't contain the update block. Game updates are not affected.

Update

13.03.2024 - System updates now get blocked by the wafel_isfshax_patch.ipx plugin.
29.12.2023 - Standby Services are now supported. For that to work you need to have the latests ISFShax superblock installed and need to use the latest minute fw.img and wafel_core.ipx. Also autoboot needs to be enabled.

What is this for?

ISFShax exploits boot1 with specially crafted ISFS (the filesystem of the SLC) superblock. Once it is installed ISFShax provides similar capabilities to defuse once it is installed. Since it launches before IOSU, so it can be used to apply early patches to IOSU and can be used to fix most bricks. But it won't protect you of bricks caused by: breaking boot1, seeprom bricks or installing a broken ISFShax superblock. ISFShax also doesn't help you if you already bricked the Wii U.
Usecases are:
  • Rebuilding / upgrading the MLC
  • Removing 64GB MLC limit and disabling SCFM
  • Brick protection (e.g. before doing region change)
  • Cold booting redNAND (useful when when the eMMC is failing)
  • It gives a minimal CFW, which can launch old homebrew using the homebrew launcher (not sure how usefull since we have Aroma and Tiramisu)
  • Stop the Wii U from turning the Tablet on during boot (using a stroopwafel plugin)
Choosing the Exploit

There are multiple ways to launch the ISFShax installer:
If you already have Tiramisu or Aroma installed and can launch it follow the Instructions for [Tiramisu]
If the Browser still works and you can launch the browser exploit u.wiidb.de follow the Instructions for [Browser]
If you can't access the Browser, but Settings still work follow Instructions for [DNSpresso]
If you your Wii U crashes in the initial setup on Mii creation follow Instructions for [DNSpresso]
If your Wii U can't launch the browser anymore or can't connect to the internet follow the Instructions for [UDPIH]
Steps without a prefix apply to all.

Preparing the SD card

Make sure the SD card is formatted FAT32 (already the case if you are using it for Tiramisu). You can use guiformat for that.

Get the following files and put them in the root of the SD
  1. ISFShax installer (
    ios.img
    ) from https://github.com/isfshax/isfshax_installer/releases
  2. ISFShax
    superblock.img
    and
    superblock.img.sha
    from https://github.com/isfshax/isfshax/releases
  3. Put the stroopwafel
    wafel_core.ipx
    from https://github.com/jan-hofmeier/stroopwafel/releases in
    wiiu/ios_plugins
  4. Put the
    wafel_isfshax_patch.ipx
    stroopwafel plugin from https://github.com/isfshax/wafel_isfshax_patch/releases in
    wiiu/ios_plugins
  5. [Tiramisu | Browser | DNSpresso] minute
    fw_encrypted.img
    from https://github.com/jan-hofmeier/minute_minute/releases and renameto
    fw.img
  6. [Browser | DNSpresso] fw_img_payload from https://github.com/wiiu-env/fw_img_payload/releases extract the zip and put the
    wiiu
    folder, containing the
    payload.elf
    on the SD
  7. [DNSpresso] Extract the root.rpx from https://github.com/wiiu-env/PayloadFromRPX/releases and rename it to launch.rpx and place it in the root of the SD card
  8. [UDPIH] minute
    fw.img
    and
    boot1.img
    from https://github.com/jan-hofmeier/minute_minute/releases
  9. [UDPIH]
    recovery_menu
    from https://github.com/jan-hofmeier/recovery_menu/releases
The structure on the SD should look like this:
Code: 
boot1.img (only for UDPIH)
fw.img
ios.img
recovery_menu   (only for UDPIH)
superblock.img
superblock.img.sha
wiiu
    ios_plugins
         wafel_core.ipx
         wafel_isfshax_patch.ipx

Launching into minute

This step heavily depends on the used Exploit.

  1. Hold B on the Gamepad while booting (if coldboot is enabled) or launching the H&S app
  2. A black and white menu should show up asking you to choose a payload.
  3. Select
    fw_img_loader

  1. Open the Browser and browse to u.wiidb.de
  2. Click on "HAXX"

If you can a access the settings just follow these instructions (you already have the right files on the SD): https://gameparadise.org/threads/dnspresso-a-wii-u-dns-exploit.1710/
If you are stuck on the Mii creation in the Inital setup:
  1. If you already connected your Wii U to your AP / Router, turn the AP / Router or the Wifi on it off.
  2. When the setup asks you if you already have a NNID, say yes (even if you don't have one)
  3. Now it tries to connect to the Internet, but will fail and ask you to take you back to the Wifi settings, follow back to thge settings.
  4. Turn your Router / AP on again and give it time to start.
  5. If you don't already have your Wifi configured there, connect to it now, but enter a wrong password.
  6. Edit your wifi connection and configure 85.215.57.182 as Primary DNS, if you entered a wrong password before set the right one now.
  7. Press (B) Back and select Connection Test.

  1. Load the recovery using UDPIH: https://gameparadise.org/tutorials/udpih-usb-host-stack-exploit-recovery-menu.161/ (don't replace the recovery_menu)
  2. Unplug the Pico
  3. select the "Load BOOT1 payload" and proceed. (If you don't have screen output: 18x eject, 1x power, 1 eject, 1 power)

Now you should see the minute main menu. If not something went wrong, make sure you have the correct fw.img file on the SD.
In minute you move the cursor with the power button and enter with the eject button (swapped compared to the recovery menu).

Note minute only outputs 1080p through HDMI, no picture on the gamepad, and nothing on the analog outputs.
Some people reported that the screen output is not working for them when minute was loaded from the recovery. If you made sure nothing else is the problem (right fw.img, TV supports 1080p HDMI), you can still follow along blindly by pressing the approriate buttons. Make sure to wait long enough between the presses, so the system has time to load. Without display output skip the first backup and go directly to Installing ISFShax.

Backup

  1. Navigate to
    Backup and Restore
  2. Dump SEEPROM & OTP
  3. Dump SLC.RAW
  4. Return to Main Menu
Installing ISFShax

  1. Choose
    Boot `ios.img`
    (5x Power, 1x Eject)
  2. Now the ISFShax installer should launch (this takes a few seconds)
  3. Follow the Instructions on the screen, the buttons are the same as in minute. (3x Eject, 1x Power, 3x Eject)
  4. The console should now turn off.
  5. [Tiramisu | Browser] replace the
    fw.img
    on the SD with the
    fw.img
    from https://github.com/jan-hofmeier/minute_minute/releases
  6. If the install was successfull the Wii U should directly start into minute once you turn it on again.
Backup ISFShax

Dump the SLC.RAW again. This will overwrite the previous SLC.RAW file on the SD. This is required if you need to restore the SLC for unbricking, without loosing ISFShax. Keep that backup in a safe place.

Booting

If you came here from the redNAND or the MLC rebuild tutorial continue with that tutorial now.

For now your Wii U needs the SD card to boot. From there it loads minute (fw.img), which then applies the required patches from SD card. (IOSU needs to be patched, so it doesn't fall over the ISFShax superblock).
To boot into the Wii U OS select
Patch (sd) and boot IOS (slc)

Aroma / Tiramisu

  1. To install Aroma or Tiramisu put the corresponding files on the SD.
    Tiramisu: https://tiramisu.foryour.cafe/
    Aroma: https://aroma.foryour.cafe/ (You don't need to have install Tiramisu to have Aroma, also the FTPiiU plugin will become handy later)
  2. Put the wafel_payloader.ipx in the
    ios_plugins
    folder https://github.com/jan-hofmeier/wafel_payloader/releases
  3. Put the root.rpx from PayloadFromRPX in the wiiu folder on the SD https://github.com/wiiu-env/PayloadFromRPX/releases
Note: if you are already coldbooting Tiramisu / Aroma via the PayloadLoaderInstaller, you have to disable the coldboot in the PayloaderLoaderInstaller first. For more detailed instructions on this, see this post by ZaMaster: https://gameparadise.org/threads/how-to-set-up-isfshax.2056/post-2074

Booting without SD

This step is optional but highly recommended. Now the Wii U doesn't show anything on the screen without the SD. That could lead to confusion if the SD ever gets lost or corrupts.
To make it from the internal memory we need to install the minute
fw.img
and the
ios_plugins
to the SLC. This can be accomplished using FTPiiU Everywhere, which can be launched from Tiramisu and is already part of the Aroma Package (enable Everywhere in the settings) or you can use the haxcopy homebrew https://github.com/mackieks/haxcopy/releases
Using haxcopy is recommended for most users, but if you copy a wrong plugin to the slc or need to delete one for whatever reason you still have to use FTP for that.

  1. create a folder
    hax
    on the SD card (this will be copied to the slc)
  2. copy the
    fw.img
    to the
    hax
    folder
  3. create a subfolder
    ios_plugins
    in the
    hax
    folder
  4. rename the
    wafel_core.ipx
    to
    0core.ipx
    and copy it to the
    hax/ios_plugins
    folder
  5. rename the
    wafel_isfshax_patch.ipx
    to
    6isfshax.ipx
    and copy it to the
    hax/ios_plugins
    folder
  6. if you want to coldboot aroma or tiramisu, rename the
    wafel_payloader.ipx
    to
    9payldr.ipx
    and copy it to the
    hax/ios_plugins
    folder
  7. If you need any other plugins like the
    wafel_unlimit.ipx
    , you have to rename and copy it to the
    hax/ios_plugins
    folder
  8. Copy the haxcopy app to the
    wiiu/apps
    folder (like you usually install homebrew)
  9. Put the SD in the Wii U and run haxcopy to copy the hax folder to the slc.

On Aroma you have to make sure access to system files is enabled:
  1. Open the Aroma Plugin Configuration Menu using L + Down + SELECT (-) on the GamePad or Pro Controller (or B + Down + Minus (-) for WiiMotes)
  2. Open the FTPiiU option, then settings and set 'Allow access to system files' to 'true' by pressing A

Uploading the files:
  1. (Tiramisu only) Make sure FTPiiU Everywhere is running on the Wii U
  2. Using a FTP client on the PC browse to
    /storage_slc/
  3. If you see a
    scfm.img
    file and
    sys
    folder go into the
    sys
    folder. If you see a bunch of folders (config import logs proc rights security title tmp) just go to the next step.
  4. create a subfolder
    hax
    and enter it
  5. Make sure your FTP client is in binary mode (not ASCII mode)
  6. upload the minute
    fw.img
    to the
    /storage_slc/sys/hax
    folder
  7. create another subfolder
    ios_plugins
    in
    /storage_slc/sys/hax
  8. enter that
    /storage_slc/sys/hax/ios_plugins
    folder
  9. rename the
    wafel_core.ipx
    to
    0core.ipx
    and upload it
  10. rename the
    wafel_isfshax_patch.ipx
    to
    6isfshax.ipx
    and upload it
  11. if you want to coldboot aroma or tiramisu, rename the
    wafel_payloader.ipx
    to
    9payldr.ipx
    and upload it
  12. If you need other plugins like the
    wafel_unlimit.ipx
    , you have to rename and upload them too

Now the Wii U should autoboot if no SD card is inserted.
If a SD card is inserted the minute menu should show up (even if the SD doesn't contain a fw.img). In that menu you can select the
Patch (slc) and boot IOS (slc)
to load the plugins from the slc and boot (no need to have them on the SD anymore).

The Wii U will first try to load the fw.img from the SLC and if that fails it falls back to the SD.
If you installed a broken fw.img which doesn't load, you can force isfshax to load the fw.img from sd by repeatly pressing power till the menu shows up.

Warning: A factory reset will delete the hax folder. Without the fw.img on the SD the Wii U will then just have a black screen with a orange LED


Autobooting with SD

Optional: To make the Wii U autoboot with an SD card inserted you need to create the file
sd:/minute/minute.ini
with the following content:
Code: 
[boot]
autoboot=1
autoboot_timeout=3
You can adjust the timeout (in seconds) to your liking. The
autoboot
option specifies which entry from the minute menu will be loaded.
1
corresponds to
Patch (slc) and boot IOS (slc)
, which loads the ios_plugins from the SLC. If you haven't installed them to the SLC or want to load them from the sd for another reason you can change that value to
3
which corresponds to
Patch (sd) and boot IOS (slc)


Uninstalling ISFShax

DON'T just restore an older SLC backup, as that would break SCFM!
  • Make sure your Wii U doesn't depend on any patches (linke wafel_unlimit_mlc.ipx or redNAND). You can check that by booting with only the wafel_core.ipx and the wafel_isfshax_ipx plugins in the ios_plugins directory on the SD and using the
    Patch (sd) and boot IOS (slc)
    option
  • Delete the
    /storage_slc/sys/hax
    folder if you set up the slc booting
  • run the ISFShax installer again from minute and follow the on screen instructions to uninstall.