Hacking Possible to Repair Wii U System Memory Error Code 160-0103?

[Razor83]

Have you tried installing System Settings to USB?

Just managed to download System Settings v178 using nusgrabber.exe (I hate using command lines!)
I used System Config Tool to install it to USB, but afterwards it doesn't appear as a title on the USB drive.

@EyeKey I have just dumped all 32GB of the MLC, might there be a way I can extract this and view the contents/filesystem?

Also I just ran nandBinCheck.exe on the SLC dump, and here is the result

** nandBinCheck : Wii nand info tool **
   from giantpune
   built: Mar 24 2017 23:49:06
NAND Type: SLC (WiiU)
checking boot1...
Boot1 hash: "3806d41a5c5f139f5b09bbe5b74a5ec45e0f5507"
Boot1 OK!
checking for lost clusters...
found 0 lost clusters
UNK ( 0xffff ) 84 (59e8, 59e9, 59ea, 59eb, 59ec, 59ed, 59ee, 59ef, 5e2f, 6d44, 6
d45, 6d46, 6d47, 70a0, 70a1, 70a2, 70a3, 70a4, 70a5, 70a6, 70a7, 70a8, 70a9, 70a
a, 70ab, 70ac, 70ad, 70ae, 70af, 70b8, 70b9, 70ba, 70bb, 70bc, 70bd, 70be, 70bf,
 70c0, 70c1, 70c2, 70c3, 70c4, 70c5, 70c6, 70c7, 7101, 7102, 7103, 7104, 7105, 7
106, 7107, 7150, 7151, 7152, 7153, 7154, 7155, 7156, 7157, 7158, 7159, 715a, 715
b, 715c, 715d, 715e, 715f, 7160, 7161, 7162, 7163, 7164, 7165, 7166, 7167, 7180,
 7181, 7182, 7183, 7184, 7185, 7186, 7187, 71a8, 71a9, 71aa, 71ab, 71ac, 71ad, 7
1ae, 71af, 71b8, 71b9, 71ba, 71bb, 71bc, 71bd, 71be, 71bf, 71c8, 71c9, 71ca, 71c
b, 71cc, 71cd, 71ce, 71cf, 71d0, 71d1, 71d2, 71d3, 71d4, 71d5, 71d6, 71d7, 71e8,
 71e9, 71ea, 71eb, 71ec, 71ed, 71ee, 71ef, 71f0, 71f1, 71f2, 71f3, 71f4, 71f5, 7
1f6, 71f7)
free            4879
verifying ecc...
0 out of 907200 pages had incorrect ecc.
they were spread through 0 clusters in 0 blocks:
 ()
0 of those clusters are non-special (they belong to the fs)
verifying hmac...
verifying hmac for 487 files
hmac bad (1)
"scfm.img" is 8004000 bytes ( 2001 ) clusters

00000000  ff000000 00000000 00000000 00000000  ................
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 00000000 00000000  ................

00000000  ff000000 00000000 00000000 00000000  ................
00000010  00000000 00000000 00000000 00000000  ................
00000020  00000000 00000000 00000000 00000000  ................
00000030  00000000 00000000 5106ae09 960d6902  ........Q.....i.

00000000  e02d1517 42d0de9a 215017e6 6c89c3dd  .-..B...!P..l...
00000010  a535b5aa                             .5..
bad HMAC for "/scfm.img"
1 files had bad HMAC data
checking HMAC for superclusters...
0 superClusters had bad HMAC data

Full OS Crash Line. It seems like MLC is (i mean) screwed
It seems to acquire "mvplayer-gui", whatever that is.

I appreciate that this Wii U might be "screwed" but I still want to try to fix it, or at least just figure out what the actual cause of the 160-0103 error actually is.
Clearly most of the MLC is still working (I can install titles) so IMO it could be:-

Corrupted data - Should be fixable by formatting the affected partition/files.

Bad blocks - Could be worked around, or the ECC data repaired (Maybe even repartition the MLC as just 8GB instead of the full 32GB?)

Failing MLC chip - Possible, but even if thats the case I would be interested to know if I could replace it with a new MLC chip (Or since only 8 wires are needed perhaps we could replace the MLC with an 8GB/32GB SD card which has the correct NAND chip ID?)

So it still might be fixable, depending on the actual cause.

 

[Deleted User]

You fail if call is requested from SDCard [Homebrew uses FS to access system partitions] to MLC chip if that even helps you.
Still, a handy MLC tool would help, otherwise there's nothing to do, really.
SLC looks fine to me.

 

[piratesephiroth]

I have just dumped all 32GB of the MLC, might there be a way I can extract this and view the contents/filesystem?

https://gbatemp.net/threads/successfully-dumped-wiiu-emmc-nand-with-hardmod.457165/page-3#post-7084870

and also Wii U NAND Extractor from herehttps://gbatemp.net/threads/success...-nand-with-hardmod.457165/page-3#post-7084870
http://gbatemp.net/threads/release-wii-u-nand-tools.465386/

Though since the filesystem commands don't seem to be able to manage the corruption/bad blocks, the only way to write the data back is through a hardmod (at least it's the easier one that requires only a card reader).

Or maybe someone can find out which commands System Settings uses to format the console and make a homebrew for that? (supposing the memory format commands know how to handle that corruption)

 

[Razor83]

https://gbatemp.net/threads/success...-nand-with-hardmod.457165/page-3#post-7084870
and also Wii U NAND Extractor from here
http://gbatemp.net/threads/release-wii-u-nand-tools.465386/

Thanks but as far as I can tell those only allow access to the SLC, not the MLC (eMMC)?

Though since the filesystem commands don't seem to be able to manage the corruption/bad blocks, the only way to write the data back is through a hardmod (at least it's the easier one that requires only a card reader).

Or maybe someone can find out which commands System Settings uses to format the console and make a homebrew for that? (supposing the memory format commands know how to handle that corruption)

I would be happy to hardmod it if I knew it would fix it, but at the moment there just doesnt seem to be any tools available for manipulating/repairing the MLC.

I do have access to the system restore/format option in the System Config Tool, however from what I have read online everyone who has had error 160-0103 and tried to format the system using System Settings has ended up with a full brick.

I would imagine that both the standard System Settings and the System Config Tool use the same filesystem commands (FSA) to try and format the console, so if those commands are simply not low-level enough to clear the corrupted data then we would need a homebrew app which is coded "to the metal" to bypass the filesystem and restore the MLC to a functional state.

 

[piratesephiroth]

Thanks but as far as I can tell those only allow access to the SLC, not the MLC (eMMC)?

Ah yeah. Unfortunately I don't think anyone has disclosed the way to decrypt MLC. I suppose it's similar to USB.

 

[Razor83]

So I was doing some reading about eMMC and have come up with a theory/possible cause of the 160-0103...

I was reading Wiiubrew's information about the different types of eMMC chips used in the Wii U:-
http://wiiubrew.org/wiki/EMMC_NAND
As you can see the eMMC can be either a Samsung 8GB/32GB chip, or a Toshiba 32GB chip.

Then I was reading bunnie's blog about hacking microSD cards:-
https://www.bunniestudios.com/blog/?p=3554
Which explains that eMMC chips use a microcontroller to control all access to the flash memory, and that this microcontroller has its own firmware.
Then this sentence caught my attention:-

However, it’s been previously noted that at least one Samsung eMMC implementation using an ARM instruction set had a bug which required a firmware updater to be pushed to Android devices,

Since I already knew the the Wii U uses a Samsung eMMC chip on some models I thought maybe this microcontroller firmware bug could also be affecting the Wii U.

I googled and read through a number of xda forum threads with info about the bug, the most interesting of which was this one:-
https://forum.xda-developers.com/showthread.php?t=2096045
It seems that this bug affects eMMC chips which use the VHX microcontroller, and wouldnt you know it the Samsung 32GB chip (KLMBG4GE4A-A001) used in the Wii U also uses the VHX micocontroller! (The Samsung 8GB chip uses the VFX_U microcontroller, which may or may not have the same bug)<EDIT>A Russian site I found suggests that both the VHX and VFX_U microcontrollers can be affected by the bug.

As far as I can tell the affected Samsung eMMC chips were manufactured throughout 2012, so a good number of early Wii U consoles could be affected (Nintendo originally hoped to sell 5.5 million Wii U consoles by April 2013) It appears the problem is not the the flash memory itself, but rather the wear levelling data can potentially become corrupted after specific commands are issued.

As far is it seems right now, it isn't caused by flash wear or anything like that. It seems that it's caused by a bug which is triggered in a very specific case. Then, it causes the device to corrupt its inner structures or its firmware - I'm not sure which one yet.

The specific bug is that they don't check the return value of some function returning a pointer, which may be NULL. It then leads to a NULL pointer dereference which corrupts things.

The lockup doesn't happen immediately after power-on. The chip doesn't lock up until a sector is referenced that has corrupted wear leveling data inside the chip. Once that sector is referenced, the chip will lockup hard, and the only thing that will get it talking again is to power cycle it. Once it is power cycled, the chip will talk again, until that bogus sector is accessed.

I imagine Super Smash Bros reads/writes to the eMMC much more often than most other games (Saving trophies etc) so its more likely to trigger the bug.

Since this is a low level eMMC error there is unfortunately no way for the Wii U to format/delete the corrupted data. However Samsung did issue a VHX microcontroller firmware update for some affected phone models by using vendor specific commands:-
https://forum.xda-developers.com/showpost.php?p=38112844&postcount=79
Some people suggest that this firmware update would require the eMMC to be formatted at the same time, whilst others suggest it should be possible to apply the update without formatting the data.

At this point I think what we really need is a homebrew app which can use the Samsung vendor specific commands to first retrive an extended SMART report from the eMMC, to ascertain if the chip indeed has one of the affected firmware revisions. After that we likely need a way to dump the eMMC microcontrollers firmware, so that we can then dump the firmware from a later batch of Samsung eMMC with a known 'good' firmware, and then apply that firmware to the older Samsung eMMC with the 'bad' firmware. Alternatively we can try and apply the same "fw.h" update file Samsung used on Android phones and hope for the best.

Anyone up to the challenge?

 

[Razor83]

I have been doing a little more research and it seems the only way to currently update the eMMC firmware on a Wii U is by using a phone shop repair box like "Advance Turbo Flasher" (ATF) or "Z3X Easy JTAG" which cost quite a lot of money - either that or replace the eMMC chip entirely which would require a BGA rework station. Unfortunately this means its currently not worth me trying to repair this Wii U, which is a shame

I did manage to find the (latest revision?) firmware update files for the 8GB and 32GB Samsung eMMC chips used in the Wii U by rooting through the ATF box files, and I have attached them to this post in the hope that maybe at some point in the future someone will find an easy way to perform an eMMC firmware update - via either a homebrew app, or if you are unable to load homebrew a hardmod with a standard USB SD card reader or Raspberry Pi.

<EDIT>I have also attached the Samsung eMMC datasheets/specifications for the 8GB and 32GB chips, although you may also want to look at the earlier leaked moviNAND datasheet.

 

[piratesephiroth]

I have been doing a little more research and it seems the only way to currently update the eMMC firmware on a Wii U is by using a phone shop repair box like "Advance Turbo Flasher" (ATF) or "Z3X Easy JTAG" which cost quite a lot of money - either that or replace the eMMC chip entirely which would require a BGA rework station. Unfortunately this means its currently not worth me trying to repair this Wii U, which is a shame

I did manage to find the (latest revision?) firmware update files for the 8GB and 32GB Samsung eMMC chips used in the Wii U by rooting through the ATF box files, and I have attached them to this post in the hope that maybe at some point in the future someone will find an easy way to perform an eMMC firmware update - via either a homebrew app, or if you are unable to load homebrew a hardmod with a standard USB SD card reader or Raspberry Pi.

<EDIT>I have also attached the Samsung eMMC datasheets/specifications for the 8GB and 32GB chips, although you may also want to look at the earlier leaked moviNAND datasheet.

I guess the firmware could also be flashed with a Raspberry Pi, just like it can be used to recover 3DSs bricked by Gateway.

 

[piratesephiroth]

BTW, have you sen this?

http://gbatemp.net/threads/release-wfs-file-injector.479846/

 

[GardoG]

Any progress with a possible repair?
My unmodified launch WII U just gave me this error, and my local Nintendo representative tells me a fix would cost more than a second-hand system.

 

[Kafluke]

I have been doing a little more research and it seems the only way to currently update the eMMC firmware on a Wii U is by using a phone shop repair box like "Advance Turbo Flasher" (ATF) or "Z3X Easy JTAG" which cost quite a lot of money - either that or replace the eMMC chip entirely which would require a BGA rework station. Unfortunately this means its currently not worth me trying to repair this Wii U, which is a shame

I did manage to find the (latest revision?) firmware update files for the 8GB and 32GB Samsung eMMC chips used in the Wii U by rooting through the ATF box files, and I have attached them to this post in the hope that maybe at some point in the future someone will find an easy way to perform an eMMC firmware update - via either a homebrew app, or if you are unable to load homebrew a hardmod with a standard USB SD card reader or Raspberry Pi.

<EDIT>I have also attached the Samsung eMMC datasheets/specifications for the 8GB and 32GB chips, although you may also want to look at the earlier leaked moviNAND datasheet.

@EyeKey have you seen this? Can you work any magic to update the chip?

Some questions I have

1. If you updated the firmware would it then be in a factory state. Not Wii U factory state but Samsung.

2. If that's the case wouldn't we need to dump the current Wii U eMMC and then somehow inject something into the Samsung update before flashing?

This is really interesting to me.

 

[piratesephiroth]

I don't think there's a way for the Wii U to do it unless there a hidden system app that updates the eMMC controller firmware.
You'd either need the smartphone box thing or a raspberry pi to send the raw commands and flash it manually.

 

[Kafluke]

I don't think there's a way for the Wii U to do it unless there a hidden system app that updates the eMMC controller firmware.
You'd either need the smartphone box thing or a raspberry pi to send the raw commands and flash it manually.

Yeah. I'm talking about using a teensy to hardmod

 

[IgraBIT]

Hello, I am from Russia, I am faced with the same problem as you. wiiu error 160-0103, how did you manage to solve the problem? I only have nand after this error.

[Здравствуйте, я из России, я столкнулся с той же проблемой, что и вы. wiiu ошибка 160-0103, как удалось решить проблему? У меня есть только nand после этой ошибки.]

 

[Deleted User]

I have been given a second hand unmodified Wii U console, which boots up normally to the main menu but displays error code 160-0103 "There is a problem with the system memory" when I select almost any app/program, including system settings. I have tried to create a new user, but although Mii Maker initially loads the system crashes once I select 'create/receive' Mii.

-I can still load the internet browser, but as I cant access system settings I cant enter my router details.
-I can also still load up vWii mode without any problems.

Assuming error code 160-0103 is the result of corrupted files on the eMMC memory (and not a defective eMMC chip) Is there any way I can access homebrew and potentially fix the system memory? Perhaps by formatting the user data section?

Some questions/ideas:
-Does the Wii U automatically connect to any open networks or Nintendo Zone hotspots?
-If I hack the vWii mode is there any way to use that to alter the Wii U modes internet settings, and from there load up Wii U homebrew to fix the problem?
-Can the Wii U OTP be dumped from vWii mode, so that I can then hard mod and dump and decrypt the eMMC?

Oh and before anyone suggests just sending it in to Nintendo - even though Nintendo of America usually repairs Wii U consoles with this error code even outside of warranty, Nintendo UK will apparently not fix it unless I pay a repair charge, which is more than the cost of just buying a Wii U console on ebay

reformat it

 

[IgraBIT]

[QUOTE = "Missingphy, сообщение: 8632774, участник: 466592"] переформатировать его [/ QUOTE]
99% brick

 

[SlavaX]

Hello, any progress?
I have the same problem :-) I am lucky because WiiU costed only 40 pounds.
I have 2 WiiU (one is my over 5 Years and fully working, second one faulty)
It had a parent lock - solved by brute force , pin was 1810 :-)
What does it do -- :

Start the system, can go to SETTINGS and set everything. Can do full restore system. Everything is working except ---- WEB BROWSER (160-0103), PARENT LOCK (the same).
So I cannot access loadiine.
Only once I got the WEB but when I tried set the address --- fault

 

[MikeyTaylorGaming]

Just bumping in case anyone is interested in helping the cause with this, Voultar on twitter is investigating the issue and is looking for effected WiiU consoles!

You can find the tweet here

 

[Razor83]

Since this thread has been bumped I may as well give a small update on this console.

After trying everything I could think of back in 2017 I eventually tried to format the system memory using System Config Tool and....it fully bricked, just like I thought it would. I still have the console and the NAND backups somewhere, so I can theoretically hard mod the console and restore it back to its 'semi-bricked' state if I wanted to, but there's really not much point in doing that right now when there is still no fix available for the 160-0103 error.

I just keep it around in the hope that one day somebody will figure out a solution for the 160-0103 error, and perhaps even a boot rom exploit so that consoles without prior NAND backups can also be fixed (I'm not sure if UDPIH runs early enough in the boot process to allow a potential fix to be applied?)

Just bumping in case anyone is interested in helping the cause with this, Voultar on twitter is investigating the issue and is looking for effected WiiU consoles!

I would offer to dig out my console and send it to Voultar, but given i'm in the UK and he's in the US it wouldn't be cost effective. I imagine it would be much easier to find a faulty Wii U console with the same 160-0103 error on eBay. I hope Voultar is successful, as there are a growing number of Wii U consoles out there affected by this error.

Oh and I noticed the Samsung moviNAND datasheet link is dead now, so just in case it helps I have attached a copy to this post.

 

[SDIO]

Hi Razor,
if UDPIH is not working there is also the chance to fix your mlc with wfs-inject. But keep in mind you also need to restore the SLC if you restore the MLC, because the SLC has a cache for the MLC.

Here I shared my experience. I was lucy to have a good backup, but I think you have a godd chance with udpih and wfs-inject.
https://gbatemp.net/threads/how-i-fixed-160-0103-system-memory-error.626448/