'''ISFShax''' exploits boot1 using a specially designed ISFS (SLC filesystem) superblock. Once installed, it offers similar capabilities to defuse. Since it runs before IOSU, it can apply early patches to IOSU and repair most types of bricks. However, it cannot protect against bricks caused by boot1 corruption, seeprom issues, or installing a faulty ISFShax superblock. Additionally, ISFShax cannot help if the Wii U is already bricked.

== Features ==

*Rebuilding or upgrading the MLC
*Removing the 64GB MLC limit and disabling SCFM
*Brick protection, such as before performing a region change
*Cold booting redNAND, which is helpful when the eMMC is failing
*Providing a minimal CFW that can launch old homebrew using the homebrew launcher (though this might be less useful with Aroma and Tiramisu available)
*Preventing the Wii U from turning on the Tablet during boot using a stroopwafel plugin

== Exploit Methods ==

There are quite a few ways to launch the ISFShax installer.

*If you already have Tiramisu or Aroma installed and can launch it, follow the Instructions for Aroma
*If the Browser still works and you can launch the browser exploit u.wiidb.de, follow the Instructions for Browser
*If you can't access the Browser, but Settings still work follow Instructions for DNSpresso
*If your Wii U crashes in the initial setup on Mii creation, follow Instructions for DNSpresso
*If your Wii U can't launch the browser anymore or can't connect to the internet, follow the Instructions for UDPIH

{{info|text= Note: If you have a legacy CFW (Haxchi, CBHC) installed you can also use it, but follow the Aroma steps and hold A instead of B.}}

Make sure your SD card is FAT32, although this should already be the case if you have Aroma/Tiramisu installed.

== SD Preparation ==

You will need:
*The [https://github.com/isfshax/isfshax_installer/releases ISFShax installer] (<code>ios.img</code>)
*The [https://github.com/isfshax/isfshax/releases ISFShax Superblocks] (<code>superblock.img</code> and <code>superblock.img.sha</code>)
*The [https://github.com/jan-hofmeier/stroopwafel/releases stroopwafel] (<code>wafel_core.ipx</code>)
*The [https://github.com/isfshax/wafel_isfshax_patch/releases IOSU ISFShax tolerance patch] (<code>wafel_isfshax_patch.ipx</code>)

*The [https://github.com/jan-hofmeier/minute_minute/releases minute image] (<code>fw_encrypted.img</code>) '''[Aroma/Browser/DNSpresso]'''
*The [https://github.com/wiiu-env/fw_img_payload/releases fw_img_payload] zip '''[Browser/DNSpresso only]'''
*The [https://github.com/wiiu-env/PayloadFromRPX/releases root.rpx] '''[DNSpresso only]'''
*The [https://github.com/jan-hofmeier/minute_minute/releases minute images] (<code>fw.img</code> and <code>boot1.img</code> '''[UDPIH only]'''
*The [https://github.com/jan-hofmeier/recovery_menu/releases recovery_menu] '''[UDPIH only]'''

# Copy the <code>ios.img</code> to the root of your SD card.
# Copy the <code>superblock.img</code> and <code>superblock.img.sha</code> to root of your SD card.
# Copy the <code>wafel_core.ipx</code> and <code>wafel_isfshax_patch.ipx</code> to the <code>ios_plugins</code> folder in the <code>wiiu</code> folder.
# Copy the <code>fw_encrypted.img</code> to the root of your SD card and rename it to <code>fw.img</code>.
#Extract the contents of the <code>fw_img_payload</code> zip to the root of your SD card. '''(Browser/DNSpresso)'''
# Copy the <code>root.rpx</code> to the root of your SD card and rename it to <code>launch.rpx</code> '''(DNSpresso)'''
# Copy the <code>fw.img</code> and <code>boot1.img</code> to the root of your SD card. '''(UDPIH)'''
# Copy the <code>recovery_menu</code> to the root of your SD card. '''(UDPIH)'''

The structure on the SD should look like this:
{{Tree list}}

* {{Tree icon|sd}} (root)
** {{Tree icon|f}} boot1.img (UDPIH only)
** {{Tree icon|f}} fw.img
** {{Tree icon|f}} ios.img
** {{Tree icon|f}} recovery_menu (UDPIH only)
** {{Tree icon|f}} launch.rpx (DNSpresso only)
** {{Tree icon|f}} superblock.img
** {{Tree icon|f}} superblock.img.sha
** {{Tree icon|d}} wiiu
*** {{Tree icon|f}} payload.elf (Browser, DNSpresso only)
*** {{Tree icon|d}} ios_plugins
**** {{Tree icon|f}} wafel_core.ipx
**** {{Tree icon|f}} wafel_isfshax_patch.ipx
{{Tree list/end}}

==Booting into Minute ==

Choose the appropriate method to boot into Minute based off of the setup you have.

<tabber>

|-|Aroma=


# Hold B on boot or while launching Health and Safety (whether you coldboot or not) to boot into the PayloadLoader.
# You will be asked to choose your payload.
# Select "fw_img_loader".

{{info|text= If the fw_img_loader isn't present, grab it from the [https://aroma.foryour.cafe Aroma Website].}}


|-|Browser=


# Navigate to the browser and type in "u.wiidb.de" in the address bar.
# Click on "HAXX".


|-|DNSpresso=


If you can access the settings, follow the instructions provided here (you already have the correct files on the SD card): [https://gbatemp.net/threads/dnspresso-a-wii-u-dns-exploit.642123/ DNSpresso - A Wii U DNS Exploit.]

If you are stuck on User/Mii creation during the initial setup:

# If your Wii U is already connected to your AP/Router, turn off the AP/Router or disable its WiFi.
# When the setup asks if you already have a NNID, select "Yes" (even if you don't have one).
# The system will attempt to connect to the Internet, fail, and then prompt you to return to the WiFi settings.
# Turn your AP/Router back on and wait for it to start.
# If your WiFi is not already configured, connect to it now, but enter an incorrect password.
# Edit your WiFi connection and set 85.215.57.182 as the Primary DNS. If you entered a wrong password before, correct it now.
# Press (B) to go back and select "Connection Test."


|-|UDPIH=


# Boot into recovery_menu as per [https://gbatemp.net/threads/udpih-usb-host-stack-exploit-recovery-menu.613369/ this guide]
# Unplug the pico or Switch.
# Select "Load BOOT1 Payload" from the list and continue on.

{{info|text=(If your tv doesn't display an output, you'll have to navigate blindly: 18x eject, 1x power, 1 eject, 1 power)}}


</tabber>

You should now see the minute main menu. If not, ensure you have the correct fw.img file on the SD card.

In minute, use the power button to move the cursor and the eject button to select (this is opposite to the recovery menu controls).

{{info|text=Minute only outputs 1080p through HDMI, with no display on the GamePad or analog outputs. Some users have reported that the screen output doesn't work when minute is loaded from the recovery_menu. If you've verified that the fw.img file is correct and your TV supports 1080p HDMI, you can still proceed by pressing the appropriate buttons blindly. Make sure to wait long enough between presses to allow the system to load. Without display output, skip the first backup and go directly to installing ISFShax.}}

==Backup and Installation==
We will now start with a fresh NAND backup.

#Navigate to <code>Backup and Restore</code>
#Select <code>Dump OTP and Seeprom</code>
#When that is done, select <code>Dump SLC.RAW</code>
#Once that is done, return to the main menu.

===Installing ISFShax ===
#Select <code>Boot ios.img</code>(blind combo is Power 5x, Eject 1x)
# The ISFShax installer will launch after a brief moment.
#Follow the onscreen instructions, the buttons are the same as minute's (3x Eject, 1x Power, 3x Eject).
# The console should now turn off.
#Replace the fw.img on the SD with the fw.img (The non-encrypted one) from the [https://github.com/jan-hofmeier/minute_minute/releases Minute releases].
#If it successfully installed, the Wii U will directly boot into minute once you boot again.

===Backing up ISFSHax ===
Go back to Backup and Restore and Dump the SLC.RAW again. This will replace the previous SLC.RAW file you dumped earlier. It's required if you want to restore the SLC for unbricking, without losing ISFShax, in case the superblock protection fails. Keep that backup somewhere safe.

==Booting with ISFShax ==

From this point on, the Wii U can still boot without the SD card, but will have some patches applied (ISFShax tolerance for IOSU, update blocking).
To boot into the Wii U OS in minute, select <code>Patch (sd) and boot IOS (slc)</code>.

===Launching environments with ISFShax ===
You can use ISFShax to boot into Aroma or Tiramisu.
To begin, you will need the latest files from the sites.

*Aroma: Download [https://aroma.foryour.cafe here]
*Tiramisu: Download [https://tiramisu.foryour.cafe here]

# Put the wafel_payloader.ipx file in the ios_plugins folder: Download here
#Place the root.rpx file from [https://github.com/wiiu-env/PayloadFromRPX/releases PayloadFromRPX] in the wiiu folder on the SD card.
#*Alternatively, if you have Aroma and/or Tiramisu already, you can just grab the root.rpx from your environment of choice's folder from <code>wiiu/environments/[ENVIRONMENT]/</code> and place it on the root of the SD card.

{{info|text=If you are already coldbooting Tiramisu or Aroma via the PayloadLoader Installer, you need to disable the coldboot in the PayloadLoaderInstaller first.}}

===Booting without SD ===

This step is optional but highly recommended. Without the SD card, the Wii U will still boot, but will only have minimal patches applied.

To fix this, we need to install minute (fw.img) and the stroopwafel plugins (wafel_core + wafel_isfshax_patch) to the internal memory (SLC). This can be done using FTPiiU-Everywhere, which can be launched from Tiramisu and is part of the Aroma Package (enable in the plugin settings), or you can use the [https://github.com/mackieks/haxcopy haxcopy homebrew].

Haxcopy is recommended for most users, but if you accidentally copy a wrong plugin to the SLC or need to delete one, you'll still need to use FTP.

<tabber>

|-|Haxcopy=

# Create a folder named "hax" on the SD card.
# Copy the fw.img to the hax folder.
# Create a subfolder named "ios_plugins" in the hax folder.
# Rename wafel_core.ipx to 0core.ipx and copy it to the hax/ios_plugins folder.
# Rename wafel_isfshax_patch.ipx to 6isfshax.ipx and copy it to the hax/ios_plugins folder.
# If you want to coldboot Aroma or Tiramisu, rename wafel_payloader.ipx to 9payldr.ipx and copy it to the hax/ios_plugins folder.
# If you need other plugins like wafel_unlimit.ipx, rename and copy them to the hax/ios_plugins folder.
# Download the <code>haxcopy.wuhb</code> from [https://github.com/mackieks/haxcopy/releases here] and copy it to to the wiiu/apps folder (as you would normally install homebrew).
# Insert the SD card into the Wii U and run haxcopy to transfer the hax folder to the SLC.


|-|FTP=

{{info|text=You do not need to do the first two steps if you already have system file access enabled in the FTPiiU configuration.}}
#Open the Aroma Plugin Configuration Menu using L + Down + SELECT (-) on the GamePad or Pro Controller (or B + Down + Minus (-) for WiiMotes).
#Open the FTPiiU option, then settings, and set ‘Allow access to system files’ to ‘true’ by pressing A.
# Use an FTP client on the PC to browse to /storage_slc/.
# If you see a scfm.img file and sys folder, go into the sys folder. If you see folders like config, import, logs, proc, rights, security, title, and tmp, move to the next step.
# Create a subfolder named "hax" and enter it.
# Ensure your FTP client is in binary mode (not ASCII mode).
# Upload the minute fw.img to the /storage_slc/sys/hax folder.
# Create another subfolder named "ios_plugins" in /storage_slc/sys/hax.
# Enter the /storage_slc/sys/hax/ios_plugins folder.
# Rename wafel_core.ipx to 0core.ipx and upload it.
# Rename wafel_isfshax_patch.ipx to 6isfshax.ipx and upload it.
# If you want to coldboot Aroma or Tiramisu, rename wafel_payloader.ipx to 9payldr.ipx and upload it.
# If you need other plugins like wafel_unlimit.ipx, rename and upload them too.

</tabber>
Now, the Wii U should autoboot if no SD card is inserted. If an SD card is inserted, the minute menu should show up (even if the SD doesn't contain a fw.img). In that menu, you can select the Patch (SLC) and boot IOS (SLC) to load the plugins from the SLC and boot (no need to have them on the SD anymore).

{{info|text=The Wii U will first try to load the fw.img from the SLC, and if that fails, it will fall back to the SD. If you install a broken fw.img that doesn't load, you can force ISFShax to load the fw.img from the SD by repeatedly pressing the power button until the menu shows up.}}

{{warning|text=A factory reset will delete the hax folder. Without the fw.img on the SD, the Wii U will boot with minimal patches.}}

===Autobooting with SD (Optional) ===

To enable autoboot on the Wii U with an SD card inserted, create the file <code>sd:/minute/minute.ini</code> with the following content:

<syntaxhighlight>
[boot]
autoboot=1
autoboot_timeout=3
</syntaxhighlight>

You can adjust the timeout (in seconds) to your preference. The <code>autoboot</code> option determines which entry from the minute menu will be loaded. Setting it to <code>1</code> corresponds to <code>Patch (slc) and boot IOS (slc)"</code>, which loads the ios_plugins from the SLC. If you haven't installed them to the SLC or want to load them from the SD for any reason, change the value to <code>3</code>, which corresponds to <code>"Patch (sd) and boot IOS (slc)</code>.

{{info|text=If you combine autobooting minute with the wafel_payloader plugin, You can autoboot Aroma or Tiramisu without having Health and Safety injected at all!}}

As an alternative, check out the Fastboot option below.

===Fastbooting (Optional) ===

To make the Wii U boot as fast as possible, without showing minute, you can now use the fw_fastboot.img. This won't work with redNAND
It is hardcoded to go straight to the first option (booting the SLC, with patches from SLC). It won't display anything and ignore any autoboot configuration in the minute.ini.

#First make sure the system can boot using the first option in minute. (see Booting without SD)
#Replace the the fw.img in the hax folder on the SLC with the fastboot image (fw_fastboot.img renamed to fw.img)

If you get stuck for whatever reason and need to fully load minute from your SD, you can do this:

#Place the minute fw.img on the SD card
#Repeatedly press the power button until the minute menu shows up on the screen.

==Uninstalling ISFShax ==

{{warning|text=Do NOT restore an older SLC backup, as it will break SCFM!}}

Ensure your Wii U doesn't rely on any patches (like wafel_unlimit_mlc.ipx or redNAND). You can verify this by booting with only the wafel_core.ipx and wafel_isfshax_ipx plugins in the ios_plugins directory on the SD card and selecting the "Patch (sd) and boot IOS (slc)" option.

To proceed:

#Delete the /storage_slc/sys/hax folder if you have set up SLC booting.
# Run the ISFShax installer again from minute and follow the on-screen instructions to uninstall.