- Hold B on boot or while launching Health and Safety (whether you coldboot or not) to boot into the PayloadLoader.
- You will be asked to choose your payload.
- Select "fw_img_loader".
![]() |
If the fw_img_loader isn't present, grab it from the Aroma Website. |
(root.rpx goes in wiiu folder, not root) |
m (Unencrypted fw.img no longer needed) |
||
Line 137: | Line 137: | ||
#Follow the onscreen instructions, the buttons are the same as minute's (3x Eject, 1x Power, 3x Eject). | #Follow the onscreen instructions, the buttons are the same as minute's (3x Eject, 1x Power, 3x Eject). | ||
# The console should now turn off. | # The console should now turn off. | ||
#If it successfully installed, the Wii U will directly boot into minute once you boot again. | #If it successfully installed, the Wii U will directly boot into minute once you boot again. | ||
ISFShax exploits boot1 using a specially designed ISFS (SLC filesystem) superblock. Once installed, it offers similar capabilities to defuse. Since it runs before IOSU, it can apply early patches to IOSU and repair most types of bricks. However, it cannot protect against bricks caused by boot1 corruption, seeprom issues, or installing a faulty ISFShax superblock. Additionally, ISFShax cannot help if the Wii U is already bricked.
There are quite a few ways to launch the ISFShax installer.
![]() |
Note: If you have a legacy CFW (Haxchi, CBHC) installed you can also use it, but follow the Aroma steps and hold A instead of B. |
Make sure your SD card is FAT32, although this should already be the case if you have Aroma/Tiramisu installed.
You will need:
ios.img
)superblock.img
and superblock.img.sha
)wafel_core.ipx
)wafel_isfshax_patch.ipx
)fw_encrypted.img
) [Aroma/Browser/DNSpresso]fw.img
and boot1.img
[UDPIH only]ios.img
to the root of your SD card.superblock.img
and superblock.img.sha
to root of your SD card.wafel_core.ipx
and wafel_isfshax_patch.ipx
to the ios_plugins
folder in the wiiu
folder.fw_encrypted.img
to the root of your SD card and rename it to fw.img
.fw_img_payload
zip to the root of your SD card. (Browser/DNSpresso)root.rpx
to the root of your SD card and rename it to launch.rpx
(DNSpresso)fw.img
and boot1.img
to the root of your SD card. (UDPIH)recovery_menu
to the root of your SD card. (UDPIH)
The structure on the SD should look like this:
Choose the appropriate method to boot into Minute based off of the setup you have.
![]() |
If the fw_img_loader isn't present, grab it from the Aroma Website. |
If you can access the settings, follow the instructions provided here (you already have the correct files on the SD card): DNSpresso - A Wii U DNS Exploit. If you are stuck on User/Mii creation during the initial setup:
![]() |
(If your tv doesn't display an output, you'll have to navigate blindly: 18x eject, 1x power, 1 eject, 1 power) |
You should now see the minute main menu. If not, ensure you have the correct fw.img file on the SD card.
In minute, use the power button to move the cursor and the eject button to select (this is opposite to the recovery menu controls).
![]() |
Minute only outputs 1080p through HDMI, with no display on the GamePad or analog outputs. Some users have reported that the screen output doesn't work when minute is loaded from the recovery_menu. If you've verified that the fw.img file is correct and your TV supports 1080p HDMI, you can still proceed by pressing the appropriate buttons blindly. Make sure to wait long enough between presses to allow the system to load. Without display output, skip the first backup and go directly to installing ISFShax. |
We will now start with a fresh NAND backup.
Backup and Restore
Dump OTP and Seeprom
Dump SLC.RAW
Boot ios.img
(blind combo is Power 6x, Eject 1x)Go back to Backup and Restore and Dump the SLC.RAW again. This will replace the previous SLC.RAW file you dumped earlier. It's required if you want to restore the SLC for unbricking, without losing ISFShax, in case the superblock protection fails. Keep that backup somewhere safe.
From this point on, the Wii U can still boot without the SD card, but will have some patches applied (ISFShax tolerance for IOSU, update blocking).
To boot into the Wii U OS in minute, select Patch (sd) and boot IOS (slc)
(2x Power, 1x Eject).
You can use ISFShax to boot into Aroma or Tiramisu. To begin, you will need the latest files from the sites.
![]() |
If you are already coldbooting Tiramisu or Aroma via the PayloadLoader Installer, you need to disable the coldboot in the PayloadLoaderInstaller first. |
wiiu/environments/[ENVIRONMENT]/
and place it in the wiiu folder of the SD card.This step is optional but highly recommended. Without the SD card, the Wii U will still boot, but will only have minimal patches applied.
To fix this, we need to install minute (fw.img) and the stroopwafel plugins (wafel_core + wafel_isfshax_patch) to the internal memory (SLC). This can be done using FTPiiU-Everywhere, which can be launched from Tiramisu and is part of the Aroma Package (enable in the plugin settings), or you can use the haxcopy homebrew.
Haxcopy is recommended for most users, but if you accidentally copy a wrong plugin to the SLC or need to delete one, you'll still need to use FTP.
haxcopy.wuhb
from here and copy it to to the wiiu/apps folder (as you would normally install homebrew).
![]() |
You do not need to do the first two steps if you already have system file access enabled in the FTPiiU configuration. |
Now, the Wii U should autoboot if no SD card is inserted. If an SD card is inserted, the minute menu should show up (even if the SD doesn't contain a fw.img). In that menu, you can select the Patch (SLC) and boot IOS (SLC) to load the plugins from the SLC and boot (no need to have them on the SD anymore).
![]() |
The Wii U will first try to load the fw.img from the SLC, and if that fails, it will fall back to the SD. If you install a broken fw.img that doesn't load, you can force ISFShax to load the fw.img from the SD by repeatedly pressing the power button until the menu shows up. |
![]() |
A factory reset will delete the hax folder. Without the fw.img on the SD, the Wii U will boot with minimal patches. |
To enable autoboot on the Wii U with an SD card inserted, create the file sd:/minute/minute.ini
with the following content:
[boot]
autoboot=1
autoboot_timeout=3
You can adjust the timeout (in seconds) to your preference. The autoboot
option determines which entry from the minute menu will be loaded. Setting it to 1
corresponds to Patch (slc) and boot IOS (slc)"
, which loads the ios_plugins from the SLC. If you haven't installed them to the SLC or want to load them from the SD for any reason, change the value to 3
, which corresponds to "Patch (sd) and boot IOS (slc)
.
![]() |
If you combine autobooting minute with the wafel_payloader plugin, You can autoboot Aroma or Tiramisu without having Health and Safety injected at all! |
As an alternative, check out the Fastboot option below.
To make the Wii U boot as fast as possible, without showing minute, you can now use the fw_fastboot.img. This won't work with redNAND It is hardcoded to go straight to the first option (booting the SLC, with patches from SLC). It won't display anything and ignore any autoboot configuration in the minute.ini.
If you get stuck for whatever reason and need to fully load minute from your SD, you can do this:
![]() |
Do NOT restore an older SLC backup, as it will break SCFM! |
Ensure your Wii U doesn't rely on any patches (like wafel_unlimit_mlc.ipx or redNAND). You can verify this by booting with only the wafel_core.ipx and wafel_isfshax_ipx plugins in the ios_plugins directory on the SD card and selecting the "Patch (sd) and boot IOS (slc)" option.
To proceed: