User:Lazr/sandbox

Let me (Lazr) preface this guide by saying that this is NOT for noobs. You will have to solder to small vias or traces (if you so choose) in order to unbrick your Wii with another piece of hardware.

I am aware that there are tools that "clip" (they are pressure-fitted) onto the NAND flash (aka 360 Clip), but they are pretty pricey (I paid $40, and eventually the ribbon cable wore out) and there are cheaper options, like the ones shown here, but it requires manual wiring.

You should also exhaust all other options before resorting to hardware flashing, like the BootMii NAND restore, or maybe you don't even need to restore.

In the guide, I will cover both Teensy2.0++ and the Raspberry Pi Zero. Theoretically, any Pi can be used for this, but I only have the Zero, so use at your own risk!

What is required

Hardware Needed

• A bricked Wii, for starters.
• A Teensy2.0++ or Raspberry Pi Zero (From now on, I will refer to this as "RPi"). If you have neither, purchase a Zero, they are cheap (~15 USD) compared to the discontinued Teensy (I paid ~50 USD for one).
• A brain, and one that knows its way around a soldering iron is crucial for this.
• Magnet wire (aka Enameled Wire) or really thin solid-core wire. I recommend 32AWG-38AWG, but you might be able to get away with 30AWG if you are careful.

Software Needed

• A NAND backup from that Wii before the brick, or at least the NAND keys (You can re-encrypt another Wii's NAND, but I am not going to go into detail for that here.)
• Teensy users:
  • Flash this to the Teensy with the Teensy Loader
  • Download the NANDway.py (Python 3 Edition).
    • I don't remember the results of using the Py3 version, but I think it worked fine. If you do not want to risk it, use the Py2 version.
  • Python 2 or Python 3, and PySerial (install via pip: pip install pyserial). Depending on what script above you use. Do note that Python 2 is deprecated and getting everything installed might be a PITA.
• RPi users:
  • Download rpi-raw-nand-v3.c and compile it by running g++ rpi-raw-nand-v3.c -o rpi-raw-nand-v3 on the RPi.

Unbricking the Wii

There are 3 different kinds of boards that the Wii used during its lifespan: 6 layer boards (RVL-CPU-01, RVL-CPU-10, RVL-CPU-20, and RVL-CPU-30), 4 layer boards (RVL-CPU-40, RVL-CPU-50, RVL-CPU-60, RVK-CPU-01, and RVK-CPU-02), and the Wii Mini board. I don't have a Wii Mini, so I cannot get scans of it and it will be unsupported for now.

What board you have is important to know, as they all have the NAND in different spots, orientations, and the via locations are different. This post on BitBuilt.net is excellent on showing you how to check your board revision.

Now that (hopefully) you know what board you have, you can follow the respective guide: I recommend you solder to the vias. You can solder to the traces, but either you are insane or skilled enough, or both to not be using the vias. You also need to scratch the vias/traces to expose the copper. Some boards have plugged vias, so you will need to use the "pad" thats created after tinning the vias, instead of being able to shove your magwire into the vias.

For GND, you can use one of the sides of the capacitors, scratch some of the soldermask off of the GND plane above the NAND, or use TP3.

Open the picture in another tab and zoom in. This will give you the full quality of the scans.

For GND, you can use one of the sides of the capacitors or use TP3.

The Wii Mini is unsupported at this time.

Select what you will be using to reflash the NAND:

Connect all of the CLE, ALE, RE, and WE pins to their respective pins. You can use magwire to do this, or solder blob them together.

ALL of the commands should be ran without any <> in them, ie. python3 NANDway3.py /dev/ttyUSB0 0 info.

Linux users might have to run some of the commands as root.

1. Copy the NAND dump to the same directory as the NANDway script.
2. Plug in the Teensy into your PC.
3. Find the serial ID of the Teensy:
   • On Windows machines, this will be under Device Manager as a COM port
   • On Linux (and maybe macOS?), this will be a tty. Run ls /dev/tty* in a terminal and look for ttyUSB0.
4. Open a Command Prompt or Terminal if one is not already open.
5. cd to where the NANDway script is.
6. Power on the Wii with the heatsink placed ontop of the CPU and GPU.
7. Run python(or python3) <NANDway.py or NANDway3.py> <serial ID> 0 info
8. If you get an output that looks correct, run <python or python3> <NANDway.py or NANDway3.py> <serial ID> 0 vwrite <NAND dump>, otherwise check your wiring.
9. When it has finished, unplug the Teensy from your PC, plug in the WiFi module and Bluetooth module into the Wii, and try booting up.

You only need to use one GND point.

1. Copy the NAND dump to the root of the users home directory on the SD card (ie /home/pi).
2. Power on the RPi and open a Terminal if one is not already open.
3. Run sudo ./rpi-raw-nand-v3 50 read_id.
4. If you get an output that looks correct, run sudo ./rpi-raw-nand-v3 50 erase_blocks 0 4096 && sudo ../rpi-raw-nand-v3 50 write_full 0 262144 <NAND dump>, otherwise check your wiring.
5. When it has finished, power off the RPi, plug in the WiFi module and Bluetooth module into the Wii, and try booting up.

Credits

• Lazr1026 - Created the guide, the scans, and traced out the NANDs on 6 layer and 4 layer boards.
• Marcan/Effleurage/hjudges and nicl83 - NANDway and NANDway3 respectively.
• Kafluke - The Teensy picture was taken and modified from their Wii U Unbrick guide on GBATemp.
• pharos/littlebalup/skypiece/r00t1024 - RPi NAND flasher program.
• playerjmr - Pushed me to make the guide.
• Stashboy - Sent me a few Wiis to mess with.