Wii U:ISFShax

ISFShax exploits boot1 using a specially designed ISFS (SLC filesystem) superblock. Once installed, it offers similar capabilities to defuse. Since it runs before IOSU, it can apply early patches to IOSU and repair most types of bricks. However, it cannot protect against bricks caused by boot1 corruption, seeprom issues, or installing a faulty ISFShax superblock. Additionally, ISFShax cannot help if the Wii U is already bricked.

Features

Rebuilding or upgrading the MLC
Removing the 64GB MLC limit and disabling SCFM
Brick protection, such as before performing a region change
Cold booting redNAND, which is helpful when the eMMC is failing
Providing a minimal CFW that can launch old homebrew using the homebrew launcher (though this might be less useful with Aroma and Tiramisu available)
Preventing the Wii U from turning on the Tablet during boot using a stroopwafel plugin

To protect against Nintendo pushing a boot1 update, which would brick a console with ISFShax, system updates get blocked by the wafel_isfshax_patch plugin. If you need to perform a system update, use v1.0 of said plugin, which doesn't contain the update block.

Exploit Methods

There are quite a few ways to launch the ISFShax installer.

If you already have Tiramisu or Aroma installed and can launch it, follow the Instructions for Aroma
If you already have Haxchi or CBHC installed, follow Instructions for Haxchi
If the Browser still works and you can launch the browser exploit u.wiidb.de, follow the Instructions for Browser
If you can't access the Browser, but Settings still work follow Instructions for DNSpresso
If your Wii U crashes in the initial setup on Mii creation, follow Instructions for DNSpresso
If your Wii U can't launch the browser anymore or can't connect to the internet, follow the Instructions for UDPIH

Make sure your SD card is FAT32, although this should already be the case if you have an environment installed.

SD Preparation

You will need:

The ISFShax installer (ios.img)
The ISFShax Superblocks (superblock.img and superblock.img.sha)
The stroopwafel (wafel_core.ipx)
The IOSU ISFShax tolerance patch (wafel_isfshax_patch.ipx)

The minute image (fw_encrypted.img) [Aroma/Haxchi/Browser/DNSpresso]
The fw_img_payload zip [Browser/DNSpresso only]
The root.rpx [DNSpresso only]
The minute images (fw.img and boot1.img [UDPIH only]
The recovery_menu [UDPIH only]

Copy the ios.img to the root of your SD card.
Copy the superblock.img and superblock.img.sha to root of your SD card.
Copy the wafel_core.ipx and wafel_isfshax_patch.ipx to the ios_plugins folder in the wiiu folder.
Copy the fw_encrypted.img to the root of your SD card and rename it to fw.img. (Aroma/Haxchi/Browser/DNSpresso)
Extract the contents of the fw_img_payload zip to the root of your SD card. (Browser/DNSpresso)
Copy the root.rpx to the root of your SD card and rename it to launch.rpx (DNSpresso)
Copy the fw.img and boot1.img to the root of your SD card. (UDPIH)
Copy the recovery_menu to the root of your SD card. (UDPIH)

The structure on the SD should look like this:

(root)
- boot1.img (UDPIH only)
- fw.img
- ios.img
- recovery_menu (UDPIH only)
- launch.rpx (DNSpresso only)
- superblock.img
- superblock.img.sha
- wiiu
  - payload.elf (Browser, DNSpresso only)
  - ios_plugins
    - wafel_core.ipx
    - wafel_isfshax_patch.ipx

Booting into Minute

Choose the appropriate method to boot into Minute based off of the setup you have.

Hold B on boot or while launching Health and Safety (whether you coldboot or not) to boot into the PayloadLoader.
You will be asked to choose your payload.
Select "fw_img_loader".

If the fw_img_loader isn't present, grab it from the Aroma Website.

Hold A on the gamepad while launching the Haxchi or DO NOT TOUCH ME app.
Alternatively, if you have CHBC, you can hold A on the gamepad while booting the console.

Navigate to the browser and type in "u.wiidb.de" in the address bar.
Click on "HAXX".

If you can access the settings, follow the instructions provided here (you already have the correct files on the SD card): DNSpresso - A Wii U DNS Exploit. If you are stuck on User/Mii creation during the initial setup:

If your Wii U is already connected to your AP/Router, turn off the AP/Router or disable its WiFi.
When the setup asks if you already have a NNID, select "Yes" (even if you don't have one).
The system will attempt to connect to the Internet, fail, and then prompt you to return to the WiFi settings.
Turn your AP/Router back on and wait for it to start.
If your WiFi is not already configured, connect to it now, but enter an incorrect password.
Edit your WiFi connection and set 85.215.57.182 as the Primary DNS. If you entered a wrong password before, correct it now.
Press (B) to go back and select "Connection Test."

Boot into recovery_menu as per this guide
Unplug the pico or Switch.
Select "Load BOOT1 Payload" from the list and continue on.

(If your tv doesn't display an output, you'll have to navigate blindly: 18x eject, 1x power, 1 eject, 1 power)

You should now see the minute main menu. If not, ensure you have the correct fw.img file on the SD card.

In minute, use the power button to move the cursor and the eject button to select (this is opposite to the recovery menu controls).

Minute only outputs 1080p through HDMI, with no display on the GamePad or analog outputs. Some users have reported that the screen output doesn't work when minute is loaded from the recovery_menu. If you've verified that the fw.img file is correct and your TV supports 1080p HDMI, you can still proceed by pressing the appropriate buttons blindly. Make sure to wait long enough between presses to allow the system to load. Without display output, skip the first backup and go directly to installing ISFShax.

Backup and Installation

We will now start with a fresh NAND backup.

Navigate to Backup and Restore
Select Dump OTP and Seeprom
When that is done, select Dump SLC.RAW
Once that is done, return to the main menu.

Installing ISFShax

Select Boot ios.img (blind combo is Power 6x, Eject 1x)
The ISFShax installer will launch after a brief moment.
Follow the onscreen instructions, the buttons are the same as minute's (3x Eject, 1x Power, 3x Eject).
The console should now turn off.
Replace the encrypted fw.img on the SD with the fw.img (NOT the encrypted one). (Aroma/Haxchi/Browser/DNSpresso)
If it successfully installed, the Wii U will directly boot into minute once you boot again.

Backing up ISFSHax

Go back to Backup and Restore and Dump the SLC.RAW again. This will replace the previous SLC.RAW file you dumped earlier. It's required if you want to restore the SLC for unbricking, without losing ISFShax, in case the superblock protection fails. Keep that backup somewhere safe.

Booting with ISFShax

From this point on, the Wii U can still boot without the SD card, but will have some patches applied (ISFShax tolerance for IOSU, update blocking). To boot into the Wii U OS in minute, select Patch (sd) and boot IOS (slc) (2x Power, 1x Eject).

If your console bootloops through minute over and over again, you're probably coldbooting Aroma or Tiramisu and replaced the wiiu/payload.elf with the fw_img loader. Just replace it with the proper wiiu/payload.elf for Aroma here (This also applies to Tiramisu).

Launching Aroma/Tiramisu with ISFShax

You can use ISFShax to boot into Aroma or Tiramisu. To begin, you will need the latest files from the sites.

If you are already coldbooting Tiramisu or Aroma via the PayloadLoader Installer, you need to disable the coldboot in the PayloadLoaderInstaller first.

Aroma: Download here
Tiramisu: Download here
The wafel_payloader.ipx

Put the wafel_payloader.ipx file in the ios_plugins folder.
Place the root.rpx file from PayloadFromRPX in the wiiu folder on the SD card.
- Alternatively, if you have Aroma and/or Tiramisu already, you can just grab the root.rpx from your environment of choice's folder from wiiu/environments/[ENVIRONMENT]/ and place it in the wiiu folder of the SD card.

Booting without SD

This step is optional but highly recommended. Without the SD card, the Wii U will still boot, but will only have minimal patches applied.

To fix this, we need to install minute (fw.img) and the stroopwafel plugins (wafel_core + wafel_isfshax_patch) to the internal memory (SLC). This can be done using FTPiiU-Everywhere, which can be launched from Tiramisu and is part of the Aroma Package (enable in the plugin settings), or you can use the haxcopy homebrew.

Haxcopy is recommended for most users, but if you accidentally copy a wrong plugin to the SLC or need to delete one, you'll still need to use FTP.

Create a folder named "hax" on the SD card.
Copy the fw.img to the hax folder.
Create a subfolder named "ios_plugins" in the hax folder.
Rename wafel_core.ipx to 0core.ipx and copy it to the hax/ios_plugins folder.
Rename wafel_isfshax_patch.ipx to 6isfshax.ipx and copy it to the hax/ios_plugins folder.
If you want to coldboot Aroma or Tiramisu, rename wafel_payloader.ipx to 9payldr.ipx and copy it to the hax/ios_plugins folder.
If you need other plugins like wafel_unlimit.ipx, rename and copy them to the hax/ios_plugins folder.
Download the haxcopy.wuhb from here and copy it to to the wiiu/apps folder (as you would normally install homebrew).
Insert the SD card into the Wii U and run haxcopy to transfer the hax folder to the SLC.

You do not need to do the first two steps if you already have system file access enabled in the FTPiiU configuration.

Open the Aroma Plugin Configuration Menu using L + Down + SELECT (-) on the GamePad or Pro Controller (or B + Down + Minus (-) for WiiMotes).
Open the FTPiiU option, then settings, and set ‘Allow access to system files’ to ‘true’ by pressing A.
Use an FTP client on the PC to browse to /storage_slc/.
If you see a scfm.img file and sys folder, go into the sys folder. If you see folders like config, import, logs, proc, rights, security, title, and tmp, move to the next step.
Create a subfolder named "hax" and enter it.
Ensure your FTP client is in binary mode (not ASCII mode).
Upload the minute fw.img to the /storage_slc/sys/hax folder.
Create another subfolder named "ios_plugins" in /storage_slc/sys/hax.
Enter the /storage_slc/sys/hax/ios_plugins folder.
Rename wafel_core.ipx to 0core.ipx and upload it.
Rename wafel_isfshax_patch.ipx to 6isfshax.ipx and upload it.
If you want to coldboot Aroma or Tiramisu, rename wafel_payloader.ipx to 9payldr.ipx and upload it.
If you need other plugins like wafel_unlimit.ipx, rename and upload them too.

Now, the Wii U should autoboot if no SD card is inserted. If an SD card is inserted, the minute menu should show up (even if the SD doesn't contain a fw.img). In that menu, you can select the Patch (SLC) and boot IOS (SLC) to load the plugins from the SLC and boot (no need to have them on the SD anymore).

The Wii U will first try to load the fw.img from the SLC, and if that fails, it will fall back to the SD. If you install a broken fw.img that doesn't load, you can force ISFShax to load the fw.img from the SD by repeatedly pressing the power button until the menu shows up.

A factory reset will delete the hax folder. Without the fw.img on the SD, the Wii U will boot with minimal patches, but some actions (such as leaving the System Settings) may be slower. It's recommended to set up minute and stroopwafel again.

Autobooting with SD (Optional)

To enable autoboot on the Wii U with an SD card inserted, create the file sd:/minute/minute.ini with the following content:

[boot]
autoboot=1
autoboot_timeout=3

You can adjust the timeout (in seconds) to your preference. The autoboot option determines which entry from the minute menu will be loaded. Setting it to 1 corresponds to Patch (slc) and boot IOS (slc), which loads the ios_plugins from the SLC. If you haven't installed them to the SLC or want to load them from the SD for any reason, change the value to 3, which corresponds to Patch (sd) and boot IOS (slc).

If you combine autobooting minute with the wafel_payloader plugin, you can autoboot Aroma or Tiramisu without having Health and Safety injected at all!

As an alternative, check out the Fastboot option below.

Fastbooting (Optional)

To make the Wii U boot as fast as possible, without showing minute, you can now use the fw_fastboot.img. This won't work with redNAND It is hardcoded to go straight to the first option (booting the SLC, with patches from SLC). It won't display anything and ignore any autoboot configuration in the minute.ini.

First make sure the system can boot using the first option in minute. (see Booting without SD)
Replace the the fw.img in the hax folder on the SLC with the fastboot image (fw_fastboot.img renamed to fw.img)

If you get stuck for whatever reason and need to fully load minute from your SD, you can do this:

Place the minute fw.img on the SD card
Repeatedly press the power button until the minute menu shows up on the screen.

Uninstalling ISFShax

Do NOT restore an older SLC backup, as it will break SCFM!

Ensure your Wii U doesn't rely on any patches (like wafel_unlimit_mlc.ipx or redNAND). You can verify this by booting with only the wafel_core.ipx and wafel_isfshax_ipx plugins in the ios_plugins directory on the SD card and selecting the "Patch (sd) and boot IOS (slc)" option.

To proceed:

Delete the /storage_slc/sys/hax folder if you have set up SLC booting.
Run the ISFShax installer again from minute and follow the on-screen instructions to uninstall.

Recommended Plugins

Here is a list of currently available stroopwafel plugins you can use with ISFShax:

wafel_noinit_tablet - Prevents the gamepad from turning on while booting the console.
SDUSB - Allows you to run games from the SD Card.
USB Partition - Allows you to use partitioned USB devices with the Wii U.
wafel_setup_mlc - Allows you to rebuild or upgrade the MLC.