ISFShax

You should use ISFShax at your own risk. Messing with ISFS superblocks is dangerous and can brick your Wii U. Make sure you have an SLC backup before installing ISFShax If something goes wrong, you will need de_Fuse to restore this backup.

If you are restoring an old SLC backup, ISFSHax will be removed. Newer versions of minute try to preserve ISFShax when restoring the SLC.

ISFShax exploits boot1 using a specially designed ISFS (SLC filesystem) superblock. Once installed, it offers similar capabilities to de_Fuse. Since it runs before IOSU, it can apply early patches to IOSU and repair most types of bricks. However, it cannot protect against bricks caused by boot1 corruption, seeprom issues, or installing a faulty ISFShax superblock. Additionally, ISFShax cannot help if the Wii U is already bricked.

Features

Rebuilding or upgrading the MLC
Removing the 64GB MLC limit and disabling SCFM
Brick protection, such as before performing a region change
Cold booting redNAND, which is helpful when the eMMC is failing
Providing a minimal CFW that can launch old homebrew using the homebrew launcher (though this might be less useful with Aroma and Tiramisu available)
Preventing the Wii U from turning on the GamePad during boot using a stroopwafel plugin
Using partitioned USB storage devices/SD cards

To protect against Nintendo pushing a boot1 update, which would (probably) brick a console with ISFShax, boot1 updates are blocked by the 5isfshax.ipx plugin. Other titles from a system update should still install normally.

Choosing the Exploit

There are multiple ways to launch the ISFShax installer.

If you already have Tiramisu or Aroma installed and can launch it, follow the instructions for Aroma.
If you already have Haxchi or CBHC installed, follow the instructions for Haxchi.
If the browser is working, follow the instructions for Browser.
If you cannot access the browser but can access System Settings, or your Wii U crashes during Mii creation during initial setup, follow the instructions for DNSpresso.
If your Wii U cannot connect to the internet, follow the instructions for UDPIH.

Preparing the SD Card

In order to install ISFShax, you must have the following on your Fat32 formatted SD card:

Method	Download	File Name	Location on SD Card	Notes
All	ISFShax Installer	`ios.img`	Root	This is the ISFShax installer, installing the ISFShax superblocks to 4 existing superblocks. It also marks those superblocks as bad in the normal superblock, so they won't be overwritten.
All	ISFShax Superblock	`superblock.img`, `superblock.img.sha`	Root	This is the actual ISFShax superblock, exploiting a vulnerability in boot1 that allows for arbitrary code execution. Included with this is the checksum for the superblock, ensuring it doesn't get corrupted.
All	Stroopwafel	`00core.ipx`	`wiiu/ios_plugins`	This is stroopwafel, which contains patches for handling IOSU reloads, redNAND, and other plugins for minute.
All	ISFShax Patch	`5isfshax.ipx`	`wiiu/ios_plugins`	This is the specific patch that makes IOSU ignore the ISFShax superblock.
All	minute_minute	`fw.img`	Root	This is minute_minute (abbreviated throughout the guide as minute. This gives you a menu after running the exploit and/or turning on the console that can be used for multiple purposes, such as creating and restoring backups.
Aroma, Browser, DNSpresso	fw.img Loader	`payload.elf`	`wiiu/payloads/fw_img_loader`	This is the fw_img loader, allowing the IOSU to load fw.img off the SD card. This must be replaced if it already exists on the SD card.
Aroma, Browser, DNSpresso	PayloadLoaderPayload	`payload.elf`	`wiiu`	This is the standard payload loader, used by most exploits. This allows you to select a payload to load.
DNSpresso	PayloadFromRPX	`root.rpx`	Root, rename to `launch.rpx`	This is loaded by DNSpresso, which loads the payload used by this exploit.
UDPIH	minute boot1	`boot1.img`	Root, rename to `boot1now.img`	This is a mini version of minute_minute, loading the fw.img from the SD card. This also allows more hardware to initialize, since PRSHhax exploits boot1 early.
UDPIH	Recovery Menu	`recovery_menu`	Root	This is the recovery menu, loaded by UPDIH. This is used to load minute. By seeing the boot1now.img, this skips the menu and uses PRSHhax to reset the Wii U into said file.
Haxchi	fw.img Loader	`fw_img_loader.elf`	`wiiu/apps/fw_img_loader`	This is a version of the fw_img_loader that can be launched through the Homebrew Launcher. This comes as a zip file, which you should extract to the SD card.

Your SD card structure should look like this:

💾SD:
┣ 📂wiiu
┃  ┣ 📂apps (Haxchi only)
┃  ┃ ┣ 📂fw_img_loader
┃  ┃ ┃ ┣ 📜fw_img_loader.elf
┃  ┃ ┃ ┣ 📜icon.png
┃  ┃ ┃ ┗ 📜meta.xml
┃  ┣ 📂ios_plugins
┃  ┃  ┣ 📜00core.ipx
┃  ┃  ┗ 📜5isfshax.ipx
┃  ┣ 📂payloads (Aroma, Browser, and DNSpresso only)
┃  ┃ ┣ 📂fw_img_loader
┃  ┃ ┃ ┗ 📜payload.elf
┃  ┗ 📜payload.elf
┣ 📜boot1now.img (UDPOH only)
┣ 📜recovery_menu (UDPIH only)
┣ 📜launch.rpx (DNSpresso only)
┣ 📜fw.img
┣ 📜ios.img
┣ 📜superblock.img
┗ 📜superblock.img.sha

Launching into minute

There are multiple different exploits you can perform to launch into minute. Choose one from the selection below.

Hold B on the GamePad while booting or launching the Health and Safety app, depending on if you have autobooting enabled.
A black and white menu should appear. In this menu, select fw_img_loader.

Simply load the Homebrew Launcher and select the fw.img loader app.

Open the browser, and navigate to wiiuexploit.xyz
Tap on "Run Exploit!" and immediately hold the B button until you see a black and white menu.
Select fw_img_loader.

The first set of instructions will pertain to users who still have access to the System Settings app.

Navigate to System Settings > Internet > Connect to the Internet.
Set up a new connection, if necessary.
Press the X button to access the connection list, selecting your network.
Navigate to Change Settings > DNS > Do not auto-obtain
Enter 85.215.57.182 as the primary DNS, then hit Confirm.
Press the B button to go back, then select Connection Test.
Immediately hold the B button after starting the connection test until you see a black and white menu.
Select fw_img_loader.

The next set of instructions will pertain to users who are facing crashes during the Mii creation phase in the initial setup process.

If you already connected your Wii U to your AP / Router, turn the AP / Router or the Wifi on it off.
When the setup asks you if you already have a NNID, say yes (even if you don't have one).
It'll try to connect to the internet, but it should fail. This will prompt you back to setting up an internet connection.
Turn your Router / AP on again and give it time to start.
If you don't already have your conection configured there, connect to it now, but enter a wrong password.
When prompted, navigate to Change Settings > DNS > Do not auto-obtain.
Enter 85.215.57.182 as the primary DNS, then hit Confirm.
Press the B button to go back, then select Connection Test.
Immediately hold the B button after starting the connection test until you see a black and white menu.
Select fw_img_loader.

Power on the console and insert the UDPIH device as soon as you see the Wii U icon on either the GamePad or TV screen.
The LED should turn purple, and a countdown timer for loading boot1now.img should appear. Wait 5 seconds before unplugging your UDPIH device.

You should now see the minute main menu.

minute only outputs 1080p through HDMI, with no picture on the gamepad nor on analog inputs. If you cannot access a television with 1080p HDMI support, or it otherwise does not show on the TV screen, you can follow the instructions blindly. In minute, you move the cursor using the power button and enter with the eject button. Skip the backup and immediately go to installing ISFShax if this is the case.

ISFShax isn't installed yet! minute is just loaded temporarily, and it will disappear after a reboot unless you continue with the guide.

Initial Backup

You should only perform the backup steps if you are able to see video output through minute!

Before installing ISFShax, you should make a fresh backup. You can do this through minute by following the instructions below.

Navigate to Backup and Restore
Select Dump SEEPROM and OTP and wait for it to complete. It should only take a few seconds or less.
Go back to Backup and Restore, this time selecting Dump SLC.RAW. This should take a few minutes.
Return to the main menu.

Installing ISFShax

Here are the steps to properly install ISFShax.

From the main menu, navigate to Boot `ios.img` (Power 6x, Eject 1x).
After a few seconds, the ISFShax installer should launch. It uses the same controls as minute.
Follow the instructions on screen (otherwise, Eject 3x, Power 1x, Eject 3x).
After installation is completed, the console will turn off.

If installation was successful, the Wii U should boot directly into minute once the console is turned back on.

If you wish to backup ISFShax, dump the SLC.RAW again. This will overwrite the previous file on the SD. This is required if you need to restore the SLC for unbricking without losing ISFShax.

Booting with ISFShax

For now, the console is booting into minute, which then applies the required patches from the SD card so that IOSU doesn't fall over the ISFShax superblock. To boot into the Wii U OS, select Patch (sd) and boot IOS (slc) (Power 3x, Eject 1x). This is the third option, not the first!

If your console bootloops through minute, you're likely autobooting Aroma/Tiramisu and accidentally replaced the wiiu/payload.elf with the fw_img loader. Simply replace it with the PayloadLoader Payload to fix this.

Booting Aroma/Tiramisu with ISFShax

ISFShax can also be used to autoboot into Aroma/Tiramisu. This is done through a specialized payloader that's loaded alongside ISFShax itself. This can replace autobooting with the PayloadLoader. If you'd like to do this, or you're installing Aroma/Tiramisu for the first time, follow the steps below:

If you're already autobooting Aroma/Tiramisu, undo the autobooting by following this guide.

On the Aroma site, scroll down to the Download section. Read through all the steps and click on the checkboxes.
Ensure you download EnvironmentLoader and Base-Aroma, alongside any addictional plugins and modules you'd like to download at this stage.
Insert your Wii U's SD card into your PC and extract the wiiu folder from each .zip file to the root of your SD.
Download the wafel payloader, and place the 5payldr.ipx in the wiiu/ios_plugins folder.

In most cases, Tiramisu has been superseded by Aroma. If you'd like to install Tiramisu for use with legacy homebrew, you can follow the steps below.

On the Tiramisu site, click on Download Tiramisu. This should include all of the necessary files needed to use Tiramisu.
Insert your Wii U's SD card into your PC and extract the wiiu folder from the .zip file to the root of your SD.
Download the wafel payloader, and place the 5payldr.ipx in the wiiu/ios_plugins folder.

Booting without an SD Card

This step is optional but recommended. The Wii U will boot like normal without the SD card, as ISFShax applies a minimal set of patches to the system in order for it to tolerate the modified superblock. Since these patches are kept minimal, they are not optimized, and some actions, like leaving System Settings, will take longer.

To make the full minute, as well as any plugins, run from the internal memory, you can install them to the SLC. This can be accomplished through FTPiiU or haxcopy. Using haxcopy is recommended for most users.

If you're using haxcopy to update an existing install, make sure the plugins have the same name as before. You may install duplicate files, which can cause problems.

Create a folder on the root of your SD card and rename it to hax. This will be what's copied to the SLC.
Copy the fw.img to the newly created directory.
Inside the hax folder, create a subfolder and name it ios_plugins
Copy any plugins you have in the wiiu/ios_plugins folder to this one.
Copy the haxcopy.wuhb or haxcopy.rpx to the wiiu/apps folder.
Place the SD card back into the Wii U and run haxcopy to copy the hax folder to the SLC.

On Aroma, make sure you have enabled access to system files for FTPiiU. Otherwise, you'll only see the files on your SD card.

Using an FTP client, navigate to /storage_slc/sys
Inside this folder, create a subfolder and name it hax.
Make sure your FTP client is in binary mode, not ASCII mode.
Upload the fw.img to the newly created directory.
Inside the hax folder, create a subfolder and name it ios_plugins
Upload any plugins you have in the wiiu/ios_plugins folder to this one.

Now, the Wii U should autoboot if no SD card is inserted. If an SD card is inserted, the minute menu should show up, even if fw.img is not present. You can now select Patch (slc) and boot IOS (slc) to load the plugins from SLC and boot. There's no need to have them on your SD card anymore.

Since ISFShax v5.0, it'll first try to load the minute image from the SD first, then fallback to the SLC. Previous versions will first try to load the minute image from the SLC first, then fallback to the SD.

A factory reset will delete the hax folder, leaving you with only the basic patches ISFShax applies!

Autobooting with an SD Card

To make the Wii U autoboot with an SD card inserted, you need to create a configuration file called minute.ini located in the sd:/minute directory. Inside of said file, insert the following content:

[boot]
autoboot=1
autoboot_timeout=3

You can adjust the timeout (in seconds) to your liking. The autoboot option corresponds to which option in the minute menu will be loaded. For instance, 1 corresponds to Patch (slc) and boot IOS (slc). If you'd like to change this value to a different option in the minute menu, you may.

Fastbooting without an SD Card

As an alternative to autobooting, fastbooting makes the Wii U boot as fast as possible, without showing minute. This will not work with redNAND, since it's hardcoded to go to the first option (booting the SLC, loading patches from SLC). It won't display anything and ignore any autoboot configuration present.

Make sure the system can boot using the first option in minute.
Replace the fw.img in the hax folder on the SLC with the fw_fastboot.img renamed to the former file's name.

In case you get stuck and need to load the full minute from the SD card, you can simply place the minute image on the SD card.

Uninstalling ISFShax

DON'T just restore an older SLC backup, as that would break SCFM! You also do not need to uninstall ISFShax to update it, as simply reinstalling the new superblock over the old one replaces it completely.

If for any reason you need to uninstall ISFShax, follow the steps below:

Make sure your Wii U doesn't depend on any patches (like wafel_unlimit_mlc.ipx or redNAND).
- You can check that by booting with only the 00core.ipx and the 5isfshax.ipx plugins in the wiiu/ios_plugins directory on the SD and using the Patch (sd) and boot IOS (slc) option.
Delete the /storage_slc/sys/hax folder if you set up SLC booting.
Run the ISFShax installer again from minute and follow the on-screen instructions to uninstall.