help bricked wii hey guys am a noob here, need help regarding a bricked wii, already posted on a thread here but no replies. so i decided to start a new thread. anyway it was bricked due to downgrade fail. i wasn't the one who downgraded so i don't really know how it happen. I have already tried a couple of tips and tricks like pressing the directional buttons on a gc controller but nothing. When i boot up nothing comes up just a quick flash then black screen display nothing. i have tried to replace the bluetooth daughter card still nothing. Thinking its a full brick i have removed the nand its a samsung nand (k9f4g08uoa). I have dumped the nand but am not sure if the dump is good or not. I really need to know where i can find the console i.d. and unique keys if its still there. I read in another thread that i could actually use another nand with bootmii installed and re-solder it to the the dead wii to boot up bootmii and dump the keys ? but its not really clear how to do this. I really don't want to risk my good wii (removing nand) so i made a dump of the nand and was thinking of flashing this to the dead wii's nand. Am not sure though if this is possible i do not want to proceed not knowing if the first dump that i made from the dead wii is usable i don't want to risk loosing the data inside if i don't have a good back up. so things i need to know before proceeding 1. where are the id console and unique keys located ? did it come with the nand dump that i made for the dead wii ? 2. can i flash the good dump from another wii to the dead wii's nand with bootmii and use that to dump the console id and keys ? 3. what is the correct nand dump size ? i noticed that the dump that i made from the good wii and the dump that i made from the dead wii is not the same size its has a difference of 1kb i think. 4. when i do find the console id and keys, how would i be able to regenerate the firmware ? although i don't mind sending it over to bushing to have him do it for me as i don't really undestand much about hex and bins. 5. i have done this before on a psp so its somewhat similar although i read somewhere that the wii's firmware is signed to console i.d. and keys is this correct ? I can send the file that i have dumped from the bricked wii if anyone is interested and is willing to help me.http://forum.wiibrew.org/read.php?22,23449,23449#msg-23449Sun, 07 Jun 2026 15:55:11 +0200 Phorum 5.2.23 http://forum.wiibrew.org/read.php?22,23449,41007#msg-41007 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,41007#msg-41007
Quote
Juan
Quote
yellowstar
Never mind, it's simple to find the boot2 version inside an NAND dump /w spare data: check the big-endian u16(2 bytes) at 0x21ee0 in the dump, for the boot2 version. I found this by searching for 0000000100000001 twice, then the version is 0x50 bytes after that.

@yellowstar
I have
0x21ee0 00 03 00 01 00 00 00 00-00 00 00 00 00 00 00 01
0x21ef0 00 00 00 00 00 02 3F 71-EA 5C 22 73 C8 AB AD 2B
0x21f00 13 64 7B B4 CB 2D 20 F0-F9 49 29 51 00 00 00 00
Does that mean I have boot2 version 3? Please help.

Stupided question:
- If we change at " 0x21ee0 - 0x21ee1 " from " 00 04 " to " 00 03 " : What happen when we flash back to NAND Chip (same NAND Chip from begining).

srisawats]]> srisawats FixMiiThu, 12 Nov 2009 18:43:34 +0100 http://forum.wiibrew.org/read.php?22,23449,26639#msg-26639 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,26639#msg-26639 solac FixMiiMon, 27 Jul 2009 06:01:20 +0200 http://forum.wiibrew.org/read.php?22,23449,26552#msg-26552 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,26552#msg-26552amoxiflash is an alternative to the official Infectus NAND programmer software, for the Infectus NAND programmer hardware only. What is this hardware you're using?]]> yellowstar FixMiiSun, 26 Jul 2009 17:56:05 +0200 http://forum.wiibrew.org/read.php?22,23449,26551#msg-26551 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,26551#msg-26551 solac FixMiiSun, 26 Jul 2009 17:31:32 +0200 http://forum.wiibrew.org/read.php?22,23449,26550#msg-26550 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,26550#msg-26550
thanks yellow start, but i need to fix the issues for my nand reader writer, i have a gut feeling that it should boot up, i guess there is something wrong after programming the nand. i hope the company that made the machine will eventually come out with the bug fix. :(

i told the support that i hope a new update with the bug fix will come out soon as i need to use that particular i.c.]]> solac FixMiiSun, 26 Jul 2009 17:22:53 +0200 http://forum.wiibrew.org/read.php?22,23449,25736#msg-25736 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,25736#msg-25736 yellowstar FixMiiMon, 20 Jul 2009 17:38:18 +0200 http://forum.wiibrew.org/read.php?22,23449,25718#msg-25718 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,25718#msg-25718 metroid_maniac FixMiiMon, 20 Jul 2009 14:36:49 +0200 http://forum.wiibrew.org/read.php?22,23449,25716#msg-25716 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,25716#msg-25716
well all out of ideas am thinking of maybe using another nand to try to flash the program then re install to the wii ?]]> solac FixMiiMon, 20 Jul 2009 13:21:24 +0200 http://forum.wiibrew.org/read.php?22,23449,25080#msg-25080 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,25080#msg-25080 yellowstar FixMiiWed, 15 Jul 2009 17:34:56 +0200 http://forum.wiibrew.org/read.php?22,23449,25042#msg-25042 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,25042#msg-25042 solac FixMiiWed, 15 Jul 2009 05:30:42 +0200 http://forum.wiibrew.org/read.php?22,23449,24634#msg-24634 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,24634#msg-24634
so basically the bricked wii is a 4.0j with hbc installed but it got bricked upon downgrade. so after i copy the bootmii i hope hbc boots up :)

il keep you guys posted hope this works]]> solac FixMiiSun, 12 Jul 2009 13:37:35 +0200 http://forum.wiibrew.org/read.php?22,23449,24530#msg-24530 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,24530#msg-24530 yellowstar FixMiiSat, 11 Jul 2009 16:54:29 +0200 http://forum.wiibrew.org/read.php?22,23449,24509#msg-24509 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,24509#msg-24509 metroid_maniac FixMiiSat, 11 Jul 2009 09:14:58 +0200 http://forum.wiibrew.org/read.php?22,23449,24508#msg-24508 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,24508#msg-24508
am using winhex and i have no idea how to copy the first 2bytes and paste in this thread for everyone to see. hehehe]]> solac FixMiiSat, 11 Jul 2009 09:12:05 +0200 http://forum.wiibrew.org/read.php?22,23449,24317#msg-24317 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,24317#msg-24317 yellowstar FixMiiThu, 09 Jul 2009 23:47:01 +0200 http://forum.wiibrew.org/read.php?22,23449,24175#msg-24175 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,24175#msg-24175
By the way i was thinking, since the bricked dump was from the the same unit. Would'nt it be possible to just use that and correct the problem ? provided the problem can be located ? but i really have no idea what caused the brick in the first place.

if this can be done then i could just use the original firmware]]> solac FixMiiWed, 08 Jul 2009 05:23:03 +0200 http://forum.wiibrew.org/read.php?22,23449,24171#msg-24171 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,24171#msg-24171
Quote
yellowstar
Yes.

Thank you !! :)]]> Juan FixMiiWed, 08 Jul 2009 04:40:27 +0200 http://forum.wiibrew.org/read.php?22,23449,24116#msg-24116 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,24116#msg-24116 yellowstar FixMiiTue, 07 Jul 2009 18:40:46 +0200 http://forum.wiibrew.org/read.php?22,23449,24114#msg-24114 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,24114#msg-24114
Quote
yellowstar
Never mind, it's simple to find the boot2 version inside an NAND dump /w spare data: check the big-endian u16(2 bytes) at 0x21ee0 in the dump, for the boot2 version. I found this by searching for 0000000100000001 twice, then the version is 0x50 bytes after that.

@yellowstar
I have
0x21ee0 00 03 00 01 00 00 00 00-00 00 00 00 00 00 00 01
0x21ef0 00 00 00 00 00 02 3F 71-EA 5C 22 73 C8 AB AD 2B
0x21f00 13 64 7B B4 CB 2D 20 F0-F9 49 29 51 00 00 00 00
Does that mean I have boot2 version 3? Please help.]]> Juan FixMiiTue, 07 Jul 2009 18:25:58 +0200 http://forum.wiibrew.org/read.php?22,23449,23903#msg-23903 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,23903#msg-23903 solac FixMiiMon, 06 Jul 2009 03:52:12 +0200 http://forum.wiibrew.org/read.php?22,23449,23724#msg-23724 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,23724#msg-23724 yellowstar FixMiiSat, 04 Jul 2009 17:41:57 +0200 http://forum.wiibrew.org/read.php?22,23449,23666#msg-23666 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,23666#msg-23666 solac FixMiiSat, 04 Jul 2009 10:06:43 +0200 http://forum.wiibrew.org/read.php?22,23449,23642#msg-23642 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,23642#msg-23642 yellowstar FixMiiSat, 04 Jul 2009 05:24:04 +0200 http://forum.wiibrew.org/read.php?22,23449,23638#msg-23638 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,23638#msg-23638 solac FixMiiSat, 04 Jul 2009 05:04:23 +0200 http://forum.wiibrew.org/read.php?22,23449,23632#msg-23632 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,23632#msg-23632 solac FixMiiSat, 04 Jul 2009 04:43:07 +0200 http://forum.wiibrew.org/read.php?22,23449,23583#msg-23583 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,23583#msg-23583 yellowstar FixMiiFri, 03 Jul 2009 19:32:07 +0200 http://forum.wiibrew.org/read.php?22,23449,23554#msg-23554 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,23554#msg-23554only dump NAND via Bootmii with keys, or restore, attempting to boot sysmenu/HBC will not work, as the NAND FS would be encrypted with the wrong keys. Boot2 is an encrypted WAD, so injecting Bootmii manually may be tough, in particular when the good/bricked Wiis have different boot2 versions. Determining where the TMD title version field is in the NAND dump with spare data may be tough... I wrote a tool to decrypt or strip NAND dumps with spare data. The decrypt code just decrypts the FS section into another file, it doesn't decrypt the NAND into a directory structure. The strip function removes the spare data, and writes the output to several files.(boot1enc.bin, boot2.wad, fsenc.bin, sffs.bin.) The strip function is supposed to remove spare data, so cat(GNU app which could be used to concatenate the files into an NAND dump) in combination with zestig, could be used to unpack and decrypt NAND. But, for some unknown reason, zestig creates sys sub-directories inside the previous sys dir repeatedly until it crashes. So, this tool isn't really ready for public release, so I may just PM the tool to you. I'll include the offset within the WAD where the TMD title version field is.]]> yellowstar FixMiiFri, 03 Jul 2009 17:06:47 +0200 http://forum.wiibrew.org/read.php?22,23449,23518#msg-23518 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,23518#msg-23518An area of memory, that can only be written once]]> daniel_c_w FixMiiFri, 03 Jul 2009 10:22:04 +0200 http://forum.wiibrew.org/read.php?22,23449,23516#msg-23516 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,23516#msg-23516
I was thinking would it be possible to install bootmii externally ? (like a hex editor) In this way i could edit out the dump that i got from the dead wii so that i can reflash the edited dump and try to boot with bootmii ? and therefore dump the keys that i need?

Can i use the good dump with bootmii installed, crop out section of the dump that has the bootmii code and copy it over to the same section of the dead wii's dump? this would be a lot easier i think. If so does anyone know where bootmii is written. where is boot2 located? (hex address) its worth a shot i guess. :)

by the way what is OTP?]]> solac FixMiiFri, 03 Jul 2009 09:39:56 +0200 http://forum.wiibrew.org/read.php?22,23449,23453#msg-23453 Re: help bricked wiihttp://forum.wiibrew.org/read.php?22,23449,23453#msg-23453
2: Yes, but only to dump/restore NAND.

3: Bootmii adds an 1KB OTP+SEEPROM dump footer to NAND dumps. Bootmii will not restore dumps unless they have the footer with the correct keys for this Wii.

4: That's complicated. There's hardly any people who knows how to "sign" NAND with the custom HMAC algorithm. Best ask bushing.(Bushing actually released the HMAC code on Google Code wii-fsck project, but there's no documentation on where exactly in the spare date the signature is stored, ect.)

5: Yes. Each Wii NAND is encrypted with the OTP NAND AES key, and "signed" with a custom HMAC algorithm. Boot1 and Boot2 are not encrypted/signed with these keys, however the FS is encrypted and "signed" with these. The metadata is only "signed".]]> yellowstar FixMiiFri, 03 Jul 2009 05:39:50 +0200