Wii U Jailbreak Method to Run Game Backups via Modding Tickets

Similar to the PS4 Brazilian Game Sharing Method (not to be confused with the PlayStation 4 Russian Jailbreak Method) and following the recent Wii-U ROP / OTP Hacks, today BurningDesire documented the Brazilian Team's Wii U Jailbreak Method to install and run game backups by modifying Nintendo eShop Tickets using internal memory or USB loading!

Here is his compilation, to quote: Wii U USB loading - Install WiiU Games to USB or Internal Memory

Important Info

• If you want to install on HDD, you need to format your HDD to WiiU format. Attention it will DELETE everything on that drive. DO NOT USE THE DRIVE YOU USE FOR vWII!
• In order to get your HDD to be recognized you may need to use a split USB cable
• The downloaded games need to be the region of your Wii U.
• The games will be playable online!
• You can install only ONE game at a time. You can of course have many installed games at the same time on your HDD or WiiU, but the installation process is done one by one!
• Purchased DLC and updates work fine
• You can transfer games installed to you Hard drive to your internal storage and it will run fine
• You can install games to internal storage without installing to USB
• If you have an existing savegame for your game on your internal storage, move it to you USB before installing the game to USB or you'll lose it!
• To install your Loadiine save into the console, use Saviine homebrew. Guide available here

Instructions

• Get the game from NUS, do not decrypt. Be sure it's the same region than your console!
• Put the game files (.app, .h3, etc.) on your SD card, in SD:/Install/ folder
• Get the ticket for your game (extracted from a WUD file). Be sure it's the same region than your console!

Note: you don't need ALL the rar files to extract the full 25GB wud. Only the first .rar or .r01 file is enough to extract an incomplete wud and get the ticket.

• Edit the ticket (title.tik located in folder sys/02/)
• Either with an hexEditor: Ticket's byte 0x01 set to 0x01, subtract or add 2 to the value of byte 0x0F. Example here.

Or with a tool:

• Wii U Ticket Modifier (Wii U Ticket Modifier by AboodXD)
• Wii U Ticket Modifier with GUI (Tik_Modifier: Wii U Ticket Modifier with GUI by Tesa)

• Put the modified title.tik in the SD:/Install/ folder too.
• Put SD card into Wii U
• Plug in your WiiU Hard drive to your Wii U (if you want to install to USB)
• Eject any inserted game disc
• Launch the homebrew launcher
• Launch the modified wup installer (WUPInstaller-AnyTitle-master.zip) (Attention it has whitelist removed, you can brick your WiiU if you try to install System titles or game from another region!)
• Press X button to install to HDD, or press A to install to internal memory.
• Let the game install. You will see an incorrect % progress (such as 300% or more depending on the game) don't worry and let it finish.
• When the install ends you will be rebooted back into the homebrew launcher, exit it and your games will be installed!
• Delete ALL the files located on your SD:/install/ folder. You can now install another game.

Video Tutorials

Spanish:

Credit for the Spanish tutorial goes to Masterwin.

I am not responsible if your Wii U bricks. All credit for this method goes to Brazilian Team, King Cerelepe for testing, and all users from this thread who explained the ticket editing method.

Update: Kafluke released what he calls Kafluke's Self Hosting AIO - 100% launch success on firmwares 5.3.2, 5.4.0 and 5.5.1 followed by Version 2.1 now with 100% launch success on ALL firmwares with a wiiu_ticket_generator.py Python script to generate Wii-U Tickets!

Download: AIO Self Hosting 2.1.zip (138.9 MB) / KaflukeHost APK's (Android AIO) by oldsk00l / (ZSUN) via kimchee2000

Without XAMPP and PC Software included: AIO Self Hosting without PC software 2.1.zip (17.5 MB)

To update: Replace and merge everything from folder "www" to your server. Then replace everything in folder "SD CARD" to your sd card.

Online version = loadiine.ovh/kafluke
ZSUN = http://zsun_ip/wiibrew
Thanks to @VultraAID for the tip in our PSXHAX.COM Shoutbox!

 

[GregoryRasputin]

GeoHot you are a dick

 

[PSXHAX]

LOL did you see his latest project?

Not as entertaining as his rap video

 

[GregoryRasputin]

I try and block all memory of his existence from my mind, only to be reminded about it each time someone posts the word 'Jailbreak', i think he is a clown for the damage he done to the PS3 scene.

 

[PSXHAX]

Yup I knew that's exactly what you were referring to, 'jailbreaking' a video game console.. go figure Some people's kids eh?

​

 

[nanpsx]

No one cares about wii u, I want the ps4 jailbreak!!!!!

 

[YamooDookie123]

No one cares about wii u, I want the ps4 jailbreak!!!!!

same here PS4 PS4 PS4 BAIL for president!!!

 

[PSXHAX]

Here are a few updates from WiiUbru for those following on their Nintendo Wii-U CFW Booter and GUI for wupclient, with a Java one (JWUPClient) in the works from MaschellDev as well:

And to quote from pwsincd: How to Load a fw.img for Any File Dumping + WiiUBru status update

Hi everyone,

For the past three weeks there has been heavy active development on our WiiUBrU forums regarding the IOSU exploit by generous users of the community. It has been developed in the public-eye, and as a result was able to gain speed quickly by not creating a barrier for people who wanted to get involved.

Today, one very important thing is being "officially" released:
CFW Booter - A .elf file for the Homebrew Launcher which will boot a custom fw.img off the root of the SD card. In other words, this is a stable version of the long-coveted "IOSU exploit" for 5.5.x users only !!

As usual, the file can be downloaded here or on the Homebrew App Store. If your Wii U isn't set up at all for homebrew, you can visit wiiubru.com/go on your Wii U.

However! A "CFW Booter" is not useful without a modified fw.img file to use it with... Thanks to the effort of smealum several months ago, and his release of iosuhax, making a fw.img with modified patches is as easy as reading and running his code. Anyone can do this now using the above booter, BUT if you use random fw.img's lying around, that's at your own risk.

In short, the IOSU exploit elf provided above ALONE cannot hurt you or your console. It alone also cannot get you nand backups or redNAND.

So, from here on the deliverables will likely be in the form of new fw.img to boot with the above elf. Yes, this means the goal is no longer"omg teh iosu exploit", but rather a properly patched fw.img files, that does what you want it to do.

And don't freak out!

There's been "rumors" spreading about our team, and some people even go as far as to call this typical developer arrogance/elitism. It is not that. If you know where to look, and you are willing, you can find us, talk with us, test this stuff out. It's not ready for end users. Don't blindly run it. If you're brave and willing to get your hands a tad dirty come talk to us.

And before I say more, our current RedNand progress does not currently allow installation of unsigned tiles. It cannot be used install homebrew titles, only signed ones. It is actively still being worked on! So yes, we have redNand. We have NAND dumps. You could too, but don't take that as a challenge! Come and chat with us. If you don't want to get your hands dirty, wait for something official either from us or Salt. Again, we have not cracked title installation so right now RedNand isn't very useful to the non-developer!

Also, the reason we are not releasing a NAND dumper right now is the backup format is pretty glitchy (dumps fail, writes raw bytes to hardcoded values on SD, ec). Again, if you're willing, stop on by and work on it with us. Otherwise, this shouldn't be interesting to anyone.

And for the hopefully near future, you will also want a 64GB sd card or bigger if you have a 32GB console. You don't have to worry when we say soon™ cause all the work is already out there if others want to pick it up. The way it should be. We also have no info on a coldboot hack, but if anyone has any suggestions or ideas, hit us up!

Okay, but that's it for bad news. We have some good news too. We are providing a fw.img that we do think is ready for the public to use with the above elf. It won't dump NAND, and it won't boot redNand, and it certainly won't patch titles, but it will let you dump some files using IOSU access from your Wii U.

If you copy this fw.img in sd:/fw.img and run our elf at the top of this post, you will boot into a mode that runs Smea's "wupserver". Once it boots, it will look like the normal Wii U menu, but it will be running a server in the background that can connect to from your computer. You then dump and mount various things from the Wii U that you normally couldn't.

As fw.img files are copyright Nintendo, we cannot provide them to you directly. Instead here are the instructions on how to make a wupserver fw.img, and here is a patch that you can apply to one downloaded from NUS. You can do this with the latest JNustool with We know these instructions aren't great, but you can ask if you have questions. Just please /please/ stop running unfinished, dangerous "rednand fw.img's"

Once you run the wupserver on your Wii U by placing that fw.img on the root of your SD and running our elf above, you can connect to it either with a modified version of smea's wupclient.py or the new wupclientgui.py that was developed. Both are available here:http://www.wiiubru.com/appstore/wupclientgui.zip. And if you hate python, a Java Gui version is on the way.

As it has been repeated do not run any files you see "from us" running around in the wild. You will hear from us through our twitter page at http://twitter.com/wiiubru or you can ask us. But chances are if we haven't tweeted, it's not ready. (from us)

We're aware the community has been burned by at least two maybe three teams in the past on public releases, but this is different. You can play along this time, there's no special rules to play!

Anyway, please understand. Thank you

One more thing! http://www.wiiubru.com/red.html

DiscU is also updated to v4.1b, which can be used to extract / decrypt Wii-U game images in WUD format.

Download: DiscU_4.1b-cred.rar

DiscU 4.1b Changelog:

• Fixes wrong IV in sys part & adds content extraction for WUP install and few other minor changes & fixes.

WupInstaller y Mod with Multiple Install Folders by Yardape8000

To quote: Here is my modified WUP installer.

https://github.com/Yardape8000/wupinstaller/releases/latest

Put the multiple update folders in the install folder like this:

install/game 1
install/game 2
install/game 2 update
install/game that is [2] awesome
etc...

Do not use special characters such as ™ ® é

• Use up/down on the d-pad to select the folder.
• Left = deselect, right = select, plus = select all, minus = deselect all.
• Selected directories will display *
• Press A to install all selected to NAND.
• Press X to install all selected to USB.
• Press Y to remount and rescan folders on SD.
• When a directory is installed, there is a 5s delay when you can press B to cancel.

If you only want to install 1 directory, press - to unselect all, then you just have to have the directory you want shown, then select X or A depending on where you want to install.

If you select 1 or more directories with the right d-pad, a * appears to show they are selected, then select X or A depending on where you want to install and only selected directories are installed.

• DLC and demo installation is untested
• DLC currently will not work until a way is found to patch the console specific key

I do not plan on sorting the directories alphabetically. sorry.

Installing Games on your WiiU from a .WUD Image Guide by DarkKaine

To quote: Somehow this went unnoticed, but you can actually do this now. This will let you play games such as Project Zero that did not get an eShop release depending on your region.

1) Download and extract the new DiscU (above)
2) Run DiscU.exe path\to\game.key path\to\game.wud c
3) After it's done extracting, go into the folder that was just generated (WUP-P-AL5P in my case) and find the first "GM" folder which holds the game data. Proceed to copy all the files in this directory to your SD card in the SD:\Install folder.
4) Go up one directory and enter the system\02 folder. Copy the title.tik, title.tmd and title.cert files in the SD:\Install folder as well.
5) Proceed to install it like you would with eShop releases. I recommend wupinstaller y mod with mulitple install folders (above)

• Setup redNAND w/ Sigpatches by iAqua
• Stable Nand Dumper + RedNAND by pwsincd
• Wuphax - Hacking vWii with iOSuhax by FIX94
• SDiO NAND Extractor and Injector by dimok789
• Wuphax by FIX94
• JNUSTool by Maschell
• FTPiiu by dimok789
• Homebrew Launcher by dimok789
• Haxchi by smealum
• hexFW by hexkyz
• iOSuHax by dimok789
• LibiOSuHax by dimok789
• WUPInstaller y Mod by Yardape8000
• Lindbergh by crediar
• SEEPROM2SD by dimok789
• Nintendont by crediar
• HBC: The Homebrew Channel by fail0verflow
• Haxchi v2.0 by FIX94
• WuDump by FIX94
• Wud2App by FIX94

Have fun

 

[PSXHAX]

More updates for those following on Wii U CFW:

 

[PSXHAX]

Here's another update: Haxchi v2.0 - a persistent WiiU hack

To quote from FIX94: After doing quite a lot of work I now think it is time to release this - Version 2.0 of Haxchi!

If you already have a installation of v1.7 or v1.8 then this wont bring anything new for you, it just makes it far simpler for new people. It now comes with its own installer and does not need iosuhax, wupclient or any additional scripts anymore, just your wiiu, a DS VC game and a way to run the homebrew launcher.

If you happen to have a DS VC title that is listed in this readme then go ahead and grab both haxchi .elf and .zip from here: https://github.com/FIX94/haxchi/releases

The .elf goes into sd:/wiiu/apps and the .zip should just be extracted to sd:/haxchi with all its contents inside. That content right now just consists of a simple replacement icon, logo and replacing the game title with "Haxchi", its example config.txt will boot homebrew launcher by default and a fw.img on your sd card when holding A. The content of this haxchi folder can be changed to your liking - if you want to you can also add in an alternative bootSound.btsnd to replace the original which I did not do in this example haxchi folder.

After setting up the content to your liking all you have to do is run the haxchi .elf in homebrew launcher, select the game you want to install it on and that is it!

Please note, this will ONLY WORK WITH DS VC GAMES ON NAND, if you have a ds vc game on USB you want to use then please move it to your NAND first and ideally detach your usb device before using this installer .elf.

Let me know if everything works fine since there is only so much I can test myself.