Welcome, Guest!

Here are some links you may find helpful

Wii Bricked my NDEV. Need some help.

WiiCurious

Member
Original poster
Jan 19, 2021
10
1
3
So I was digging around in the Nintendo leaks running prerelease software on my NDEV when disaster struck.

I ran "BackToolForSys1_64_US_RC1_1.gcm". This program installed a bunch of wads. It looks to be a disc for getting an RVT unit set up like a retail unit? (I'll post a list of the disc contents after posting this thread)
It displays two screens. The first says 'initializing step 1' (or something like that), then it reboots. It then shows "Initializing step 2".
After step 2 finished, it rebooted to a black screen.

Now, all my NDEV does is repeat "insert disc" over the serial connection.

Trying to launch retail games or an ELF file (either legit or homebrew) throws this error: (on the serial console)
"Security error(0) has occurred"
"Failed to boot app in BS2Mach.c on line 1776"

I can launch GCM files, such as update files, but they refuse to install the system menu WADs.

I tried extracting the main.dol from the nmenu_for_corrupted_banner and replacing it with a Wii Mod Lite dol renamed to main.dol, then realsigning it to debug with RVTHtool.
This causes the serial output to change from "Insert Disc" to "Wrong Disc" (Even though the original GCM booted fine)

This is getting into some really obscure stuff. Does anybody have any ideas on how to fix this?
My goal is to find some way to install WADs manually so I can just overwrite all the crap I installed with the BackTool.
I'm not completely out of ideas yet, but I can't work on it any longer today and figure somebody here might be able to help.

I'd post pictures, but it looks like there's no way to upload them to the site?
 

WiiCurious

Member
Original poster
Jan 19, 2021
10
1
3
Here're the contents of that disc I installed. (BWF means BroadOnFormatWad, I think. there's a python tool in the leaks that convert WAD to BWF and back)

bc.wad
systemmenu.rvl.255.9.eu.wad
boot2.64.922.2.wad
systemmenu.rvl.255.9.jp.wad
boot2.bwf
opening.bnr
systemmenu.rvl.255.9.us.wad
firmware.64.922.9.wad
os_devel.64.403.4.bwf systemmenu.rvl.wad
mios.wad
os_devel.64.901.9.bwf Weather.wad
News.wad
photo.wad
zzzzzzzz.zzz
NigaoeNR.wad
Shopping.wad


Like I said, I think installing all the proper 128MB RAM wads will fix the issue, I just need to get some WAD manager booting.
 

MSX

Is secretly 32-bit
Donator
Community Contributor
Registered
Jun 7, 2019
Donations
£543.68
80
93
18
AGName
MSX
AG Join Date
Dec 7, 2011
I don't believe the NDEV has any internal memory. When it's booted and properly hooked up to a Windows host with drivers, I believe it will be on the text base "insert disc" screen like a RVT-R without the system menu installed. I believe there should be a system menu installer iso in the leaks that you can load and get the system menu.
 

WiiCurious

Member
Original poster
Jan 19, 2021
10
1
3
The "insert disc' isn't being displayed on the screen. If not for the serial connection to my XP machine, I wouldn't even be able to tell that this NDEV was alive.

It used to boot to the normal devkit system menu, but not it does not.
There is for sure internal memory and I screwed it up.
 

WiiCurious

Member
Original poster
Jan 19, 2021
10
1
3
Another update:
I ran swupdate_ALL_us.gcm and WiiMenuChanger1.05.gcm.
This installed a bunch of IOSs and the system menu channels.

It still boots to a black screen, but now trying to run ELF files or retail games causes "Fatal Error Occurred" to display in the terminal.

The biggest update is that using the nmenu_for_corrupted_banner gcm lets me successfully boot channels installed onto the NAND. I can launch the Mii Channel and all the rest from the nmenu interface. Still can't get to the system menu.

I'm going to see what images I have from RVT-H units to see if there's a version of nmenu that allows for installing wads.
The system is still installing the 64MB WADs from the updates, so I need to force the 128MB ones to install manually.

It's still unclear if I screwed up boot2. I have plenty of boot2.128 wads from the BroadOn leaks, but I do not want to start installing those at random. That could completely brick the system.
 

WiiCurious

Member
Original poster
Jan 19, 2021
10
1
3
Is it okay that I'm providing updates in their own post? I can start editing my first post, but I find multiple posts makes it easier to read.

I thought I had activated some failsafe on the NDEV. It seemed like the 'Insert Disc' message was some way to prevent a brick.
Turns out, the systemmenu.rvl.wad from the BackTool was correctly installed. This spamming of 'insert disc' is actually normal behavior. If you wadresign it to retail, it'll install fine on Dolphin. Check the logs and you can see the 'insert disk' message being spammed there.

No clue why none of the update files will overwrite it. They are happy to overwrite the IOSs, but always skip the system menu/devkit menu wad.

It's kind of cool that I'm running one of the earliest system menus ever found. Less cool that I can't seem to escape from it.
I can't figure out the purpose of this particular system menu. It installs all the normal titles(news, weather, shop), but doesn't install any interface for accessing them?

Anyway, I don't know if this brings me any closer to a solution.


EDIT:

More progress!
So the system menu in the BackTool had a version(?) in the TMD of 33. Interestingly, that's the same version number as the USA region system menu 1.0. (https://wiibrew.org/wiki/System_Menu)
Unfortunately, it seems that all the devkit menus/rvl menus all had a version of 2 in the TMD. I'm guessing this is to allow upgrading and downgrading? That doesn't make a ton of sense, but it's my best guess right now.

This means when I try to use the system menu changer discs or any of the fwupdate/swupdate, it skips over installing a menu, since the installed version is higher than the version in the update.

Here's what I did:
1. Took swupdate_53.16.17_55.18.25_devkit1.19_us.gcm and trimmed off the first 32kb with HxD. (It's just junk data. Weird SDK stuff)
2. Extracted the system menu wad, systemmenu.rvl.119.55.wad.
3. Opened the WAD with ShowMiiWads and changed the version number to 300. (random choice)
4. The wad is now debug fake signed. I used wadresign to fix the signatures.
(wadresign won't fix the signature if only the TMD is fakesigned. (eg this wad only has a fakesigned TMD, so Wadresign won't modify it. I have to resign it to retail, then back to debug for all signatures to be fixed)
5. I use WiiScrubber to put the wad, which is identical except for version number, back into the original gcm file.
6. I use RVTHtool to sign the disc back to debug, since wiiscrubber will just fakesign it. RVTHtool will realsign it.
7. The new GCM actually boots on the NDEV and it tries to install the system menu (this is huge progress!), but it hangs at 75%. I had to reset the console after waiting for 10 minutes. It wasn't bricked, though. Seems like it didn't actually install anything.

My next step is to repeat this process, but give the TMD a 2 digit version number. I can't imagine the installer is sensitive to notice a single extra byte in the TMD, but I don't know what else it could be.

I'm doing this on three different computers, since RVTHtool and WADresign are an unbelievable pain in the ass to compile. I have wadresign on my linux machine that I complied back in 2019 (the latest versions from github fail to compile on either windows or linux and the binary release does not include wadresign. Fun bonus, the binary on github and the version on my computer both have a bug that prevent resigning most WADs. It complains about footer size.) The tools I need, WiiScrubber and ShowMiiWads only run under windows.
So there's an Ubuntu 18.04 desktop computer for resigning stuff, a windows 10 laptop for extracting, and a Windows XP computer for running the NDEV ODEM software and serial monitor. So everything I'm doing here involves using an old XP compatible flash drive and constantly moving it between the three computers.

I think this little project is going to be the push I need to finally figure out how to properly implement virtual machines.
That, or I'll just buy a bigger desk.


EDIT2:
My back, hand, and eyes all hurt. I'll have to avoid the computer for a few days to let my tendons heal from being curled around various mice and trackpads for the last 2 days straight.

I opened the system menu wad and dug through the contents.
This system menu has been described on RGD wiki: https://wiki.raregamingdump.ca/index.php/Wii_System_Menu
It's menu RC1.

All I need to do is get a GC controller out of storage and hold Z while booting to get to a system menu.
It'll be RC1, which means I'll still need to do some work before a complete recovery, but I'm very, very close.

EDIT3:
Just confirmed it in dolphin. Holding Z on controller 4 boots to system menu.
 
Last edited:
  • Like
Reactions: MSX

WiiCurious

Member
Original poster
Jan 19, 2021
10
1
3
Finally took the time to try fixing this again.

I took the wiimenu changer disc v1.05 (which has sys menus 1.0 to 3.2ish) and extracted the system menu wad for the USA system menu v1.0.
Using showmiiwads, I changed the title version to 33. I then realsigned it with wadresign, used WiiScrubber to put it back in the original .gcm, then used rvthtool to realsign the gcm.

All the realsigning is probably unnecessary, but when dealing with irreplaceable hardware, it's best to not risk it.

I moved the gcm to my XP machine, booted up the console, and ran the update.

It worked! My NDEV is now running system menu 1.0. It boots correctly and seems to be doing fine.
Until I get a sensor bar (which won't be for a couple weeks), there's not much I can do right now.

Next step is to uninstall the system menu to get me back to the dev menu so I can boot disc using the ODEM software, update to 4.3, install the HBC and then manually install a system menu with the proper version number.
I'll probably grab the keys for the console and a NAND dump before installing any wads. That'll let me recover from a brick if anything goes wrong.
 

WiiCurious

Member
Original poster
Jan 19, 2021
10
1
3
If anybody finds this thread in the future, I can 100% confirm that the BackTool is installing the RC1 system menu.

It's actually pretty cool. It includes some beta channels, such as a photo channel with a date stamp and a Mii channel that looks to be identical to release. As far as I know, these channels have never been documented.

The info/video online are actually incorrect about a few things in this version of the menu. It doesn't crash when looking at Wii save or channel data, for example.

Currently working on getting a video uploaded somewhere. I don't have a youtube channel and I'm not sure I want to start one.
 

MSX

Is secretly 32-bit
Donator
Community Contributor
Registered
Jun 7, 2019
Donations
£543.68
80
93
18
AGName
MSX
AG Join Date
Dec 7, 2011
I have a feeling this thread will be a great resource for trying to recover an NDEV (learned some stuff as well). Nicely done!
 

GerbilSoft

New member
Aug 5, 2019
2
6
3
With regards to the wadresign footer issue, which WADs are you attempting to resign that's showing that error? I did make some changes to wadresign to fix issues with certain IOS WADs recently.

Also, I do plan on releasing rvthtool 2.0 "soon", with precompiled wadresign and nusresign executables.
 
  • Love
Reactions: HI_RICKY

Make a donation