Racing Thoughts

Last weekend we went on a little jaunt to IKEA to get some additional BESTÅ bits and bobs to make our living room TV setup complete. Now we've finally got a proper place for the vast majority of our older video game systems, excluding just the OG Xbox and my childhood Gamecube.
The Xbox simply doesn't see too much weekly or even monthly use, and the Wii can run GC games anyway.
However, we do also own a Wii U, and I noticed that the Wii U can run GC games as well using Nintendont, which I've used quite a bit on the original Wii. Obviously GC games cannot run directly from the original discs, as the Wii U's drive cannot read them natively, but backups loaded from USB work just fine. This coupled with the Wii U's native HDMI output made me think - wouldn't the Wii U be the perfect all-in-one system for Wii U, Wii and GC games?
And there's a relatively user-friendly softmod available for the Wii U? No contest for a Sunday afternoon.

The exploitation process was as user-friendly as they get. Prepare a SD card (I used an ancient 128Gb SDHC card that cost a college student's fortune in 2015) with the requisite files, pop that in the Wii U and navigate to a website using the Wii U browser and click Run Exploit. Sure enough, in a few seconds I was in a payload selector menu. Of course, the first step in exploiting a video game console is usually a full system backup, or rather a NAND backup that one can use if things go haywire at some point. These tend to take a while on newer consoles with larger internal storage, but I never skip them, especially as this console has quite a bit of personal data on it.

So, NANDDumper time it was. The Wii U in question is a 32Gb PAL Premium edition from the launch day batch. The Wii U's storage has three larger partitions: the SLC, which holds Wii U's system data, the SLCCMPT with vWii compatibility system data, and the MLC with is the actual 32GB user storage area with installed games, saves etc. (Or something close to that, don't quote me on this, didn't look too deep into it at this time.) I chose to back up absolutely everything, knowing it'd take a while, and glued my eyes to the progress bar.

SLC and SLCCMPT were dumped out without any notifications. However, as the MLC backup started, I noticed the "retry" count starting to climb up. A brief Google search explained that this was due to the software having trouble reading something from the eMMC, and this could be indicative of a hardware failure, or at least one in the making. Even more Google searches led me to stories of certain launch-day Wii Us having eMMC chips manufactured by Hynix being more prone to premature degradation and failure. This would eventually manifest in Error 160-0103 appearing during normal use of the system. Oh dear. Further searches led to forum and Reddit posts peppered with alarming headlines and people bragging of having a launch Wii U eMMC produced by Toshiba or Samsung instead of Hynix... And of course, tons of folk remedies and accusatory language in the vein of "not taking care of your console by powering it on frequently" being the cause of degradation. It's the New 3DS IPS screen stuff again, except that this time you get the burden of eventual dooooooom cast upon you.

After the NAND backup finished, I went on to configure the Aroma environment and the rest of the homebrew software I wanted. Nothing particularly exciting here. WiiUIdent told us that indeed, the system had Hynix as the eMMC vendor.

I wanted to identify the extent of the corruption. An user in a similar situation had made a fantastic writeup about a severe case of 160-0103 that provided a couple of vital clues. I could reconstruct the MLC part files of the NAND dump into a single file, and then try to extract that file with a piece of software called wfs-extract, a part of the wfs-tools utility set. Read errors during the extraction process would point out where in the data the read errors likely occurred.

The extractor ran for a while, and eventually finished with a single error.



/content/animal? Animal Crossing Plaza? Yes, that's where the title ID of 10145600 in the path points at. I noticed the "szs" file format, and apparently this is a packer format that can be read using the Switch-Toolbox software. Opening up the szs files in Switch Toolbox proved my hunch correct- indeed, this folder had animal model/texture data for the application. I went through the models, noticing familiar faces here and there - it's been a while since I last played New Leaf, of which the Plaza was a "companion app" of. "rbt" appeared to be rabbits, and there were 20 of them in total. rbt08.szs, however, refused to open, reinforcing its status as broken.

I wanted a valid copy of the file for comparison, so I fired up Wii U Downloader and downloaded a decrypted version of Animal Crossing Plaza, eager to find out which leporine "friend" was going to take the Wii U down with it... rbt08.szs corresponded to...



GENJI the rabbit.
Poor little pile of bits.

Even though corrupted memory is far from a desirable thing - I'm a bit far gone and thus absolutely thrilled at the result. What's going to happen next? Will the application crash if Genji tries to enter the plaza? Will the error manifest in more insiduous ways? Should I replace the broken file or try some new install shenanigans?
The possibilities are endless!

From what I've read so far, if the eMMC is on its way out, there are multiple solutions ranging from replacing the physical eMMC with a SD card or redirecting the eMMC accesses to the SD card slot. I like fixing things, so that's not really a problem. If more symptoms of eMMC corruption like the 160-0103 error start to manifest in the future, I will choose one of these alternative solutions. In any case, we will mostly use the USB storage for app/software installs, so the MLC's read/write accesses will be minimized anyway for the time being. And besides, I've got a full NAND backup of the system now (sans the unfortunate Genji), so we have a restore point of sorts for the console even if the eMMC fails.

By the way, what in the discount Anamanaguchi was that vocal song in the Aroma Appstore? At least you can change the background music MP3. No shame on the band, keep doing what you want, it's just not my cup of java.
On the topic of unusual music choices - there was this one Dreamcast VMU save manager disc that for whatever reason had the Love Hina anime theme as the default background music... on repeat...over and over again. I've never watched the show, so all I associate that song with is scrounging for everything-unlocked savegames. Ah, memories.