UDPIH Wii U

UDPIH
General
Author	GaryOderNichts
Type	Exploits
Version	R5
License	GPL-2.0
Last Updated	2025/03/12
Links
Download
Website
Source
Support Author

UDPIH (pronounced like "mud pie" without the M), which stands for "USB Descriptor Parsing Is Hard," is an exploit for the Wii U that takes advantage of a flaw in how the system reads USB information. This allows users to gain control of the system code using devices like Raspberry Pi Pico/Zero or Nintendo Switch.

Since the USB Stack runs before anything else on the Wii U, it would allow recovering from CBHC bricks without soldering by using this with the recovery menu.

You can find the detailed write-up here.

Installation

Supported devices include:

• Raspberry Pi Pico (W) / Pico 2 (W)
• Raspberry Pi Zero (W) / A / A+ / Zero 2 W / 4 / 5
• Steam Deck
• Espressif ESP32 S2 / S3
• A Nintendo Switch capable of running udpih_nxpayload.

Setup and usage instructions.

Media

UDPIH: Exploiting the Wii U's USB Descriptor parsing (GaryOderNichts)

Running UDPIH using an unpatched Switch (GaryOderNichts)

Changelog

v5 2025/03/12

• ESP32:
  • A new port for ESP32 S2 and S3 based boards has been added.
• Pico:
  • No Pico specific changes.
• Linux:
  • No linux specific changes.
• Common:
  • Kernel code built with latest devkitARM.

v4 2024/12/06

• Pico:
  • Releases for the RP2350 based Pico 2 boards are now available.
• Linux:
  • No linux specific changes
• Common:
  • Kernel code built with latest devkitARM.

v3 2024/07/17

• Linux:
  • Fixes compatibility with linux v5.19 (info).
  • Fixes compatibility with DWC3.
  • Fixes compatibility with devices reporting the ep0 max packet size as 0.
• Pico:
  • No pico specific changes.
• Common:
  • Changed custom request to 0x50 to avoid issues with DWC3.
• Improved documentation.
• The Steam Deck is now supported.

v2 2022/06/14

• The console now powers off if the recovery_menu cannot be loaded from the SD Card.
• The gadget now supports both full speed and high speed mode, to support more linux systems.

v1 2022/06/06

• Initial release.

Credits​

• @Maschell for the network configuration types.
• @dimok789 for mocha.
• @hexkyz for hexFW.
• @rw-r-r-0644 for the lolserial code.

Special thanks to Maschell, rw-r-r-0644, QuarkTheAwesome, vgmoose, exjam, dimok789, and everyone else who contributed to the Wii U scene.

External links

• Author's website - https://garyodernichts.blogspot.com/2022/06/exploiting-wii-us-usb-descriptor-parsing.html
• GitHub - https://github.com/GaryOderNichts/udpih
• GBAtemp - https://gbatemp.net/threads/udpih-usb-host-stack-exploit-recovery-menu.613369/