How to set up ISFShax

​

Warning​

Although this is in use by many users and has proven itself as safe and reliable, you still use this at your own risk. Messing with the isfs superblocks is dangerous and can brick your Wii U. Make sure to make a SLC backup before installing isfshax (included in the guide). If something goes wrong, you will need defuse to restore this backup. The superblock linked here was tested and confirmed working. Installing an broken superblock will brick your Wii U.
Also keep in mind: if you are restoring a old SLC backup, which was taken before installing ISFShax, ISFShax will be removed by restoring that backup. Newer versions of minute try to preserve ISFShax when restoring the SLC.

To protect against Nintendo pushing a boot1 update (very unlikely, but you newer know), which would brick a console with ISFShax, boot1 updates get blocked by the 5isfshax.ipx plugin. Older versions did block system updates in general. If you need to do a system update, make sure you have the latest version of said plugin.

Update​

02.02.2025 - isfsh.ax website
26.01.2025 - Remove updatre block
20.01.2025 - Removed encrypted fw.img due to update fw_img_loader and changed file names
13.07.2024 - No longer require the wiiu/root.rpx. Replace Tiramisu with Aroma as default. Add Haxchi as Entry Exploit.
04.04.2024 - Add Fastboot
13.03.2024 - System updates now get blocked by the wafel_isfshax_patch.ipx plugin.
29.12.2023 - Standby Services are now supported. For that to work you need to have the latests ISFShax superblock installed and need to use the latest minute fw.img and wafel_core.ipx. Also autoboot needs to be enabled.

What is this for?​

ISFShax exploits boot1 with specially crafted ISFS (the filesystem of the SLC) superblock. Once installed, ISFShax provides similar capabilities to defuse. Since it launches before IOSU, it can be used to apply early patches to IOSU and can be used to fix most bricks. But it won't protect you of bricks caused by: breaking boot1, seeprom bricks or installing a broken ISFShax superblock. ISFShax also doesn't help you if you already bricked the Wii U.
Use cases are:

• Rebuilding / upgrading the MLC
• Removing 64GB MLC limit and disabling SCFM
• Brick protection (e.g. before doing region change)
• Cold booting redNAND (useful when when the eMMC is failing)
• It gives a minimal CFW, which can launch old homebrew using the homebrew launcher (not sure how useful since we have Aroma and Tiramisu)
• Stop the Wii U from turning the Tablet on during boot (using a stroopwafel plugin)
• Use partitioned HDDs / SD cards

Choosing the Exploit​

Don't forget to download the files below, before juming to the exploit specific instructions.

There are multiple ways to launch the ISFShax installer:
If you already have Tiramisu or Aroma installed and can launch it follow the Instructions for Aroma
If you already have Haxchi or CBHC installed follow Instructions for Haxchi
If the Browser still works and you can launch the browser exploit u.wiidb.de follow the Instructions for Browser
If you can't access the Browser, but Settings still work follow Instructions for DNSpresso
If you your Wii U crashes in the initial setup on Mii creation follow Instructions for DNSpresso
If your Wii U can't launch the browser anymore or can't connect to the internet follow the Instructions for UDPIH

Preparing the SD card​

Windows hides file name extension by default. I highly recommend turning this feature off to avoid confusion (also it's a good idea in general to see what type of you are dealing with): https://www.howtogeek.com/205086/beginner-how-to-make-windows-show-file-extensions/

Make sure the SD card is formatted to FAT32 (already the case if you are using it for Homebrew). You can use guiformat for that.

A zip archive with all the files required can be downloaded here: https://isfsh.ax/
Extract it and move everything inside the sd folder to the root of the SD card. If asked, merge folders and replace existing files.

If you are upgrading an existing ISFShax setup: make sure to clean out the ios_plugins directory, since file names did change. These files need to be deleted, if they exist: wafel_core.ipx,wafel_isfshax_patch.ipx, 0core.ipx, 6isfshax.ipx.

You can a also download all the files manually from the git repos:

The structure on the SD should look like this:

Launching into minute​

This step heavily depends on the used Exploit.






Now you should see the minute main menu. If not, something went wrong. Make sure you have the correct fw.img file on the SD.
In minute you move the cursor with the power button and enter with the eject button (swapped compared to the recovery menu).

ISFShax isn't installed yet! minute is just loaded temporarily and gone after a reboot.

Note: minute only outputs 1080p through HDMI, no picture on the gamepad, and nothing on the analog outputs.
Some people reported that the screen output is not working for them when minute was loaded from the recovery_menu. If you made sure nothing else is the problem (right fw.img, TV supports 1080p HDMI), you can try following along blindly by pressing the appropriate buttons. Make sure to wait long enough between the presses, so the system has time to load. Without display output skip the first backup and go directly to Installing ISFShax.


minute main menu

Backup​

1. Navigate to Backup and Restore
2. Dump SEEPROM & OTP
3. Dump SLC.RAW
4. Return to Main Menu

Note: some correctable ECC errors are expected, so no need to worry if you see a few.

Installing ISFShax​

1. Choose Boot `ios.img` (6x Power, 1x Eject)
2. Now the ISFShax installer should launch (this takes a few seconds)
3. Follow the Instructions on the screen, the buttons are the same as in minute. (3x Eject, 1x Power, 3x Eject)
4. The console should now turn off.
5. If the install was successful the Wii U should directly start into minute and the power LED on the console will be purple, once you turn it on.

successful isfshax install

Backup ISFShax​

Dump the SLC.RAW again. This will overwrite the previous SLC.RAW file on the SD. This is required if you need to restore the SLC for unbricking, without loosing ISFShax. Keep that backup in a safe place.

Booting​

If you came here from the redNAND, the MLC rebuild or the Region Change guide continue with that tutorial now.

For now your Wii U loads minute (fw.img), which then applies the required patches from SD card. (IOSU needs to be patched, so it doesn't fall over the ISFShax superblock).
To boot into the Wii U OS select Patch (sd) and boot IOS (slc) <-- This is the third option, not the first!

If your console just bootloops through minute over and over again, you are probably coldbooting Aroma and replaced the wiiu/payload.elf with the fw_img loader. Just replace the wiiu/payload.elf again with the Aroma one (applies to Tiramisu too).

To make the Wii U booting automatically, without you having to press any buttons in the minute menu, you have to complete the "Autobooting with SD" section further down.

Autobooting with SD​

To make the Wii U autoboot with an SD card inserted you need to create the filesd:/minute/minute.ini with the following content:

The attached isfshax.zip file contains a few example minute.ini files for autobooting slc, sd or rednand. You can copy and rename the appropriate one. The files in the zip already have the .ini file name extension. if you don't see it, then DO NOT add it, as Windows is hiding it.

You can adjust the timeout (in seconds) to your liking. The autoboot option specifies which entry from the minute menu will be loaded. 1 corresponds to Patch (slc) and boot IOS (slc), which loads the ios_plugins from the SLC (see below for how to setup the files on SLC). If you haven't installed them to the SLC or want to load them from the sd for another reason you can change that value to 3 which corresponds to Patch (sd) and boot IOS (slc)

As an Alternative check out the Fastboot option below.

Aroma / Tiramisu​

1. If you are already coldbooting Aroma / Tiramisu, undo the Autobooting: https://wiiu.hacks.guide/uninstall-payloadloader.html
2. To install Aroma or Tiramisu put the corresponding files on the SD.
   Tiramisu: https://tiramisu.foryour.cafe/
   Aroma: https://aroma.foryour.cafe/ (You don't need to have install Tiramisu to have Aroma, also the FTPiiU plugin will become handy later)
3. Put the 5payldr.ipx in the ios_plugins folder https://github.com/jan-hofmeier/wafel_payloader/releases (if you used the downloader, the plugin is already installed)

Optional: Installing Plugins to SLC (instead of SD)​

Now the Wii U will boot like normal without the SD. To achieve that ISFShax applies a minimal set of patches to the system (to tolerate the ISFShax superblock). Since these patches kept minimal, they are not optimized and some things like leaving the settings will take longer.
To make the full minute+stroopwafel run from the internal memory we can install minute fw.img and the ios_plugins to the SLC. This can be accomplished using FTPiiU Everywhere / the Aroma ftp plugin, which can be launched from Tiramisu and is already part of the Aroma Package (enable Everywhere in the settings) or you can use the haxcopy homebrew. Using haxcopy is recommended for most users.


Now the Wii U should autoboot with the installed plugins if no SD card is inserted.
If a SD card with a fw.img is inserted, that will be loaded instead of the installed. So if you want to make sure the fw.img from the slc is used, rename or remove the fw.img from SD. You can also boot the plugins from SLC by booting the first option Patch (slc) and boot IOS (slc) from the minute menu.

Since ISFShax v5.0 the Wii U will first try to load the fw.img from the SD and if that fails it will try to load it from SLC.
Previous versions of ISFShax will first try to load the fw.img from the SLC and if that fails it falls back to the SD.
If you installed a broken fw.img which doesn't load, you can force isfshax to load the fw.img from sd by repeatedly pressing the power button till the menu shows up.

Warning: A factory reset will delete the hax folder. Without the fw.img on the SD the Wii U will then just have a black screen with a orange LED with the latest ISFShax it will apply minimal patches to boot and it will still block updates, but some things like leaving the settings might me slower. It's recommended to setup minute and stroopwafel again.

Optional: Fastbooting (Advanced)​

To make the Wii U boot as fast as possible, without showing minute, you can now use the fw_fastboot.img. This won't work with redNAND.
It is hardcoded to go straight to the first option (booting the slc, with patches from SLC) when loaded from slc or the third option when loaded from SD. It won't display anything and ignore any autoboot configuration in the minute.ini.
If you used haxcopy with the hax folder from the isfsh.ax download or the download script, then the fastboot minute is already installed.

To install it manually replace the the fw.img in the hax folder on the SLC with the fw_fastboot.img (renamed to fw.img)

In case you ever get stuck and need to load the full minute from SD you can do this:

1. Place the minute fw.img on the SD card
2. repeatedly press the power button until the minute menu shows up on the screen. (Since ISFShax v5.0 you don't have to do this, since it will try the SD first by default)

Updating ISFShax​

To update ISFShax replace the files on the SD card. While doing this make sure to clean out the wiiu/ios_plugins and hax/ios_plugins directory, since file names did change. These files need to be deleted, if they exist: wafel_core.ipx,wafel_isfshax_patch.ipx, 0core.ipx.

To update the installed ISFShax superblock, you need to go trough the installer again (Boot ios.img) but generally you don't need to, if everything works. DON'T uninstall it, just install the new superblock, it will overwrite the old one.

If you installed files to the SLC, you can use haxcopy to update those. All plugins (like SDSUSB) that are not in the hax/ios_plugins folder will be removed in the process, so make sure you have them there, if you use them.
If you are redNAND user, remove the hax folder and creare a new one and copy the fw.img from the root of the SD into there, before running haxcopy. The hax folder form the download contains the fastboot fw.img, which doesn't work with redNAND. By installing the normal minute and not having the ios_plugins folder on the menu, the Wii U will display the minute menu.

Installing System Updates​

To protect against Nintendo pushing a boot1 update (very unlikely, but you newer know), which would brick a console with ISFShax, boot1 updates get blocked by the 5isfshax.ipx plugin. Older versions of the plugin did block system updates in general. If you need to do a system update, make sure you have the latest version of said plugin.

To install a system update (e.g. for vWii Decaffinator), make sure you have the latest version of the plugin (and stroopwafel). To do this just replace the 5isfshax.ipxin the wiiu/ios_plugins folder with the lastes one.
If you have Aroma or Tiramisu, you also need to remove the 5payldr.ipx to prevent Aroma from loading, since Aroma also comes with it's own update block.

Which files can be removed?​

If you installed the the files to the SLC, then you don't need to keep any files on the SD, but I would still recommend keeping the hax folder to make future updates easier (so you have all the plugins you installed).
For SD booting / redNAND you just need to keep the fw.img, the wiiu/ios_plugins and your config int the minute folder.
Also if you are using Aroma, you want to keep the wiiu/payload.elf (and the other Aroma files) of course.
The otp.bin / seeprom.bin and SLC.RAW should be copied to a safe place and can also be removed from the SD.
The ios.img would only be needed for uninstalling ISFShax, so if you don't plan on doing that, you can remove it too.

But there is no harm in just leaving all the files on the SD.

Uninstalling ISFShax​

DON'T just restore an older SLC backup, as that would break SCFM!
You DON'T need to uninstall ISFShax to update it. Also uninstalling and reinstalling it won't fix anything. Just installing the new superblock over the old replaces it completely.

• Make sure your Wii U doesn't depend on any patches (linke wafel_unlimit_mlc.ipx or redNAND). You can check that by booting the Patch ISFShax and boot IOS (slc) option in minute.
• Delete the /storage_slc/sys/hax folder if you set up the slc booting
• run the ISFShax installer again from minute and follow the on-screen instructions to uninstall.

Plugins​

Here is a list of currently available stroopwafel plugins, you can use with ISFShax:

• wafel_noinit_tablet - Don't run on the Tablet controller on boot
• SDUSB - Run Wii U games from the SD Card
• USB Partition - Use partitioned USB HDDs with the Wii U
• wafel_setup_mlc - Rebuild / Upgrade the MLC

If you have more plugins, tell me and I can add them to the list

Description of the Files​

In case you are interrested in how all the files work together and which you need to keep, you can keep reading on:

superblock.img
This contains the actual ISFShax. It is a specially crafted superblock for the SLC File System (ISFShax) to exploit a vulnerability in boot1 and give us arbiary code excution. It also contains a mini version of minute, which will be executed to load the full minute (fw.img) from SD or SLC.

superblock.img.sha
This is the checksum for the superblock, to make sure it didn't corrupt along the way, as a bad superblock would lead to a brick.

fw.img
this contains the full minute, which gives you the menu after turning on. It can be used for creating and restoring backups and similar tasks and it acts as a bootloader stroopwafel. When selecting one of the First 3 Boot options, it will load IOSU (the OS/Firmware that runs on the ARM processor) and also loads the plugins from the ios_plugins folder. It will then patch IOSU to first execute the first plugin, which should be stroopwafel, before launching IOSU. At that point you see the GO GO GO message, as IOSU takes over.

00core.ipx
This is stroopwafel. It contains a patches for handeling IOSU reloads (so these go through minute, to apply the patches again), redNAND and to facilliate a framwork for other plugins to apply patches and also exports functions to be used by plugins.

5isfshax.ipx
This plugin patches IOSU to ignore the ISFShax superblock and use the normal superblocks instead. (A superblock contains the file system meta data, like folder structure and used blocks. The SLC has 64 superblocks (to spread the wear), which are written in round robbin, whenever something is change don the slc. ISFShax is installed to 4 superblocks for reduandency)

5payloader.ipx
This redirects the men.rpx (the Wii U Menu) to the root.rpx of aroma, so Aroma gets loaded on boot. If the root.rpx is missing it will load the menu normally.

ios.img
This is the ISFShax installer. It installs the superblock.img to 4 of the superblocks, and marks these superblocks as bad in the normal superblock, so they won't be overwritten.

wiiu/payload.elf
This file gets loaded by most exploits (Like the Browser exploit or the Aroma Payloadloader). In this case it contains the menu, that comes up by holding b and letting you select another payload. By default it would load the Environmentloader for Aroma, if installed.

wiiu/payloads/fw_img_loader/payload.elf
This patches IOSU to load the fw.img from SD and then tells it to reload. This is used to initially load minute, before ISFShax is installed.

wiiu/apps/fw_img_loader/fw_img_loader.elf
This is the a version of the fw_img_loader that can be loaded as an app from the Homebrew Launcher. (Haxchi)

launch.rpx
This is loaded by DNSpresso and loads the wiiu/payload.elf

recovery_menu
The recovery menu is loaded by UDPIH. It has some options to fix certain problems, but we are just using it to load minute. If the recovery_menu sees the boot1now.img, It will skipp the menu and after a countdown use PRSHhax to reset the Wii U into boot1now.img

boot1now.img
SInce PRSHhax exploits boot1 early, many hardware initilizations still needed to be done. This is done by boot1now, which is a mini version of minute, similar to the one embedded in the ISFShax superblock. It will then load the fw.img from the sd.




This means after ISFShax is setup, you only need to keep the fw.img, wiiu/ios_plugins and your config in the minute folder. If you are fastbooting from the SLC, then you don't need anything on the SD.