Nintendo Wii - Bad NAND Blocks
Part 1
February 9, 2024
A Nintendo Wii hit the bench this week which seemed to have an intermittent issue with black screen during power on. I couldn't seem to identify a pattern as sometimes the system would power up without any issues and other times it would seemingly freeze on a black screen. It didn't seem to matter if it was from a cold state, warmed up, whether it was reset or power cycled.
A visual inspection of the board didn't turn up anything obvious, and voltages seemed to be correct on the board. I had also tried an alternate power supply just to rule power issues out. I began to suspect that there may be something happening with the system NAND which could be causing intermittent boot issues.
Before getting in too deep I hoped to get a backup of the NAND to have as a rollback point in case I got myself into trouble. Years in the IT industry taught me to always have a way out in case of trouble. I put together an SD card containing BootMii which would be used to run some code which would create a NAND backup to an SD card.
Unfortunately I wasn't able to get a functional backup as the process would hang after a period of time, though not before issuing several warnings of failures to verify certain blocks.
I created a secondary SD card to use to boot into the backup routines just in case there was something wrong with the first card that was causing the hanging, but this didn't change anything. Perhaps these bad blocks were the reason the system was hanging?
As I wasn't able to complete the backup process it looked like I wasn't going to have a safety net for this one. But, the system wasn't useable as it was so why not try to fix it?
On this system the NAND resides in a Hynix HY27UF084G2B which is a 4Gb NAND with an x8 bus width.
To remove the NAND from the board I applied some fresh solder to the pins and then hit it with some hot air. My hot air station is a little under-powered and it sometimes requires longer under the heat than I would like in order to remove parts from many-layer boards, but the NAND came off cleanly.
Connecting up my trusty TL866II, I could insert the NAND into a TSOP48 adapter and read the contents. The filesystem contained on the chip is encrypted using a console specific AES key, and then signed using a system specific HMAC to prevent changes. Luckily the backup process attempted while the chip was still installed was able to retrieve the key needed to decrypt the NAND contents. I was hoping to be able to review the contents of the NAND to see if I could determine where the bad blocks were, and understand better how they may be impacting the functionality of the system.
NAND Extract to the rescue. Using this program I could load up the NAND backup, point to the retrieved encryption keys and browse the contents of the filesystem. Most helpfully the program indicates bad blocks with black squares, and you can see which file(s) may be occupying those locations.
At this point I could see that some files were impacted by the bad block areas. I wanted to preserve the original NAND but also do some experiments with rebuilding/replacing the affected files to see if I could get a stable system operating. I decided to order a couple of replacement NAND chips to use for experimentation. This one will have to wait for the parts to be delivered and a revisit. I'll link the follow-up to this article once I move things forward.