A quick update has been released for Stroopwafel , a custom framework and firmware for Wii U consoles, successor to iosuhax and based on SaltyNX , which introduces new features for advanced management of the IOSU operating system.

Stroopwafel is designed to patch the IOSU kernel and its modules, offering enhanced functionality over iosuhax . It works by redirecting code execution to the core wafel_core component instead of the standard reset handler a 0xFFFF0000.

After applying the necessary patches, wafel_core jumps to boot the system. Stroopwafel0xFFFF0000 plugins use memory at the end of the 128 MiB RAM disk and are mapped to all IOS modules to allow code patches and feature replacements.0x20000000

The plugins are PIE (Position Independent Executable) and self-relocate on startup, with the ability to resolve symbols from other plugins.

The update improves the robustness of support for redNAND , the console’s NAND emulation mode, and nocrypt handling , which is useful for accessing unencrypted content.

This strengthens overall system stability when mounting custom file systems and during more sensitive operations with internal storage.

Main features

Stroopwafel includes all the features of iosuhax (such as redNAND, wupserver, etc.) and adds the following features:

Support for de_Fuse : Redirect OTP reads to RAM, requires minute_minute to apply data.
Loading decrypted fw.img in IOSU.
IOSU reloads through minutes to simplify patching.
Disable writes to SEEPROM for added security.
redNAND MLC acceleration : Moves MLC cache (SCFM) to SLCCMPT to improve performance.
Semihosting hooks : kprintf and syslog printing on pico de_Fuse serial.
Disabling disk without writing to SEEPROM.
USB_SHRINKSHIFT – Allows you to have both the Wii U filesystem and a normal filesystem on a USB device, moving the Wii U portion after the MBR.
USB_SEED_SWAP : Overwrites the USB SEEPROM key to simplify system migration.
Experimental features: loading kernel.img from SD card (not stable).

Warnings

Stroopwafel’s redNAND formatting is incompatible with other implementations; use minute to format.
Keep USB_SHRINKSHIFT to 0 if using existing USB devices.
The PRINT_FSAOPEN option is useful but extremely slow.
Tested only on 5.5.x firmware (fw.img); not ported to earlier versions.
Incorrect use of patches can cause your console to brick; read the instructions carefully.

Using plugins

Plugins allow you to apply additional patches to IOSU. To use them:

Place the compiled plugin (e.g. 00core.ipx) next to wafel_core.ipxin the s d:/wiiu/ios_pluginsor /storage_slc/sys/hax/ios_plugins.
Upon startup, minute will automatically load plugins.
Each plugin can implement two hooks:
- void kern_main(): run in kernel mode before everything else.
- void mcp_main(): Runs before the main MCP thread; may spawn new threads.
Both functions must return, but mcp_main()can start additional threads.
An example plugin is available in wafel_plugin_example.

IOSU Patch with Stroopwafel

Stroopwafel provides defined macros wafel/patch.hto apply patches to IOSU:

U32_PATCH_K(_addr, _val): Overwrites a virtual address with a 32-bit value.
ASM_PATCH_K(_addr, _str): Applies assembly code specified as a string, assembled at compile time, and copied at runtime to the specified address (does not support external relative references).
ASM_T_PATCH_K(_addr, _str): As above, but for Thumb code.
BL_TRAMPOLINE_K(_addr, _dst): Generates a BL instruction relative to the specified address; cannot jump to plugin code (distance too long).
BL_T_TRAMPOLINE_K(_addr, _dst): As above, but for Thumb.
BRANCH_PATCH_K(_addr, _dst): Generates a relative B statement; cannot jump to plugin code.

IOSU Hook with Trampolines

Stroopwafel offers functions to wafel/trampoline.hhook C or assembly code into IOSU:

trampoline_hook_before(uintptr_t addr, void *target): Creates a trampoline with a BL instruction to call the specified function, preserving registers. It does not support PC-relative addressing instructions, except BL, which jumps to the original target.
trampoline_t_hook_before(uintptr_t addr, void *target): As above, but for Thumb; overwrites two instructions (because BL takes up 4 bytes).
trampoline_blreplace(uintptr_t addr, void *target): Replaces a BL call. The new function receives the first four arguments (r0-r3), a pointer to the original target and the saved LR, followed by the arguments on the stack.
trampoline_t_blreplace(uintptr_t addr, void *target): As above, but for Thumb.
trampoline_blreplace_with_regs(uintptr_t addr, void *target): Similar to trampoline_blreplace, but also saves registers r4-r12 for use as arguments.
trampoline_t_blreplace_with_regs(uintptr_t addr, void *target): As above, but for Thumb, save r4-r7.

Trampolines support multiple hooks on the same address. With blreplace, the replacement function must call the original one via the provided pointer to avoid breaking the chain. An example of trampolines is available in wafel_trampoline_demo/source/main.c.

Configuring USB_SHRINKSHIFT

To use the USB_SHRINKSHIFT feature (which allows you to have both the Wii U filesystem and a normal filesystem on the same USB device):

Format the USB device with a FAT32 partition as the first partition.
Create a second NTFS partition for the Wii U filesystem.
Make sure USB_SHRINKSHIFT is enabled (set to 1) in the configuration file ( ios_process/source/config.h).
Connect the USB device to the Wii U; the Wii U portion will be moved after the MBR for compatibility.