Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

Fuzz posted:

I still don't get how there's no way to play regular DS games directly off the SD card. The system can play the carts just fine, so it has the hardware ability to run all of them just fine, and yet no one has figured out a method to play them without a flash cart.

It's because the sytem doesn't emulate being a DS to play DS games, it just uses the DS-like hardware present in the system to boot "as a DS" and play it directly as a DS would. Which means, hard-coded low-latency reading directly from the hardware cart slot which has like 13 access pins instead of the 5 or so on a (micro-)SD card.

The SD-slot in the 3DS is rear end and doesn't provide the neccessary latency to just switch everything over from "read the inputs from the cart slot hardware" to "read from the SD slot hardware".

HenryEx fucked around with this message at 00:07 on Nov 4, 2017

Adbot
ADBOT LOVES YOU

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

SeANMcBAY posted:

You’re bumming me out. I hope there will be some way to prevent this.:smith:

Why is Nintendo so bad at securing their hardware when it’s seemingly impossible to hack PS and Xboxes that are connected online?

Yeah this is on NVidia, cause the exploit lies within the recovery mode of NVidia's whole Tegra line of embedded processors. The only mistake Nintendo did here was using NVidia hardware.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
So i have a switch that's apparently on 3.0. What can i do with that and where do i start?

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
My full nand dump has failed verifying correctly three times in a row now.

Each attempt takes roughly 1 hour. :suicide:

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

KKKLIP ART posted:

naehrwert has deleted the repository for Hekatebecause folks were using it as a platform for playing backed up games

He's just privated it and going closed source.

There's still that public mod by the one dude, who's also still a contributor to the original repository.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

Empress Brosephine posted:

Is there a hack that doesn’t require the 3D print thing yet

Just hold a paperclip to the backmost pin on the right side. That's it. Hold any conductive material to the backmost pin on the right joycon rail, and press Vol+ and power on.
You don't need some 3d-printed whatever

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

KKKLIP ART posted:

Probably. TX says it’s so they can find out if another company just rips off their code but :rolleyes:

This is extra funny, since someone reverse engineered the SX OS code and their loader is comprised of an old version of the nx-hbmenu, a modified version of Atmosphère for all file system interactions, a modified kip1 loader (which is hekate i guess), and even their code talking to their license server is using an open-souce crypto-library. Note that license-wise all the open-source stuff can only be used if you provide the source code with your program. Guess what they're not doing.

Just about the only original code in there is the one that will brick your system by encrypting your entire storage plus boot partitions with some random password if you look at it funny.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

Rupert Buttermilk posted:

Man, I couldn't imagine owning a Switch now and modding it. I'm looking forward to ten years from now when Nintendo couldn't give less of a poo poo about the system (which is how the Wii currently is) and then I'll be modding the hell out of it. :toot:

You better hope there's switches manufactured in 2017 still around and sold in ten years, then. Nintendo is pretty on the ball with vulnerabilities and exploits this time (probably due to the debacle that was the 3DS) and even the guy who develops the current Switch CFW atmosphere is very pessimistic for any good software exploits at version >5.0. They also cranked up the telemetry to insane levels in versions 5 and up, just to immediately know when something slips through their cracks, probably.

The reason why the switch is so wide open right now is a NVidia hardware fault, the software side is pretty remarkably thought out this time around. And as of today, we've already got reports coming in of people buying new switches where said hardware Recovery Mode exploit no longer works. The switch also sells pretty well, so by the end of summer, all mainstream stock of switches could be replaced by the hardware fixed revision.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

SeANMcBAY posted:

Probably GameStop or online. Nintendo themselves sell refurbished ones but they’re out at the moment. They’ll probably have a few more later.

People have already reported that they sent their switch in for repairs and got one back with a changed SoC that has an ipatch applied for the hardware exploit. So be careful with refurbished ones.

That ipatch on older hardware is most likely what's hitting stores right about now, since the new chip model T214 (codename Mariko) that has the vulnerability fixed and all-around improved security isn't actually used in any switch models yet. They just applied a patch to all newly manufactured T210 models as soon as they got wind of the vulnerability, so, a couple months ago. Said patched models from a few months ago are just starting to actually get sold.


So yea, if you're interested in homebrew in the future or even just want a convenient Emulation Tablet via linux with built-in controllers, you should probably get one now, even if you don't intend to do much with it yet.

The moderately good news is that even those ipatched units entering the market now are old enough to still have firmware 4.1.0, which is still software exploitable via as-of-yet unreleased exploit. So even if you get an early version of those with the hardware exploit fixed, you can get CFW as long as you don't update.
There's no telling how long it'll take for hardware-fixed models with current (5+) firmware to surface though.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
My bad, was too focused on the console pertaining to my own interests rn.

Still, it's probably good to know that Ninty isn't above just replacing your switch processor to keep you from hacking their stuff.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

Uncle at Nintendo posted:

How is Nintendo making some of them unhackable if they still have the old Tegra chip?

http://switchbrew.org/index.php?title=Fuses#bootrom_ipatch

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

Uncle at Nintendo posted:

Ah so even launch consoles on 5.0 are screwed?

The bootrom can only be patched during manufacturing. If your console is vulnerable to fusée gelée, it will always be vulnerable. (Until your SoC is replaced when you send it in for repairs)

What that means though, is that whenever the fusée gelée vulnerability was made known (several months ago), Nintendo immediately started manufacturing patched hardware. It just took the distribution channels and stores up until now to work through the backlog of old hardware still being sent out and displayed.

If you're living in some kind of trade hub, like a big city with a harbor for international shipping, most stores will already have the new patched shipments, since they always get the freshest stock. If you're living out in the boonies, it might still take a few weeks for big retailers to catch up, and who knows how long little brick and mortar stores might still have switch hardware from 2017 stocked.

But yeah, patched units so far still come with 4.1.0 firmware, which means that Nintendo has been producing patched hardware since the start of March this year at the latest, maybe earlier. The supply of vulnerable hardware is going to dry up faster and faster now.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

RedMagus posted:

Why is there all this drama in the Switch hacking community? It is just the money/notoriety?

I mean, it didn't seem this insane with the 3DS/DS hacking scene, is it just because how quickly it appears, and how useful the console is?

i'm guessing it's because the 3ds/ds hacking scene didn't have a trans woman as one of its prominent figures ¯\_(ツ)_/¯

i mean of course there's always different reasons stated but consider the audience there and search your heart

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

MohShuvuu posted:

Rei was pretty prominent

Near as i can tell, Rei is just a dude who really, really likes anime (girls) and has never contradicted that.

Speaking of Rei, as an avid ReiNAND user back on the 3DS i'm excited for his new ReiNX CFW. It "released" today, insofar as most of it is done but he has problems getting the actual "backup loader" to work consistently on all firmwares, so it's not much more than we already have via barebones amosphere/hekate right now.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
The Tegra sound drivers are apparently a notorious nightmare to get to work, so anyting that doesn't run sound through the switch's native OS has a hard time getting any sound.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
Still waiting for atmo to properly (i hope) block/spoof error reporting before i really do anything unsanctioned with my switch. Updated from 4.0.1 to latest without burning fuses and set up auto-RCM to prevent accidental burning, so i can go back to eventually soft-modding my switch w/ après-vu or whatever. Only thing i've used the console for so far is playing failing at Crypt of the Necrodancer.

Just in case, I ordered some kind of chinese USB dongle to boot a payload from SD for ~15$ tho*, i'll let you know how well it works when it arrives in roughly 45 days


* i hope that's what i ordered, you never know with chinese sites + language barrier

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
New update for switches (6.0) seems to be incoming. Apparently the updates are already out for people with devkits, so the turbonerds already had a look at what it brings:




Nintendo ain't loving around anymore

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
The penalty for non-compliance with GDPR is something like 20 million € so that would kinda smart even for Big N

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
You never needed a jig to hack a switch, you just need to hold a metal wire to one of the pins. Then use hekate or whatever to brick your switch so it auto boots into RCM.

Lol if you bought a jig for 5 bucks just to save you the 20 seconds of looking down the rail with proper lighting, or even worse, 3d printed one yourself

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

Nonviolent J posted:

Not everyone wants to risk touching the wrong pins and frying it

You can't fry anything if you don't connect two different pins with the metal wire for some reason. :confused: Which you don't have to do and actively have to try to achieve.

Just touch the right pin with a metal wire and hold it in your hand. Magic.


edit:

Here's a picture, just touch Pin 9 (the yellow one) with a metal wire, ignore all others. Even if you miss slightly and touch pins 10, 8 or 7 instead, nothing will happen aside from RCM not working. Believe me, i've tried. Missed a couple of times on my first tries.

HenryEx fucked around with this message at 13:13 on Oct 1, 2018

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
it was very useful in Breath of the Wild for that one shrine where the solution to the puzzle is in another shrine, so you just make a screenshot and saunter over and look at the solution in your home menu

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

bbcisdabomb posted:

I just took a picture with the in-game camera and pulled it up in the in-game photo viewer. Seems simpler.

IIRC that was about 5 gameplay hours before i got the camera function

i assumed "this is a nintendo launch title it's meant to demonstrate and make use of all console gimmicks so obvs i'm supposed to use the screenshot button on this here controller"

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

azurite posted:

From what I've read: Whatever version you're on, it will apply a separate update, but then update you to the latest firmware. The general recommendation is to use FAT32, because Nintendo's implementation of exFAT is lousy and tends to result in corruption.

Edit: If you want to do FAT32 instead, you can reformat the card with guiformat or similar.

Note that it only ends in corruption via homebrew means. Horizon (the switch OS) avoids the exFAT corruption issues.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
In my experience, if they're cagey about THAT site or doing some shadowy or dark allusions, they mean a site called dark umbra. Seems to be the hotspot for all things about switch piracy. i think i went there once to find a rom of some game (Pokken something?) i had no interest in just so i could extract the complementary 3.0.0 update files, so i could get exFAT support on my switch, which was so hilariously complicated, time-consuming and rear end-backwards that i eventually just said "gently caress it" and just updated fuseless when that became an option.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
Regarding the new update: this is a list of all the system titles that have changed https://yls8.mtheall.com/ninupdates/titlelist.php?date=11-19-18_07-05-09&sys=hac

You might notice it's drat near all of them. They seem to have overhauled large portions of the system, and encrypted everything with new keys. Now here's the kicker: the keys are now derived via the Tegra Security Co-processor (TSEC), which was so far not used, so no one knows how it works yet.

From gbatemp:

quote:

The major (obvious) change is that TSEC is now actually involved, and TSEC is a blackbox with signed secrets.

Much like the gamecart slot, TSEC is a self-contained entity with its owned signed FW and secrets. It has an open stage 0 but that might not be enough/satisfactory, and TSEC has for the most part remained wholly undocumented for the Switch because its not been used but it is also not obviously open to be documented.

[...]

This is a massive overhaul of their security. If TSEC cannot be pwned/bypassed, you can't do jack poo poo even with RCM on 6.2+. This is far bigger than Smash or Pokemon.

This might actually take a while.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
You will likely not be able to play 6.2.0+ games on lower firmware until someone manages to get the new keys (but don't quote me on that). And while you can set your pirated games to ignore the statted FW requirements, eventually games still won't run on higher firmware if they rely on some code calls or newer libraries they expect to be there. They'll most likely crash or not boot at all.
Luckily, new core functions relevant to games are rare, and devs that start using them moreso.

OTOH, 6.2 seems to have shaken up quite some stuff and while most of it is the new crypto, they apparently also rewrote some other system modules. What exactly changed is something we'll have to see after someone unlocks the new firmware.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

Hammer Bro. posted:

To expand upon things a little bit:

You can still enter RCM on 6.2.0 and up. From there, provided you have the appropriate backups, you can re-flash your Switch to a previous state (whatever was backed-up).

Homebrew still works from there except that Sleep Mode is no longer accessible -- they appear to have updated something somewhere not currently accounted for such that that persists. I imagine like how the game cart reader can be updated independently of the firmware and, to my knowledge, we don't have the tools to downgrade it. It's possible that homebrewers will figure out how to fix Sleep Mode in un-6.2.0-ed systems though I don't know that the candidate pool is large enough for them to bother.

You could then in theory return to 6.2.0 (also perhaps via backups) and, provided you didn't do anything to get yourself banned, keep playing as though it were a regular console.

You're not entirely locked out of homebrew if you've ever hit 6.2.0, but the inconvenience and limitations make it a fair bit less palatable / more risky than before.

I'm sure somebody will something something at some point, but this is a strong blow to the homebrew scene that suspiciously coincides with Smash on the horizon. As SciresM said, Nintendo gettin' clever.

I'm p. sure that the reason you can't wake from stand-by post-downgrade is that you will need to burn fuses to upgrade to 6.2.0 (cause we can't circumvent the fuse burning due to the new encyption), and while your bootloader will ignore the fuse count when you boot a lower firmware, the switch checks fuses again when waking up from standby and they won't match on a downgraded firmware.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
When he says "cracked", it's really just that we got the keys needed for 6.2. AFAIK someone used a userland exploit to dump the keys, and these are easily fixable by Nintendo.

The TSEC, which actually generates these new keys, is still a blackbox and uncracked. All Nintendo has to do is patch the userland exploit in the next firmware, crack one of the levers inside TSEC that generates the keys, and we'll be locked out again. Expect every new firmware update to break CFW for a while. And eventually we'll probably run out of userland exploits to take a peek at the new keys.

We're safe for a few weeks/months now, tho



edit: here's what they did to intercept the key output from TSEC, and apparently someone already informed Nintendo on the method, so... ¯\_(ツ)_/¯

HenryEx fucked around with this message at 20:28 on Nov 24, 2018

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
Atmosphère v0.8 is out, and is now the first CFW to support firmware 6.2.0. Happy updating.

It'll be interesting to see how Nintendo's going to fight against the genius strategy of "just set up an emulated TSEC and manually feed it the stuff it derives its keys from, then get keys from your virtual machine and decrypt the rest". The atmo devs are surely counting on Nintendo doing something cause they have also included a way to manually read FW keys from the SD card instead, in case we get less easily circumvented key generation in the future.

I say "easily" but apparently it did involve coding a virtual SMMU (system memory management unit) from scratch

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
Atmosphère 0.8.1 is out and was stealth-patched a few hours after release, so if in doubt, download it again.

It now automatically disables your game card reader if your fuses indicates a <=3.0.1 FW and you are booting a 4.0.0+ one by default, with the option to force that both on and off. (If you're wondering, on 4.0.0 and up there was an update to the GC reader firmware that cannot be reversed currently, so if you update to 4.0.0+ you can't downgrade later on and keep game card functionality, unless you use these nogc patches).
Earlier you had to juggle these nogc patches manually, now atmo does it for you. It also implemented a function for homebrew to reboot straight into RCM, so you don't have to whip out your jigs or tinfoils or whatever anymore. Plus, on a fatal error (a console crash of any kind), you can now press the power button to reboot like normal or press a volume button to reboot straight into RCM.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

Empress Brosephine posted:

So does this mean the newest firmware is hackable?

Yes, though currently only Atmosphère supports 6.2.0. If you're using SX OS or one of the others, you'll have to wait for them to steal atmo's code again. Shouldn't take too long, since the code is open source.

In the mean time, there's plug-in patches for Atmosphère to make it do basically anything the other CFWs do (which mostly means piracy)


As mentioned, you won't need the nogc patches for atmo anymore, since that funcionality is now included by default.


edit: for reference (mostly my own) i'm pasting this here, which details how Atmosphère 0.8+ deals witht he new TSEC key generation security:

quote:

They did now own TSEC at all. What the sploit does is fool TSEC into thinking it's running with sole full control of the system (it thinks the CPUs / DMA are halted). Only then will it continue to generate the keys and decrypt the package1. To fool the TSEC, it needs to read the same constant values from MMIO memory space. This can be done by remapping the address space into DRAM by using SMMU translation. If a single bit from this space is different (like say the BPMP CPU is still running, the IO space would reflect that) then the TSEC would detect it. But by mimicing the same values in DRAM, the TSEC is fooled and continues decrypting package1.

To actually pwn TSEC you need to get code execution in the authenticated mode of the TSEC, which can then be used to reveal TSEC secrets. To date, nobody (and I'm pretty sure not even reswitched or switchbrew) has managed to do this.

Seems like a comparatively easy fix for Nintendo in the next update.

HenryEx fucked around with this message at 13:40 on Dec 2, 2018

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
Since i'm not well versed in the actual homebrew part of the switch yet, i figure i'd ask here.

Is there any way to make proper backups? And i mean actual backups of stuff on my switch, properly signed, so i could install and run them on an unhacked switch. No fake tickets or whatever that needs signature patches.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
Speaking of hekate!

It finally updated to support FW 6.2.0, with a 100% successful boot rate. No more "Failed to enable SMMU" errors when booting Atmosphere through its own loader.


Finally, i can go online and update again. Just in time to smash some ultimate bros


edit:

Turtlicious posted:

I think you can read / wipe the logs with hekate, but whiping your logs is also an autoban since you should have logs for things you HAVE done.

Wiping logs has long been deprecated for the reason you've mentioned, which is why Atmosphère now has custom modules for error and crash logs, which intercepts them and writes them to your SD card instead of the system NAND, so they don't get sent to Nintendo when you go online.

HenryEx fucked around with this message at 23:48 on Dec 6, 2018

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
To be fair, i haven't really used "CFW" so far, i've just used hekate to boot stock firmware (but updating without burning fuses). Seems safe since i've been doing it for half a year and haven't been banned yet.

I was mostly waiting for Atmosphère to mature though, and it's come a long way, so i'll probably start to actually use it from now on. Time to cash in on all those sweet save editor homebrews

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
Atmo has had some nice improvements (up to 0.8.2 now actually) so even if you stay on FW5.1 i think it's worth it.
Basically just download it here and drop the atmosphere folder on your SD card. They've put away all the files into the atmo folder now, so no clutter on your SD root.

Then just push the fusee-primary.bin into RCM like you do with any bootloader. That's it.

If you want, you can open the atmosphere/loader.ini and change the key combination to enter the Homebrew Launcher via album to something else. By default it's "override_key=!R" (which means, don't press R and you get HBL). So you usually enter the homebrew menu via the album, unless you press the R button during it, then you get the normal album.

Don't forget the homebrew menu (drop in root of your SD card) and the homebrew loader (drop in atmosphere folder) if you haven't got them already.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

ROCK THE HOUSE M.D. posted:

Is there coldboot for 1.0 firmware yet? I'm under the impression 1.0 is the golden firmware, and I've been holding off on hacking my extra switch on 1.0 until there is coldboot. I haven't paid attention to the scene at all, so I don't really know what's going on, if 1.0 isn't that great, etc.

It's pretty easy to update nowadays without burning fuses.

For reference: firmware updates burn hardware fuses, and the bootloader checks the firmware version to be loaded against the number of destroyed fuses. So FW 1.0.0 only boots with 1 burnt fuse, FW 2.0.0 only boots with 2 burnt fuses and so on. If the bootloader sees that the FW you want to boot doesn't match the number of burnt fuses he can do two things:
a) if # of fuses is less than the amount the firmware requires (you're trying to boot a higher firmware), it'll burn the amount of fuses neccessary to match it (up to 8 burnt fuses for FW 6.2.0 for example)
b) if # of fuses is greater than the amount the firmware requires (you're trying to boot a lower firmware), the bootloader errors out. This prevents downgrading to an exploitable firmware.
Fuses are actual physical components on the chip that get destroyed and cannot be replaced.

Now, as you can see only the bootloader really has access to the fuses, so if you use a custom bootloader like Hekate or the one from Atmosphere, you can just skip the fuse check, and also the burning of fuses on a mismatch. So as long as you boot with a custom bootloader, your fuses are safe and you can always eventually downgrade your firmware to whatever it started at and run stock firmware, for eventual cold-/warmboot exploits from Horizon OS.
If you ever boot normally with a non-matching fuse count, however, the fuses are immediately burnt, so you basically need AutoRCM on your switch when you upgrade fuselessly. This way there's no risk to accidentally boot into normal FW.


Now for the actual interesting part, the fuseless updating:
Current Atmosphère versions protect your AutoRCM when updating FW. And fuses are burnt after updates when you boot up. So now you can just do this to protect your precious 1.0.0 fuse count even if you're on latest firmware.

1) Boot into RCM via your method of choice.
2) Use Hekate to do a full NAND backup (BOOT0/BOOT1 and eMMC) if you haven't already, so you can eventually downgrade again
3) While you're still in Hekate, activate the AutoRCM option (if it isn't already active)
4) Boot into Atmosphère (v0.8.1+)
5) Update via System Settings

Since Atmo protects your AutoRCM now, the console will reboot into RCM and you can use whatever custom bootloader to protect your fuses on any subsequent starts.

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
Regarding the new TSEC chip i'm just gonna repost this from a page or two ago:

HenryEx posted:

edit: for reference (mostly my own) i'm pasting this here, which details how Atmosphère 0.8+ deals with the new TSEC key generation security:

quote:

They did not own TSEC at all. What the sploit does is fool TSEC into thinking it's running with sole full control of the system (it thinks the CPUs / DMA are halted). Only then will it continue to generate the keys and decrypt the package1. To fool the TSEC, it needs to read the same constant values from MMIO memory space. This can be done by remapping the address space into DRAM by using SMMU translation. If a single bit from this space is different (like say the BPMP CPU is still running, the IO space would reflect that) then the TSEC would detect it. But by mimicing the same values in DRAM, the TSEC is fooled and continues decrypting package1.

To actually pwn TSEC you need to get code execution in the authenticated mode of the TSEC, which can then be used to reveal TSEC secrets. To date, nobody (and I'm pretty sure not even reswitched or switchbrew) has managed to do this.

Seems like a comparatively easy fix for Nintendo in the next update.

What it's doing is fooling the security chip into thinking it has sole computing and execution power by faking a virtual memory that is in halted state. Then they feed it its input and grab the output (the 6.2 FW keys).

Yet, still no one actually knows how the keys are derived. In fact, it is still impossible to get the package1_key_06 used for decrypting package1 (part of the FW) in FW 6.2.0+, because it is fully derived, used and erased within the confines of TSEC.

So yes, while the hackers have worked around it for now, i wouldn't bet that Nintendo can't come up with a way to disrupt the smokescreen hackers use to fool TSEC into doing their work for them. When that happens, prepare for quite a wait until someone actually cracks TSEC. Then again, you can never put a hard date on someone finding an exploit.


MohShuvuu posted:

If you update via system settings, doesn't that mean you have to connect online? I deleted my wifi settings just so my switch wouldn't ever go online.

Yeah, you need to be online. I've done all my updates (4.1.0 -> 5.1.0 -> 6.0.0 -> 6.2.0) via system settings so far. I tried the manual way but it was wayy to bothersome. Before atmo when updates broke AutoRCM, i had to use system update, use a paperclip/jig while the system reboots, press the VOL button and hope to god it registered and booted into RCM instead of the OS. Now it's extremely easy.

Nothing's happened to me in these past 6 or so months (wow it's been so long...) online but i don't do anything stupid like installing fake tickets for pirated games or whatever.
If you want to stay offline, there's now a homebrew called ChoiDujourNX which allows you to more or less easily update from your switch, but you'll need to go looking for the copyrighted firmware files on seedy websites or extract the update partition of some game ROM or leech them from IRC channels like it's loving 1994

HenryEx fucked around with this message at 23:29 on Dec 13, 2018

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer

Kaethela posted:

I'm interested in hacking my Switch solely for emulation purposes. If I just use Lakka and nothing else (so no cfw or homebrew) what are the chances I get banned?

Very very low, when you never touch the Horizon OS. Can't rule it out completely, but it's as safe as it gets when you don't boot into Nintendo's firmware at all to do your thing, which i assume Lakka doesn't (it's one of those linux packages, right?)

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
Overclocks coming soon, to make handheld performance on switches a little less anemic:

https://twitter.com/loleaguesin/status/1085226687741206537

https://twitter.com/m4xwdev/status/1085628051281625088

Going to the 460 MHz clock seems to already have quite a nice effect on performance, but if you want to run handheld at the same clocks that docked mode runs at (768 MHz), there's a patch for atmosphere that lets you toggle between handheld and docked clock speeds at runtime.

Author posted:

If you're really interested in running docked GPU speed in handheld, you're more than welcome to give mine a shot. It's for Atmosphere. I'll attach it in a zip. Holding ZL and clicking down the left stick activates it. ZL + Right stick returns it to whatever it was before. If you want to be 100% sure it's working ZR + Left stick will output a file to sdmc:/clock.txt with what the system reports the clock speeds are. I don't have any games that seem to benefit from it a lot though, so I'm going by what the system reports.

http://s000.tinyupload.com/?file_id=56468597866230067301


Use at your own risk, since the power draw running at full speed docked mode could be more than the battery can handle. The dock has more power output than the battery and doesn't need to power the screen simultaneously.

HenryEx fucked around with this message at 23:33 on Jan 18, 2019

Adbot
ADBOT LOVES YOU

HenryEx
Mar 25, 2009

...your cybernetic implants, the only beauty in that meat you call "a body"...
Grimey Drawer
Bought two of them.

The first one was that X86-RCM dongle thingy, and the shipping took so long the battery died and caused a brown out on the usb controller whenever i plugged it in. Unusable unless you pick it apart and manually charge the battery with a lithium charger or w/e. You have to pry the case apart to get at the reset button you need to press to reflash it anyways, i guess. Big and blocky though, with a male USB-C on one side and a male USB-A on the other to stick into your PC and flash it. In theory. If it had worked.
There's multiple revisions of those and i guess newer ones come with better batteries and case, but it's a little late for me. For reference, this is the github where you can get your CFW/bootloader files to flash: https://github.com/euclala/RCM_typeC_ex

It did come with a VERY nice and high quality jig, but even as nice as it is, the 13 bucks or whatever i paid was a little expensive for what amounted to just a jig. Still using that one, though.


Bought the NS atmosphere one ( http://www.ns-atmosphere.com/en/ ) afterwards and while it took just as long to arrive, the dongle actually looks and feels like a quality product. There's a reset button on it instead of having to take it apart, and - even better - it has a on/off slide switch. Bet that helped the battery not die on the way here! If you only turn it on when you need to boot and turn it off afterwards, the battery will last for hundreds of boots, too.
It even has two(!) LEDS built in for operational feedback! One for "is powered" and one for "is working", and they can glow in different colors to signal different states! Holy poo poo, did someone actually, like, DESIGN this? It's slimmer than the other one, too, despite that one really just being a slimm chip between two plastic shells. Probably because this one eschews the male USB-A adapter. Instead, it has what looks like a female micro USB input, which makes the design smaller than the other dongle.
Luckily, for about the same price as that other one, this one also comes with a short free USB-A to Micro USB cable, so you can connect it to your PC for recharging and flashing if you don't have a USB-C input on your computer. It even has a little rubber cap for the USB-C port for protection against dust! Hot drat.

It also comes with a tiny jig that slots into the casing, so you don't lose it:

While the jig is a little too small for easy use and feels rougher and not as nicely made as the one from the other dongle, it's awesome that it's part of the dongle. Also you probably won't need the jig more than once or so anyways.

The website i posted above has a program for windows, ubuntu and mac where you can just flash any bin file to the dongle pretty effortless, and there's also a step-by-step walkthrough with pictures on how to do it. Flashing takes a while (a minute or so for a 120kb file) but hey. Tried it multiple times, worked flawlessly for me.

In short, this thing's pretty awesome. I guess the SX OS dongle is still smaller but it's the size of a slightly large USB stick, nothing too wild. Should fit into any pocket.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply