A few days after the monumental reveal of a work-in-progress flashcart being made for the Nintendo Switch, more information has been made available. The previously unnamed flashcart is set to be called "Mig Switch", and the initial Twitter user that unveiled the Mig Switch's existence, After Time X, managed to get in contact with the team behind it all. According to them, they were offered a review unit of the Mig Switch, but turned it down, as the After Time X team fears legal repercussions from dealing with "backup loader" hardware.

Another interesting tidbit is that existing dumps of Switch games will NOT be compatible with the Mig Switch, and backups will need to be repacked to function with the flashcart. Games played with the flashcart can be played online, as well.

The Mig Switch currently has a website, where it is seeking distributors to work together with in order to sell initial limited quantities of the Mig Switch device, with the first units to be delivered sometime in January. The team claims that full availability is expected around March/April 2024. It'll come with the Mig Switch card, and the Mig Switch Dumper, with the latter of which allowing you to back up your games using NXdumpTool.

More Details Has Been Uncovered About the First Switch Flashcart

After some digging around by our @AfterTimeX journalists, it was discovered that the “Switch Flashcart” in fact has a name, “Mig Switch” and they agreed to answer a few of our questions about some points that… pic.twitter.com/kQtXdSNg7E

— After Time X (@AfterTimeX) December 27, 2023

Official Website

 

[Blythe93]

Imagine the guy who has the job of sanding all those chips down to hid they're markings.

I really hope that whoever is doing that skips one or two to make it easier for people to reverse-engineer the whole thing and let the clones appear all over the place.

 

[ghjfdtg]

Nah, don't say that. Nintendo uses a browser that eventually will be suspect to a webkit vulnerability. However the Tegra Trustzone is the real problem. The modchip still relies on RCM mode and the Picofly trains itself to trigger the reset within fractions of a second. The other way to hack a Switch will most likely come from a chained attack just like the Vita. So a bug in an emulator (for example the SNES emulator on Switch) will lead to an exploit with priviledge escalation to the whole system.

But there are many more attack surfaces like we have seen over the years. On Wii there were DNS problems, on Wii Mini a Bluetooth protocol failure, on WiiU the FailST bug.

The real challenge is the Xbox One. Not a single hack has been done. The Xbox360 is also very strong, with RGH3 it's close but still a hardware mod. Xbox security has been very very tight. Eventually like with the OG Xbox a drop in solution will be developed like Project Stellar. We saw it also with the PS3. The Superslim is the only console that is still not able to run permanent custom firmware. Even the PSP has now the bootrom dumped, there is a way to unbrick them with the Baryonsweeper batteries and custom firmware can come. If PSP is eventually hacked 20 years after release, I'm sure the Switch will. Maybe just a software hack that will be patched by Nintendo, but it will be hacked by a softmod.

On Playstation we also saw that only signed executables ran, after the masterkey was found they could make signed executables. Recently also a DSi Modchip was announced by someone which is under 30 years old. So the knowledge is there, the tech is there. It just needs to be in the right hands, with the right amount of time and the right intention. Do not forget that there are much heavier fortified structures the world has. Banks, airplanes, etc. The Switch Lite is after all just a souped up Tegra phone. It doesn't have the same security like an ATM has.

You don't know the security system on the Switch so don't act like a softmod is inevitable. Atmosphere needs TrustZone level of access and SciresM reverse engineered all of it. Zero vulnerabilities. Not surprising because the TZ code is tiny. Nintendo knows TZ is secure as is and will avoid any major code changes.

Get a chip and enjoy CFW. That is the only option and will remain the only option until we have access to quantum computers capable of breaking RSA.

 

[impeeza]

You don't know the security system on the Switch so don't act like a softmod is inevitable. Atmosphere needs TrustZone level of access and SciresM reverse engineered all of it. Zero vulnerabilities. Not surprising because the TZ code is tiny. Nintendo knows TZ is secure as is and will avoid any major code changes.

Get a chip and enjoy CFW. That is the only option and will remain the only option until we have access to quantum computers capable of breaking RSA.

He may be not but some really smart guys are and they are SO SURE a new software attack is nearly impossible

Post automatically merged: Feb 7, 2024

On a close time frame, may be on some centuries every crypto a nd security measure will render invalid but...

 

[ber71]

The system may be totally bug free in its implementation, but not 100% secure.
There could be severe flaws at the design level. Some component, some message, some signature... may be used in a way not mean to be, which will allow for code execution and privilege escalation. There are plenty of examples of these kind of design flaws in the past.

 

[MountainMan23]

We might be the first reseller to receive them as we are in the Russian federation, so I just wanted to share those pictures. They sent them to us unassembled, so we will start to ship to our preorders only Wednesday we believe. So first Russian customers will soon be able to give you more reviews and feedback.
We did not know they were coming like that, but no big deal, just a bit of work.

What a lazy joke! So the shipping process will take even longer now. Might as well ship it as is unasembeled to everyone.

 

[theo400]

The system may be totally bug free in its implementation, but not 100% secure.
There could be severe flaws at the design level. Some component, some message, some signature... may be used in a way not mean to be, which will allow for code execution and privilege escalation. There are plenty of examples of these kind of design flaws in the past.

Almost all CFW for past systems was originated as a flaw in legitimate software. OOT save file injection, banner bomb.... it's not a matter of breaking the OS, it's getting code to run through valid software most of the time.

 

[SylverReZ]

View attachment 418754

I can still recognize what chips these are. Some of them don't have the markings completely sanded out.

I guess that solves our theory.

@BigOnYa @impeeza

 

[linuxares]

I can still recognize what chips these are. Some of them don't have the markings completely sanded out.

I guess that solves our theory.


View attachment 419022

View attachment 419025

@BigOnYa @impeeza

A person already figured it out like instantly, it's on Twitter with Hekxyz

 

[SylverReZ]

A person already figured it out like instantly, it's on Twitter with Hekxyz

Saw the thread already. Guess the manufacturer who made these couldn't be bothered to laser etch away the markings on the chip, instead scrubbing them off with a fibre-glass pen.

 

[linuxares]

Saw the thread already. Guess the manufacturer who made these couldn't be bothered to laser etch away the markings on the chip, instead scrubbing them off with a fibre-glass pen.

It's expensive and hard to do lasers in "Russia"

 

[User_84628]

so how fast do you think until we see knock offs?

 

[linuxares]

so how fast do you think until we see knock offs?

As soon as someone cracks the software it's maybe just a weeks or max months for knock offs

 

[pinkbeetle]

I can still recognize what chips these are. Some of them don't have the markings completely sanded out.

I guess that solves our theory.


View attachment 419022

View attachment 419025

@BigOnYa @impeeza

Those appear to be lattice ICE40UP5 and Expressive ESP32S2, the retail for both of them together is about 11$, if bought in large quantities it would be much much less . I am monitoring taobao day and night to spot knockoffs for these.

 

[SylverReZ]

Those appear to be lattice ICE40UP5 and Expressive ESP32S2, the retail for both of them together is about 11$, if bought in large quantities it would be much much less . I am monitoring taobao day and night to spot knockoffs for these.

Then again, you'd also need to spend the amount of money for the programmers too.

 

[BigOnYa]

It would be funny to see a clone come out, before the Mig even ships out to customers. Pirates pirating piracy.

 

[rayida]

It would be funny to see a clone come out, before the Mig even ships out to customers. Pirates pirating piracy.

That might even be part of the plan.

 

[W00fer]

You don't know the security system on the Switch so don't act like a softmod is inevitable. Atmosphere needs TrustZone level of access and SciresM reverse engineered all of it. Zero vulnerabilities. Not surprising because the TZ code is tiny. Nintendo knows TZ is secure as is and will avoid any major code changes.

Get a chip and enjoy CFW. That is the only option and will remain the only option until we have access to quantum computers capable of breaking RSA.

RSA was broken on the DSi on 37c3. See the video.

 

[impeeza]

RSA was broken on the DSi on 37c3. See the video.

https://media.ccc.de/v/37c3-11736-nintendo_hacking_2023_2008

Post automatically merged: Feb 11, 2024

Of course with the pass of time and improvement of computer power any key will be cracked "Easily"

today 128 bits blobs can be cracked on any house pc in minutes. back on the days when that was standard a IBM powerfull computer take 1 or 2 years to cracke a 128 bits cypher, so.

 

[ghjfdtg]

RSA was broken on the DSi on 37c3. See the video.

No. Watch again.

Side note:
The private key for ntrboot on the DSi leaked along with the gigaleaks. This is unrelated to what was shown in the 37c3 presentation.

 

[Bladexdsl]

It's expensive and hard to do lasers in "Russia"

nah SPEWtin just took them all to put on his laser guided missiles and laser scopes