ROM Hack Question Could the files found in /Nintendo/save/ on the microSD card hold any relevance to Switch hacking?

[Xplic1T]

You could compare 2 saves from the same game from different consoles and do a dif check to see which text characters were different ... and which text characters were the same. Also may have to do the same with a hex converter. Doubt this will go anywhere though.

 

[The Real Jdbye]

I'd love to, but I'm concerned that these files may have some sort of personally identifiable information on them; Given that they're unique per-console (from what I've seen), it wouldn't be too much of a stretch. The files are too large to go over manually (there's a lot more in 8000000000000124), so I'm not sure how I'd make sure they don't contain any identifiable information.

It's a Switch, how much personally identifiable information could there be? Doubt they'd store your Nintendo account information or credit card info in plaintext

 

[Alkéryn]

It's a Switch, how much personally identifiable information could there be? Doubt they'd store your Nintendo account information or credit card info in plaintext

The only information we would get is hw ones if it is switch related so even if that might be interesting it is useless for hacking

 

[DerpyEagle]

It's a Switch, how much personally identifiable information could there be? Doubt they'd store your Nintendo account information or credit card info in plaintext

Fair enough. I still don't want to share the files in their entirety, but attached is the output of strings for the two files.
strings000.txt is the output for 8000000000000000, and strings124.txt is the output for 8000000000000124.
These files should contain all the plaintext. It's interspersed between data that was mistakenly recognised as strings, but there's so much of it that I haven't got the time to remove it all. Scroll through the files for a bit or do a find to look around; Most of the interesting stuff is in strings124.txt.

strings124.txt was too large to upload here, so I've put it on mixtape.moe, here.

A lot of the stuff in that does seem to be rPi-related, although I'm not sure why. Can anyone compare their own files and see if they contain the same strings?

 

[kylemsguy]

As in the files weren't there, or they weren't the same? I just found the files on my SD card, so I'm not sure what exactly caused them to appear or if the process can be replicated.

The files were there, but running strings on them returned a ton of garbage, similar to what you have uploaded. However, i didn't see any of the strings such as those in the file you uploaded. In particular, the latter file (8000000000000124) was much shorter than yours.

 

[The Real Jdbye]

Fair enough. I still don't want to share the files in their entirety, but attached is the output of strings for the two files.
strings000.txt is the output for 8000000000000000, and strings124.txt is the output for 8000000000000124.
These files should contain all the plaintext. It's interspersed between data that was mistakenly recognised as strings, but there's so much of it that I haven't got the time to remove it all. Scroll through the files for a bit or do a find to look around; Most of the interesting stuff is in strings124.txt.

strings124.txt was too large to upload here, so I've put it on mixtape.moe, here.

A lot of the stuff in that does seem to be rPi-related, although I'm not sure why. Can anyone compare their own files and see if they contain the same strings?

Wtf is this. There are direct mentions of Raspberry Pi in several locations in strings124.txt. Any chance the Switch has a Raspberry Pi embedded in it?
Edit: I think this may be some leftover data from when it was used in a Raspberry Pi that the Switch for some reason found and saved into that file. The folder name "save" could be referring to it being used to save recovered data that doesn't belong to a file from file system scanning (like the lost+found directory in Linux, and the FOUND.000, .001 and so on in Windows)

 

[DerpyEagle]

The files were there, but running strings on them returned a ton of garbage, similar to what you have uploaded. However, i didn't see any of the strings such as those in the file you uploaded. In particular, the latter file (8000000000000124) was much shorter than yours.

That's pretty much exactly what I got when I generated new files on a fresh SD card. I'm not sure what caused the plaintext to be placed in my files on the original SD card.

Wtf is this. There are direct mentions of Raspberry Pi in several locations in strings124.txt. Any chance the Switch has a Raspberry Pi embedded in it?

Doubt it, but I really have no idea why they're there. The rPi isn't powerful enough to be used as a development board, so the only thing I can think of is an rPi being used as a buildbot? Even so, that's highly unlikely, as Nintendo proabaly has an actual computer as a buildbot.

 

[The Real Jdbye]

That's pretty much exactly what I got when I generated new files on a fresh SD card. I'm not sure what caused the plaintext to be placed in my files on the original SD card.

Doubt it, but I really have no idea why they're there. The rPi isn't powerful enough to be used as a development board, so the only thing I can think of is an rPi being used as a buildbot? Even so, that's highly unlikely, as Nintendo proabaly has an actual computer as a buildbot.

I think this may be some leftover data from when it was used in a Raspberry Pi that the Switch for some reason found and saved into that file. The folder name "save" could be referring to it being used to save recovered data that doesn't belong to a file from file system scanning (like the lost+found directory in Linux, and the FOUND.000, .001 and so on in Windows)
I wonder though, after you erased the card and let the Switch recreate the files, do they still contain any interesting strings?
None of the data seems obviously Switch related, so it doesn't seem like it's data belonging to the Switch at all.

 

[DerpyEagle]

I think this may be some leftover data from when it was used in a Raspberry Pi that the Switch for some reason found and saved into that file. The folder name "save" could be referring to it being used to save recovered data that doesn't belong to a file from file system scanning (like the lost+found directory in Linux, and the FOUND.000, .001 and so on in Windows)
I wonder though, after you erased the card and let the Switch recreate the files, do they still contain any interesting strings?
None of the data seems obviously Switch related, so it doesn't seem like it's data belonging to the Switch at all.

I didn't erase the card, but I formatted a different card (same model and size, though) and put it in. The files the Switch created on the "fresh" card did not contain any of the strings in the other files.

 

[Xplic1T]

I didn't erase the card, but I formatted a different card (same model and size, though) and put it in. The files the Switch created on the "fresh" card did not contain any of the strings in the other files.

The strings aren't stored in plain text but most likely in hex. Thus meaning 1 space off the total string data could produce a completely different set of resulting hex values.

 

[GerbilSoft]

The strings aren't stored in plain text but most likely in hex. Thus meaning 1 space off the total string data could produce a completely different set of resulting hex values.

...what do you mean "in hex"? Text strings are just sequences of bytes. It's either there or it isn't.

 

[Alkéryn]

...what do you mean "in hex"? Text strings are just sequences of bytes. It's either there or it isn't.

Plain text don't equal hex but
i think what he meant is that if you have one bit more in the begining, the rest could be shifted and look like garbage
but it don't really work like that so i don't know what he meant

 

[Selver]

... this particular SD card probably has seen a rPi, the Switch formatted it before use, and it hasn't been in a rPi after that.

I also still haven't used this SD card with a pi since formatting it with my Switch, and I haven't modified any files from my computer, so all the files on the card are ones the Switch has placed there. Plus I don't think the rPi would store its crash dumps in /Nintendo/saves.

I formatted a different card (same model and size, though) and put it in. The files the Switch created on the "fresh" card did not contain any of the strings in the other files.

Hi DerpyEagle,

It's a fluke event. Here's an explanation that is as simple as I can make it.

1. The SD card was previously used in a RPi. The RPi stored data on the SD card.
For sake of explanation, let's say the layout was as follows:
Sectors 0-99 == File system (list of directories and where to find files), with pionters to sectors 100-199 for file FOO.TXT
Sectors 100-199 == the data of file FOO.TXT

2. The SD card was then "formatted", which only clears the file system.
For sake of explanation:
Sectors 0-99 == File system, with sectors 100-199 showing as "free" ... available for use by the next file to be created... no "FOO.TXT" file exists anymore
Sectors 100-199 == Still contains the data of the old file FOO.TXT (format does not overwrite data... it'd take really long time...)

3. The SD card was then used by the Switch, and it created the files you noted. When allocating space for that file, it included sectors 100-199, as they were showing as "Free space" in the file system.
For sake of explanation:
Sectors 0-99 == File system, now with sectors 100-199 showing as "used" as part of the file 8000000000000000 etc.
Sectors 100-199 == Still contains the data of the old file FOO.TXT

4. the Switch writes to sectors 100-149 when writing to file 8000000000000000.
For sake of explanation:
Sectors 0-99 == File system, now with sectors 100-199 showing as "used" as part of the file 8000000000000000 etc.
Sectors 100-149 == now contain new, switch-specific encrypted data
Sectors 150-199 == Still contains (part of) the data of the old file FOO.TXT

5. User runs strings on the files that appear on the SD card, and finds unencrypted data with interesting strings.

This also explains why, when you put a different (clean) SD card into the system, no unencrypted strings appeared in those two files. Sorry, but it appears that you just found old data because the switch didn't use all the space in the file... it just allocated it ahead of time.

 

[Alkéryn]

Hi DerpyEagle,

It's a fluke event. Here's an explanation that is as simple as I can make it.

1. The SD card was previously used in a RPi. The RPi stored data on the SD card.
For sake of explanation, let's say the layout was as follows:
Sectors 0-99 == File system (list of directories and where to find files), with pionters to sectors 100-199 for file FOO.TXT
Sectors 100-199 == the data of file FOO.TXT

2. The SD card was then "formatted", which only clears the file system.
For sake of explanation:
Sectors 0-99 == File system, with sectors 100-199 showing as "free" ... available for use by the next file to be created... no "FOO.TXT" file exists anymore
Sectors 100-199 == Still contains the data of the old file FOO.TXT (format does not overwrite data... it'd take really long time...)

3. The SD card was then used by the Switch, and it created the files you noted. When allocating space for that file, it included sectors 100-199, as they were showing as "Free space" in the file system.
For sake of explanation:
Sectors 0-99 == File system, now with sectors 100-199 showing as "used" as part of the file 8000000000000000 etc.
Sectors 100-199 == Still contains the data of the old file FOO.TXT

4. the Switch writes to sectors 100-149 when writing to file 8000000000000000.
For sake of explanation:
Sectors 0-99 == File system, now with sectors 100-199 showing as "used" as part of the file 8000000000000000 etc.
Sectors 100-149 == now contain new, switch-specific encrypted data
Sectors 150-199 == Still contains (part of) the data of the old file FOO.TXT

5. User runs strings on the files that appear on the SD card, and finds unencrypted data with interesting strings.

This also explains why, when you put a different (clean) SD card into the system, no unencrypted strings appeared in those two files. Sorry, but it appears that you just found old data because the switch didn't use all the space in the file... it just allocated it ahead of time.

I don't know what you meant by "fluke" event, don't know that word
though i didn't thought about it happening
generally when i format cards i wipe them as well with zeros so i didn't thought about it then xD

 

[Toni456]

I'm concerned that these files may have some sort of personally identifiable information on them

If these are simple files left on the sd card and not obtained via hacking then it doesn't matter what kind of information these files have there is no risk of been hacked or banned unless they literally had your username/password, you're just been paranoid lol

 

[Sketchy1]

I couldn't find anything about these on switchbrew, so I figure here's a good place to ask. I was looking around the files that the Switch leaves on the microSD card, and I noticed the /save/ directory had two files in it. These files have some plaintext in them: 8000000000000000 contains a build date, as well as some other information:

283x
283X
270X
DDTK
DTOKLinux version 4.4.34+ (dc4@dc4-XPS13-9333) (gcc version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611) ) #930 Wed Nov 23 15:12:30 GMT 2016
KVer
RPTL

A little farther in the file is what looks to be compiler messages:

 -- System halted
Attempting division by 0!
stack-protector: Kernel stack is corrupted
Uncompressing Linux...
decompressor returned an error
 done, booting the kernel.
invalid distance too far back
invalid distance code
invalid literal/length code
incorrect header check
unknown compression method
invalid window size
invalid block type
invalid stored block lengths
too many length or distance symbols
invalid code lengths set
invalid bit length repeat
invalid literal/lengths set
invalid distances set
incorrect data check
Out of memory while allocating output buffer
Out of memory while allocating input buffer
Out of memory while allocating z_stream
Out of memory while allocating workspace
Not a gzip file
header error
read error
uncompression error

There's also another file, 8000000000000124, which contains a lot more plaintext regarding everything from graphics shaders, as well as some interesting strings regarding an imx219 camera module:

imx219_open
%s: state->standby. %d
--> imx219 camera driver open
<-- imx219 camera driver open
%s: No camera module found, check camera module is present and is the correct part!
../../../../../vcfw/drivers/device/camera/imx219.c

imx219_read_cal
imx219 read cal
imx219_read_cal OK
f rom pan cal          value: %d
f rom act cal macro    value: %d
f rom act cal infinity value: %d
imx219_read_cal f rom device not present
Failed to read calibration data from f rom, result: %d
imx219_read_reg

A lot of the stuff in this file seems to be video-related, as other strings also concern HDMI output, as well as HDR support. I honestly have no idea if any of this is of any use in current or future switch haxxing efforts, but I figured it'd be worth posting about. Is any of the information in these files useful to haxxing efforts?

If you're interested in looking yourself, these files can be found in the /Nintendo/save/ directory on an inserted microSD card.

Most likely worthless, because at the end of the day it's still encrypted, and even if it's decrypted magically without the console, we would have trouble with the switch actually accepting the edited save

 

[studio1b]

i took a brand new card placed in the switch i opened the 8000000000000124 file and i found : res/drawable-xxxhdpi-v4/zw02.qmg

 

[Nagarjuna]

i took a brand new card placed in the switch i opened the 8000000000000124 file and i found : res/drawable-xxxhdpi-v4/zw02.qmg

Can you open it in notepad and do a ctrl f for "Rasp"? Im about to get my card and put it in.

I didn't erase the card, but I formatted a different card (same model and size, though) and put it in. The files the Switch created on the "fresh" card did not contain any of the strings in the other files.

Did the Raspberry Pi that touched the card ever have the camera module?

 

[studio1b]

Can you open it in notepad and do a ctrl f for "Rasp"? Im about to get my card and put it in.


Did the Raspberry Pi that touched the card ever have the camera module?

res/drawable-xxxhdpi-v4/zw02.qmg does not have anything to do with a Pi

 

[Nagarjuna]

res/drawable-xxxhdpi-v4/zw02.qmg does not have anything to do with a Pi

Sorry, I meant if anywhere else in the file is there references to a RaspPi

Edit: Looked at mine and found nothing related to a Raspberry Pi. Looks like its just you, OP