Hardware Hacking Fake RCMloader dongles in the wild

[binkinator]

This one looks cool…never seen it in the wild though.

 

[Lamcza]

This one looks cool…never seen it in the wild though.

View attachment 341782

mehh cool it will be cool if I can prove to the seller that i got a fake one becouse a working fake one is even better than the original when its free xD

 

[SylverReZ]

This one looks cool…never seen it in the wild though.

View attachment 341782

I have. It went under the name AceNS.

 

[binkinator]

I have. It went under the name AceNS.

Found some old threads by searching for AceNS

https://gbatemp.net/threads/xkits-rcm-clip-dongle-jig-is-10.518090/

Before my time! :-o

 

[gavinlai]

My rcm loader is white box, it can update payload.bin via micro usb connect to PC, don't use type-c connect to PC.

If your rcm loader can not use. I suggest format the loader drive, and then extract the package file to drive and update the payload.bin file.

 

[warriosbest]

multiple as yellow, memgenta and cyan ?

Forget to ask you boys have that plastick bag ones or later white box?

here

 

[Lamcza]

here

yea that colors/profiles are working fine for me too if you want to check it put some payload in any of user folders

My rcm loader is white box, it can update payload.bin via micro usb connect to PC, don't use type-c connect to PC.

If your rcm loader can not use. I suggest format the loader drive, and then extract the package file to drive and update the payload.bin file.

what xD now i want to try that type c connection to my pc

but if you are talking to me, again i dont have any problems with payloads the problem is in user profiles/folders so it looks like it is firmware of the loader itself so no format of internal memory will help in here but anyway i was trying that also yesterday

 

[Kallim]

I gave a mate mine and bought another from Ali Express. ITs a fake.... If you class it as a fake there are loads of these and quite a lot are different to some degree. Some let you change the folder names some don't etc.

This one doesn't seem to have any flash memory. All these posts about putting the payloads in the user folders isn't going to work... it simply won't recognise the US?B device.

It however does always seem to boot into the latest version of hkate. I'm not sure how if it had an internal .bin file it'd get the error with dragons (Out of date bin file). I'm wondering if its using the bin file in the hekate folder itself on the SD card??

 

[binkinator]

I gave a mate mine and bought another from Ali Express. ITs a fake.... If you class it as a fake there are loads of these and quite a lot are different to some degree. Some let you change the folder names some don't etc.

This one doesn't seem to have any flash memory. All these posts about putting the payloads in the user folders isn't going to work... it simply won't recognise the US?B device.

It however does always seem to boot into the latest version of hkate. I'm not sure how if it had an internal .bin file it'd get the error with dragons (Out of date bin file). I'm wondering if its using the bin file in the hekate folder itself on the SD card??

Probably a payload that takes advantage of this:



Can you try something real quick? Temporarily replace /payload.bin (if it exists) with lockpick_RCM.bin.

This will see if it will pick it up and autoboot whatever is in /payload.bin or if it’s only looking for Hekate.

 

[Kallim]

Probably a payload that takes advantage of this:

View attachment 342783

Can you try something real quick? Temporarily replace /payload.bin (if it exists) with lockpick_RCM.bin.

This will see if it will pick it up and autoboot whatever is in /payload.bin or if it’s only looking for Hekate.

When you connect to a pc with one of these "fakes" it just says device not recognised. So I can't check and it'll always load Hekate.

I'll check later if loading an earlier version of Hekate from a pc still brings up the error with dragons. It used to do that (last checked about 6 months ago).

I have previously had 2 other models of RCM loader which let you launch whatever payload you wanted as long as it was called payload.bin.

I gave these to a friend and my brother when I modded their switch (I used my phone temporarily).

The other 2 devices were actually different to each other. On one you could rename the folders and the device would cycle them alphabetically and launch the payload.

On the other of you renamed a folder the payload launcher wouldn't see or use that folder.

I imagine there's a lot more than just 3 variants. And the photo you showed me is different again.... But that's probably more information than anyone needs to know about RCM loaders.

It shouldn't matter for most people. If you can get in Hekate the payloads are usually in the bootloader/payloads (or if not it's a good idea to put them there) folder so you can launch anything from there.

 

[impeeza]

dude i know iam asking if you can try it from your rcm loader lets say put any payload in user1 and boot it

With original RCM Loaders you can as easy as press a button.

with the "V5" clones on the wild that function is broken and you only can inject the first payload.

 

[SylverReZ]

with the "V5" clones on the wild that function is broken and you only can inject the first payload.

That's something that I am not aware of.

 

[Kallim]

Ok. So I did some more investigating.

The actual file on the RCM loader you can't access is for Hekate 5.8 (I'm currently on 5.9). There are no other payloads on this RCM loader just one (and I can't change it or try any others).

I only found this out because I replaced update.bin with fusee.bin in the Hekate folder.

It didn't launch fusee it just booted straight into Hekate 5.8. now what appears to be happening is it's booting a little slower once I restore the update.bin file. Obviously it's taking about a second for Hekate to check, then realise it's an older payload hence the delay.

To be honest I prefer the other RCM loaders.... But these are sort of fool proof of you've hacked a kids switch you can chainload atmosphere and use the aio updater so they may be better for someone with no knowledge or no PC etc. But for anyone in this forum I'd think the others are better.

Even for kids the others may be better. I'm not sure id trust a kid not to mess with the Hekate settings.... so you'd need to chainload cfw.

You also couldn't use auto rcm because then you'd stop them using ofw if you chainload fusee (assuming they play legit stuff online).

 

[Lamcza]

With original RCM Loaders you can as easy as press a button.

with the "V5" clones on the wild that function is broken and you only can inject the first payload.

yea but this is not true ; ) you can easily load 3 different payloads(you cant push anything into user folders) ofc iam writing about my rcm loader

I think that they are not even fake(not all of them ofc) they are just second versions with broken firmware from the already dead company.
Maybe someone who has v2 original(whitebox) one that can update the firmweare by app not by files in memory can confirm that he has fully working 6 profiles/folders?


its good that i only need one folder/profile xD

 

[impeeza]

yea but this is not true ; ) you can easily load 3 different payloads(you cant push anything into user folders) ofc iam writing about my rcm loader

I think that they are not even fake they are just second versions with broken firmware from the already dead company.
Maybe someone who has v2 original(whitebox) one that can update the firmweare by app not by files in memory can confirm that he has fully working 6 profiles/folders?

Hi, as published before, I have a V1 original (transparent plastic box) and a fake "V5" from Aliexpress.

For the original you can put 6 different payloads on each folder (ATMOSPHERE_HEKATE, REINX, SXOS, USER1, USER2, USER3,) and select any of them pressing the button with no problem. (look the table on https://www.xkit.xyz/rcmloader/)

For the "V5", the firmware is broken and even if you can copy payloads to all folders, the "selection" process is bug and almost never you know which payload really will be injected, you can press the button and the color will change but always the blue LED is shown when injecting the payload even if the injected one is not the one on the ATMOSPHERE_HEKATE folder.

That's why for these "new" RCM Loaders I recommend to use ArgonNX-SE (https://github.com/Storm21CH/ArgonNX-SE/releases & https://gbatemp.net/threads/argonnx-se-payload-with-mariko-and-aula-oled-support.581956/) so you always know what is injecting the RCM Loader, and you can chainload any payload you want, including Hekate and with Hekate's NYX you can also chainload any payload. and the update process is simpler, you update your payloads on the MicroSD no need to mess with the RCM Loader.

 

[Lamcza]

Hi, as published before, I have a V1 original (transparent plastic box) and a fake "V5" from Aliexpress.

For the original you can put 6 different payloads on each folder (ATMOSPHERE_HEKATE, REINX, SXOS, USER1, USER2, USER3,) and select any of them pressing the button with no problem. (look the table on https://www.xkit.xyz/rcmloader/)

For the "V5", the firmware is broken and even if you can copy payloads to all folders, the "selection" process is bug and almost never you know which payload really will be injected, you can press the button and the color will change but always the blue LED is shown when injecting the payload even if the injected one is not the one on the ATMOSPHERE_HEKATE folder.

That's why for these "new" RCM Loaders I recommend to use ArgonNX-SE (https://github.com/Storm21CH/ArgonNX-SE/releases & https://gbatemp.net/threads/argonnx-se-payload-with-mariko-and-aula-oled-support.581956/) so you always know what is injecting the RCM Loader, and you can chainload any payload you want, including Hekate and with Hekate's NYX you can also chainload any payload. and the update process is simpler, you update your payloads on the MicroSD no need to mess with the RCM Loader.

There is also the original one v2 ("one plus" on firmware 2.02) in the white box ;P that one you can update only by app


Again no or maybe in your case . You have some broken or totally fake one ; P

In my loader color matched the selected profile on injection and it injects different payloads because i tried 3 stock ones on the second i get a black screen on the third i get some red text on the switch that I am missing some part to boot it on first i was normally loaded to hekate and i was trying to boot it from all 3 profiles i mean all 6 but only first 3 are working fine


Mine can even successfully run an update from xkit in app. So either it is a good fake one or just a firmware of v2 is quacked.

Just now i boot that argonx x from profile 2 green and then i boot hekate on profile 1 blue no problemo.

If somone looks for a good enough one that has 3 working profiles out of 6, normal reset button and can be formated.
https://www.aliexpress.com/item/100...o.order_list.order_list_main.5.2082180206gYvS
i buy it here it has bulid in memory and payloads in 3 first folders can be swapped so far without a problem.

Iam not saying that but since it is kinda broken(only 3 profiles out of 6 are usable) xD you can get solid refound out of it also xD

 

[Kallim]

Hi, as published before, I have a V1 original (transparent plastic box) and a fake "V5" from Aliexpress.

For the original you can put 6 different payloads on each folder (ATMOSPHERE_HEKATE, REINX, SXOS, USER1, USER2, USER3,) and select any of them pressing the button with no problem. (look the table on https://www.xkit.xyz/rcmloader/)

For the "V5", the firmware is broken and even if you can copy payloads to all folders, the "selection" process is bug and almost never you know which payload really will be injected, you can press the button and the color will change but always the blue LED is shown when injecting the payload even if the injected one is not the one on the one ATMOSPHERE_HEKATE folder.

That's why for these "new" RCM Loaders I recommend to use ArgonNX-SE (https://github.com/Storm21CH/ArgonNX-SE/releases & https://gbatemp.net/threads/argonnx-se-payload-with-mariko-and-aula-oled-support.581956/) so you always know what is injecting the RCM Loader, and you can chainload any payload you want, including Hekate and with Hekate's NYX you can also chainload any payload. and the update process is simpler, you update your payloads on the MicroSD no need to mess with the RCM Loader.

I had that problem with one of my RCM loaders... But I did get it working. Here's what I did.... But I don't see why this would work or if it will for anyone else.

I copied all the files to my pc. Reformatted the RCM loader to fat32 and then reformatted to fat.

I then put all the folders back on the device apart from one.

I can't remember the name of the folders I left off but it was one of the txt (maybe ini) files. It had the default folder (alphabetically this was the third folder I think it was the remix folder?).

When I removed the device it allowed me to cycle the folders using the + button.

I then restored the text file but edited it and pointed it to a different folder and it worked.

I'm not sure if that'll help anyone... But it worked for me.

Post automatically merged: Dec 15, 2022

This is going to sound like the stupidest question ever but....

Is there a payload to launch ofw?

It's actually more useful than you'd first think. I've modded a switch for a child who has my old RCM loader. The only payload I put on is fussee. He simply turns on (auto RCM enabled) and plugs in the RCM loader.

What I'm thinking is if I add an ofw payload say "ofw.bin" he can use that.... But I doubt there's much call for one.

I don't really want to put Hekate on the RCM loader where you can just reboot ofw. I think he'd mess with the nand etc.

How hard would it be to write one? Is there an editor?

Post automatically merged: Dec 15, 2022

I had that problem with one of my RCM loaders... But I did get it working. Here's what I did.... But I don't see why this would work or if it will for anyone else.

I copied all the files to my pc. Reformatted the RCM loader to fat32 and then reformatted to fat.

I then put all the folders back on the device apart from one.

I can't remember the name of the folders I left off but it was one of the txt (maybe ini) files. It had the default folder (alphabetically this was the third folder I think it was the remix folder?).

When I removed the device it allowed me to cycle the folders using the + button.

I then restored the text file but edited it and pointed it to a different folder and it worked.

I'm not sure if that'll help anyone... But it worked for me.

Post automatically merged: Dec 15, 2022

This is going to sound like the stupidest question ever but....

Is there a payload to launch ofw?

It's actually more useful than you'd first think. I've modded a switch for a child who has my old RCM loader. The only payload I put on is fussee. He simply turns on (auto RCM enabled) and plugs in the RCM loader.

What I'm thinking is if I add an ofw payload say "ofw.bin" he can use that.... But I doubt there's much call for one.

I don't really want to put Hekate on the RCM loader where you can just reboot ofw. I think he'd mess with the nand etc.

How hard would it be to write one? Is there an editor?

One other thing once I'd formatted the RCM loader I noticed the colour was different. The ini file pointed to the third folder. Without that ini file it simply cycles alphabettically.

When the colour changed after formatting I realised I was part way to fixing it (even though no folders were on it at that time).

 

[impeeza]

Tempers confirmed, the fake V5 RCM Loaders from Aliexpress CAN NOT inject Hekate 6.0.1 payload, however, can inject Hekate 6.0.0.

IS NOT A HEKATE's issue is the broken firmware. My V1 (Plastic box) works just fine with Hekate 6.0.1 payload.

that is why I do recommend to use ArgonNX-SE on the fake ones.

 

[SylverReZ]

Tempers confirmed, the fake V5 RCM Loaders from Aliexpress CAN NOT inject Hekate 6.0.1 payload, however, can inject Hekate 6.0.0.

IS NOT A HEKATE's issue is the broken firmware. My V1 (Plastic box) works just fine with Hekate 6.0.1 payload.

that is why I do recommend to use ArgonNX-SE on the fake ones.

Yes, I was gonna say. I have no problems with injecting a payload on my V2 (plastic box) model.

 

[iepuras]

Tempers confirmed, the fake V5 RCM Loaders from Aliexpress CAN NOT inject Hekate 6.0.1 payload, however, can inject Hekate 6.0.0.

IS NOT A HEKATE's issue is the broken firmware. My V1 (Plastic box) works just fine with Hekate 6.0.1 payload.

that is why I do recommend to use ArgonNX-SE on the fake ones.

oh, so it’s not like with the 5.9.0 where you delete everything and then just drop the folders with updated payloads back on? that worked for my fake model when 5.9.0 dropped and I could not inject properly