Hacking the Switch through the Album?

Discussion in 'Switch - Hacking & Homebrew' started by Jackson Ferrell, Jun 9, 2017.

  1. GerbilSoft

    GerbilSoft GBAtemp Addict

    Member
    2,103
    2,341
    Mar 8, 2012
    United States
    HMAC = Hash-based message authentication code. Basically, you use a standard hash function, but add in a secret key. Nintendo DSi uses SHA1-HMAC for banners, which is why DSi-compatible flash carts use banners from licensed games instead of their own games.

    RSA signature = using RSA public key cryptography to create a signature that validates the contents of some file. Usually this is done by taking a hash of the contents and then encrypting the hash using the RSA private key. The signature can be verified by decrypting the hash with the public key and comparing that hash with the actual hash. RSA signatures are used by the DSi and 3DS for virtually everything.

    As far as I know, there are no general-purpose cracks for RSA signatures other than brute-force. However, that's assuming the implementation is working. The 3DS Boot ROM signature hax was only possible because the Boot ROM's RSA verification function is broken. (The main FIRM RSA verification is correct, though.)
     
  2. blujay

    blujay GBATemp's Official Warthog

    Member
    GBAtemp Patron
    blujay is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    2,206
    2,051
    Nov 2, 2015
    United States
    Gilbert, Arizona
    Alrighty! Thanks for letting me know. I'm assuming these things are stored outside of the image?
     
  3. GerbilSoft

    GerbilSoft GBAtemp Addict

    Member
    2,103
    2,341
    Mar 8, 2012
    United States
    I haven't checked yet, but it may or may not be. The signature and/or HMAC could be in some EXIF tags, or simply appended to the file, or stored in some extra database file somewhere.

    The secret keys are definitely not stored in the image, though.
     
  4. xXxSwagnemitexXx

    xXxSwagnemitexXx The person who asks n00b questions

    Member
    348
    84
    Dec 7, 2016
    United States
    Somewhere
    I was gonna say, maybe the hash is stored in the extra 44 bytes
     
  5. sarkwalvein

    sarkwalvein More coffee, please!

    Member
    GBAtemp Patron
    sarkwalvein is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    5,206
    5,553
    Jun 29, 2007
    Germany
    Niedersachsen
    Yes, in the Maker notes EXIF.
     
  6. blujay

    blujay GBATemp's Official Warthog

    Member
    GBAtemp Patron
    blujay is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    2,206
    2,051
    Nov 2, 2015
    United States
    Gilbert, Arizona
    Did you confirm this? I was still a little confused about everything...
     
  7. sarkwalvein

    sarkwalvein More coffee, please!

    Member
    GBAtemp Patron
    sarkwalvein is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    5,206
    5,553
    Jun 29, 2007
    Germany
    Niedersachsen
    Not confirmed that it is a hash or anything.
    But after checking the header, the only part that changes consistently between files and could contain a hash is this.
     
  8. blujay

    blujay GBATemp's Official Warthog

    Member
    GBAtemp Patron
    blujay is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    2,206
    2,051
    Nov 2, 2015
    United States
    Gilbert, Arizona
    Alright. Thanks for letting me know. I have to work on my 3ds homebrew for a few hours, but later I can check it out.
     
    Seelbreaker likes this.
  9. Dmafra

    Dmafra Member

    Newcomer
    49
    24
    Aug 26, 2015
    Brazil
  10. jt_1258

    jt_1258 GBAtemps Midna

    Member
    1,716
    936
    Aug 21, 2016
    United States
    The Twilight Realm
    great, now were gona just have people filling there album with there dam porn collection -.-


    ...but tbh it would be cool to at least save our favorite images for viewing on switch
     
  11. Mnecraft368

    Mnecraft368 GBAtemp Advanced Fan

    Member
    906
    216
    Aug 8, 2015
    can someone make a tool for putting our own images on the switch
     
  12. xXxSwagnemitexXx

    xXxSwagnemitexXx The person who asks n00b questions

    Member
    348
    84
    Dec 7, 2016
    United States
    Somewhere
    I would if I knew how to. I only know html tho.
     
  13. Mnecraft368

    Mnecraft368 GBAtemp Advanced Fan

    Member
    906
    216
    Aug 8, 2015
    lets hope someone gets this done
     
  14. Apache Thunder

    Apache Thunder I have cameras in your head!

    Member
    4,112
    4,063
    Oct 7, 2007
    United States
    Levelland, Texas
    Seems like the Switch signs the JPGs with hashes much like the DSi did. I suppose in time that will be cracked. It was for the DSi. Sadly we found no flaws in the JPG stuff on DSi. :(
     
  15. Mnecraft368

    Mnecraft368 GBAtemp Advanced Fan

    Member
    906
    216
    Aug 8, 2015
    that sux.
     
  16. dpad_5678

    dpad_5678 GBAtemp's Memelord

    Member
    1,698
    1,254
    Nov 19, 2015
    United States
    DicPicHax
     
    Piluvr likes this.
  17. Mnecraft368

    Mnecraft368 GBAtemp Advanced Fan

    Member
    906
    216
    Aug 8, 2015
    PornHax
     
  18. SciresM

    SciresM GBAtemp Advanced Fan

    Member
    596
    1,860
    Mar 21, 2014
    United States
    I already documented how the hash works, post a few above yours references my tweet, it's just an sha256 hmac with a hard coded key lol -- eventually I'll probably make a tool but I tested and a custom "resigned" JPEG worked fine last night.
     
  19. xXxSwagnemitexXx

    xXxSwagnemitexXx The person who asks n00b questions

    Member
    348
    84
    Dec 7, 2016
    United States
    Somewhere
    Image?
     
  20. blujay

    blujay GBATemp's Official Warthog

    Member
    GBAtemp Patron
    blujay is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    2,206
    2,051
    Nov 2, 2015
    United States
    Gilbert, Arizona
    i assume then you have the hardcoded key?

    also, i'm happy my theory about the album was actually true.