As promised, the pinout and high quality pictures of the PCB

For me it looks like a normal NAND chip, however it seems to have a rather odd pinout, that does not match regular TSOP48 NAND chips. It most likely is a 8-bit channel NAND chip though, which should be readable

(Oh, and the capacitors are 0.2 and 0.1uF. Top to bottom: 0.2uF, 0.1uF, 0.2uF, 0.1uF)



-----

Pinouts!

(Blank pins are not connected to anything)



To me it looks like Pink is VCC and Dark Blue is GND, but I can't be 100% sure.

-----

I won't continue with any kind of reverse engineering, but I hope this pinout helped

 

Hmm, different from BOTW. This is from #switchdev courtesy of Retr0id:
https://imgur.com/a/ojxLu

 

Very, very intresting.

Custom chip with the pads for the switch directly attracted to the back?

 

Is that seriously just a flash memory with contacts? Or a custom chip?

 

hum maybe thats why my zelda makes noise when i shake it lol.

I think it will be a bit hard to dump these games. Seems like there might be alot of different type of chips in them

 

I don't know anything about the engineering-work behind it, but i can tell you one thing.

Use Bitrex. Easily available and a fairly superior bittering agent compared to the weak stuff Nintendo uses.

 

These are the kind of posts I want to see! Research and development, AKA progress!

 

That's just basic security 101. The interesting partitions on the switch's flash are encrypted and protected bye a secure area inside the cpu. Dumping a flash is something you take for granted today. Just look at all those mobile phone chip-off forensic kits that are out there.

I would put my ass on the line that the flash-cart and the switch do some kind of mutual authorization checks before any accepts the other one. Otherwise we would be in the era of GB or NES security ;-)

If the switch flash cart would only by some kind of flash-memory, the appearance of sky-3ds-style carts would only be a matter of weeks - months tops.

I'm not that deep into the 3ds flash cart security but I'd guess that emulating a 3ds flash cart was only possible after the initial 3ds firmware breach, so an emulation to the 3ds-cart-security could be developed.

But it's always the same (as it is with PayTV) once you give your "secret" into customer's hand they will "hack" it sooner or later.

bye
Darky

 

I know my fair share of mobile forensics and chip off since this part of my line of work (no not for .gov). What I wanted to say was, that dumping a soldered NAND chip was way more difficult a few years ago than it is now - with plug-and-play solutions all over the place. Right now dumping a flash chip is basically as easy as extracting a SATA-HDD and creating a physical copy - as long as you have the right tools readily available.

So if I was a developer I would assume that my NAND contents would be dumped on day1 if not day0. So this can't be a valid thing my strategy keeping my device secure.

To just go back to smartphones: Chip-Off was primarily used to circumvent PIN or Patternlocks on unencrypted devices. Devices that use strong passwords with state of the art encryption - you'll just find "random" data on the NAND (maybe except the phone-os-partition and sometimes the emulated SD-Card)

My reply was also not about the flash card but on EpicLPer's statement about the switch NAND being dumped and having partiton names in it. Again good security comes not from hiding anything but making it nearly impossible to break it even when you exactly know how it works.

I also now my fair share about code signing and modern security architectures. So GUIs like we had on GBA or DS flash carts won't be available any time soon (I guess). Having a cart that would just behave like a sky3ds would sell like hell. So if it could be done it will be done. The main goal of those carts is piracy - and getting unsigned / self signed code running on the system to display your own GUIs - at this point the switch would be hacked wide open so carts would be obsolete again.

My guess is that even providing a 1:1 copy of a flash cart is more difficult then getting some kind of code execution on the switch itself.

Another guess will be that the communication between the cart and the switch will be encrypted as well.

Was there really a 1:1 copy of a 3ds game just months after the release? I always thought the first team that accomplished this was sky3ds. The other carts like Gateway relied on firmware bugs / exploits...

However, keep up your good and contributing work - I'm very curious what your findings will be!

bye,
Darky

 

Amazing work!