Hacking Hacking the Switch through the Album?

[jt_1258]

I already documented how the hash works, post a few above yours references my tweet, it's just an sha256 hmac with a hard coded key lol -- eventually I'll probably make a tool but I tested and a custom "resigned" JPEG worked fine last night.

could we see a picture of your switch with this resigned image in your album? just for the sake of absolute proof, sorry, just want to know if this truly is real...it's hard to beleive that so much you folks have done in 4 months, I expected this all to take much longer to the point of at least a year or 2, just wow

 

[SciresM]

i assume then you have the hardcoded key?

also, i'm happy my theory about the album was actually true.

Yes, the key is extremely easy to extract if you have capsrv's code....they were smart enough not store the key itself, instead the ipad/opad (Key ^ 0x363636...., Key ^ 0x5C5C...) are loaded via MOVK instructions.

Still, not hard if you know what you're doing.

On 2.0 the Hmac function is at 0x7B94 in .text, it takes in (pointer to output mac, pointer to jpeg data, size of jpeg data, pointer to output size_parsed variable)

could we see a picture of your switch with this resigned image in your album? just for the sake of absolute proof, sorry, just want to know if this truly is real...it's hard to beleive that so much you folks have done in 4 months, I expected this all to take much longer to the point of at least a year or 2, just wow

I guess I can tweet a pic this evening when I'm doing switch stuff, heh -- didn't bother since it's only screenshots...

 

[jt_1258]

Yes, the key is extremely easy to extract if you have capsrv's code....they were smart enough not store the key itself, instead the ipad/opad (Key ^ 0x363636...., Key ^ 0x5C5C...) are loaded via MOVK instructions.

Still, not hard if you know what you're doing.

On 2.0 the Hmac function is at 0x7B94 in .text, it takes in (pointer to output mac, pointer to jpeg data, size of jpeg data, pointer to output size_parsed variable)



I guess I can tweet a pic this evening when I'm doing switch stuff, heh -- didn't bother since it's only screenshots...

oh, I thought you had edited and put in a custom pic

 

[SciresM]

oh, I thought you had edited and put in a custom pic

When I tested the screenshot stuff last night I "resigned" a pic of the reswitched logo and put on my SD card, verified album loaded it with no problems...didn't bother posting to social media because like I said it's only screenshots editing...

I think you took "it's only screenshots" to mean "no custom pictures" -- not what I meant, those work fine, I just meant screenshot editing isn't a huge deal in terms of hax-noteworthiness

 

[jt_1258]

When I tested the screenshot stuff last night I "resigned" a pic of the reswitched logo and put on my SD card, verified album loaded it with no problems...didn't bother posting to social media because like I said it's only screenshots editing...

I think you took "it's only screenshots" to mean "no custom pictures" -- not what I meant, those work fine, I just meant screenshot editing isn't a huge deal in terms of hax-noteworthiness

>.< well, hit it on the nail, sorry about that, well, cool
if ninty ever does implement recording gameplay maybe something similar could be done to get it to play movies and stuff
seems pretty dam cool
also are there ever any issues with adding an image into the album if it's not the same dimensions like a 150x120 image in there instead of the normal dimensions you would see on a tv or the switch itself?

 

[SciresM]

>.< well, hit it on the nail, sorry about that, well, cool
if ninty ever does implement recording gameplay maybe something similar could be done to get it to play movies and stuff
seems pretty dam cool
also are there ever any issues with adding an image into the album if it's not the same dimensions like a 150x120 image in there instead of the normal dimensions you would see on a tv or the switch itself?

Don't know, haven't messed with that -- there's definitely "some" validation of size, images without right size thumbnail show as question marks with "corrupt data" message. I'm sure it'll get documented eventually, but the non-crypto parts of validation are low priority heh.

 

[Deleted User]

Yes, the key is extremely easy to extract if you have capsrv's code....they were smart enough not store the key itself, instead the ipad/opad (Key ^ 0x363636...., Key ^ 0x5C5C...) are loaded via MOVK instructions.

Still, not hard if you know what you're doing.

On 2.0 the Hmac function is at 0x7B94 in .text, it takes in (pointer to output mac, pointer to jpeg data, size of jpeg data, pointer to output size_parsed variable)



I guess I can tweet a pic this evening when I'm doing switch stuff, heh -- didn't bother since it's only screenshots...

ah i see. my switch is on 3.0 because i used to have a different stance on switch hacking. (although not really sure this is considered switch hacking).

capsrv is in the kernel then, right?

 

[SciresM]

ah i see. my switch is on 3.0 because i used to have a different stance on switch hacking. (although not really sure this is considered switch hacking).

capsrv is in the kernel then, right?

Nope, capsrv is a sysmodule, not the kernel.

The sha256 stuff is implemented via native sha256 instructions in .text.

 

[Deleted User]

Nope, capsrv is a sysmodule, not the kernel.

The sha256 stuff is implemented via native sha256 instructions in .text.

gotcha.

i really should kept my switch on 2.0.

 

[SciresM]

I guess I can tweet a pic this evening when I'm doing switch stuff, heh -- didn't bother since it's only screenshots...

Like I said, it works fine: https://twitter.com/SciresM/status/885694921696354305

 

[Deleted User]

Like I said, it works fine: https://twitter.com/SciresM/status/885694921696354305

you should share that key. or make a tool.

i'd say I would help but you probably got it under control.

also, really nice work.

 

[jt_1258]

Like I said, it works fine: https://twitter.com/SciresM/status/885694921696354305

beat me to the punch >.<

 

[Deleted User]

beat me to the punch >.<

he tweeted it did you expect him to be the one to post it

 

[jt_1258]

he tweeted it did you expect him to be the one to post it

I was just gona throw it in here in the thread just cause...

 

[Deleted User]

I was just gona throw it in here in the thread just cause...

ok.

i wish i had that key, but i was retarded and updated my switch

 

[jt_1258]

ok.

i wish i had that key, but i was retarded and updated my switch

was it somehow patched in later uodates? I feel like I'm missing something

 

[SciresM]

ok.

i wish i had that key, but i was retarded and updated my switch

I was never a believer in keeping keys secret. It's on my pastebin.

 

[Deleted User]

I was never a believer in keeping keys secret. It's on my pastebin.

oh. thank you...

 

[Nezztor]

I was never a believer in keeping keys secret. It's on my pastebin.

Thanks for your hard work! Keep the good job ,and thanks for sharing the updates of your progress

 

[xXxSwagnemitexXx]

What do you use to sign the image?
I probably sound like a noob