Hacking Atmosphere-NX - Custom Firmware in development by SciresM

[YigglyPoof]

Today was a big milestone -- for the first time, on hardware, Atmosphere managed to load the kernel, receive an smc (smcCpuOn), and successfully turn on a second CPU core that executes our code.

Video of that below.

Lots and lots of work went into that by TuxSH and I (and a few other contributors <3), and of course there's lots and lots of work still to do, but it's cool to see the stuff that's been done working on hardware.

Good shit. Keep it up, and take your time.

 

[TheCyberQuake]

Today was a big milestone -- for the first time, on hardware, Atmosphere managed to load the kernel, receive an smc (smcCpuOn), and successfully turn on a second CPU core that executes our code.

Video of that below.

Lots and lots of work went into that by TuxSH and I (and a few other contributors <3), and of course there's lots and lots of work still to do, but it's cool to see the stuff that's been done working on hardware.

Good work man. Can't believe you guys have gotten the console this broken in merely a year. Can't even begin to imagine how much work it took.
Can't wait to watch this continue to develop.

 

[Bowl0l]

Sorry for being clueless.
does CFW = access to eShop?
Thanks for the hard work, SciresM.

 

[HexZyle]

Sorry for being clueless.
does CFW = access to eShop?
Thanks for the hard work, SciresM.

Custom Firmware is a modification to your system that allows you the ability to control what firmware your console is on, as well as leaving a hole punched in the security so you can execute programs of your choosing.
If you are on the latest firmware, you have access to the eShop.

 

[TheGreek Boy]

Sorry for being clueless.
does CFW = access to eShop?
Thanks for the hard work, SciresM.

emunand will allow access to eShop.

 

[Solid924]

Is there a possibility that we get something like Freeshop in the future for the switch?

 

[TheCyberQuake]

Is there a possibility that we get something like Freeshop in the future for the switch?

Don't ask that here. And no, with switch online security doing freeshop on switch will guarantee a ban, if it was even possible at all.

 

[wsdyleon]

Today was a big milestone -- for the first time, on hardware, Atmosphere managed to load the kernel, receive an smc (smcCpuOn), and successfully turn on a second CPU core that executes our code.

Video of that below.

Lots and lots of work went into that by TuxSH and I (and a few other contributors <3), and of course there's lots and lots of work still to do, but it's cool to see the stuff that's been done working on hardware.

GOOD work！
thanks for your effort！

 

[Onibi]

@SciresM If you allow me a bit of constructively meant critique:

While you have certainly made progress (cudos), there is still a lot of work to be done. A bit more then the people who are currently contributing can produce in the near future, I think.

I would like you to reconsider your exploit disclosure policy. Not many people are fit to implement exploits or are interested in doing so in general - esp. when a bunch of people have already implemented them (waste of time being second, possibly costs weeks to do proper esp. on 2.0+).

However, there is an entirely different group of people interested in OS development (a good amount more then those who are interested in exploits probably) who can read specs, reverse code, implement hardware initialization, os drivers, patches and loaders. And who would be super interested in contributing to a custom firmware.

You are currently missing out on these people because they don"t have an exploit to be able to develop on their switch.

As such, I belief that progress is currently hindered by that exploit wall, for not much of a reason. I really see very little benefit in not readying the exploit for 3.0 (which most have) and releasing it to get more developers to help out.

I would be interested in your thoughts. Thanks for your efforts!

 

[Lacius]

Is there a possibility that we get something like Freeshop in the future for the switch?

For various reasons related to how the Switch works, it is highly unlikely we will ever have anything like freeShop on the Switch. If/when people have access to game-piracy on the Switch, it will likely require a more manual approach (e.g. the Wii U).

@SciresM If you allow me a bit of constructively meant critique:

While you have certainly made progress (cudos), there is still a lot of work to be done. A bit more then the people who are currently contributing can produce in the near future, I think.

I would like you to reconsider your exploit disclosure policy. Not many people are fit to implement exploits or are interested in doing so in general - esp. when a bunch of people have already implemented them (waste of time being second, possibly costs weeks to do proper esp. on 2.0+).

However, there is an entirely different group of people interested in OS development (a good amount more then those who are interested in exploits probably) who can read specs, reverse code, implement hardware initialization, os drivers, patches and loaders. And who would be super interested in contributing to a custom firmware.

You are currently missing out on these people because they don"t have an exploit to be able to develop on their switch.

As such, I belief that progress is currently hindered by that exploit wall, for not much of a reason. I really see very little benefit in not readying the exploit for 3.0 (which most have) and releasing it to get more developers to help out.

I would be interested in your thoughts. Thanks for your efforts!

Anyone is free to join in the development of Atmosphere NX, fork it, etc. There's no reason to release any exploit before the release of a functional CFW. Otherwise, Nintendo is just going to patch released exploits with no benefit to the community (i.e. no quicker access to CFW).

In addition, the reluctance to release exploits isn't all about not having a usable CFW yet. Even when a functional CFW has been released, it's hard to decide when to release a hard-earned exploit that Nintendo will almost certainly patch. The longer it takes for an exploit to be released, the more Switch systems that will be vulnerable to the exploit when it is eventually released.

My understanding is the exploits for 1.0.0 are going to be made public first because most if not all of them have already been patched in one way or another on newer versions. However, exploits for anything above 1.0.0 require at least some exploits, specifically the TrustZone exploits, that are still functional on 4.1 and (potentially) beyond.

2.0.0-3.0.0 require fewer exploits that haven't already been patched, so that's part of why they will receive a release sooner than 3.0.1+ but later than 1.0.0.

 

[guily6669]

Is there a possibility that we get something like Freeshop in the future for the switch?

Sadly I think not. Everyone say Nintendo improved the security a lot and won't allow that very easily.

What can appear later is a similar app but that could download locally from other server the backups, but I'm sure Nintendo would close that servers very fast and the owners get jailed, I would never risk making a server like that my self...

 

[Onibi]

Anyone is free to join in the development of Atmosphere NX, fork it, etc. There's no reason to release any exploit before the release of a functional CFW. Otherwise, Nintendo is just going to patch released exploits with no benefit to the community (i.e. no quicker access to CFW).

The development so far is focused on exo (secure monitor). To work on it, you need to run it on Hardware. The visible CFW parts - services and kernel patches will probably (hopefully!) land mostly after the initial release. The initial kernel / service patching should be quite bare-bones. (Assuming EL2 emunand).

In addition, the reluctance to release exploits isn't all about not having a usable CFW yet. Even when a functional CFW has been released, it's hard to decide when to release a hard-earned exploit that Nintendo will almost certainly patch. The longer it takes for an exploit to be released, the more Switch systems that will be vulnerable to the exploit when it is eventually released.

My understanding is the exploits for 1.0.0 are going to be made public first because most if not all of them have already been patched in one way or another on newer versions. However, exploits for anything above 1.0.0 require at least some exploits, specifically the TrustZone exploits, that are still functional on 4.1 and (potentially) beyond.

2.0.0-3.0.0 require fewer exploits that haven't already been patched, so that's part of why they will receive a release sooner than 3.0.1+ but later than 1.0.0.

As I understand it, the trustzone execution is not patch-able and has been disclosed already (including how to get there on 1.0.). Newer firmwares have mitigated the issue but additional exploits have been found each time to restore the entry. As such, you are right, that each FW needs additional exploits, however I think for 3.0, they have been named to be fixed by now (e.g. memory controller, sm) or don't seem fix-able (e.g. CMAC/CBC same key ... ...).

So over all, I am not sure how many secrets a 3.0 release would divulge / imply for a future firmware to be fixed. But it does not seem like a lot can be done that has not been done by now.

 

[NANASHI89]

I'm gonna probably be chewed out for asking this, but that's probably the worst that could happen to me.

Will 4.1.0 require a game as an exploit?

Sent from my SM-T280 using Tapatalk

 

[TheGreek Boy]

I'm gonna probably be chewed out for asking this, but that's probably the worst that could happen to me.

Will 4.1.0 require a game as an exploit?

Sent from my SM-T280 using Tapatalk

NOOOOOOOOOOOOOOOOOOOOOOO

 

[NANASHI89]

Well, that takes care of that. Thanks, @TheGreek Boy!

Sent from my SM-T280 using Tapatalk

 

[Onibi]

I'm gonna probably be chewed out for asking this, but that's probably the worst that could happen to me.

Will 4.1.0 require a game as an exploit?

Sent from my SM-T280 using Tapatalk

No. User level exploits are almost exclusively done via the browser. On 1.0 a game was needed to trigger the browser (because it had no eshop/ captive portal). You may need one to update to a specific FW at some point thou. For now - no.

That said, I don"t think 4.0>= has a real entry point (User / Kernel) yet at all (you will have to wait a good while for anything)

 

[KOPHEAD]

he said so many times 3.0.1, 3.0.2 and 4.x.x will get stuff at the same time

I'm sorry guys and thank you SciresM for all your hard work. I really want to ask this question and according to these forums it has been asked a million times but i cannot find concrete evidence to the answer all i can find is what's in the sticky which is obviously this :

• 3.0.1 - 3.0.2 are interchangeable, and also good. If you're on them, *stay* on them. They'll get stuff later than 2.0.0-3.0.0 because they don't have the sm bug, and thus require more privilege escalation to use deja vu. But it will be sooner than 4.x.

Now i have a switch that i have been patiently sitting on with firmware 3.0.1 since November. I'm happy to sit on it as there's no real game's calling me at the moment but i keep reading post's like the one above conflicting whats in the sticky. Now Obviously if i can update to 4.x before the big N rectify all vulnerabilities it's obviously going to better for future game releases but i really don't want to be sitting on a switch with firmware 4.X while all the patient switch owners on 3.0.1 are using there newly hacked consoles.

I'm truly sorry for having to ask this question again but can someone please show me some concrete evidence that 4.x.x is the same as 3.0.1

Thanks in advance

 

[TheGreek Boy]

I'm sorry guys and thank you SciresM for all your hard work. I really want to ask this question and according to these forums it has been asked a million times but i cannot find concrete evidence to the answer all i can find is what's in the sticky which is obviously this :

• 3.0.1 - 3.0.2 are interchangeable, and also good. If you're on them, *stay* on them. They'll get stuff later than 2.0.0-3.0.0 because they don't have the sm bug, and thus require more privilege escalation to use deja vu. But it will be sooner than 4.x.

Now i have a switch that i have been patiently sitting on with firmware 3.0.1 since November. I'm happy to sit on it as there's no real game's calling me at the moment but i keep reading post's like the one above conflicting whats in the sticky. Now Obviously if i can update to 4.x before the big N rectify all vulnerabilities it's obviously going to better for future game releases but i really don't want to be sitting on a switch with firmware 4.X while all the patient switch owners on 3.0.1 are using there newly hacked consoles.

I'm truly sorry for having to ask this question again but can someone please show me some concrete evidence that 4.x.x is the same as 3.0.1

Thanks in advance

this line is old, before 4.x trustzonehax

 

[KOPHEAD]

this line is old, before 4.x trustzonehax

Ok thanks. So would you sit tight on 3.0.1 or just update to latest ?

 

[TheGreek Boy]

Ok thanks. So would you sit tight on 3.0.1 or just update to latest ?

the choice is yours if you update or no
but i think its better to update to 4.1 and buy a game from eShop and wait patiently for 3.0.1 - 4.1 tzhax/cfw