http://www.ktemkin.com/faq-fusee-gelee/

Kate has collected and answered the most common questions she's gotten regarding Fusée Gelée. Most notably she explains the three "types" of FG hacks, software, hardware (temporary) and hardware (permanent).

Enjoy!

Kate herself responded to this thread on page 26, thanks Kate!

There's a lot more here than I can easily respond to, so apologies if I miss posts or gloss over points.



This is correct-- while there likely will be software chains around for these things in the future, I don't see them as coming along as quickly as f-g. We don't have a non-coldboot exploit chain at all for 5.0.0-- and we haven't looked yet, as we've had other things to focus on and coldboot works. We do have one for 4.1.0, but it's centered around a couple of exploits that we don't want to burn-- we're hoping to use them to get an opportunity to poke around inside T214/Mariko.



I don't view you as particularly hostile, no. I don't know if challenge is generally a good thing-- sometimes you do have to accept that other people have different ethics or viewpoints from yourself and let that pass, especially if they're just doing stuff for fun-- but I don't view your post as hostile.



Jamais Vu (1.0.0 TrustZone hack) isn't my bug, but has been written up, and is just awaiting someone with the skills to have time to do a public interpretation. Déjà Vu is currently centered around the exploit I mentioned above, and we definitely want to hold onto that for as long as it's applicable. It's entirely a Switch bug, too, so I don't see it as being something that needs responsible disclosure.



For Déjà Vu, absolutely. (explained in last quote)



I don't agree that things like tweeting are ego. This is something I work on because I find it a lot of fun to hack on things, and there's definitely an aspect in which it makes me happy when seeing the results of things makes other people happy. There's also an aspect in which I hope that showing these things are possible inspires people to want to learn e.g. reverse engineering. This stuff is cool; and I want to share the excitement with others and lift them up as much as I can.

You don't have to believe me on that or like that that's my goal. I won't hold it against you if you don't.



I honestly support people updating when it makes sense; and I recognize that there's a conflict between holding back information and enabling others to make reasonable decisions about that. I don't like or feel good about secrecy, and I know it has implications. I've tried to be as clear as I can about the costs regarding updating without crossing the line into giving things away.



I think we've been pretty clear that 4.1.0 will eventually see a non-coldboot, software-only exploit with the same level of power. That's actually been posted on the ReSwitched Discord's FAQ for months, but I know the message gets skewed as its gets communicated over to other places. That's part of why I'm here, now-- I want to help clear things up.

The interactions between the operating system and the bootloader-- say on reboot-- are actually fairly limited; and knowing what any of them are is enough to point people at the particular section of bootrom that's vulnerable. That's why I'm not commenting on Fusée Gelée and how it relates to software-only solutions right now. I have said e.g. above that since there's no public way of getting the privileges necessary to run things, 4.1.0 isn't going to see a pure software solution that the public can use at the time that f-g is released. Software exploits will likely come in time; and it's possible we'll come up with things that are even easier than f-g.



I'm not sure if they'll take it seriously enough. I don't know how they are internally-- but I can't just assume they'll fail to do anything and skip disclosure. Honestly, I don't think a "security advisory" is really a bad thing, either-- there are definitely applications of Tegra chips that I and/or the public don't know about. If giving NVIDIA notice gives them time to explain exactly what's dangerous and allow their customers to remove and replace units from places where the vulnerability can cause harm, I consider that a win, and well worth delaying some public switch hacks by a few months.

I'll also say that my fear that vendors won't take the vulnerability seriously is a huge reason I'm so keen to get things out there-- and why I provided a date after which I'll tell the public what's going on that I've said was non-negotiable. I want to make sure this doesn't get hidden, and that people understand exactly what f-g can and can't accomplish, to minimize FUD while also letting people understand the actual risks are associated with using a vulnerable device.



It changes this from an exploit that's going to be usable before the affected people know it's a thing to something that people may have a chance to react to. Making the vulnerability public without disclosure really increases the odds someone is capable of using it to do bad.

I didn't really give NVIDIA a chance to sell-off stock; though. I've said publicly multiple times that there are bugs in Tegra processors well before NVIDIA reached out to me seeking disclosure. If anything, I think telling the public that these vulnerabilities exist while pursuing disclosure helps developers interested in using Tegra chips in the future ask the right question.



I've already said that while pure-software stuff is doable on 4.1.0; it'll be a wait. As far as I'm remembering, the only part of the chain that could require multiple tries to work is PegaSwitch, which is our browser-based entry point, and I haven't even tried the browser entry point that'll eventually be public to see how reliable it is. SciresM did the work to get our non-coldboot exploit working on 4.1.0; not me.



Yeah, that's hard-- especially as everyone has a different view as to how inconvenient things are. I don't know of a way to communicate this better without more details.

Incidentally, the 'inconvenience' verbiage came from SciresM and I discussing our respective views on updating. I think SciresM is more towards the opinion that people should hold back more often, where I'm more of the opinion that updating can be a good and reasonable option sometimes. The way we wound up phrasing things is a compromise between views.



(I'm going to assume this meant "on the hacking side". If not I'm not sure what hacking site you're referring to.)

Updating to latest just closes the possibility of using software exploits launched from Horizon, which can make setup more difficult. I know you'd like to know how much, but I unfortunately don't have a good way of qualifying that. As I've mentioned, if you're suffering from not being able to use your 3.0.1+ Switch, you probably do want to upgrade and just risk things being more inconvenient in the future. Worst comes to worst, if you decide you can't tolerate the inconvenience, you upgrade and then wind up having to figure out a modchip.

The downgrade protection fuses literally mean nothing to a system with f-g, which can entirely skip the downgrade check. Incidentally, SciresM actually accidentally bricked one of his systems in a way such that it was always failing the downgrade checks, and he's been able to use f-g to get that system up and running again.



I don't think that's clear at all, nor do I want to confirm or deny this. Sorry.



I think you're making a bunch of assumptions here, and that's maybe not a great idea. I'm not saying you're necessarily right or wrong; just that I don't think your assumptions are founded.



I don't think this contradicts. This is talking about vulnerabilities that aren't f-g; not because f-g doesn't work on 4.1.0, but because it's possible we may come up with vulnerabilities that are even nicer on 4.1.0 in the future.



I'm being as clear as I feel I can, and adding clarifications e.g. here where I think it helps. There will be different names for the the ways you can use f-g eventually; and I'll be fully open about everything once the summer rolls around and I'm not putting the disclosure timeline in jeopardy.



I know and have said about that this "bring your own exploit" business makes development exclusive, and that's exclusionary and I really don't like it-- I just don't see a way around it. I would love to get more developers and more perspective, and that's why my release date for f-g is tied to my disclosure timeline and not in particular to Atmosphère's release.




I've tried to point out approximately what the difficulty would be for some of the options to kind of provide this, but this is a hard thing to accomplish. In this case, providing details that are more specific really points a finger at vulnerability details, so there's not much I'm comfortable sharing. I've shared what I could-- as a data point, some of the other teams have outright stated that they think I've shared too much already and made things obvious. I don't agree or necessarily care about their opinons, but c'est la vie.



Well, this isn't the case. This has been disclosed to Nintendo, too-- as NVIDIA shares their vulnerability findings with downstream customers. It's more general malicious actors that I'd be worried about.



See above-- but I don't think I'd advise specifically updating to 4.1.0 unless that gives you enough access to the games you want.



I'm also super glad that we can do a lot of our work in the open. I hope there's a lot more of it in the future-- and I'd love to stream some of it.



I find the requirement disheartening as well, but I think this is the right way to do things, for now. I've explained my rationale above; feel free to ask questions.



I'm not sure why people are against communication, here. There were definite benefits to talking about f-g in the first place; including that it demonstrates that Tegra chips are vulnerable-- which hopefully influences buying decisions in the future and puts pressure on NVIDIA to seek as much of a fix as they can. After that there seemed to be definitely benefits to talking about more details, even in the limited sense that I'm able to. I've tried to give people more information than the nothing they would have had so they could have more of an idea whether it's be a good idea to e.g. pre-order a modchip or update their system. I know it can be frustrating to not get full disclosure, and that more information would help people to make a better or more conclusive decision, but full disclosure isn't an option until this summer. I don't think that's a reason to hold back information.



I don't have specific answers to your questions, unfortunately-- but I think it sounds like the main purpose of this Switch is as a gaming device and maybe you should upgrade and enjoy playing games with your son.



I don't think that asking for clarification is criticism. It might be rude to push me to answer something I said I wouldn't, but I don't think there's harm in answer.



I don't think I've said anything about opening the console or not. See above for my views on updating?



I'm not sure where you got this impression, or why you're confident about things enough to claim you know about the internal values or working of ReSwitched. This is also easily disprovable just from public information--Hedgeberg has tested out f-g on stream. I don't see it as great opsec to enumerate how many people have access to the vulnerability, but we've long had a policy of only giving exploit details to those who actually want to know them and are in a position where they can use them to help. This is a basic security precaution and not about trust.

I'm actually not sure how this is relevant to the broader discussion. Based on your post history, I can tell that you strongly support TX and the option they're providing, and you're welcome to that, but I think throwing around generic unfounded criticism of RS doesn't do much good and distracts from me answering community questions.



I don't think they're obviously more convenient, as they exist right now. They're both inherently however-tethered-you-consider-PegaSwitch, take a bunch of time to run, and rely on a pegaswitch entry point.



That's not correct-- everyone on a current hardware revision will be able to install and use CFW the day it's released, if they're willing to put in the effort and potentially take on some minor risk.



I'm actually not sure what you mean by this entire post? Sorry about that-- I'd love to address your ideas, but unfortunately I can't figure out your meaning.



That was about me having fun by trying to see if a DIY, cheap modchip option is reasonable. It turns out it is. As you've noted, it's not necessary on any firmware. I just really like the idea that the open exchange of knowledge -- especially when profit's not a motive -- can result in creation of neat options for the community. ^-^



Yep; that's exactly what it means.



I don't think this has been at all implied-- and you'd be hard pressed to find a way to make a solder-less Arduino option that even remotely fits in the Switch case.

I should also clarify that the DIY option isn't solderless.

If you have or are going to get the game anyway, you can. Those versions are pretty much interchangeable in the long-term.



Yep-- and it's possible at some point that we'll allow you to install Fake News without Puyo using f-g/Atmosphère. The original plan was to release Atmosphère for 1.0.0 first while we tried to figure out how to deal with Fusée Gelée, but we actually wound up with a disclosure schedule that was faster than we'd thought.

 

[TotalInsanity4]

It's still not a guarantee, but it's probably the best option to lay low on nintendo's radar. The nice thing is atmosphere is designed in a way where it's basically bare bones without plug-ins, and the fun stuff we think of with cfw will mostly come from plug-ins. At least that's how I understood what they've said in discord at the ktemkin live streams

Oh, that's interesting! I hadn't even heard that it would support plugins until now (granted, I probably glossed over that at some point)

 

[TheCyberQuake]

Oh, that's interesting! I hadn't even heard that it would support plugins until now (granted, I probably glossed over that at some point)

I'm not sure plug-ins is the right word, but that's what I've heard.

 

[Giga_Gaia]

Nice, the 128GB microSD card I just ordered is on its way.

 

[Onibi]

Jesus, I'm done with this crap. Time to update. It's so freaking obvious now that there was no point lagging behind on old firmware. I'll happily do the snip or tweezer thing or just get a TX in a few months. Or maybe my Switch will randomly die and Nintendo will quietly replace it will a Mariko unit when I send it in for repair.

My friend, you are the single most intelligent person in this mess of egos, self-promotion, self-importance, mindless cult following, unintelligence and misinformation
To this day they have not even released a kernel exploit. Clearly control and seeing & hearing themselves hailed to is the name of the game they are playing. Not open collaboration and development. I would even say that the whole development is slowed down significantly as a byproduct of all this agenda and reswitched-only crap.

And people are buying it left and right. Look they are doing all this hard work alone. How great are they Look how galant, waiting for Nvidia to get of their arses to issue a security advisory "your product is affected" message to their customers (and meanwhile selling their current stock). And let's not forget the potential potential of a potential recall potential - to protect those affected customers.
Riddle me this: How is it responsible to _not_ disclose it now (and create presure) so that they have a tougher time selling the affected Tegras that they have already produced and are currently producing with the flaw? How does the next person feel about that responsible-ness when he picks up a freshly produced device (car or whatever) or uses one, with the flaw, that was produced today - and since no potential recall ever happened still is in use.
The whole assumption of the process is bogus for a non fixable hardware flaw. It's assuming that more then a security advisory will EVER happen, and it does so at the cost of producing even more affected devices. Thanks for being so responsible

I am also worried about the lifetime. I have a backup device. Worst case I sell it down the road (probably not gonna decrease in value ...) but hey, it may come in handy Even thinking of another backup ... but that would be ... too weird.

 

[TotalInsanity4]

To this day they have not even released a kernel exploit.

What the hell is Deja Vu then

 

[TheCyberQuake]

My friend, you are the single most intelligent person in this mess of egos, self-promotion, self-importance, mindless cult following, unintelligence and misinformation
To this day they have not even released a kernel exploit. Clearly control and seeing & hearing themselves hailed to is the name of the game they are playing. Not open collaboration and development. I would even say that the whole development is slowed down significantly as a byproduct of all this agenda and reswitched-only crap.

And people are buying it left and right. Look they are doing all this hard work alone. How great are they Look how galant, waiting for Nvidia to get of their arses to issue a security advisory "your product is affected" message to their customers (and meanwhile selling their current stock). And let's not forget the potential potential of a potential recall potential - to protect those affected customers.
Riddle me this: How is it responsible to _not_ disclose it now (and create pressume) so that they have a tougher time selling the affected Tegras to people they have already produced and are currently producing with the flaw? How does the next person feel about that responsible-ness when he picks up a freshly produced device (car or whatever) or uses one, with the flaw, that was produced today - and since no potential recall ever happened still is in use.
The whole assumption of the process is bogus for a non fixable hardware flaw. It's assuming that more then a security advisory will EVER happen, and it does so at the cost of producing even more affected devices. Thanks for being so responsible

I am also worried about the lifetime. I have a backup device. Worst case I sell it down the road (probably not gonna decrease in value ...) but hey, it may come in handy Even thinking of another backup ... but that would be ... too weird.

Mfw this is the fastest hacked console but people still complain devs aren't releasing stuff fast enough.

 

[Onibi]

What the hell is Deja Vu then

You mean the writeup for 1.0.0 consoles? That's a nice start. It's not a release and certainly not useful to most.

It's like knowing somebody needs fertilizer for their plants at home and you are giving them an instruction on how to find and collect cow poo. Technically that would be helping, practically it is not.

 

[TheCyberQuake]

You mean the writeup for 1.0.0 consoles? That's a nice start. It's not a release and certainly not useful to most.

It's like knowing somebody needs fertilizer for their plants at home and you are giving them an instruction on how to find and collect cow poo. Technically that would be helping, practically it is not.

No point in releasing a TZ exploit when nothing can make use of it right now. What are you going to do with TZ without cfw?
Like honestly answer that question.

 

[Onibi]

Mfw this is the fastest hacked console but people still complain devs aren't releasing stuff fast enough.

Eh. That's because they are dangling it in front of you. Consistently.

Anger and frustration is deeply connected to expectation. If you take a Donut and dangle it in front of a hungry child and then always take it away so they can't eat it, see how much frustration you will get then. And eventually anger. It is also deeply wrong to play with people in this manner.
Secondly, illogical behavior to an intelligent person violates their sense of justice. So seeing this crap ...
Thirdly, personal proliferation and seeing selfish instead of social behavior to most is not appealing. If you look at the people and how they behave, they clearly are using this circus for themselves. Not to develop open and socially.

--------------------- MERGED ---------------------------

No point in releasing a TZ exploit when nothing can make use of it right now. What are you going to do with TZ without cfw?
Like honestly answer that question.

Development of course! I like to reverse the question and ask: Why not release it then?

 

[TheCyberQuake]

Eh. That's because their are dangling it in front of you. Consistently. Anger and frustration is deeply connected to expectation. If you take a Donut and dangle it in front of a hungry child and then always take it away so they can't eat it, see how much frustration you will get then. And eventually anger. It is also deeply wrong to play with people in this manner.
Secondly, illogical behavior to an intelligent person violates their sense of justice. So seeing this crap ...
Thirdly, personal proliferation and seeing selfish instead of social behavior to most is not appealing. If you look at the people and how they behave, they clearly are using this circus for themselves. Not to develop open and socially.

All of what you say is like the ramblings of madman. Never actually answering the questions and going off of nonexistent and made up social cues you think you are seeing but not really there.
They haven't "dangled things in front of us consistently" in fact pretty much everything that has been announced has been released within a very reasonable time frame, especially when compared to what goes on in other console hacking scenes.

 

[Quantumcat]

All of what you say is like the ramblings of madman. Never actually answering the questions and going off of nonexistent and made up social cues you think you are seeing but not really there.
They haven't "dangled things in front of us consistently" in fact pretty much everything that has been announced has been released within a very reasonable time frame, especially when compared to what goes on in other console hacking scenes.

What has actually been released though? Is Kate part of reswitched? If so there's just pegaswitch, nothing else that has been announced is usable? If Kate isn't part of reswitched then she has released nothing?

 

[Onibi]

All of what you say is like the ramblings of madman. Never actually answering the questions and going off of nonexistent and made up social cues you think you are seeing but not really there.
They haven't "dangled things in front of us consistently" in fact pretty much everything that has been announced has been released within a very reasonable time frame, especially when compared to what goes on in other console hacking scenes.

Sorry but I feel the same about you. All you do is mindlessly defend whatever they come up with. Mostly by simply repeating them You are the perfect follower

Also make note: I was not answering a question at all (because there was none). You made a statement and I tried to put your comment of "not understanding it" into a social frame which I was hoping would make you understand why people "complain". Clearly I was mistaken

May I note also: Nothing has been released. And "a reasonable" time frame depends on your workforce and behavior. If you intentionally limiting access it becomes unreasonable. It has been almost what 8 Month of consistent holdbacks now? At least 4-5 of those with so much access that A LOT more people could have joined the effort and we could not only be further along but also much more open and a community.

"Here is some user space access, play with it, we don"t want you to have kernel. Meanwile we are gonna do some low level dev ... that you kids best stay away from" - Behavior like that is what I see.

 

[guily6669]

Lol so much drama ppl... This is something illegal and no one owns nothing to anyone, just either wait or simply keep updating your console and buy games then all the hardware flaws won't affect you in any kind, games you buy will keep being played...

Now if you want to hack your console either exploit it your self and then make a CFW or keep waiting for one...

Ps: I'm sure your not paying them to be working for you...

 

[subcon959]

just either wait or simply keep updating your console and buy games then all the hardware flaws won't affect you in any kind, games you buy will keep being played...

You're assuming this is about piracy which I get is probably a good bet in most cases but not this time.

Now if you want to hack your console either exploit it your self and then make a CFW or keep waiting for one...

Ps: I'm sure your not paying them to be working for you...

Ugh. Do you even know you're spouting this mantra as if it was some sort of cult? I've got to give credit to whoever first came up with this, it's a great way to sheepify people and control dissent. It's isn't however a good way to have a fun, open community. Again, I get it, the majority of temp just want piracy and couldn't give a crap about actual homebrew development so they are happy to defer to the select few gods.

 

[Onibi]

Now if you want to hack your console either exploit it your self and then make a CFW or keep waiting for one...

I don't think this is true. They have learned from others and do have a responsibility to society to provide back. That is the base idea of free software. That knowledge should be free and nobody has a right to abuse it for power or personal gain.

But on a technical side: I believe there are more people who want to and can help development then there are those who want to and can hack. It is not helpful to keep them locked away behind an exploit. I for example do not give two cents about exploits and their development - super boring
The issue is they, by various means and as a group have been able to dump the binaries of the next higher stage and thus could then find exploitable code. Without that, it is not as easy.

Ps: I'm sure your not paying them to be working for you...

You do. Same as you paid Facebook or YouTube before they had ads to finance them. You give them reputation and make them known. That's that what they are doing this for. That's also why stuff is not released and dangled. Each day keeping the hype fresh and dragging it along as long as possible.

Oh: I am also absolutely for giving credit and even them their rightful reputation. And The issue is that at some point it becomes abusive (for example when you block other developers for the sake of it).

 

[subcon959]

I'm just gonna throw this out there too as I'm sure someone is bound to come back with "well just join the discord and prove yourself or whatever and you can be part of their gang". What if someone likes to tinker on their own and doesn't want to be part of a group and have to follow their ideals? It's like wanting to be a politician and then finding out there's only a single party that you can join or you can't do it.

 

[guily6669]

You guys make too much drama... I don't visit their YouTube or twitch or whatever, they are not winning nothing with me...

Anyway instead of blaming I rather prefer to wait for something released and anyone with a lot of coding knowledge can join their team and help and source code is open too...

 

[subcon959]

join their team

 

[guily6669]

Lol, we were typing together but you knew what I was going to type you evil Wizard joking...

 

[Onibi]

I'm just gonna throw this out there too as I'm sure someone is bound to come back with "well just join the discord and prove yourself or whatever and you can be part of their gang". What if someone likes to tinker on their own and doesn't want to be part of a group and have to follow their ideals? It's like wanting to be a politician and then finding out there's only a single party that you can join or you can't do it.

In addition you can be against joining such a team because it would lock you into the same standards. You have to become them.

I was in the same situation. An exploit was not public. I build on it. I wanted to release something. The guy did not want to release the exploit, even thou it was already fixed. I had the option to either release what he gave me in confidence or not release at all. Or release something only those with the exploit themselves could use. Again, the in-crowed.

I do not want to be in this situation anymore. I refuse this group lock-in-lock-up mentality ... Bring your own exploit is an offensive mantra. I hate Failoverflow so much