Hacking [RCM Payload] Hekate - CTCaer mod

[CTCaer]

Apart from the raw nand dump, does this look like everything there is to be backed up? Is there anything else I need to do separately to have everything I could need? Thanks.

View attachment 123828

Your eMMC is BOOT0, BOOT1, rawnand.bin <-- These 3 are your actual main backup files

BCPKG2*, PRODINFO*, SAFE, SYSTEM, USER are partitions and are included in rawnand.bin

pkg_decr.bin, sm.bin, wamrboot.bin are included in package1 which is included in BOOT0 and BOOT1.

fuse, kfuse are your SoC's (Tegra X1) fuses dump.

 

[hippy dave]

Your eMMC is BOOT0, BOOT1, rawnand.bin <--Your actual main backup files

BCPKG2*, PRODINFO*, SAFE, SYSTEM, USER are partitions and are included in rawnand.bin

pkg_decr.bin, sm.bin, wamrboot.bin are included in package1 which is included in BOOT0 and BOOT1.

fuse, kfuse are your SoC's (Tegra X1) fuses dump.

Awesome thanks - so BOOT0 + BOOT1 + rawnand.bin = the whole nand.

 

[Ohex4455]

Oh wow this is actually the first payload able to dump on my Samsung 128gb Evo+.
Although I just formatted it with mkfs/fuse-exfat, so I can't give full credit

Anyway big thanks!

Edit: Fatal Error 1 when writing to SD card

 

[CTCaer]

Oh wow this is actually the first payload able to dump on my Samsung 128gb Evo+.
Although I just formatted it with mkfs/fuse-exfat, so I can't give full credit

Anyway big thanks!

Edit: Fatal Error 1 when writing to SD card

Classic.
Wait for version 1.5, it will be easier to do what you need to do.

Btw, I still don't understand what's the real reason that this disk i/o error happens.. I have 6 SD card and all of them can dump it completely with no error.
So I can't test and find why. The reason is probably either bad sectors, or sd card busy or a mem leak/overflow or sth else.
If @0x25b3 you are willing to test, because you have a very fast sd card, I can provide you a full debug printing version.

 

[Ohex4455]

Classic.
Wait for version 1.5, it will be easier to do what you need to do.

Btw, I still don't understand what's the real reason that this disk i/o error happens.. I have 6 SD card and all of them can dump it completely with no error.
So I can't test and find why. The reason is probably either bad sectors, or sd card busy or a mem leak/overflow or sth else.
If @0x25b3 you are willing to test, because you have a very fast sd card, I can provide you a full debug printing version.

I got to 13 now. Yeah ofcourse, I'm up for debugging. Gimme dat verbose one

 

[CTCaer]

I got to 13 now. Yeah ofcourse, I'm up for debugging. Gimme dat verbose one

Ah so you use FAT32. When it fails you can press volume and "Dump raw emmc" again and it will continue from the last part it was trying.
IF you are lucky. 1.3 writes the partial.idx file after the fatal error occurs, so it may try to write in the problematic area and fail.
1.5 will fix that by writing the .idx before the start of every part. So when an error occurs, you just run "Dump raw emmc" again.

Anyway, I will cook up the debugging version. Maybe it will shed some light.

 

[Ohex4455]

Ah so you use FAT32. When it fails you can press volume and "Dump raw emmc" again and it will continue from the last part it was trying.
IF you are lucky. 1.3 writes the partial.idx file after the fatal error occurs, so it may try to write in the problematic area and fail.
1.5 will fix that by writing the .idx before the start of every part. So when an error occurs, you just run "Dump raw emmc" again.

Anyway, I will cook up the debugging version. Maybe it will shed some light.

No I've used mkfs.exfat and it identifies as exfat in other tools too. I've reformatted and tried again and got to 13. Continue did not work both times.

 

[CTCaer]

No I've used mkfs.exfat and it identifies as exfat in other tools too. I've reformatted and tried again and got to 13. Continue did not work both times.

So how it started a partial dumping with a 128GB partition? You made it smaller?

 

[kamo]

Oh man, I was around 95% when I had to remove the card to make space. Sure enough my Switch booted to the lockscreen first where I had to power it down. So it looks like I can start all over, lol. This is a neverending story for me.

 

[Ohex4455]

So how it started a partial dumping with a 128GB partition? You made it smaller?

I don't think it did start a partial dump. I've formatted with mkfs.exfat on fedora to 128gb. Started Dump raw emmc and it got to 7% and crashed with fatal error 1 I've tried Vol a couple times but it did not continue. I've turned the console off, reformatted again with mkfs.exfat, and started Dump raw emmc again, this time it got to 13%. Oh and I just tried again. It fails with fatal error 2 at 13%, if that's any help

 

[CTCaer]

I don't think it did start a partial dump. I've formatted with mkfs.exfat on fedora to 128gb. Started Dump raw emmc and it got to 7% and crashed with fatal error 1 I've tried Vol a couple times but it did not continue. I've turned the console off, reformatted again with mkfs.exfat, and started Dump raw emmc again, this time it got to 13%. Oh and I just tried again. It fails with fatal error 2 at 13%, if that's any help

I thought 13th part.
Anyway, for your 1st backup, wait for 1.5. It has better error handling and easier tricks to skip the problematic sectors.

Error 2 is FR_INT_ERR = Assertion failed. Do a fsck.

Anyway, I'm currently writing the debug prints. Please be patient

EDIT:
BTW, I never asked anyone with the write errors what their cluster size was..

 

[CTCaer]

@0x25b3
Attached is a mild debugging version for f_write function.
Your screen will fill up with prints. Better take a photo if you can.

 

[Ohex4455]

BTW, I never asked anyone with the write errors what their cluster size was..

What does that mean?

Attached is a mild debugging version for f_write function.

Gonna try in a few, checking the sd card first

 

[CTCaer]

What does that mean?

The FAT32/exFAT cluster size. 512, 1KB, 2KB, 4KB, 8KB, 16KB, 32KB or 64KB?

EDIT:
OH. At last. I found an old 8GB class 2 OEM sd card with write error 1. I'll also debug.
EDIT2:
Nvm, it just got read-only locked from over usage (cells became read only from too many write cycles).

 

[kamo]

I always use 32KB. I think it was also recommended somewhere here. Any way to check if my backup is corrupt? My Switch booted once to the lockscreen while doing the partial dump. I didn't actually opened the homescreen tho.

 

[CTCaer]

I always use 32KB. I think it was also recommended somewhere here. Any way to check if my backup is corrupt? My Switch booted once to the lockscreen while doing the partial dump. I didn't actually opened the homescreen tho.

You are unlucky :/
You successfully done the backup at last, but midway, got corrupted from booting Horizon OS.
Keep it as a play testing dump though.

 

[kamo]

You are unlucky :/
You successfully done the backup at last, but midway, got corrupted from booting Horizon OS.
Keep it as a play testing dump though.

Yeah, I will just wait for 1.5 now. Or I could try the new debug version if it helps. Anything to look out for to report back?

 

[Ohex4455]

The FAT32/exFAT cluster size. 512, 1KB, 2KB, 4KB, 8KB, 16KB, 32KB or 64KB?

Oh you meant you forgot to ask everybody! I've read it as a security promise.. like "we never ask you for your password" I think I was at 32KB.

Okay I wasn't able to repair the card because fsck and fsck.exfat aren't able to repair exfat filesystems. However there IS one error, something with the magic number. Not really familliar with it.

With the debug version I also don't get any relevant output, except for a lot of [ff]: 03 to 10 and it ends with fatal error 2 after 126 seconds

 

[CTCaer]

Yeah, I will just wait for 1.5 now. Or I could try the new debug version if it helps. Anything to look out for to report back?

For the fatal error (1).
Your screen will be filled, but if you take a photo, I can find the last debug print.
(btw 1.5debug has a working partial dumping, because it writes the partial.idx file before it starts the next part)

--------------------- MERGED ---------------------------

Oh you meant you forgot to ask everybody! I've read it as a security promise.. like "we never ask you for your password" I think I was at 32KB.

Okay I wasn't able to check the card because fsck and fsck.exfat aren't able to repair exfat filesystems. However there IS one error, something with the magic number. Not really familliar with it.

With the debug version I also don't get any relevant output, except for a lot of [ff]: 03 to 10 and it ends with fatal error 2 after 126 seconds

Better format it again. Error 2 is filesystem level error. We need the Fatal error (1).

 

[hippy dave]

Oh good question about the cluster size. Mine was whatever MacOS Disk Utility used as default for ExFAT on a 32gb card, but I can check later.