Hacking AutoRCM Implementation by Reisyukaku

[CreAtor135]

@Reisyukaku made a post on Twitter showcasing him performing something similar to TX's advertised "AutoRCM" feature.



Rei's Twitter: https://twitter.com/Reisyukaku

 

[link42586]

@Reisyukaku made a post on Twitter showcasing him performing something similar to TX's advertised "AutoRCM" feature.



Rei's Twitter: https://twitter.com/Reisyukaku

So is this similar to what was described in A post on here about intentionally bricking your system?

 

[NeoSlyde]

So is this similar to what was described in A post on here about intentionally bricking your system?

Yup

 

[ManguitoZ]

How can we do this?

 

[tecfreak]

How can we do this?

You would have to invalidate the rsa key sitting inside the BCT doing so for all four of the BCTs. You just need to change one byte per key and your switch will always boot into RCM.

 

[fatsquirrel]

@Reisyukaku Is this only sub 4.1 or ...even current firmware? Im wondering if I should stay on 4.1 and its harder tp wait from day to day

 

[NANASHI89]

No need for a USB-C cable?

 

[Addconsult]

What i know its not released to the public yet. Probably because of brick risk and detection from nintendo. Hope he will release it with a "USE AT YOUR OWN RISK" Tag!

 

[link42586]

No need for a USB-C cable?

I def see A USB cable..Its the jig u can lose with this.

 

[xxxacexxx]

am praying he releases it. this getting into rcm mode is so difficult.....

 

[Wierd_w]

I def see A USB cable..Its the jig u can lose with this.

As I have discussed with some other people, adding a micro controller with at least 1 gpio pin, a was7227q high speed data switch (to enable the USB port's D+ and D- pins to be connected programmatically by the micro controller), and the autoRCM methodology, would result in a soldered modchip that works from power-on.

 

[Reisyukaku]

Working on a getting one of my cheap portable computers to deliver the payload cuz i cant be arsed to write a bare bones USB delivery function on a teensy or FTDI.. (trying on C.H.I.P specifically)

@Reisyukaku Is this only sub 4.1 or ...even current firmware? Im wondering if I should stay on 4.1 and its harder tp wait from day to day

All firms.. since its just using a "corrupt the nand intentionally" technique.

 

[Miqote]

I see Rei is a person of culture as well (Rem > Emilia).

 

[fatsquirrel]

All firms.. since its just using a "corrupt the nand intentionally" technique.

So..please correct me if I'm wrong. There's absolutely no point on staying on old firmware anymore is there?
Superb discovery, my hat's off to you!

 

[Reisyukaku]

So..please correct me if I'm wrong. There's absolutely no point on staying on old firmware anymore is there?
Superb discovery, my hat's off to you!

In theory no reason. I'm still on 2.0.0 though in just in case. *shrug*

 

[Miqote]

I understand this boots straight into RCM every time, but theoretically a payload (similar to SX's I guess) could let us boot into Horizon or CFW, right?

 

[tecfreak]

Is this only sub 4.1 or ...even current firmware?

This will work on all current and all future firmwares. But it can be easily detected by Nintendo if you manage to boot into Horizon without reverting those modifications.

No need for a USB-C cable?

Still need a USB host to inject some payload.

 

[Wierd_w]

So..please correct me if I'm wrong. There's absolutely no point on staying on old firmware anymore is there?
Superb discovery, my hat's off to you!

You quoted the wrong person bro.

However, to answer your question anyway:

Using a hardware modchip that auto-injects the RCM payload on power-on would allow cold-boot on any firmware.
However, for the solderingly impaired (like myself), keeping the old firmware for Deja-vu, and using emunand would be desirable also.

It depends on what you want to do, and why.

 

[fatsquirrel]

In theory no reason. I'm still on 2.0.0 though in just in case. *shrug*

Same on 4.1. That damn ''just in case'' eh
Thank you for the great work man.

@Wierd_w
How did I quote the wrong person? :o

 

[mnemonicpunk]

Sounds interesting. Source available?