Hacking SWITCH NOOB PARADISE - Ask questions here

[Scipio_]

I've been reading up on the 3ds scene and was wondering if someone can explain what a9lh and b9s are, how they differ from emunand, and if those would ever be possible to run on the swtich?

 

[Cyka_Delik]

Oh, crap! I was under the impression that all the hacks would run on any firmware version since the hack exploits the hardware rather than the software.... What firmware versions can run what software? What versions can't run anything? If it is a hardware exploit using the RCM of the CPU, then how is Nintendo blocking it with a software update?

Damnit. I hope I didn't wait too late to buy another Switch =(

 

[Draxzelex]

Oh, crap! I was under the impression that all the hacks would run on any firmware version since the hack exploits the hardware rather than the software.... What firmware versions can run what software? What versions can't run anything? If it is a hardware exploit using the RCM of the CPU, then how is Nintendo blocking it with a software update?

Damnit. I hope I didn't wait too late to buy another Switch =(

Just copying and pasting what I said in another thread to explain everything and I'm too lazy to re-write it all XD. Lemme know if you're still confused by anything.

@MiserySW Let's start with what we do know. There are a number of untethered exploits. Some establish higher level access to the console. And depending on your firmware, there are certain homebrew you can utilize. For example, Pegaswitch is available for 3.0 and below but only has access to homebrew. The tethered coldboot works on all firmwares and grants you full access to the console at the cost of tethering. There are unreleased softmod warmboots that work all the way up to 4.1 but they have not been released yet. The softmod warmboot for 3.01-4.1 will not be released when the CFW is launched. This is speculation for the reasoning, but they have stated that they have not tested any exploits for 5.x as of yet. Since they have not released this exploit, Nintendo should not be aware of what to patch theoretically. So based on this logic, it holds that the 3.01-4.1 exploit may work on 5.x. There is a reason this is important.

I get the vibe that you are aware that Nintendo is planning on releasing a new Switch revision that takes care of the tethered coldboot, known as Mariko (based on the chip it uses). The current Switch revision, Erista, has a hole in its bootrom that cannot be patched out because it is read-only thus allowing all firmwares to be hacked. The reason we know Mariko is coming is because there was support added for it in firmware 5.0. Now because the tethered coldboot will no longer work on the Mariko Switches, we currently have no means of hacking them when they come out. This is where those unreleased exploits come into play as they may be the key for unlocking those consoles. The next part will help explain why you should buy sooner rather than later.

Now, the following is speculation after closely following the scene, but I think it will help to advise that you should buy an Erista Switch ASAP. We have no idea when the Mariko Switch will hit the market. Nintendo will most likely do a silent implementation of this revision. We have no idea how to even identify them, until they come out that is. So we can't warn users beforehand if they are buying a Mariko Switch or not. However, what we do know is why they are making it. And that is because of the unpatchable bootrom exploit. Originally, this exploit was planned to be released on June 15th by a team that alerted the manufacturers of the exploited chip of the problem. They notified them months in advance in hopes to give them enough time to implement a fix as the exploit had potential ramifications outside of the Switch. This same team is devoting all their current time towards developing the CFW, Atmosphere. Even though the CFW is still a WIP, they were still trying to finish it by the same time as they would disclose the exploit to the public, June 15th. The reason they have not tested any exploits for 5.x yet is because not only are they busy working on Atmosphere for the time being, but they may have a strong feeling that the Mariko Switches may be released sometime around that date. If Atmosphere can be finished by the time the Mariko Switches are out, it will give them the perfect opportunity to work on cracking the Mariko Switch with the unreleased softmod warmboot exploits for 3.01-4.1.

The long and the short of the last paragraph is that although we have no idea when the new Switch revision will hit the market, the longer you wait, the more risk you take that the Switch you purchase will be a Mariko unit. Of course, as long as it doesn't have 5.x then its guaranteed not to be a Mariko device. But this is why its strongly advised that now is the time to buy an exploitable Switch because at the current moment, there are no confirmed hacks that will work on Mariko.

My last point will be obtaining said sofmodded warmboot exploits. We have reason to believe that the untethered exploit for firmwares 3.0 and below may have been patched out because they indicated it will be released at the same time as the CFW. Whether it involves Pegaswitch or not is just speculation. The hard part is when they will release the one for 3.01-4.1. If it turns out that it does not work on 5.x, then similar to the one for 3.0 and below, they will release it as it has already been patched out so there's nothing holding them back on releasing it. But what if those exploits do work on 5.x? Now it becomes a guessing game as to when they'll release it, if at all since as you have noticed, exploits typically get released after they are fixed. For what its worth, I'm holding onto my 4.1 in the hopes of that untethered exploit because I don't like tethering either. But we will simply have to wait and see.

I cannot answer your questions on what hacking will be like in a year or two because a) I cannot see the future and b) anything is possible. However, I hope I answered all your questions with some history on how we got to our current point in Switch hacking. I would agree that the forums are a bit of a mess in terms of utilizing hacks and discerning right from wrong, but this should all be alleviated once the CFW comes out. As someone else once said, "We may not be as good as a LGQT support group, but we are getting there".

I've been reading up on the 3ds scene and was wondering if someone can explain what a9lh and b9s are, how they differ from emunand, and if those would ever be possible to run on the swtich?

a9lh is an exploit of one of the new 3DS's security systems. It basically checked to see if whatever you were loading into the 3DS was appropriate or not. With it, people could run any type of content but it had potential brick risks. b9s was an exploit in the bootrom of the 3DS aka the startup of the 3DS. This gave us an even higher level of execution than a9lh because it happens before the 3DS turns on. a9lh needed EmuNAND as Nintendo could implement patches in the way the exploit worked and what it checks since it does this while the 3DS is on. As such, you needed a certain firmware to make sure your ARM9Loader would still be compatible with the exploit. That all changed when b9s was released because Nintendo cannot release any firmware to patch it. Any firmware changes would be implemented too late into the exploit chain because firmware changes would be implement when the system is already on, but b9s happens before its on so we can bypass whatever firmware changes they make.

Both b9s and Fusee Gelee are coldboot-based exploits because they take place before the device is turned on. The difference here is that b9s is software-based and Fusee Gelee is tethered with either hardmod or softmods available. They both achieve the same level of code execution meaning we can run whatever we want on the 3DS or Switch. But because Fusee Gelee requires a USB cable to send a payload.bin to access any hacks makes it a little less user-friendly as compared to b9s. Now to simply answer your question, we cannot just run b9s or al9h onto the Switch because they are 2 different consoles with 2 different operating systems. The Switch doesn't even have an ARM9Loader to exploit and b9s takes advantage of flaws in the 3DS' bootrom which is not the same as the Switch's. However, that doesn't mean we can't eventually achieve that same level of ease with the Switch. Those exploits took years before they were released so it just a matter of hackers looking for other ways to break into the Switch as well as a lot of waiting.

I see...hmm. Where is the best place to lurk and watch the progress for updates? Are a lot of the programmers/modders on this site?

Hackers always find a way. I have hope this will be as hacker-friendly as the PSP someday. This exploit seems like a major oversight..

Also, couldn't we create a custom OS (even if it's based on Horizon) that Ninty couldn't detect if it went online? And wouldn't Ninty probably ban devices by MAC addresses? Would spoofing MAC addresses be possible?

There are some on this. Unfortunately, GBATemp doesn't have a definitive place to check for all updates to Switch hacking. The hacking sub-forum was initially just one sub-forum, however the community felt it was too wide an area as threads asking for help would often drown actual homebrew releases. One place I can recommend is the ReSwitched discord, the team that is working on the CFW, Atmosphere, that the entire community will be utilizing going forward.

I don't doubt this either. For the time being, we will have to deal with what we got. 3DS hacking used to be limited to being on firmwares 4.1-4.5 as well as buying a third-party cartridge. Now anyone can do it regardless of 3DS type or firmware. The Switch hacking scene is interesting because we already have full access to the console in only over a year. I think the fact that the exploit is not very user-friendly makes up for how fast the Switch was cracked wide open.

Unfortunately, the only way to make an undetectable CFW is with the appropriate keys. This is because the CFW is allowing us do things that Switch's OS Horizon would not normally let us do. As an example, the tethered exploit involves sending the Switch into RCM. To achieve RCM on any device, you hold power, volume +, and the home button. The Switch console itself lacks a home button and the Joy-Con's home button doesn't count. What we discovered is that shorting pin 10 on the Switch is the equivalent of pressing the home button. Now normally, this button should never be pressed but Nintendo can easily add a firmware update that checks this and start banning people. What complicates matters even further is that we don't know what Nintendo knows. When a ban does occur, its obviously related to some type of hack, but the reasoning for the ban is vague on Nintendo's side. Its up to the hacking community to find the smoking gun behind the ban and implement patches in their own works to prevent future bans.

As for how bans are applied, every Nintendo Switch comes with a console unique certificate when it leaves the factory. This is used to do multiple things such as access the eShop, play games online, or even add friends. This is how the only 2 people we know who got banned were banned. I'd imagine if all it took was spoofing a Mac address, it would be front page news on the Switch hacking sub-forum. But clearly, Nintendo has others means of detecting who goes online and what they are doing. We just simply don't have enough information on Nintendo's ban hammer. If you want to spoof your Mac address, go ahead. However, I don't believe you are entirely safe.

 

[Cyka_Delik]

Just copying and pasting what I said in another thread to explain everything and I'm too lazy to re-write it all XD. Lemme know if you're still confused by anything.



a9lh is an exploit of one of the new 3DS's security systems. It basically checked to see if whatever you were loading into the 3DS was appropriate or not. With it, people could run any type of content but it had potential brick risks. b9s was an exploit in the bootrom of the 3DS aka the startup of the 3DS. This gave us an even higher level of execution than a9lh because it happens before the 3DS turns on. a9lh needed EmuNAND as Nintendo could implement patches in the way the exploit worked and what it checks since it does this while the 3DS is on. As such, you needed a certain firmware to make sure your ARM9Loader would still be compatible with the exploit. That all changed when b9s was released because Nintendo cannot release any firmware to patch it. Any firmware changes would be implemented too late into the exploit chain because firmware changes would be implement when the system is already on, but b9s happens before its on so we can bypass whatever firmware changes they make.

Both b9s and Fusee Gelee are coldboot-based exploits because they take place before the device is turned on. The difference here is that b9s is software-based and Fusee Gelee is tethered with either hardmod or softmods available. They both achieve the same level of code execution meaning we can run whatever we want on the 3DS or Switch. But because Fusee Gelee requires a USB cable to send a payload.bin to access any hacks makes it a little less user-friendly as compared to b9s. Now to simply answer your question, we cannot just run b9s or al9h onto the Switch because they are 2 different consoles with 2 different operating systems. The Switch doesn't even have an ARM9Loader to exploit and b9s takes advantage of flaws in the 3DS' bootrom which is not the same as the Switch's. However, that doesn't mean we can't eventually achieve that same level of ease with the Switch. Those exploits took years before they were released so it just a matter of hackers looking for other ways to break into the Switch as well as a lot of waiting.
There are some on this. Unfortunately, GBATemp doesn't have a definitive place to check for all updates to Switch hacking. The hacking sub-forum was initially just one sub-forum, however the community felt it was too wide an area as threads asking for help would often drown actual homebrew releases. One place I can recommend is the ReSwitched discord, the team that is working on the CFW, Atmosphere, that the entire community will be utilizing going forward.

I don't doubt this either. For the time being, we will have to deal with what we got. 3DS hacking used to be limited to being on firmwares 4.1-4.5 as well as buying a third-party cartridge. Now anyone can do it regardless of 3DS type or firmware. The Switch hacking scene is interesting because we already have full access to the console in only over a year. I think the fact that the exploit is not very user-friendly makes up for how fast the Switch was cracked wide open.

Unfortunately, the only way to make an undetectable CFW is with the appropriate keys. This is because the CFW is allowing us do things that Switch's OS Horizon would not normally let us do. As an example, the tethered exploit involves sending the Switch into RCM. To achieve RCM on any device, you hold power, volume +, and the home button. The Switch console itself lacks a home button and the Joy-Con's home button doesn't count. What we discovered is that shorting pin 10 on the Switch is the equivalent of pressing the home button. Now normally, this button should never be pressed but Nintendo can easily add a firmware update that checks this and start banning people. What complicates matters even further is that we don't know what Nintendo knows. When a ban does occur, its obviously related to some type of hack, but the reasoning for the ban is vague on Nintendo's side. Its up to the hacking community to find the smoking gun behind the ban and implement patches in their own works to prevent future bans.

As for how bans are applied, every Nintendo Switch comes with a console unique certificate when it leaves the factory. This is used to do multiple things such as access the eShop, play games online, or even add friends. This is how the only 2 people we know who got banned were banned. I'd imagine if all it took was spoofing a Mac address, it would be front page news on the Switch hacking sub-forum. But clearly, Nintendo has others means of detecting who goes online and what they are doing. We just simply don't have enough information on Nintendo's ban hammer. If you want to spoof your Mac address, go ahead. However, I don't believe you are entirely safe.

You've been very informative and helpful. Thanks man! I found a 4.1 tablet only on Ebay for $170. I'll hold on to that until Atmosphere is released. Can you PM me the Discord info?

 

[Draxzelex]

You've been very informative and helpful. Thanks man! I found a 4.1 tablet only on Ebay for $170. I'll hold on to that until Atmosphere is released. Can you PM me the Discord info?

I'll do you one better

Here's an invite link to our discord server: https://t.co/2qFIT3CEv5

— ReSwitched Team (@reswitchedteam) June 25, 2017

I'm actually not a part of the Discord (mostly out of laziness). Also, you're welcome! I try my best to inform those who are curious enough. This type of information exists in bits and pieces so its only available to those who have been following the scene very closely.

 

[Cyka_Delik]

I'll do you one better https://twitter.com/reswitchedteam/status/878815086449643521I'm actually not a part of the Discord (mostly out of laziness). Also, you're welcome! I try my best to inform those who are curious enough. This type of information exists in bits and pieces so its only available to those who have been following the scene very closely.

Thanks man! One last question! What all features will the Atmosphere OS have?

 

[Draxzelex]

Thanks man! One last question! What all features will the Atmosphere OS have?

Unless you know how to read code, we don't know what features it will have out of the box. You can read its broken, work-in-progress code here: https://github.com/Atmosphere-NX/Atmosphere

However, with Atmosphere, we will be able to do pretty much anything we want on the Switch. Think of it as a perfectly fertile piece of farmland that we can now grow any fruit or vegetable we want without having to pay Nintendo. Atmosphere gives us all of the groundwork to do whatever the Switch can do but without the security measures in place. So it'll be up to the community to implement additional features such as emulators, game dumping, backup launching, etc.

 

[blopa]

Hi. Is there a way to install homebrew on firmware 3.0.2? How? Thank you.

 

[DocBo]

Now i have a Sandisk SD and my switch 1.0 kicked into atmosphere and when i start some downloaded homebrew, zelda crashes after enter the name and all the emulators crash at start.

 

[Draxzelex]

Hi. Is there a way to install homebrew on firmware 3.0.2? How? Thank you.

Follow this tutorial: https://gbatemp.net/threads/switch-hacking-101-how-to-launch-the-homebrew-menu-on-4-x-5-x.504012/
When you get to the part it tells you to download the Hekate payload (it has 2 separate download links, one for 4.x and one for 5.x), you will instead you the following payload: https://github.com/CTCaer/hekate/releases/tag/v2.0
The rest of the steps will involve following the tutorial from the first link I gave you.

Now i have a Sandisk SD and my switch 1.0 kicked into atmosphere and when i start some downloaded homebrew, zelda crashes after enter the name and all the emulators crash at start.

Issue 4: The homebrew app store is stuck on a loading screen.

Answer: Make sure you are connected to the internet, wifi can be a bit unstable in Hekate

---

Make sure you are not blocking any DNS or IP addresses. If its still not working, there doesn't appear to be a direct fix other than trying again and again. Remember that Hekate is unstable and not meant for end-user use.

 

[Mil098]

I'll do you one better https://twitter.com/reswitchedteam/status/878815086449643521I'm actually not a part of the Discord (mostly out of laziness). Also, you're welcome! I try my best to inform those who are curious enough. This type of information exists in bits and pieces so its only available to those who have been following the scene very closely.

Thanks Draxzelex for your posts, you have been very helpful.

To give you an update, I've basically given up on trying to get the switch into RCM mode for now. I have ordered some joycon slide rails which I will solder a wire between pin 1 and 10 as I'm weary of damaging the pins on the switch itself.

Once these rails arrive I'll get right back into CFW (Hen), so looking forward to turning my switch into the ultimate portable emulating machine. If I have to I'll just buy another switch to play proper games on (including online). I'm hoping very much that the rumour about Diablo 3 coming to the switch comes true.

Anyway, huge thanks to you for the information that you have provided.

 

[Draxzelex]

Thanks Draxzelex for your posts, you have been very helpful.

To give you an update, I've basically given up on trying to get the switch into RCM mode for now. I have ordered some joycon slide rails which I will solder a wire between pin 1 and 10 as I'm weary of damaging the pins on the switch itself.

Once these rails arrive I'll get right back into CFW (Hen), so looking forward to turning my switch into the ultimate portable emulating machine. If I have to I'll just buy another switch to play proper games on (including online). I'm hoping very much that the rumour about Diablo 3 coming to the switch comes true.

Anyway, huge thanks to you for the information that you have provided.

To be on the safer side of things, making a permanent modification that will involve pin 10 being high all the time might potentially warrant a ban if Nintendo adds a firmware update that starts checking for this. If you want a permanent modification that is a lot safer, the reed switch seems to be the way to go: https://gbatemp.net/threads/f-g-joycon-mod-magnethax-switch-edition.502459/ Of course, its your choice what you want to do.

In maybe less than a month, we will have the CFW, Atmosphere, that will feature EmuNAND support to allow us to play online without losing our low system firmware in case a better exploit comes along. A good setup to avoid being banned while playing online is to do all of the hacks on SysNAND using the CFW while going online using EmuNAND. Also, with all the ports coming the Switch's way, I can't see a game NOT being ported to the Switch like Diablo 3.

Anyways, gathering and distributing information is what I'm good at! Glad to know it helped a fellow user out

 

[Mr_Briscoe]

Hello everyone, can we expect to see a wii emulator? I'm a huge fan of EA sports pga tour games and would love to be able to play some of the Tiger Woods games which were released on the wii.


Sent from my iPhone using Tapatalk

 

[Draxzelex]

Hello everyone, can we expect to see a wii emulator? I'm a huge fan of EA sports pga tour games and would love to be able to play some of the Tiger Woods games which were released on the wii.


Sent from my iPhone using Tapatalk

My crystal ball says maybe someday.

 

[alexj9626]

Any way to remove the SD card from the Switch without having to turn it off?

Is it possible with homebrew? Im thinking in not have to remove it everytime i need to get a file to my SD when Atmo is released. I know about FTP, havnt tried but i would bet its slower that way.

 

[Draxzelex]

Any way to remove the SD card from the Switch without having to turn it off?

Is it possible with homebrew? Im thinking in not have to remove it everytime i need to get a file to my SD when Atmo is released. I know about FTP, havnt tried but i would bet its slower that way.

No, not as of yet. FTP support isn't implemented by any homebrew yet, although NX Shell has plans to add it in the future. Atmosphere may have a way to circumvent this too, but that still involves playing the waiting game.

 

[alexj9626]

No, not as of yet. FTP support isn't implemented by any homebrew yet, although NX Shell has plans to add it in the future. Atmosphere may have a way to circumvent this too, but that still involves playing the waiting game.

Thanks! No other way then.

Btw, i think there is a FTP homebrew app working up to 5.0, but i know it has some problems. Still, its something.

 

[Draxzelex]

Thanks! No other way then.

Btw, i think there is a FTP homebrew app working up to 5.0, but i know it has some problems. Still, its something.

Oh, I didn't know about it. Thanks for the information. Upon further reading, it seems downloading doesn't work with 5.X with ftpd. But judging from the lack of commits in over a month, it seems like there is no more support for this tool being added. I think we may all be using NX Shell moving forward, once it has FTP support fully implemented.

 

[DocBo]

Follow this tutorial: https://gbatemp.net/threads/switch-hacking-101-how-to-launch-the-homebrew-menu-on-4-x-5-x.504012/
When you get to the part it tells you to download the Hekate payload (it has 2 separate download links, one for 4.x and one for 5.x), you will instead you the following payload: https://github.com/CTCaer/hekate/releases/tag/v2.0
The rest of the steps will involve following the tutorial from the first link I gave you.


Make sure you are not blocking any DNS or IP addresses. If its still not working, there doesn't appear to be a direct fix other than trying again and again. Remember that Hekate is unstable and not meant for end-user use.

For what is the custom DNS from the tutorial!? When i enter both DNS i have no more connection to the internet.

 

[Draxzelex]

For what is the custom DNS from the tutorial!? When i enter both DNS i have no more connection to the internet.

The DNS addresses you entered as per the guide prevent your Switch from automatically downloading system updates from Nintendo. You can try restoring DNS settings to auto to see if that makes the homebrew appstore work. But its not a guarantee that will happen.