This thread is deprecated
For a faster, easier and more up-to-date way of getting keys use Lockpick_RCM by shchmue
If you still want to follow this tutorial and end up with less keys, continue reading the Thread.

WARNING

• DO NOT GIVE OUT ANY OF YOUR KEYS TO ANYONE! I CANNOT STRESS THAT ENOUGH!
• DO NOT SHARE YOUR KEYS BETWEEN MULTIPLE SWITCHES THAT YOU DO/DON'T OWN! SOME ARE CONSOLE-UNIQUE
• DO NOT ASK ME FOR KEYS

LEGEND

• SBK
  SecureBootKey
• TSEC
  Tegra Security Co-processor Key
• eMMC
  Embedded MultiMediaCard (Switch's Onboard Storage)

GOAL
End up with 83+ keys including SBK and TSEC keys. Get Master Key's 0-5. (Master Keys 6 onwards is not done in this tutorial)
Reminder, if you want more up-to-date and much more convenient way to get your Switch's Keys, use Lockpick by shchmue (available in nx-appstore/homebrew store)

Tutorial — (Outdated for Switch's on firmware 6.x or newer)

#1 - Dumping System Keys (Biskeydump)#2 - Dumping Required Files#3 - Hactool Preparation#4 - Dumping KeysFinal WordsTroubleshooting

1. 
   We need to get your Secure Boot Key (SBK) and Tegra Security Co-processor Key (TSEC) before we can get the main keys.
   These are 100% console unique.
   
   
   1. Download and extract biskeydump.bin from biskeydumpvx.zip
      - Follow this tutorial but instead of using CTCaer's Hekate Mod .bin file, use the biskeydump.bin file
      - If the QR Code is Blue, Scan the QR Code with your Phone, Laptop e.t.c
      - If you cant find a device you can scan with, type them out into your PC/Laptop (Its highly recommended to scan the QR Code, as a lot of characters can look like another, O0, Il, rn can look like m, e.t.c)
   2. Once you have the biskeydump of your System, store all the keys you received somewhere safe, I recommend a secure cloud storage aswell as a USB Stick, perhaps even print it.
      - Don't give this to ANYONE, Seriously.
   
   If you get any errors please go to the Troubleshooting Tab.
   
2. 
   
   1. Follow this tutorial AGAIN but this time use CTCaer's Hekate Mod.
      - "Tools" -> "Backup..." -> "Backup eMMC BOOT0/1"
      - "Tools" -> "Backup..." -> "Backup eMMC SYS"
      - Back all the way to the first menu, and choose "Power off"
   2. Take the microSD Card out of your Switch and into your PC.
   3. Copy both "BOOT0" and "BCPKG2-1-Normal-Main" from "sd:/backup/xxxxxx/" (xxxxxx is different for everyone) to "hactool" on your Desktop (create the "hactool" folder)
      - Rename them with .bin at the end, "BOOT0.bin", "BCPKG2-1-Normal-Main.bin"
3. 
   
   1. Download and install Python 2.7.x - NOT Python 3.x.x
      When installing, it will ask you what features you want installed, scroll to the bottom and make sure "Add Python to Path" has "Entire Feature Installed to HDD" option chose (No Red X Icon), otherwise the scripts wont find Python and WILL fail
   2. Download and extract hactool TO THE DESKTOP AND NAME THE FOLDER "hactool"
      On Linux/MacOS: clone and build hactool manually
   3. Right-click this (script originally by tesnos6921, patched by shadowninja108, jakibaki and shchmue)
      - Click "Save link as" / "save as"
      - Set "Save as type" to "All Files"
      - Name it "keys.py"
      And finally save it to the hactool folder you placed in the Desktop.
      NOTICE TO GBATEMP STAFF: The "keys" inside this file, are NOT keys, they are SHA digest hashes used to search through files to find text that matches, which would be the keys.
4. 
   
   1. Press WIN(Btn)+R to open "Run", type "cmd" and press Ctrl+Shift then Enter to open Command Prompt as an Administrator
   2. Type (in order) or Copy the following and paste into Command Prompt (Some Windows Versions use Right Click to Paste, some use CTRL+C)
      python -m pip install --upgrade pip
      pip install lz4
      cd Desktop/hactool
      python keys.py SBK_Here_From_Biskeydump TSEC_Here_From_Biskeydump
   3. It should say: "Now you can do hactool --keyset=keys.txt to use them!", if it does, and there's no warning messages, you're good to go!
   If you get any errors please go to the Troubleshooting Tab.
   
5. 
   You now have a keys.txt file with your console-specific keys inside.
   Rename as needed by any software that requires a different name or file extension, it doesn't matter.
   Though I highly recommend renaming it to prod.keys as this filename for Key file's is becoming a popular choice with other software
   There may be more keys, as the Switch's lifecycle goes on, more and more keys will be needed as the firmwares grow and grow.
   
   • The Hactool warning:

     [WARN] prod.keys does not exist.

     can be safely ignored.
     - if you want to place your "keys.txt" file their, put "keys.txt" on your Desktop and run the following with Administrator Command Prompt (Step #4.1 for instructions):
     

     mkdir -p %USERPROFILE%\.switch
     move "%USERPROFILE%\Desktop\keys.txt" "%USERPROFILE%\.switch\prod.keys"

6. 
   #1 ISSUES:
   

   • Red QR Code Outline

     - The reasons this can occur is quite a rarity, all I can say is to keep rebooting and trying again.
     - If there's a new version of biskeydump out, try using the newer biskeydump.bin

   • QR Code not being scanned by your Reader

     - Align your QR Code Readers alignment overlay with the Blue Square's Corners/Edges, NOT the QR Code's Corners/Edges.
     - Clean your camera lens
     - Be in a bright room
   
   #4 ISSUES:
   

   • File "keys.py", line ...
     print message
     ^
     SyntaxError: Missing parentheses in call to 'print'. Did you mean print(message)?

     - You didn't place SBK and TSEC in the 4th line of the Command in Step #4.2
     - You installed Python 3.x.x when you must use 2.7.x, uninstall python, logout of windows (important it removes python from PATH) and follow Step #3.2 then move back to #4.1

   • import lz4.block
     File "C:\Python27\lib\site-packages\lz4\__init__.py", line 17, in <module>
     from ._version import ( # noqa: F401
     ImportError: DLL load failed: The specified module could not be found.

     - The 2nd line of the Command in Step #4.2 failed without you noticing. Try running the 1st line to upgrade pip and if that goes successfully run the 2nd line to install lz4 and see if it successfully installs.

 

[Ofdas23]

No problem!

I haven't run into that issue, but going off of the error message, did you supply the correct SBK and TSEC key? You made sure to replace mySBK and myTSECKEY with the actual keys you got, right?

Yes, I did. I scanned the qr-code with my phone, copied the SBK and TSEC KEY paste it onto my note-app (via iCloud). That means I can copy it on my computer and paste it right into terminal (CMD for mac)

Picture (I used the ones marked with a red circle):

 

[Ashura66]

I can not, FOR THE LIFE OF ME, scan the QR code, the screen is way too bright and my phone pics up the code all blurry. Any tips?

 

[Hondyn]

I could get it to work but weirdly for some games it only gives me the romfs . Does someone know how to fix this?

 

[mike087]

First, thank you. Second, where is the hactool link? If u do something do it complete, other way dont do it.

 

[SirNapkin1334]

Dod

Using BOOT0.bin to get keys from package1...
Deriving keys...
[ WARN ] Keyblob MAC 00 is invalid. Are SBK/TSEC key correct?
[ WARN ] Keyblob MAC 03 is invalid. Are SBK/TSEC key correct?
Decrypting package1...
Failed to decrypt PK11! Is correct key present?
Using Secure_Monitor.bin to get keys to decrypt package2...
Traceback (most recent call last):
  File "C:\hactool-1.1.0
.win\keys.py", line 391, in <module>
    TZ_f = open("package1/Secure_Monitor.bin", "rb")
IOError: [Errno 2] No such file or directory: 'package1/Secure_Monitor.bin'

How to fix?

did you input the keys correctly?

 

[Naster]

Edit: no matter

 

[sergdjdolphin]

NVM

 

[WiiHomebrew+Snes]

Dod

did you input the keys correctly?

I renamed keys.dat from hactoolgui to keys.txt and keys.ini, IDK if it's because hactoolgui uses a different layout for the key info or something else. Is there a keys.txt/keys.ini template?

 

[yyoossk]

Using BOOT0.bin to get keys from package1...
Deriving keys...
Key (ReplaceMeWithTSEC must be 32 hex digits!
Traceback (most recent call last):
File "keys.py", line 374, in <module>
stage0_results = subprocess.check_output([HACTOOL_PATH, "--keyset=keys.txt",
"--intype=keygen", "BOOT0.bin"])
File "C:\Python27\lib\subprocess.py", line 223, in check_output
raise CalledProcessError(retcode, cmd, output=output)
subprocess.CalledProcessError: Command '['hactool', '--keyset=keys.txt', '--inty
pe=keygen', 'BOOT0.bin']' returned non-zero exit status 1

 

[sergdjdolphin]

Using BOOT0.bin to get keys from package1...
Deriving keys...
Key (ReplaceMeWithTSEC must be 32 hex digits!
Traceback (most recent call last):
File "keys.py", line 374, in <module>
stage0_results = subprocess.check_output([HACTOOL_PATH, "--keyset=keys.txt",
"--intype=keygen", "BOOT0.bin"])
File "C:\Python27\lib\subprocess.py", line 223, in check_output
raise CalledProcessError(retcode, cmd, output=output)
subprocess.CalledProcessError: Command '['hactool', '--keyset=keys.txt', '--inty
pe=keygen', 'BOOT0.bin']' returned non-zero exit status 1

just raplace ReplaceMeWithSBK and ReplaceMeWithTSEC on yours keys on step one

 

[yyoossk]

just raplace ReplaceMeWithSBK and ReplaceMeWithTSEC on yours keys on step one

thx
success

 

[Admiral-Purple]

I cannot for the life of me get this to work. I have python 2.7.15, I installed lz4, I put the sbk and tsec keys in the right order when i paste them into the cmd prompt, but still I get this error.

Using BOOT0.bin to get keys from package1...
Deriving keys...
[WARN]: Failed to match key "tsec_key", (value "")
[WARN]: Failed to match key "secure_boot_key", (value "")
[WARN]: Failed to match key "keyblob_key_source_04", (value "")
[WARN]: Failed to match key "keyblob_key_source_00", (value "")
[WARN]: Failed to match key "master_key_source", (value "")
[WARN]: Failed to match key "keyblob_mac_key_source", (value "")
Invalid NCA header! Are keys correct?
Decrypting package1...
[WARN]: Failed to match key "tsec_key", (value "")
[WARN]: Failed to match key "secure_boot_key", (value "")
[WARN]: Failed to match key "keyblob_key_source_04", (value "")
[WARN]: Failed to match key "keyblob_key_source_00", (value "")
[WARN]: Failed to match key "master_key_source", (value "")
[WARN]: Failed to match key "keyblob_mac_key_source", (value "")
Failed to decrypt PK11! Is correct key present?
Using Secure_Monitor.bin to get keys to decrypt package2...
Traceback (most recent call last):
File "keys.py", line 391, in <module>
TZ_f = open("package1/Secure_Monitor.bin", "rb")
IOError: [Errno 2] No such file or directory: 'package1/Secure_Monitor.bin'

I removed the keys from my post for obvious reasons. Can anyone help me with this? I've seen a few other people in this thread had the same issue but they never got an answer that I could find.

 

[BillyWhizz]

what am I doing wrong ? Followed every step on this tutorial, I'm not getting any errors but my keys just don't seem right. I know I can't post them to show anybody so I'll try to explain. Everything inside keys.txt is just one massive paragraph instead of 1 key on one line. Trying to look through it I don't think i have all master keys

 

[CuriousTommy]

Yes, I did. I scanned the qr-code with my phone, copied the SBK and TSEC KEY paste it onto my note-app (via iCloud). That means I can copy it on my computer and paste it right into terminal (CMD for mac)

Picture (I used the ones marked with a red circle):

The only other issue I can think of is that you accidentally put the SBK and TSEC KEY in the wrong spot, or you got a bad BOOT0 dump. Otherwise, I am not sure tbh.

 

[LegaNuno]

I cannot for the life of me get this to work. I have python 2.7.15, I installed lz4, I put the sbk and tsec keys in the right order when i paste them into the cmd prompt, but still I get this error.

Using BOOT0.bin to get keys from package1...
Deriving keys...
[WARN]: Failed to match key "tsec_key", (value "")
[WARN]: Failed to match key "secure_boot_key", (value "")
[WARN]: Failed to match key "keyblob_key_source_04", (value "")
[WARN]: Failed to match key "keyblob_key_source_00", (value "")
[WARN]: Failed to match key "master_key_source", (value "")
[WARN]: Failed to match key "keyblob_mac_key_source", (value "")
Invalid NCA header! Are keys correct?
Decrypting package1...
[WARN]: Failed to match key "tsec_key", (value "")
[WARN]: Failed to match key "secure_boot_key", (value "")
[WARN]: Failed to match key "keyblob_key_source_04", (value "")
[WARN]: Failed to match key "keyblob_key_source_00", (value "")
[WARN]: Failed to match key "master_key_source", (value "")
[WARN]: Failed to match key "keyblob_mac_key_source", (value "")
Failed to decrypt PK11! Is correct key present?
Using Secure_Monitor.bin to get keys to decrypt package2...
Traceback (most recent call last):
File "keys.py", line 391, in <module>
TZ_f = open("package1/Secure_Monitor.bin", "rb")
IOError: [Errno 2] No such file or directory: 'package1/Secure_Monitor.bin'

I removed the keys from my post for obvious reasons. Can anyone help me with this? I've seen a few other people in this thread had the same issue but they never got an answer that I could find.

Same is happening to me!! Pretty sure I didnt do anything wrong, in my opinion there might be two problems or indeed the BOOT0 is corrupted somehow or the hashes used might change on 4.1.0.

Any one was able to get the keys on 4.1.0 with this script?

 

[BillyWhizz]

The only other issue I can think of is that you accidentally put the SBK and TSEC KEY in the wrong spot, or you got a bad BOOT0 dump. Otherwise, I am not sure tbh.

I'll try dumping BOOT0 again when I get home. I checked my SBK and TSEC but I'll double check thanks. What should the keys look like ? Should they be all squashed together with no spaces in 1 paragraph?

 

[Duhasst0]

Continuing to get this error no matter what I do. Python 2.7.15 installed lz4 installed, dumped nand info using 2 different hekate payloads, newest one from rajkostos github and ctcaers, and when I run the script
this is the error I get.

Using BOOT0.bin to get keys from package1...
Could not find keyblob_key_source_xx! Please check the integrity of the data used in the current stage!
looked thru the thread saw someone with the same error with no reslove.

 

[BillyWhizz]

Same is happening to me!! Pretty sure I didnt do anything wrong, in my opinion there might be two problems or indeed the BOOT0 is corrupted somehow or the hashes used might change on 4.1.0.

Any one was able to get the keys on 4.1.0 with this script?

I'm on the latest firmware

 

[GameSystem]

Help Using Python 2.7.15 get the following error:

C:\Users\-------\Desktop\hactool>python keys.py ReplaceMeWithSBK ReplaceMeWithTS
EC
Traceback (most recent call last):
File "keys.py", line 25, in <module>
import lz4.block
File "C:\Users\-------\Desktop\hactool\lib\site-packages\lz4\__init__.py", lin
e 11, in <module>
from ._version import ( # noqa: F401
ImportError: DLL load failed: The specified module could not be found.

I used to get that error, so I tried what someone else recommended. Uninstall Python 2.7.15, delete the python27 folder from C, RESTART COMPUTER, go back to Python download site, pick Windows x86 MSI installer and not Windows x86-64 MSI installer, and then repeat steps from the beginning. Restarting is required after uninstall.

 

[LegaNuno]

Using BOOT0.bin to get keys from package1...
Deriving keys...
[WARN]: Failed to match key "tsec_key", (value "")
[WARN]: Failed to match key "secure_boot_key", (value "")
[WARN]: Failed to match key "keyblob_key_source_04", (value "")
[WARN]: Failed to match key "keyblob_key_source_00", (value "")
[WARN]: Failed to match key "master_key_source", (value "")
[WARN]: Failed to match key "keyblob_mac_key_source", (value "")
Invalid NCA header! Are keys correct?
Decrypting package1...
[WARN]: Failed to match key "tsec_key", (value "")
[WARN]: Failed to match key "secure_boot_key", (value "")
[WARN]: Failed to match key "keyblob_key_source_04", (value "")
[WARN]: Failed to match key "keyblob_key_source_00", (value "")
[WARN]: Failed to match key "master_key_source", (value "")
[WARN]: Failed to match key "keyblob_mac_key_source", (value "")
Failed to decrypt PK11! Is correct key present?
Using Secure_Monitor.bin to get keys to decrypt package2...
Traceback (most recent call last):
File "keys.py", line 391, in <module>
TZ_f = open("package1/Secure_Monitor.bin", "rb")
IOError: [Errno 2] No such file or directory: 'package1/Secure_Monitor.bin'

I was able to solve this error by doing the following:

re download hactool-1.1.0.win.zip from sciresm repo (sorry cant put links)
extract it and be sure to only have those files on that folder
Copy only the files needed for extraction with the proper bin extensions (python script + BOOT0 + BCPKG2-1-Normal-Main)
Run the script and it should be ok