Hacking Question How far off are we from permanent CFW

[Huntereb]

Best permanent solution that will never be patched is a modchip. Pick up a SwitchMe for like $10.

 

[HiD]

Best permanent solution that will never be patched is a modchip. Pick up a SwitchMe for like $10.

I'd love to pick a switchme, but EvilSperm (the dude selling them) told me he doesn't sell single units anymore. Not sure where to look for now.

 

[andy_mg2000]

I don’t get the fuss about coldboot to CFW. I bought a trinket m0 and a coin cell board (holds a standard cr2032 battery), soldered them together (its simple and guides are on here) then wrapped it in electrical tape to protect the board. I modded the joycon with a magnetic reed switch (again guide on here) and bought a small strong magnet for about £1 off eBay to launch rcm. I already had a usb to usb-c cable so just bought a micro usb to standard USB adapter for the output on the trinket. In total I think this cost around £20.

All of the above fits neatly into the case for my switch so if I’m ever out and need to coldboot, I have everything I need. I even have a spare cr2032 battery in the case should I ever need it. With sleep mode, it’s not often I actually cold boot anyway.

I’m aware I could fit an internal mod and have a history of hardware modding to enable me to do this, but what’s the point risking your switch at all when it’s so easy with the above. I also could have bought a dongle (sx pro etc.), but the trinket and battery board is so small, and also this method doesn’t rely on difficult to replace capacitors or batteries that might fail.

I was on fw 2.4 but upgraded to 5.1.0 as I just didn’t see the benefit of hanging around for something that might not ever come.

 

[Huntereb]

I'd love to pick a switchme, but EvilSperm (the dude selling them) told me he doesn't sell single units anymore. Not sure where to look for now.

There are re-sellers posted on the website, see if you can find one close to you.

https://rebug.me/shop/resellers/

 

[Madridi]

Why are people saying "up to 3.0.1"?
Isn't it actually 3.0.2?

If someone is on 3.0.2, can't they technically downgrade to 3.0.1 since 3.0.1 -> 3.0.2 burns no fuses?

 

[Draxzelex]

Why are people saying "up to 3.0.1"?
Isn't it actually 3.0.2?

If someone is on 3.0.2, can't they technically downgrade to 3.0.1 since 3.0.1 -> 3.0.2 burns no fuses?

Because SciresM was the one who stated that there's a theoretical coldboot exploit up to 3.0.1 (his exact words were <3.0.2) likely due to a change implemented in firmware 3.0.2. But you're right in that since they share the same number of fuses, one could just downgrade from 3.0.2 to 3.0.1 as long as their fuse count is 4.

 

[Freezerbomb]

Hi Guys!
I'd really appreciate some informative answers on this matter especially from @CTCaer, @rajkosto or @Reisyukaku (who quite know best how payloads work).
I understand that a few months back although the possibility to write in the Switch NAND was there it was avoided as there was no way to restore a corrupt NAND.
Now with the achievements done in the scene (NAND backup & restore, ChoixduJour), is it possible to modify some of the system files (like AutoRCM does) to have a permanently patched CFW?
The intention for this is to be able to normally boot into the CFW without using a payload (obviously) and do away with AutoRCM.

OP, if you want a permanent solution, just find someone with soldering skills and get them to install a trinket or this thing for you...
https://www.aliexpress.com/item/RCM...824.html?spm=a2g0s.9042311.0.0.1dab4c4drWoDO0

 

[Madridi]

Because SciresM was the one who stated that there's a theoretical coldboot exploit up to 3.0.1 (his exact words were <3.0.2) likely due to a change implemented in firmware 3.0.2. But you're right in that since they share the same number of fuses, one could just downgrade from 3.0.2 to 3.0.1 as long as their fuse count is 4.

Got it. Thanks for the info.
However I would think, when presenting such information, people should really say up to 3.0.2 (since the end user does not care about the specifics).
I mean, I can totally see someone saying: "Oh man, I'm on 3.0.2! I guess I'm out of luck.. Updating.."

 

[Reecey]

It's a soft mod that doesn't require you to use any button input or dongles or whatsoever when you power it on. So I don't see a reason why it's not a permanent cfw.

In layman’s terms Permanent cfw means exactly that, permanent! You don’t have to go through any loop holes to boot your cfw up so for example cbhc you do because you need the DS title on the wiius memory to be exploited to run the cfw so that’s not permanent.

 

[Freezerbomb]

Trust me it’s not classed as a “permanent cfw” I’m not going to explain

What's not permanent about it? By your definition, there has never been a permanent cfw (maybe the original Xbox). All cfws rely on "loop holes to boot."

 

[Reecey]

What's not permanent about it? By your definition, there has never been a permanent cfw. All cfws rely on "loop holes to boot."

I edited that part out I have explained above and that will do. cfw is one thing the exploit it uses is completely different we need an exploit to boot the cfw. We have had a few permanent cfw in the past Xbox360, Wii, PSP, 3ds, psvita that’s just of the top of my head!

 

[Spoderman80s]

Turn Auto RCM on and boot on any CFW, it is permanent right ? If you don't want/mind to get banned it's the perfect solution.

 

[ry755]

I edited that part out I have explained above and that will do. cfw is one thing the exploit it uses is completely different we need an exploit to boot the cfw. We have had a few permanent cfw in the past Xbox360, Wii, PSP, 3ds, psvita that’s just of the top of my head!

Well guess what. The 3DS's CFW also relies on an exploit on boot up. B9S uses a signature hack in Nintendo's crappy RSA implementation in order to boot unsigned code.
The Wii doesn't really run a custom firmware, unless you count cIOSs as cfw.
I think you're right about the PSP though, I don't think they need an exploit on bootup for cfw. (At least for the 1000 models)

Not sure about the other consoles.

 

[leerpsp]

Just got to thinking after reading this..... Will if you have a jig and payload injecter and wanted a full cfw and seeing that you can patch sig checks with things such as sx os why can you not have a full cfw?
That is what rmc mode lets you do is run things on the system that your not allowed to.
I think it will work but you would be stuck using a jig and payload injecter every time you boot kinda what this guy is not wanting to do.
Missing with system files and writing to the nand can cause a bricked switch but if you have emunand then that would fix that but its still a risk if you do it with out one.

 

[Deleted-351540]

CBHC is da shit. <drops mic>

I couldn't agree more.

 

[The Real Jdbye]

Hi Guys!
I'd really appreciate some informative answers on this matter especially from @CTCaer, @rajkosto or @Reisyukaku (who quite know best how payloads work).
I understand that a few months back although the possibility to write in the Switch NAND was there it was avoided as there was no way to restore a corrupt NAND.
Now with the achievements done in the scene (NAND backup & restore, ChoixduJour), is it possible to modify some of the system files (like AutoRCM does) to have a permanently patched CFW?
The intention for this is to be able to normally boot into the CFW without using a payload (obviously) and do away with AutoRCM.

We can't modify anything. AutoRCM only works because it exploits a flaw in the RCM mode that gives us full access, we have no public exploit in the early boot process of Horizon that would allow us to do the same thing. Even AutoRCM doesn't allow us to modify the system, only patch memory/files on the fly. But anything could happen in the future.