Hacking Discussion Nintendo Switch blue screen of death

[ed1973]

I have received a Nintendo Switch for repair, which did not turn on anymore and could not be charged according to customer.
Customer was using Xecuter SX Pro, was using original charger and original docking station.

When I opened the Switch, I measured 0V on the battery. When disconnecting and reconnecting the battery, I could fully charge it, but could not switch it on. Screen remained black, also no screen was seen when looking carefully, and no backlight switched on.

When connecting the Switch with USB-C cable to my laptop, and hold the power button for 15 seconds, I could hear the switch on , switch off sound always.

Then I did the following:

1) Put the Xecuter SX Pro JIG on the right side, to make connection.
2) Put the Xecuter dongle in the USB-C slot
3) Put the microSD card into the slot, with the files which belonged to the Xecuter SX Pro
4) Connected a micro USB cable to the dongle in order to charge it, left it there for 1 minute
5) Disconnected USB cable
6) Pressed power button + Volume UP
7) Then suddenly I did have screen output, namelijk a Xecuter screen with 3 options:
- Boot Custom FW
- Boot original FW
- Options

When I choose OFW or CFW, I got a blue screen output on the screen.
Then I choose Options, Disabled AutoRCM (customer enabled that), but that did not make any difference.

What could I do to fix the problem ?

 

[lieder1987]

Wipe the SD card and try that? Might be a corrupted file somewhere since you can get to the menu.

 

[Modificatorul]

Follow this instructions to recreate the nand
https://gbatemp.net/threads/how-to-...nofficially-without-burning-any-fuses.507461/

 

[ed1973]

I have never done this before, I have gone through the link.

I assume I need to backup everything first ? Like:

- RAW eMMC
- BOOT0/BOOT1
- BIS KEYS

Does somebody know, how to check these files, in order to check what is wrong ?
How sure are you, that creating a new nand, would fix this issue ?

I am not very familiar with switch modding, I am not an expert on this.

 

[Modificatorul]

You dont need to assume nothing,all the info for recreating nand is in the link please read the instructions and dont skip steps.

For nand backup,boot0,1,biskyes you can use this guide https://gbatemp.net/threads/backup-...-your-biskeys-tseckeys-keys-txt-guide.513386/

I solved same problem recreating the nand , it' s a kernel panic error https://switchbrew.org/wiki/Panic_codes

In my case i used fw 5.1 in your case i think you need this tool to check the fw version https://github.com/shchmue/FVI

If you backup everyting you dont have nothing to lose.

 

[ed1973]

I have made a backup of everything described in link previous post, thank you for that link.

had to reformat microsd to fat32 format, did not work with exFat.

but, it is not very clear, how to recreate a new good working nand, for the nintendo switch.
According to the customer, he has 5.1.0 on his switch.

 

[Albytrozz]

I have made a backup of everything described in link previous post, thank you for that link.

had to reformat microsd to fat32 format, did not work with exFat.

but, it is not very clear, how to recreate a new good working nand, for the nintendo switch.
According to the customer, he has 5.1.0 on his switch.

You're in over your head son... this won't turn out well just from reading your posts. Everything couldn't be more spelled out for you and you still don't get it.

You seem to know your stuff when it comes to electronics but I highly suggest you don't try to fix a software problem when you clearly don't understand the software involved. But good luck and all of that...

 

[ed1973]

Hello, keep in mind that I have never eend a payload to the switch and managed to backup alle correctly.

I need to follow everything described in the first link and recreate a good working nand. Many terms are Maybe extreme clear for You but i AM learning !

 

[Modificatorul]

I don't understand why you needed to use fat 32 your micro sd it's big enough?, now you have a split nand dump and you need to join the parts.

"Fat32 users only >>FAT32 Mini Guide
Fat32 guide to join or merge rawnand parts into 1 file
Download this first click here > >joiner_scripts_for_windows_linux_macos.zip

to combine the 15 parts or 30 parts of rawnand 00.bin etc into 1 rawnand.bin file
Place the correct script into the folder were you have the 15 or 30 parts backed up..
example
If you have 15 parts rawnand files use the join_15_2GBparts_linux_macosx.bat For Mac
or for windows use the join_15_2GBparts_windows.bat
Simply move the desired script that matches your system windows or mac 15 or 30 parts to the folder were you have your rawnand in parts 15 or 30 double click the bat file and it will merge/join those into one file called rawnand.bin "
From @Canna guide

Use hackmount and bisckeys to extract prod info, open extracted prod info with hexeditor https://mh-nexus.de/en/downloads.php?product=HxD20 and search console serial number, if you found it i will say your backup you made it's good.

I'm not responsible if you mess the nand whorse and i biginning to agree with @Albytrozz .

If you can folow the guide https://gbatemp.net/threads/how-to-...nofficially-without-burning-any-fuses.507461/
and use 5.1.0 firmware you will end up with a good clean nand with auto rcm activated, after that you can restore boot0 and boot1 and you will have a clean and working nand.

Of course it's not easy you need the firmware file the prod.keys to decrypt the firmware, some experience using cmd line.

If you need remote asistance i can connect to your pc , but i can't work remotely without beers )

 

[ed1973]

Thanks a lot !! First I will try to do it on my own, for sure your deserve the beer

 

[mattytrog]

So, it's charging. Rules out bq24193. Almost.
Check m92t36 voltage at VCC-IN (pin 5). If between 3 & 6v, then the power detector in m92t36 is working.

Rebuild NAND. Get bis keys, check entropy on all partitions. Backup boot0/1/prodinfo and optionally prodinfof.

If you are struggling, send it to me. I'll take a look if you like.

 

[ed1973]

I tried to format the microsd "SanDisk 64GB micro SD ULTRA Class 10 UHS-I" card with exFat format, but whatever blocksize I use, it does not work:

32MB : Failed to mount SD card (FatFS Error 13)
16MB : Failed to mount SD card (FatFS Error 13)
8MB : Failed to mount SD card (FatFS Error 13)
4MB : Failed to mount SD card (FatFS Error 13)
2MB : Failed to mount SD card (FatFS Error 13)
1MB : Failed to mount SD card (FatFS Error 13)
512kB: Failed to mount SD card (FatFS Error 13)
256kB: Failed to mount SD card (FatFS Error 13)
128kB: Failed to mount SD card (FatFS Error 13)
64kB: Failed to mount SD card (FatFS Error 13)
32kB: Failed to mount SD card (FatFS Error 13)
16kB: Failed to mount SD card (FatFS Error 13)
8kB: Failed to mount SD card (FatFS Error 13)
4kB: Failed to mount SD card (FatFS Error 13)

I got "Failed to mount SD card (FatFS Error 13)" when tried to dump to microsd card.

I just right clicked microsd card within windows explorer in order to format it with exFat.
I am using Windows 10 pro, Windows specifications version 1803. Built of OS is : 17134.407

When I formatted as Primary FAT32 (32kB) with EaseUS Partition Master 12.8 , it just works.

 

[Modificatorul]

Ceck your micro sd with H2testw.
Don't try to recreate the nand on the console until you open and verify with HacDiskMount entropy on all partitions from the nand you have read , extract prod info and check extracted prod info with hxd, you will fiind some "cal " text and your console serial number.
I want to be sure you have a good backup(but not working) before you modify something.

 

[Bellebite2000]

I have received a Nintendo Switch for repair, which did not turn on anymore and could not be charged according to customer.
Customer was using Xecuter SX Pro, was using original charger and original docking station.

When I opened the Switch, I measured 0V on the battery. When disconnecting and reconnecting the battery, I could fully charge it, but could not switch it on. Screen remained black, also no screen was seen when looking carefully, and no backlight switched on.

When connecting the Switch with USB-C cable to my laptop, and hold the power button for 15 seconds, I could hear the switch on , switch off sound always.

Then I did the following:

1) Put the Xecuter SX Pro JIG on the right side, to make connection.
2) Put the Xecuter dongle in the USB-C slot
3) Put the microSD card into the slot, with the files which belonged to the Xecuter SX Pro
4) Connected a micro USB cable to the dongle in order to charge it, left it there for 1 minute
5) Disconnected USB cable
6) Pressed power button + Volume UP
7) Then suddenly I did have screen output, namelijk a Xecuter screen with 3 options:
- Boot Custom FW
- Boot original FW
- Options

When I choose OFW or CFW, I got a blue screen output on the screen.
Then I choose Options, Disabled AutoRCM (customer enabled that), but that did not make any difference.

What could I do to fix the problem ?

I would love to see your customer's face if he knew you are as clueless as him, since you are begging here for help, incredible.
And you managed to get someone's money to post on a forum? I am just calling this a scam artist.

 

[ed1973]

@Bellebite2000 : The customer for who I am busy with his Nintendo switch, is a customer who is coming for more then 10 years with all his devices to have it repaired. I told him that I am limited experience with Nintendo switches, but wanted me to take a look at it, I could take all the time I needed for it. I have stopped modding consoles, so that's why I do not have the experience when it comes to switch modding, customer knows and told me, take your time. I prefer to give my device to you, instead of somebody else. I do not want to discuss this further here, but if you want, send me a PM.

Finally got my microsd card working on exFat within the Nintendo Switch, just used the program "SD card formatter 5.0.1" and used the option "Overwrite Format", was formatted with blocksize of 128kB.

Just did a speedtest when backing up "emmc Raw Gpp" and got a speed rate of 11.9 MB/sec ! Pretty much faster then FAT32 :-)
Also got my keys.txt now.

Checked firmware version of rawnand.bin :

"
C:\FVI>python FVI.py -b=biskeyfile.txt rawnand.bin
Firmware Version Inspector - by shchmue

Dump is full EMMC raw NAND.
Loaded BIS keys.

Found FAT boot sector!

Scanning root for /Contents/...
/Contents/ found at cluster 0x3 address 0x148000

Scanning root for /save/...
/save/ found at cluster 0x3c81 address 0xf340000

Scanning /save/ for System Savegame 8000000000000060...
Success! Found /save/8000000000000060.

Scanning /Contents/ for /registered/...
/registered/ found at cluster 0x5 address 0x150000

Scanning FAT for fragmentation...
/registered/ clusters: ['0x5', '0x2fd8', '0x11dcd', '0x15499']
Buffered 4 /registered/ clusters. Reading filenames...

Success! Found 318 NCA filenames.

Firmware version found: 5.0.2 (no exFAT)
Most recent boot: 2018-09-23 18:10:14
"

Strange, according to cu he was using 5.1.0 , checked and it is not. It's 5.0.2 ......

 

[ed1973]

Almost completed the whole procedure, but am stuck at:

STEP 8.8: Transferring the FILES for USER

SOLVED NOW, by using previous version of HacDiskMount :-)

tested the key went good, turned green
mounted the partition on free drive letter, chosen passthrough zeroes. Took a little bit longer then all other partitions, maybe because of it's size.

But I could not access the drive letter from within windows explorer. Got the error (translated to english):

H:\ is not accessible. The request could not be performed because of an I/O device error

From command prompt (CMD), I got the same error.

After that, I could not test any keys of any partitions, or mount any partitions.
When restarting HacDiskMount (admin), I could not see the switch anymore when opening "Choose physical drive".

I needed to turn off switch, enter RCM mode again, inject memloader.bin and to choose ums_emmc.ini again, in order to test keys and to mount partitions again. For example when I doubleclick SYSTEM partition again, key can be testen (green), I could mount the partition (passthrough) and see the folders from Windows Explorer.

But when I unmount SYSTEM, and go to USER partition, test keys and mount (passthrough), I got the same error.

Does somebody know, what causes this ? I only have this with the USER partition.

UPDATE : I used HacDiskMount 1044 version instead of 1055 version, and now I can mount USER partition and access the files without problems.

 

[ed1973]

The switch is working again, but in order to use the switch, I must inject a Hekate payload, and then select Launch Firmware and then select the firmware.

I think because of the fact that customer turned on AutoRCM :



the switch was bricked. See the video above.

Does somebody know, how I can get this Nintendo Switch in a 100% original state ? So that I do not have to inject a payload ? Just curious.

 

[mattytrog]

The switch is working again, but in order to use the switch, I must inject a Hekate payload, and then select Launch Firmware and then select the firmware.

I think because of the fact that customer turned on AutoRCM :



the switch was bricked. See the video above.

Does somebody know, how I can get this Nintendo Switch in a 100% original state ? So that I do not have to inject a payload ? Just curious.

Delete all software then

Tinfoil...
Delete all tickets then

Choidujour NX.
Get the firmware files from that place that cannot be named to use with ChoidujourNX... Go up to 6.1.0 MAXIMUM. Avoid 6.2.0

In choidujour, select factory reset and untick prevent fuse burning.

Done.

 

[ed1973]

Without "Get the firmware files from that place that cannot be named", do You mean that IT is not allowed to be mentioned here ?

 

[Albytrozz]

Without "Get the firmware files from that place that cannot be named", do You mean that IT is not allowed to be mentioned here ?

CAREFUL man, are you trying to get us all killed?!? IT can hear you... IT can hear everything.