Hacking Discussion is deja vu dead (on new units)?

[leo60228]

Correct Title (mods pls fix): deja vu is dead (on new units)

welp

EDIT: technical explanation
EDIT2: oh boy
EDIT3: only vaguely relevant but sleepmode on downgraded switches is enabled in fusee master

EXPLANATION:
Deja Vu was an exploit that enabled full code execution on 4.1.0, including on post-July Switches, and was expected to work on Mariko (the Switch hardware revision). Details were intentionally scarce. A relative newcomer committed to Hekate a commit that would "optimize dram configs." Research showed that this commit was the backbone for the downgraded sleepmode in Hekate 4.6. It was quickly discovered that Deja Vu relied on a (still-unpatched) bootrom exploit, and that exploit was in the DRAM configs. Now that it is public, Deja Vu can be fixed in the same way Fusee Gelee was.

 

[GraFfiX420]

welp

Ouch, that hurts. Should have been held until after the mariko release.

 

[OkazakiTheOtaku]

I'm not sure I understand the implication of the above screenshot. Is it implying that the Hekate commit is using a Deja Vu strategy, therefore revealing how it works?

 

[leo60228]

yep

 

[OkazakiTheOtaku]

Press F to pay respects.

 

[leo60228]

F

 

[OkazakiTheOtaku]

Is this on the ReSwitched Discord? What channel?

 

[leo60228]

#switch-hacking-meta

 

[TotalInsanity4]

I'm not sure I understand the implication of the above screenshot. Is it implying that the Hekate commit is using a Deja Vu strategy, therefore revealing how it works?

Yeah I'm trying to figure that out too. It seems like that was a response to something else, not a declaration that Deja Vu wasn't viable anymore

 

[TunaKetchup]

Deju Vu is the 4.1 method of entering RCM mode?

 

[TotalInsanity4]

Deju Vu is the 4.1 method of entering RCM mode?

It's a warmboot exploit that wouldn't require extra hardware, you'd boot the console, launch the exploit and then be dropped into whatever the payload is (as I understand it)

 

[leo60228]

Added an explanation

 

[MostGood]

It's a warmboot exploit that wouldn't require extra hardware, you'd boot the console, launch the exploit and then be dropped into whatever the payload is (as I understand it)

Does this mean it could possibly work on the patched switch hardware revisions or no?

 

[leo60228]

It does work on patched Switches. That was the entire point of Deja Vu. Should I clarify this in the post (EDIT: done)? I thought that was already common knowledge.

 

[MostGood]

It does work on patched Switches. That was the entire point of Deja Vu. Should I clarify this in the post (EDIT: done)? I thought that was already common knowledge.

I've heard it only worked on 4.1.0, unsure if it works on 6.2.0

 

[alexj9626]

Ok so what you are saying is that Deja Vu is now "public" (?) and because of that it would probably be pached in the Mariko units?

 

[TunaKetchup]

I've heard it only worked on 4.1.0, unsure if it works on 6.2.0

4.1 and lower is actually what I thought

I thought it was why people were keeping low firmware

 

[leo60228]

The full exploit only worked on 4.1.0, but it's primary vector is a hardware bug like Fusee Gelee.

--------------------- MERGED ---------------------------

Ok so what you are saying is that Deja Vu is now "public" (?) and because of that it would probably be pached in the Mariko units?

Yes.

 

[guicrith]

I looked at that commit, its just some values that where changes in some uint8_t buffers?
How is this an exploit leak?

 

[leo60228]

I looked at that commit, its just some values that where changes in some uint8_t buffers?
How is this an exploit leak?

It's obfuscated, but the bug was in the parser for that buffer (which is in the bootrom). See the technical details.