Hacking RELEASE Kosmos - A Hekate CFW-package

[Zumoly]

I am wondering if USB is really faster than the SD installation.

It actually amounts to the same process: if your files are on your pc/external HD you should use USB installation rather than copying and installing afterwards.
Also with USB installation you don't have to split your files anymore.

 

[ShadowOne333]

It actually amounts to the same process: if your files are on your pc/external HD you should use USB installation rather than copying and installing afterwards.
Also with USB installation you don't have to split your files anymore.

If I already have all my NSPs split and in the SD card, is there any point on making the USB installation even if I already have them ready for SD installation?

 

[Zumoly]

If I already have all my NSPs split and in the SD card, is there any point on making the USB installation even if I already have them ready for SD installation?

Not at all mate if you have enough space to install them.
I was just pointing it out for the future.

 

[ShadowOne333]

Not at all mate if you have enough space to install them.
I was just pointing it out for the future.

Ah very well, thanks for the tip

 

[lordelan]

Very detailed answers!
Thank you so much!
It really help clarify a lot of questions I had about starting to hack my Switch (finally!).
Also, I noticed that dOPUS/n1dus hasn't seen updated as of late, and hasn't been developed in a while.
I asked about Goldleaf because I know that one is still constantly being updated, and for what I've seen, I think you can install split NSPs as long as they have the archive bit set.
Is USB installation really that fast compared to the SD one?
I already have all of my split NSPs in my FAT32 SD, just ready for installing, but I am wondering if USB is really faster than the SD installation.

So all I have to do is this:

• Use Hekate to make a NAND backup of my Switch at 3.0.0 (Can the nand dump be small in size and be compatible with FAT32?)
• Once the nand is backed up, run Choi to update from 3.0.0 to 6.2.0 (or 7.0.0 when that is safe) without burning fuses. This installs AutoRCM automatically as well.
• Once Choi has updated the console, make another nand backup from 6.2.0 (or whatever fw version I update to) from Hekate (before launching CFW)
  
• Reboot into RCM, use Kosmos to boot Atmosphere + sigpatches.

Now for the card driver, how would I go about specifying the console to NOT update it at all once I make the jump from 3.0.0 to 6.X+?
I don't even plan on using the cartridge slot at all, since I already have all my games in NSP format, so I will only install them. Basically, I will not use cartridges at all, so I want to know exactly what I need to do to make sure that card driver doesn't get updated once I get everything setup with Kosmos.

Yes you're completely right.
n1dus has been abandoned by the dev but the mechanism how games are installed in Horizon did not change and since n1dus is very stable (never had a problem with it) there's absolutely no downside to it. Just sayin' it worked wonderful with my split NSPs.
Did not try split NSPs with Goldleaf because when that appeared, USB install was already a thing.
But I did get a few rare errors or issues with Goldleaf in the past with a few NSPs and n1dus went down on them without problems but Goldleaf might be more future proof and those bugs might have been fixed now. Also don't worry: Even if it fails to install any NSP (no matter if you used Goldleaf or n1dus) it's nothing that harms you. You can just try again with another installer.

If you have the Kosmos files on your SD, just reboot to RCM and fire up the hekate payload, go to launch and launch the CFW (=Atmosphère). Sigpatches are already applied.

However, if you really want to pretend your cartridge driver from being updated, according to @tomGER you only need to edit the hekate_ipl.ini in sd:\bootloader\ and add this line anywhere under [CFW]:

kip1patch=nogc

I didn't do that when I updated from 3.0.0 back then (that option popped out only a few days after I updated, so I was doomed lol) so I don't remember whether you can't use cartridges on 4.0+ with that kip patch or if the cartridge loading speeds are just slow.
However you said you stick to NSPs which is a good thing, so put that option in the ini file as I told you and enjoy your games on 6.2.0/7.0.0 mate.

Edit: Your hekate_ipl.ini should look like this:

Spoiler

[config]
autoboot=0
autoboot_list=0
bootwait=5
customlogo=1
verification=2
backlight=100
autohosoff=0
{AtlasNX/Kosmos v11.9}
{ }
{Discord: https://discord.gg/qbRAuy7}
{ }
{-- Custom Firmwares --}
[CFW]
kip1=modules/required/loader.kip
kip1=modules/required/pm.kip
kip1=modules/required/sm.kip
kip1=modules/required/fs_mitm.kip
secmon=modules/required/exosphere.bin
kip1patch=nosigchk
kip1patch=nogc
atmosphere=1
{ }
{---- Miscellaneous ---}
[Stock]
{ }

 

[Oracleofire]

Quick question about the new rebooting to payload capability of atmosphere. Atmosphere had an old method of booting to payload but it wasn't recommended for exFAT cards because atmosphere didn't properly shutdown HOS or something, which meant a higher chance of corruption due to exFAT's lack of journaling. I was just wondering if this new method had the same issue?

EDIT: Ah, here's an old thread I found that mentions the problem with the old method: https://gbatemp.net/threads/rcmreboot-for-atmosphere-0-8-1-reboots-your-switch-to-rcm.524989/

 

[lordelan]

Quick question about the new rebooting to payload capability of atmosphere. Atmosphere had an old method of booting to payload but it wasn't recommended for exFAT cards because atmosphere didn't properly shutdown HOS or something, which meant a higher chance of corruption due to exFAT's lack of journaling. I was just wondering if this new method had the same issue?

EDIT: Ah, here's an old thread I found that mentions the problem with the old method: https://gbatemp.net/threads/rcmreboot-for-atmosphere-0-8-1-reboots-your-switch-to-rcm.524989/

While I can't answer your specific question, I have to be that guy that tells you: Change over to FAT32 man, really.

 

[lordelan]

Thank you for all the info!

Silly question: Can I boot this up using SX OS Pro? By placing the files that the OP has uploaded into the root of the SD card and boot it that way?

Yes. That's what I'm doing.

Make a backup of your boot.dat (or download one from the SX OS website).
Install Python 3 if you didn't already.
Place your boot.dat in the same folder as the hekate_ctcaer_x.x.bin from here (or from Kosmos of course).

Create an empty text file and insert this (credits to CTCaer):

Spoiler

###############################################
# TX SX Pro Custom Payload Packer - by CTCaer #
###############################################
import struct
import hashlib
from os import unlink
"""
typedef struct boot_dat_hdr
{
unsigned char ident[0x10];
unsigned char sha2_s2[0x20];
unsigned int s2_dst;
unsigned int s2_size;
unsigned int s2_enc;
unsigned char pad[0x10];
unsigned int s3_size;
unsigned char pad2[0x90];
unsigned char sha2_hdr[0x20];
} boot_dat_hdr_t;
"""
def sha256(data):
sha256 = hashlib.new('sha256')
sha256.update(data)
return sha256.digest()
boot_fn = 'boot.dat'
# Custom payload filename.
stage2_fn = 'hekate_ctcaer_4.6.bin'
boot = open(boot_fn, 'wb')
with open(stage2_fn, 'rb') as fh:
stage2 = bytearray(fh.read())
stage2 = bytes(stage2)
# Re-create the header.
header = b''
# Magic ID.
header += b'\x43\x54\x43\x61\x65\x72\x20\x42\x4F\x4F\x54\x00'
# Version 2.5.
header += b'\x56\x32\x2E\x35'
# Set sha256 hash of stage2 payload.
header += sha256(stage2)
# Set stage2 payload destination to 0x40010000.
header += b'\x00\x00\x01\x40'
# Stage2 payload size.
header += struct.pack('I', len(stage2))
# Disable Stage2 encryption.
header += struct.pack('I', 0)
# Add padding. Stage3 size is 0.
header += b'\x00' * 0xA4
# Add header's sha256 hash.
sha256 = hashlib.new('sha256')
sha256.update(header)
header += sha256.digest()
# Write header and the plaintext custom payload.
boot.write(header)
boot.write(stage2)
boot.close()

Whenever you're planing on updating or you want to use any other payload with your SX Pro, just find and edit this line:

stage2_fn = 'hekate_ctcaer_4.6.bin'

After saving and closing that textfile, rename it to something like sxpro_custompayload.py and run it.
Look at the boot.dat in the same folder. It should be significantly smaller now. That's fine.
Now copy the boot.dat and the hekate_ctcaer_x.x.bin to the root of your SD card. That's it.

One note on that: You won't be able to boot into SX OS any longer when you do this. You can download SX OS as a payload bin file from their website but even if you chainload that through hekate or fire it up with TegraSmash, it won't boot as it's looking for an unaltered (!) boot.dat on your SD.

So if you want to preserve yourself the possibility to boot into SX OS, stick to your original boot.dat (or re-download it from their website) and use their boot menu instead to launch hekate from there.
To access their bootmenu just hold VOL+ while using the SX Pro to boot.
Btw: It's VOL- for hekate (if you want to re-enter the menu in case you enabled autoboot).
Another option would be to have both boot.dat files on your SD:

bootsxos.dat
boothekate.dat

One of them is named boot.dat which is your default one and you keep renaming them (e.g. from within NX-Shell) before your reboot.
I wrote TX about that problem but it can't be helped. Someone there recommended me this in dongle in a PM: click me - maybe you wanna go for that one instead.

Also how would you go about installing NSP's that are larger than 4GB on a fat32?

I already wrote that in just that post that you quoted lol. Take the python split script I linked there, put it in the same folder as the NSP you want to split. I'd recommend to rename the NSP to something short and simple. For example:

zeldabotw.nsp

instead of

The Legend of Zelda - Breath of the Wild [v0].nsp

Then run the script and you should end up with a folder which has a name that ends with .nsp where you used the script.
Don't let that bother you. Just treat that folder as a nsp file.
Put it along all other NSPs on your SD and install it right away. I still recommend n1dus for that but it seems Goldleaf does the job now as well.

 

[tomGER]

Wow, thank you for those detailed answershttps://gbatemp.net/members/lordelan.359178/

 

[eldavo2090]

Question: How I can redirect the Homebrew Loader to an app other than Album?
I tried editing the loader.ini and loaderORG.ini but that did not work...

 

[tomGER]

Question: How I can redirect the Homebrew Loader to an app other than Album?
I tried editing the loader.ini and loaderORG.ini but that did not work...

You have to edit "title=<titleid>" to your desired title id under "atmosphere/loader.ini"

 

[eldavo2090]

You have to edit "title=<titleid>" to your desired title id under "atmosphere/loader.ini"

Yeah, I did precisely that and it stops working, I press the cofigured button (R) and I put the title id for Smash Bros Ultimate (01006A800016E000) and it doesnt boot Homebrew Loader... neither in the Album when I modify the loader.ini inside the atmosphere folder...

 

[tomGER]

Yeah, I did precisely that and it stops working, I press the cofigured button (R) and I put the title id for Smash Bros Ultimate (01006A800016E000) and it doesnt boot Homebrew Loader... neither in the Album when I modify the loader.ini inside the atmosphere folder...

Try using !R instead of R so it has to start hbl whenever you launch Smash Bros

 

[Asia81]

Is it possible to use custom strings in the firmware version "on-the-fly" without rebuilding the homemenu or settings application, to get something like CFW 6.2E ?
Something same as Luma3DS with a txt file.

 

[eldavo2090]

Try using !R instead of R so it has to start hbl whenever you launch Smash Bros

This is how I have it configured, doesn't work... only the one that comes with the .zip file...
[config]
hbl_tid=01006A800016E000
hbl_path=atmosphere/hbl.nsp
override_key=!R

 

[tomGER]

Is it possible to use custom strings in the firmware version "on-the-fly" without rebuilding the homemenu or settings application, to get something like CFW 6.2E ?
Something same as Luma3DS with a txt file.

on-the-fly doesn't sound that possible - Idk if hot-reloading set_mitm would work but I highly doubt that

This is how I have it configured, doesn't work... only the one that comes with the .zip file...
[config]
hbl_tid=01006A800016E000
hbl_path=atmosphere/hbl.nsp
override_key=!R

Have you tried lowercase characters, otherwise no idea

 

[Nastas95]

Hey, using CFW Settings and switching ON "open album by default", for some odd reason stops BOTW mods from working. Switching back to OFF allows me to use the mods again... is it only me having this problem?

@tomGER

 

[tomGER]

Thats because Atmosphere using the Loader key for fs_mitm (LayeredFS) too - I don't truly get why but it is what it is

Hey, using CFW Settings and switching ON "open album by default", for some odd reason stops BOTW mods from working. Switching back to OFF allows me to use the mods again... is it only me having this problem?

@tomGER

 

[Nastas95]

Thats because Atmosphere using the Loader key for fs_mitm (LayeredFS) too - I don't truly get why but it is what it is

so no mods and album by default at the same time, got it thanks!

 

[ZachyCatGames]

so no mods and album by default at the same time, got it thanks!

Just hold down R (or whatever the default button is) while launching the game you want to use mods for