Hacking Question Help, trying to unbrick 6.1.0

[Lazardo]

Hello,

I got a 2nd hand Switch on a semi brick state, it's on auto rcm, I can inject payloads on it but it doesn't boot either OFW or CFW.

I have been following the guide How to install/run ANY Switch firmware UNOFFICIALLY (WITHOUT burning any fuses) up until STEP 7: GENERATE the files/images to be transferred to the console via ChoiDujour

On that step I get:
ChoiDujour 1.1.0 by rajkosto
uses hactool by SciresM (xxxxxxx)
visit xxxxx for updates and more Switch stuff!

Using source firmware files from folder Firmware
Traceback (most recent call last):
File "ChoiDujour.py", line 517, in <module>
File "ChoiDujour.py", line 225, in call_hactool
Exception: [WARN]: Failed to match key "master_kek_04", (value "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
[WARN]: Failed to match key "master_kek_05", (value "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
[WARN]: Failed to match key "master_kek_02", (value "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
[WARN]: Failed to match key "master_kek_03", (value "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
[WARN]: Failed to match key "master_kek_00", (value "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
[WARN]: Failed to match key "master_kek_01", (value "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")

I have edited the keys file, removed the master_kek_* entrys and got:
...

Everything is Ok

Size: 1146880
Compressed: 22709
Verifying file SYSTEM/save/8000000000000120
All files verified! Prepared firmware update is in folder E:\ChoiDujour110\NX-6.1.0_exfat

But the folder e:\ChoiDujour110\NX-6.1.0_exfat\SAFE is empty, which makes me believe that something is wrong. I have checked the SAFE partition on the emmc and it is also empty.

 

[Sucuk60]

I downgraded my Switch too and the folder SAFE was empty

 

[Lazardo]

When you mount the SAFE folder wjth

I downgraded my Switch too and the folder SAFE was empty

When you mount the SAFE folder with HacDiskMount is it also empty (mine is...)

 

[Philliyxx]

I've downgraded with SAFE folder empty as well.

 

[Adran_Marit]

Hello,

I got a 2nd hand Switch on a semi brick state, it's on auto rcm, I can inject payloads on it but it doesn't boot either OFW or CFW.

I have been following the guide How to install/run ANY Switch firmware UNOFFICIALLY (WITHOUT burning any fuses) up until STEP 7: GENERATE the files/images to be transferred to the console via ChoiDujour

On that step I get:
ChoiDujour 1.1.0 by rajkosto
uses hactool by SciresM (xxxxxxx)
visit xxxxx for updates and more Switch stuff!

Using source firmware files from folder Firmware
Traceback (most recent call last):
File "ChoiDujour.py", line 517, in <module>
File "ChoiDujour.py", line 225, in call_hactool
Exception: [WARN]: Failed to match key "master_kek_04", (value "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
[WARN]: Failed to match key "master_kek_05", (value "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
[WARN]: Failed to match key "master_kek_02", (value "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
[WARN]: Failed to match key "master_kek_03", (value "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
[WARN]: Failed to match key "master_kek_00", (value "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
[WARN]: Failed to match key "master_kek_01", (value "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")

I have edited the keys file, removed the master_kek_* entrys and got:
...

Everything is Ok

Size: 1146880
Compressed: 22709
Verifying file SYSTEM/save/8000000000000120
All files verified! Prepared firmware update is in folder E:\ChoiDujour110\NX-6.1.0_exfat

But the folder e:\ChoiDujour110\NX-6.1.0_exfat\SAFE is empty, which makes me believe that something is wrong. I have checked the SAFE partition on the emmc and it is also empty.

This is fine, you can continue the process

 

[Lazardo]

This is fine, you can continue the process

I did it and it's still bricked, the only clue that I have is that the on the console the SAFE folder is empty, the previews owner mus have erased it, is there any way to get/build the contents of that folder?

 

[PrEtZaL]

I did it and it's still bricked, the only clue that I have is that the on the console the SAFE folder is empty, the previews owner mus have erased it, is there any way to get/build the contents of that folder?

This is not your problem the SAFE partition can be empty. How far through the boot process do you get?

 

[Adran_Marit]

I did it and it's still bricked, the only clue that I have is that the on the console the SAFE folder is empty, the previews owner mus have erased it, is there any way to get/build the contents of that folder?

I can assure it is okay if the safe folder is empty.

try the rest of the process again, if it doesn't boot I suspect they attempted a manual downgrade and formatted the nand

 

[PrEtZaL]

As long as they didn't mess up the boot files and prodinfo it should be recoverable. Also try using hekate 4.6 with the custom kip and hekate file from choidujour. I had issues with 4.8 on a downgrade, but work fine after 1st boot

 

[Adran_Marit]

As long as they didn't mess up the boot files and prodinfo it should be recoverable

Boot files dont matter when doing the downgrade.. prod info does.... I suspect the original owner might have attempted a downgrade and clicked format

 

[PrEtZaL]

Boot files dont matter when doing the downgrade.. prod info does.... I suspect the original owner might have attempted a downgrade and clicked format

No they won't matter on downgrade, although if they're buggered it won't boot.

If they formatted should be able to see by using a hex editor

 

[Lazardo]

I will assume that they did that, is there any way to recover it?

 

[Adran_Marit]

I will assume that they did that, is there any way to recover it?

again re-try the downgrade/rebuild process, let me know how it goes, if it fails to boot again message me as I have something I wish to try

 

[PrEtZaL]

If they formatted the boot file partitions without a backup then no.......

 

[Lazardo]

again re-try the downgrade/rebuild process, let me know how it goes, if it fails to boot again message me as I have something I wish to try

I did that several times with the Firmware 6.1.0 (checked the burnt fuses and rawnand and they match)

 

[Adran_Marit]

I did that several times with the Firmware 6.1.0 (checked the burnt fuses and rawnand and they match)

Message me on discord, it will be quicker and easier but I can think of one thing that *might* and that is a veeery big might help

 

[Sucuk60]

Your problem is you created the fw folder in Choi with exfat support!
In Choi you should type: the command —noexfat

That was my problem.

 

[Adran_Marit]

Your problem is you created the fw folder in Choi with exfat support!
In Choi you should type: the command —noexfat

That was my problem.

how is exfat the problem

 

[Sucuk60]

how is exfat the problem

My problem was exfat support. First time I downgraded it with Choi (5.1 exfat) and then the switch still had a blackscreen. As I tried it without exfat support on fw 5.1 (because I read it here) .. everything worked fine.

Sorry for my english!

 

[Adran_Marit]

My problem was exfat support. First time I downgraded it with Choi (5.1 exfat) and then the switch still had a blackscreen. As I tried it without exfat support on fw 5.1 (because I read it here) .. everything worked fine.

Sorry for my english!

Odd, you're the first person I've seen with that issue. No one else I know who's done this has had a problem with the exfat support