Description
Lockpick_RCM is a bare metal Nintendo Switch payload that derives encryption keys for use in Switch file handling software like hactool, hactoolnet/LibHac, ChoiDujour, etc. without booting Horizon OS.

Source: https://github.com/shchmue/Lockpick_RCM
Payload: https://github.com/shchmue/Lockpick_RCM/releases

Due to changes imposed by firmware 7.0.0, Lockpick homebrew can no longer derive the latest keys. In the boot-time environment however, there are fewer limitations. That means the new keys are finally easy to dump!

Usage

• Launch Lockpick_RCM.bin using your favorite payload injector or chainload from Hekate by placing it in /bootloader/payloads
• Upon completion, keys will be saved to /switch/prod.keys on SD
• If the console has Firmware 7.x, the /sept/ folder from Atmosphère or Kosmos release zip containing both sept-primary.bin and sept-secondary.enc must be present on SD or else only keyblob master key derivation is possible (ie. up to master_key_05 only)

Big thanks to CTCaer
For Hekate and all the advice while developing this!

Known Issues

• Chainloading from SX will hang immediately due to quirks in their hwinit code, please launch payload directly

 

[shchmue]

When I launch the payload using Hecate, it just shows this screen and freezes and doesn't give me any keys.

is hekate up to date? can you try pushing the payload directly?

 

[EmeraldB]

is hekate up to date? can you try pushing the payload directly?

Yeah I tried both of those things and it still doesn't work

 

[shchmue]

Yeah I tried both of those things and it still doesn't work

have you ever done anything that modifies NAND like early SX emuNAND? does the console boot?

 

[EmeraldB]

have you ever done anything that modifies NAND like early SX emuNAND? does the console boot?

The console does not boot. I need the device.keys to rebuild my NAND

 

[shchmue]

The console does not boot. I need the device.keys to rebuild my NAND

ahh. how did it get into that state?

 

[EmeraldB]

ahh. how did it get into that state?

My brother turned the wifi on and updated it to 7.0.0 which caused it to not work. I then tried to restore my backup which I previously made on 6.2.0 and it must have burned a fuse or something.

 

[shchmue]

My brother turned the wifi on and updated it to 7.0.0 which caused it to not work. I then tried to restore my backup which I previously made on 6.2.0 and it must have burned a fuse or something.

did you restore both rawnand.bin and boot0/1? if you do one without the other that's why it's not booting and that's also probably why lockpick is failing

 

[EmeraldB]

did you restore both rawnand.bin and boot0/1? if you do one without the other that's why it's not booting and that's also probably why lockpick is failing

Huh, looks like that did it. I can't believe it was that easy. Thank you for helping.

 

[Cheshy]

So uh....I managed to get the title.keys and prod.keys files, but I have no clue how to convert them into the keys.txt. I feel really dense asking for help, but I think I'm throwing my hat in the river for this one. Can anyone please tell me what I need to do next, any help would be greatly appreciated!

 

[shchmue]

rename the file

 

[shchmue]

https://github.com/shchmue/Lockpick_RCM/releases

Updated to v1.1 with support for 8.0.0 and a tweak that made it much faster.

Note: there are no new keys since 7.0.0, this simply allows running on 8.0.0 consoles.

 

[shchmue]

Bumped to v1.1.1 to fix a 6.2.0-specific issue
https://github.com/shchmue/Lockpick_RCM/releases

 

[StraTTtheRipper]

Hey, i'm having trouble getting this to work correctly. I've put the sept folder on the root of the sd card as instructed but the payload is telling me it's not there.
"On firmware 7.x but no sept payload present skipping new key derivation"
Any help would be greatly appreciated!

 

[shchmue]

Hey, i'm having trouble getting this to work correctly. I've put the sept folder on the root of the sd card as instructed but the payload is telling me it's not there.
"On firmware 7.x but no sept payload present skipping new key derivation"
Any help would be greatly appreciated!

that error message means the program failed to locate /sept/sept-primary.bin and /sept/sept-secondary.enc on your SD card. are they present? did you copy the files inside /sept to the SD root instead or something?

 

[StraTTtheRipper]

that error message means the program failed to locate /sept/sept-primary.bin and /sept/sept-secondary.enc on your SD card. are they present? did you copy the files inside /sept to the SD root instead or something?

Nope, I copied the entire Sept folder to the root of the SD card. I used the atmosphere folder

 

[StraTTtheRipper]

Alright, I got it to work now. I used the Sept folder from Kosmos and it worked perfectly. Thanks!

 

[Eskof76]

Hello,

Seems I cannot get my keys properly

(Cannot post image for some reason)
imgur FC5qc6j.jpg


OFW : 8.0
CFW : 7.0.1

Using SX OS

 

[c0013r]

Hello. I got error FFFFFFFF dumping TSEC keys. What I doing wrong? I got this error using any TSEC dumping methods. FW version 6.2.0.

 

[Muxi]

Hello,

Seems I cannot get my keys properly

(Cannot post image for some reason)
imgur FC5qc6j.jpg


OFW : 8.0
CFW : 7.0.1

Using SX OS

You need the sept folder from Atmosphere on your SD card.

 

[shchmue]

Hello,

Seems I cannot get my keys properly

(Cannot post image for some reason)
imgur FC5qc6j.jpg


OFW : 8.0
CFW : 7.0.1

Using SX OS

what the poster above said. instructions are in the OP. as for the keyblobs, I dunno about what SX does with emunand, sounds like it did something I don't understand with your boot0

Hello. I got error FFFFFFFF dumping TSEC keys. What I doing wrong? I got this error using any TSEC dumping methods. FW version 6.2.0.

from this tool? are you using the latest version?