​

The ReSwitched Hacking Team have done it again. motezazer, ktemkin and SciresM have achieved code execution on 4.1.0, the latest version at the time of writing this, via deja vu at TrustZone level. This means devices on 4.1.0 and below will be able to gain access to the whole system. SciresM strongly advises to not update in the future.

After less than a year, the Switch hacking team has moved extremely fast and now have got full access on the latest version. The progress being made is incredible, and in comparison, the 3DS took around 2 years to get ARM9 access. The scene is looking very promising so far and we are very lucky to have such talented people working on the Switch.

Source

 

[Dothackjhe]

Any good reason why the Deja Vu exploit is to be delayed for release or will not be released at all?

 

[kumikochan]

Any good reason why the Deja Vu exploit is delayed for released or will not be released at all?

it won't probably be released since they're waiting for the new hardware revision units meaning they probably also have another entry point they're not telling anybody about cause otherwise they can't test if it still works on those newer units that eventually will be released

 

[Dothackjhe]

it won't probably be released since they're waiting for the new hardware revision units meaning they probably also have another entry point they're not telling anybody about cause otherwise they can't test if it still works on those newer units that eventually will be released

Is that just a speculation or is it something which came originally from the people behind the exploit themselves?

 

[kumikochan]

Is that just a speculation or is it something which came originally from the people behind the exploit themselves?

what part ?

 

[Dothackjhe]

what part ?

The delaying and the not releasing part.

 

[kumikochan]

The delaying and the not releasing part.

Speculation seeing they originally said they would release it when atmosphere launches but with the pre-release notes there is zero mention of the kernel exploit launching together with the release of Atmosphere so we'll know for sure by the end of august. But if they don't release it then, well then we can be pretty sure they're holding on to it for the hardware revisions that don't do RCM anymore and they can only test if that kernel exploit works by having another entry point they didn't tell anyone about. So at the moment it is speculation yeah

 

[Dothackjhe]

I guess this is the part where patience truly shines as a virtue. While I do understand where the deduction is coming from, I'd like to consider the delay as a more refinement of the ongoing project involving the exploit. I think we'd all rather have a polished exploit late than have a problematic exploit early in release. Just my two cents, though.

 

[annson24]

I guess this is the part where patience truly shines as a virtue. While I do understand where the deduction is coming from, I'd like to consider the delay as a more refinement of the ongoing project involving the exploit. I think we'd all rather have a polished exploit late than have a problematic exploit early in release. Just my two cents, though.

Devs usually wait for the exploit to be patched first before they decide whether to release it or not. By doing that, the exploit will potentially work with more firmware versions.

One other thing, since there is a working, unpatched exploit (fusee gelee) already. That is one more reason not to release the other one just yet.

With that being said, there are a few switch floating around which has already patched fusee gelee. However, since Mariko units will arrive soon, I'm guessing they will also wait for its release to see if Mariko units are still on v4.1.0 and/or Deja Vu is still not patched.

But all these are only my speculation also. Nothing in my statement came directly from any of the devs.

 

[kumikochan]

Devs usually wait for the exploit to be patched first before they decide whether to release it or not. By doing that, the exploit will potentially work with more firmware versions.

One other thing, since there is a working, unpatched exploit (fusee gelee) already. That is one more reason not to release the other one just yet.

With that being said, there are a few switch floating around which has already patched fusee gelee. However, since Mariko units will arrive soon, I'm guessing they will also wait for its release to see if Mariko units are still on v4.1.0 and/or Deja Vu is still not patched.

But all these are only my speculation also. Nothing in my statement came directly from any of the devs.

The thing is that the Kernel exploit still needs an entry point to be executed. So if RCM doesn't work with future hardware revisions would mean they still have an entrypoint besides RCM or the Webkit exploit that they're gonna use to test that kernel exploit so I doubt they'll release it anytime soon. To test Deja vu you need an entry point and on the Mariko units there is no RCM and no webkit exploit so meaning they still have an unreleased entry point they're not telling anyone about

 

[mariogamer]

Devs usually wait for the exploit to be patched first before they decide whether to release it or not. By doing that, the exploit will potentially work with more firmware versions.

One other thing, since there is a working, unpatched exploit (fusee gelee) already. That is one more reason not to release the other one just yet.

With that being said, there are a few switch floating around which has already patched fusee gelee. However, since Mariko units will arrive soon, I'm guessing they will also wait for its release to see if Mariko units are still on v4.1.0 and/or Deja Vu is still not patched.

But all these are only my speculation also. Nothing in my statement came directly from any of the devs.

Mariko unit will come with 5.x. That firmware added specific configuration for it.

Deja vu is currently not fully patched on 5.x as repeated before. They are waiting to see if nintendo will fully patch it with mariko ( it can't be fully patched on software side)

 

[annson24]

The thing is that the Kernel exploit still needs an entry point to be executed. So if RCM doesn't work with future hardware revisions would mean they still have an entrypoint besides RCM or the Webkit exploit that they're gonna use to test that kernel exploit so I doubt they'll release it anytime soon. To test Deja vu you need an entry point and on the Mariko units there is no RCM and no webkit exploit so meaning they still have an unreleased entry point they're not telling anyone about

Mariko unit will come with 5.x. That firmware added specific configuration for it.

Deja vu is currently not fully patched on 5.x as repeated before. They are waiting to see if nintendo will fully patch it with mariko ( it can't be fully patched on software side)

Good read. Thanks.

 

[coldfire0101]

is there any news on th release date or news for deja vu yet ??

 

[Der_Blockbuster]

is there any news on th release date or news for deja vu yet ??

No, there is not.

 

[aos10]

I still laugh at the "fabled" mariko unit that come with update 5.0

 

[M7L7NK7]

ask hexkyz

 

[wikdclown]

Wasn't it almost a month ago that sciresm said no point in holding the hack back and said he'd release in one week? I see that never happened.

 

[8BitWonder]

Wasn't it almost a month ago that sciresm said no point in holding the hack back and said he'd release in one week? I see that never happened.

You're thinking of browserhax + nvhax, which only escalated to userland.
That has been released for a little while now through Pegaswitch.

Anyway, browserhax + nvhax for < 6.2.0 will be released later this week (along with the writeup) so people with ipatched units can play around a bit in userland. It's not much, but hopefully will lead to more people researching other attack vectors in the latest firmwares.

— Mike Heskin (@hexkyz) December 17, 2018

 

[Ratatattat]

Wasn't it almost a month ago that sciresm said no point in holding the hack back and said he'd release in one week? I see that never happened.

These types of promises have gone on and on. Don't count on it.

 

[ZachyCatGames]

These types of promises have gone on and on. Don't count on it.

first of all, that person was mixing up deja vu with something else. secondly deja vu has been released and has been implemented in something (that 1.0.0 reboot to payload from pegaswitch thing uses it)

 

[ThatBenderGuy]

So me having a Switch on 8.0.0 means im still fucked right? My switch is on partially patched (XAW1011) and it automatically updated to 8.0.0 without my knowing (That or my gf did it by accident)

Will this work on my unit?