Incognito_RCM

since Incognito by blawar doesn't work on vanilla atmosphere, I made a payload to use with hekate (or any other payload injector) with the same functionality.
Incognito_RCM wipes personal information from your Nintendo Switch by removing it from prodinfo.

Functionality:​

• wipe personal information on sysnand/emunand
• backup prodinfo from sysnand/emunand
• restore prodinfo to sysnand/emunand

Since NAND memory is encrypted, this is based on shchmue's Lockpick_RCM to first get the neccessary encryption keys.
You can apply Incognito_RCM directly after installing atmosphere or any time after and it has the advantage that you don't need to set 90DNS after an internet connection and possibly communication with nintendo servers is already established. (You can apply 90DNS anyway)

This has only been tested by me on firmware 8.1.0, so please test it and report back.
Since it has only been tested by me, keep a hekate nand backup ready to be safe.

source: https://github.com/jimzrt/Incognito_RCM
releases: https://github.com/jimzrt/Incognito_RCM/releases

Disclaimer:
This is early stage and there is no guarantee that everything works as expected! Please have a hekate NAND backup ready!​

Screenshots:

Spoiler

Changelog:

Spoiler

v0.6.1

• bugfix: write to emummc instead of sdmmc

v0.6.0

• incorporate hekate & lockpick_rcm changes
• reboot to payload

v0.5.1

• firmware 9.1.0 support

v0.4.0

• adopt lockpick_rcm and hekate changes (includes fixing of possible bugs and better resource management)
• reduced payload size
• use tui progressbar

v0.3.0

• more error handling
• backup validation when reading and writing
• retry up to 5 times when reading and writing before aborting

v0.2.0

• more validation
• code cleanup and refactoring

v0.1.0

• much faster read and write speed (not sector by sector anymore)
• much more validation and verification (still not perfect)
• more error handling (still not perfect)
• backups aren't overwritten, old backups are renamed
• check for backup before applying incognito
• auto-restore backup if something goes wrong

v0.0.2

• Removed external libraries and better handling of reading big chunks of memory.

as always, have a NAND backup ready!

 

[strider009]

Any way this tool could support emunand as well?

 

[shchmue]

I thought pdrv is physical drive number? anyway, all this tweak magic that happens for xts depending on sector index happens there, so I just did it there as well - temporarily.
I'm actually improving it right now (since there seems to be interest), but not everything is working as expected. Can I annoy you with one or two questions via pm regarding the code if I don't get it to work?

sure. discord is best though

 

[linuxares]

I love it when homebrew devs help each other

 

[mattytrog]

Cool project. I`ve done a similar thing with Switchboot earlier in the year (though unreleased - I don`t want bricks on my conscience)...

It seems from a quick look through the code, you are dumping raw prodinfo, decrypting to a cache file, editing, re-encrypting file, flashing raw file back. At least for the emmc side anyway.

I`ve got FatFS writing to the emmc partitions as mounted. Instead of pdrv(1) in diskio.c (disk_write) being stubbed with a write-protect, I`ve got the re-encryption going so you can mount/edit/write directly to sysnand using the standard FatFS API, using _emmc_xts

Like yours, this is based partly on Lockpick. Yours should be a lot safer than mine!

Well done OP

 

[jimzrt]

New release ready!
https://github.com/jimzrt/Incognito_RCM/releases/tag/v0.1.0

• much faster read and write speed (not sector by sector anymore)
• much more validation and verification (still not perfect)
• more error handling (still not perfect)
• backups aren't overwritten, old backups are renamed
• check for backup before applying incognito
• auto-restore backup if something goes wrong

as always, have a NAND backup ready!

Hope to get some feedback and test reports.

--------------------- MERGED ---------------------------

Any way this tool could support emunand as well?

it already does!

 

[mattytrog]

Maybe its time to release my emmc reset payload...

If others will update it as and when, I may do. I`ve got too much on! Can of worms!

 

[Txustra]

How do I do to apply this to emummc instead of sysnand?

 

[SaulFemm]

Glad to see this! Finally an alternative for people like myself who don't like using closed-source code written by an intellectual child. I'll probably wait a bit for it to be tested some more though.

 

[0x3000027E]

...and thanks again for Ustealth

 

[raxadian]

Ah I miss the days hacking a console just involved using a bootdisk (Dreamcast) or installing a chip (Playstation).

Anyway this is still too green, but I might give it a try next year.

 

[leo60228]

Could you make it more clear that PRODINFO blanking doesn't prevent bans?

 

[goncalodoom]

Could you make it more clear that PRODINFO blanking doesn't prevent bans?

It does lol

 

[Crusatyr]

Glad to see this! Finally an alternative for people like myself who don't like using closed-source code written by an intellectual child. I'll probably wait a bit for it to be tested some more though.

Not to be that asshole, but Incognito is open source. Maybe next time you can actually put forth the effort to know what you're talking about before letting your ignorance show?

 

[linuxares]

Could you make it more clear that PRODINFO blanking doesn't prevent bans?

It doesn't really prevent a ban... it just makes it less of a chance to get one. Nothing is 100% and Nintendo log a buttload.

 

[Darksabre72]

It doesn't really prevent a ban... it just makes it less of a chance to get one. Nothing is 100% and Nintendo log a buttload.

dang i thought people might have had the upper hand with nintendo

 

[Andalitez]

Try tinfoil mod - that works on Atmosphere (untouched) and can be version spoofed, also DRM is removed.

Hey bud, where can I find this?
Sorry for the derail

 

[Dax_Fame]

This is great needed for Atmos users!

I suspect people will accidentally nuke their sysMMC prodinfo with this keep it real with the backups!

 

[xstre pwnsx]

Interesting.

 

[Localhorst86]

So, this wipes information from PRODINFO. What happens if I lose the backup, can I still boot stock firmware? What if Nintendo checks PRODINFO for valid information at a later date? Can they do that?

 

[LightBeam]

How do I do to apply this to emummc instead of sysnand?

Same question, don't want to erase the prodinfo on the sysnand by accident