Homebrew Question Black Screen on Nintendo Switch when injecting payloads

[TheRenegade]

Hi guys,

This is my first post asking for some advice.

I was given a Nintendo switch which is dead. It goes straight to the blue screen when powered on. I found out that it is an unpatched unit. Just to make sure that the RCM and payload injection works, I followed some steps which brought up a QR code on the screen. I'm guessing it's ok. So I found a very detailed video on youtube in which the guy describes how to remedy the blue screen issue by rebuilding the NAND. I thought I'd give it a shot.

I downloaded all the files and got two new memory cards. 1 Sandisk 64GB and 1 Samsung Evo Plus 64GB (it's all i could get my hands on). I formatted the Sandisk card as normal using the PC (exFAT) and tried to inject a payload to it so I could back up the NAND. However the payload just won't go on. According to TegraRcmGUI 2.6, the payload injection is successful.

RCM Device detected
Preset "PAYLOAD_FILE" set to : K:\Switch\atmosphere-0.8.6-master-994d7d5+hbl-2.1+hbmenu-3.0.1\fusee-primary.bin
Invoking TegraRcmSmash.exe with args : "K:\Switch\atmosphere-0.8.6-master-994d7d5+hbl-2.1+hbmenu-3.0.1\fusee-primary.bin"
TegraRcmSmash (32bit) 1.2.1-3 by rajkosto
Opened USB device path \\?\usb#vid_0955&pid_7321#5&1cc0e58a&0&3#{aa0dbd45-3117-f331-5c49-76bf65225042}
RCM Device with id 4003FC150000000805633C6401101062 initialized successfully!
Uploading payload (mezzo size: 92, user size: 89280, total size: 155496, total padded size: 155648)...
Switched to high buffer
Smashing the stack!
Smashed the stack with a 0x7000 byte SETUP request!
Payload successfully injected

Then I thought that the card might need formatting to FAT32 after doing that I tried again but still no luck. I've tried the other card as well and several different payloads but I always end up with the same issue. I did manage to get some text on the screen a few times. I have tried the latest version of Hekate and Atmosphere.

"Welcome to Atmosphere" - in the DOS style text but it didn't go any further.
"{ERROR} Fatal Error: An exception occurred"

I have a feeling that this is recoverable as it's clearly not patched, enters RCM mode and I have tested it for the exploit.

Any help would be very much appreciated. I am computer savvy but this is something a little bit newer to me so please be gentle.

Thanks in advance





​

 

[Draxzelex]

Hi guys,

This is my first post asking for some advice.

I was given a Nintendo switch which is dead. It goes straight to the blue screen when powered on. I found out that it is an unpatched unit. Just to make sure that the RCM and payload injection works, I followed some steps which brought up a QR code on the screen. I'm guessing it's ok. So I found a very detailed video on youtube in which the guy describes how to remedy the blue screen issue by rebuilding the NAND. I thought I'd give it a shot.

I downloaded all the files and got two new memory cards. 1 Sandisk 64GB and 1 Samsung Evo Plus 64GB (it's all i could get my hands on). I formatted the Sandisk card as normal using the PC (exFAT) and tried to inject a payload to it so I could back up the NAND. However the payload just won't go on. According to TegraRcmGUI 2.6, the payload injection is successful.

RCM Device detected
Preset "PAYLOAD_FILE" set to : K:\Switch\atmosphere-0.8.6-master-994d7d5+hbl-2.1+hbmenu-3.0.1\fusee-primary.bin
Invoking TegraRcmSmash.exe with args : "K:\Switch\atmosphere-0.8.6-master-994d7d5+hbl-2.1+hbmenu-3.0.1\fusee-primary.bin"
TegraRcmSmash (32bit) 1.2.1-3 by rajkosto
Opened USB device path \\?\usb#vid_0955&pid_7321#5&1cc0e58a&0&3#{aa0dbd45-3117-f331-5c49-76bf65225042}
RCM Device with id 4003FC150000000805633C6401101062 initialized successfully!
Uploading payload (mezzo size: 92, user size: 89280, total size: 155496, total padded size: 155648)...
Switched to high buffer
Smashing the stack!
Smashed the stack with a 0x7000 byte SETUP request!
Payload successfully injected

Then I thought that the card might need formatting to FAT32 after doing that I tried again but still no luck. I've tried the other card as well and several different payloads but I always end up with the same issue. I did manage to get some text on the screen a few times. I have tried the latest version of Hekate and Atmosphere.

"Welcome to Atmosphere" - in the DOS style text but it didn't go any further.
"{ERROR} Fatal Error: An exception occurred"

I have a feeling that this is recoverable as it's clearly not patched, enters RCM mode and I have tested it for the exploit.

Any help would be very much appreciated. I am computer savvy but this is something a little bit newer to me so please be gentle.

Thanks in advance





​

Follow this tutorial. Never ever follow video guides as they are outdated the moment they are uploaded and not made by any trusted developers.

 

[TheRenegade]

Follow this. Never ever follow video guides as they are outdated the moment they are uploaded and not made by any trusted developers.

Thanks for getting back to me. I have tried doing this but no matter what I do I just cannot get the switch to boot into Hekate.

No RCM device detected
RCM Device detected
Invoking TegraRcmSmash.exe with args : "F:\Switch\hekate_ctcaer_5.2.0_Nyx_0.9.0\hekate_ctcaer_5.2.0.bin"
TegraRcmSmash (32bit) 1.2.1-3 by rajkosto
Opened USB device path \\?\usb#vid_0955&pid_7321#5&1cc0e58a&0&3#{aa0dbd45-3117-f331-5c49-76bf65225042}
RCM Device with id 4003FC150000000805633C6401101062 initialized successfully!
Uploading payload (mezzo size: 92, user size: 122339, total size: 188555, total padded size: 192512)...
Smashing the stack!
Smashed the stack with a 0x7000 byte SETUP request!
Payload successfully injected

According to TegraRcmGUI, it's worked but the screen stays blank.

 

[SheriffBuck]

Thanks for getting back to me. I have tried doing this but no matter what I do I just cannot get the switch to boot into Hekate.

No RCM device detected
RCM Device detected
Invoking TegraRcmSmash.exe with args : "F:\Switch\hekate_ctcaer_5.2.0_Nyx_0.9.0\hekate_ctcaer_5.2.0.bin"
TegraRcmSmash (32bit) 1.2.1-3 by rajkosto
Opened USB device path \\?\usb#vid_0955&pid_7321#5&1cc0e58a&0&3#{aa0dbd45-3117-f331-5c49-76bf65225042}
RCM Device with id 4003FC150000000805633C6401101062 initialized successfully!
Uploading payload (mezzo size: 92, user size: 122339, total size: 188555, total padded size: 192512)...
Smashing the stack!
Smashed the stack with a 0x7000 byte SETUP request!
Payload successfully injected

According to TegraRcmGUI, it's worked but the screen stays blank.

I have the same issue with board I've recently purchased for repair. Seems to be stuck in RCM mode and TegraRCMSmash confirms that the stack has been smashed with a 0x7000 byte request, but it then hangs with no message saying the payload has been successfully injected. Did you make any progress?