Hacking SX Modchip firmware has been dumped

[masagrator]

Since the modchip uses a GD32, this was hardly unexpected as those are straight up clones of STM32. Nonetheless, I believe this demonstrates how this bug may be affecting way more devices than we thought.

— Mike Heskin (@hexkyz) October 8, 2020

Everything needed to start working on open source modchip alternative is now available. Time will tell how long it will take to write source code and some documentation on modchip example.

 

[GCS]

https://twitter.com/hexkyz/status/1314230677223600129

Everything needed to start working on open source modchip alternative is now available. Time will tell how long it will take to write source code and some documentation on modchip example.

This is incredible news after Team Xecuter's fall! Thank you to all developers who worked on this

 

[rsx]

And I, for one, welcome our new clone overlords!

 

[MachRc]

heil hydra

 

[baileyscream]

Why clone the sx? There are plenty of hardware dev boards out there that are open source and simple to use.
The sx used stolen code from atmosphere, edited it, encrypted it,
All this to make you pay for there board.
If people like the look of the sx boot up and menu then that could be now dumped and made to work on any board but then isn't the boot menu just a modified hekate ?

 

[matias3ds]

Will these make a free license of sxos as well ? or the sxos program hasnt been hacked yet ?

 

[masagrator]

Why clone the sx? There are plenty of hardware dev boards out there that are open source and simple to use.
The sx used stolen code from atmosphere, edited it, encrypted it,
All this to make you pay for there board.
If people like the look of the sx boot up and menu then that could be now dumped and made to work on any board but then isn't the boot menu just a modified hekate ?

1. Noone is cloning SX. Target is to make new based on SX modchip.
2. This is not about SX OS. We are talking about FW used to glitch hash check and load SX OS. This is completely different case.

Will these make a free license of sxos as well ? or the sxos program hasnt been hacked yet ?

It won't. It was hacked long time ago (hexkyz is making unpacking scripts for boot.dat for a long time), noone cares enough to share cracked SX OS.

 

[kidcharlemagne]

Why clone the sx? There are plenty of hardware dev boards out there that are open source and simple to use.
The sx used stolen code from atmosphere, edited it, encrypted it,
All this to make you pay for there board.
If people like the look of the sx boot up and menu then that could be now dumped and made to work on any board but then isn't the boot menu just a modified hekate ?

It's about obtaining the exploit that, so far, only they have found. Do you want to be able to boot custom firmware on a Mariko switch without buying an SX modchip? This how you will be able to do it.

 

[GCS]

With this will we able to use an open-source alternative of the current Sx Core boot menu or gain ability to directly open hekate on sx cored Switch?

 

[mikefor20]

If its not XCI loading direct from USB then it sucks.

 

[masagrator]

With this will we able to use an open-source alternative of the current Sx Core boot menu or gain ability to directly open hekate on sx cored Switch?

No, you won't get REd SX OS.
Hekate issue doesn't lay in that. Hekate doesn't boot because it doesn't have drivers for Mariko and Lite.

 

[GCS]

No, you won't get REd SX OS.
Hekate issue doesn't lay in that. Hekate doesn't boot because it doesn't have drivers for Mariko and Lite.

Oh, I didn't mention I was talking about Erista patched. With this I thought we would be able to change boot.dat to start hekate on boot directly without cleanup method. Sorry for couldn't explaining well

 

[Sparkss]

While I don't really mind paying TX/SX for their modchip, I am glad to hear of this as it should help ensure long term support for modding, since I would not expect updates from TX given the recent events with them.

 

[masagrator]

Oh, I didn't mention I was talking about Erista patched. With this I thought we would be able to change boot.dat to start hekate on boot directly without cleanup method. Sorry for couldn't explaining well

Well, then with this exploit it's possible to overwrite FW in modchip, so it will be possible to overwrite SX modchip FW to load any payload.

 

[Cachuchin1]

Well, then with this exploit it's possible to overwrite FW in modchip, so it will be possible to overwrite SX modchip FW to load any payload.

thats what Mike just said ... https://twitter.com/hexkyz/status/1314232731522404353

so guessing you could, literally, update/upgrade to atmosphere and be able to inject it and have profit lol

 

[CompSciOrBust]

Worth noting that at least according to ReSwitched this style of modchip is illegal as it bypasses the TPM. We probably won't see anyone well known producing these, maybe some Chinese chips.

 

[masagrator]

thats what Mike just said ... https://twitter.com/hexkyz/status/1314232731522404353

so guessing you could, literally, update/upgrade to atmosphere and be able to inject it and have profit lol

You don't need rewrite modchip FW to run Atmosphere when it will have full compability with Mariko and Lite. You will be able to run Atmosphere via Hekate that you will be able to load via SX boot menu.

--------------------- MERGED ---------------------------

Worth noting that at least according to ReSwitched this style of modchip is illegal as it bypasses the TPM. We probably won't see anyone well known producing these, maybe some Chinese chips.

Sharing blueprints and any documentation explaining modchip execution process will be also illegal?

 

[SecureBoot]

Cool stuff! Hope that custom firmware written for these new open-source chips will still be compatible with SX Core

 

[janobi]

This is like when they dumped the PS3 chip, you were then able to use much cheaper drives to load the exploit

 

[Worldblender]

I hope that there is way that I can DIY with an Arudino-compatible or like board.
More info about the STM32 chipset (but not GD32): https://en.wikipedia.org/wiki/STM32
Which STM32/GD32 chip is used, specifcally? Where can I find more info about GD32?