Hacking WiFi chip failing and can't boot. is it possible to enable Airplane Mode by editing system save files directly?

  • Thread starter Thread starter hitori5532
  • Start date Start date
  • Views Views 1,299
  • Replies Replies 16

hitori5532

Member
Newcomer
Joined
May 16, 2026
Messages
7
Reaction score
2
Trophies
0
XP
15
Country
Slovakia
Hey all, bit of a weird situation and hoping someone here has dealt with this before.

My Switch's WiFi chip appears to be failing. I've seen a few posts around the internet suggesting that enabling Airplane Mode can sometimes work around the issue and let the console boot normally.

The problem is my Switch isn't booting at all right now, so I can't just toggle it from the settings menu.

I have access to my system NAND and the usual homebrew tools, so I'm wondering:

Is there a known way to enable Airplane Mode by directly editing system save files, without needing to boot into the OS?

If anyone happens to have a modded Switch handy, it would be incredibly helpful if you could dump the nand file with Airplane Mode OFF and then ON, and share the diff. That would let us pinpoint exactly what needs to be changed.

My setup:

  • Mariko Switch with a modchip installed
  • WiFi chip was already dying before the mod, but the console at least booted back then
  • Bluetooth still works fine
  • It's specifically the WiFi that seems to be causing the boot failure
Any help appreciated, even just pointing me toward documentation or CFW source code that confirms the right offset. Thanks!
 
Maybe booting a nand dump of the console with an emulator, change the settings there and write the dump back to your console?

I don't have any experience with Switch emulator, I don't know what tooling they are shipped with. Hardest way would be injecting the files manually into the nand dump.

But if the console refuses to boot, chances are slim and maybe buying a replacement is the way to go (new mb or WiFi module+repair shop).
 
Maybe booting a nand dump of the console with an emulator, change the settings there and write the dump back to your console?

I don't have any experience with Switch emulator, I don't know what tooling they are shipped with. Hardest way would be injecting the files manually into the nand dump.

But if the console refuses to boot, chances are slim and maybe buying a replacement is the way to go (new mb or WiFi module+repair shop).
Yeah I get what you mean. I’m still gonna try the offset route if I can find it though, mainly because repair options here are pretty limited and not many shops in my country work on Switch board-level stuff.

Since Bluetooth still works and the issue really seems tied to WiFi init, I figured it’s worth at least testing whether forcing Airplane Mode in the NAND changes anything before giving up on the board.
 
Did you downgraded the firmware using Daybreak?

I got this switch for a steal, and I knew the wifi chip was faulty, but bluetooth worked, and still works, and I used a dock with an ethernet connection to be online, after I decided to mod it with picofly, I guess the wifi chip got more damaged during the disassembly process? After that CFW or not, it doesn't want to boot, keeps crashing with wlan.autoge.

So no, I didn't do anything with the firmware because I didn't get to even boot into Atmospheré.

Do you think it could be a firmware problem? Because I did give it to one tech who tried to chip it but failed, and I'm not sure what he could've done to the device while trying to patch it or something. But he said he failed to install it physically.

Then a second Tech just soldered the chip and gave it to me to install stuff myself.

Here is a snippet of the Crash Report

Atmosphère Crash Report (v1.7):
Result: 0x0 (2000-0000)

Process Info:
Process Name: wlan.autoge
Program ID: 0100000000000016
Process ID: 0000000000000066
Process Flags: 00001137
User Exception Address: 0000002b525f0000
Exception Info:
Type: User Break
Address: 0000000505e14878 ([67b92196] + 0x14878)
Break Reason: 0x0
Break Address: 00000036acd7cb1c
Break Size: 0x4
 
I’m still gonna try the offset route
I am a developer and have no slightly clue what you are trying there. Atmosphere is a series of complicated on-the-fly patches for the Horizon OS. There is no magic fixed offset to patch since it doesn't alter the wifi sysmodule (I am 95% sure). Either you are a very big brain or you have no idea what you are talking about.
If I am wrong and you know what you are doing write a patch for the wifi sysmodule to disable any functionality. This would have the highest success rate but is hard to pull off without documentation.

Same question was rejected:
https://github.com/Atmosphere-NX/Atmosphere/issues/2533

If you have an OFW dump I'd suggest starting with it or create a new one (I don't know the exact details in how to do it) to really rule out a potential software issue. Otherwise try my suggestion above or order a new motherboard, a few Y0/PH000 bits and thermal paste - it is not that hard to replace by yourself with ifixit or YT. The NAND dump can be reused (has to be prepaired and patched ofc) for the new board to transfer settings/game licenses etc.
Also there is the possibility to reflow the wifi chip (has most likely cold solder joints) but you'd need a bit more than just thermal paste and bits (please don't put electronics in the oven - even after cleaning toxic fumes will find a way into your food/body).
 
Last edited by GothicIII,
I am a developer and have no slightly clue what you are trying there. Atmosphere is a series of complicated on-the-fly patches for the Horizon OS. There is no magic fixed offset to patch since it doesn't alter the wifi sysmodule (I am 95% sure). Either you are a very big brain or you have no idea what you are talking about.
If I am wrong and you know what you are doing write a patch for the wifi sysmodule to disable any functionality. This would have the highest success rate but is hard to pull off without documentation.

Same question was rejected:
https://github.com/Atmosphere-NX/Atmosphere/issues/2533

If you have an OFW dump I'd suggest starting with it or create a new one (I don't know the exact details in how to do it) to really rule out a potential software issue. Otherwise try my suggestion above or order a new motherboard, a few Y0/PH000 bits and thermal paste - it is not that hard to replace by yourself with ifixit or YT. The NAND dump can be reused (has to be prepaired and patched ofc) for the new board to transfer settings/game licenses etc.
Also there is the possibility to reflow the wifi chip (has most likely cold solder joints) but you'd need a bit more than just thermal paste and bits (please don't put electronics in the oven - even after cleaning toxic fumes will find a way into your food/body).

To answer your question, I have a degree in CS so I have some understanding of how this stuff works, but I'm definitely a noob when it comes to console modding. So probably more of the "no idea what I'm talking about" rather than "big brain".

Also, funny you mention the oven thing! I actually did manage to fix my GPU that way once, but I used a discarded oven in an old cabin my family owns. It did work for a week only but yeah.

As for what I was trying to do, I read a few threads here about this bricking issue. One person was saying that they let the console fully discharge, and when it finally booted, enabling airplane mode somehow unbricked it so it could boot just fine after that. Another person with the same issue just put their Switch on a shelf, came back after it fully discharged 2 weeks later, and their console magically booted up.

My original idea was to get someone with a working Switch to dump two versions of their sysnand (one with airplane mode on and one with it off). That way I could try to figure out which files to decrypt and modify with hacnet or whatever on MY sysnand. I was hoping I could force it to boot in airplane mode and see if that would bypass the check and unbrick it.

I actually did fiddle with decompiling using Binary Ninja too, and I tried to modify the wlan module to just ignore the faulty hardware. But exactly as you said, without proper documentation I failed to accomplish it. Multiple other modules rely on it, and if I just faked the responses, it resulted in the console hanging indefinitely before boot.

For now, I guess I'll just shelf the Switch and see if it magically fixes itself, or wait for a dev with more experience to continue my wlan sysmodule shenanigans (https://github.com/Atmosphere-NX/Atmosphere/issues/1179). If nothing comes out of it, I will probably look into your motherboard replacement or reflow suggestions.
 
  • Like
Reactions: GothicIII
To answer your question, I have a degree in CS so I have some understanding of how this stuff works, but I'm definitely a noob when it comes to console modding. So probably more of the "no idea what I'm talking about" rather than "big brain".

Also, funny you mention the oven thing! I actually did manage to fix my GPU that way once, but I used a discarded oven in an old cabin my family owns. It did work for a week only but yeah.

As for what I was trying to do, I read a few threads here about this bricking issue. One person was saying that they let the console fully discharge, and when it finally booted, enabling airplane mode somehow unbricked it so it could boot just fine after that. Another person with the same issue just put their Switch on a shelf, came back after it fully discharged 2 weeks later, and their console magically booted up.

My original idea was to get someone with a working Switch to dump two versions of their sysnand (one with airplane mode on and one with it off). That way I could try to figure out which files to decrypt and modify with hacnet or whatever on MY sysnand. I was hoping I could force it to boot in airplane mode and see if that would bypass the check and unbrick it.

I actually did fiddle with decompiling using Binary Ninja too, and I tried to modify the wlan module to just ignore the faulty hardware. But exactly as you said, without proper documentation I failed to accomplish it. Multiple other modules rely on it, and if I just faked the responses, it resulted in the console hanging indefinitely before boot.

For now, I guess I'll just shelf the Switch and see if it magically fixes itself, or wait for a dev with more experience to continue my wlan sysmodule shenanigans (https://github.com/Atmosphere-NX/Atmosphere/issues/1179). If nothing comes out of it, I will probably look into your motherboard replacement or reflow suggestions.
Bummer that it didn't work writing a patch. I hoped it would be as easy as intercepting any communications except init and return always 0 or something like that.

A delta of both Nand dumps probably won't get you far, unfortunately. The Switch does so much logging and settings/whatever are in a binary format. You'd have to go through possibly hundreds of files with changes to find the correct swapped bit.

Decrypt your dump and use an emulator to boot that nand. It should be possible (I don't know for sure, never tried it) so you can make the change and track it with a debugger (to find the correct file). I hope that decrypted dumps are bootable since they have FAT16 as filesystem and there you can easily find the changed offsets (== file). Otherwise if only encrypted NANDs are bootable then you have to write that whole NAND back - I'd imagine due to the encryption it would be a nightmare to track a change.

I really have no other ideas than the ones already written here^^

Don't worry you already have a solid base to mod things! The Switch is a really good console for that kind of stuff even if it gets messy sometimes.

Good luck and have fun!

P.S. Yeah that oven thing is all over the place and people just use it for reflow stuff just like putting a pizza in there. It grosses me out xC
For reflowing I am using flux and a heat gun with nozzle and temp control as minimum (+ heat sensor for the surface). To reflow the wifi chip I would definitly remove the shielding so enough heat passes the chip. For the switch it shouldn't be neccessary but a heating station wouldn't hurt for preheating the boards. Reflowing is not that hard but I suggest starting with easier stuff to get a feel for it. It is not the ultimate cure, if the solder's quality is too poor then only reballing would help and then shit gets expensive really fast.
 
Last edited by GothicIII,
Bummer that it didn't work writing a patch. I hoped it would be as easy as intercept any communications except init and return always 0 or something like that.

A delta of both Nand dumps probably won't get you far, unfortunately. The Switch does so much logging and settings/whatever are in a binary format. You'd have to go through possibly hundreds of files with changes to find the correct swapped bit.

Decrypt your dump and use an emulator to boot that nand. It should be possible (I don't know for sure, never tried it) so you can make the change and track it with a debugger (to find the correct file). I hope that decrypted dumps are bootable since they have FAT16 as filesystem and there you can easily find the changed offsets (== file). Otherwise if only encrypted NANDs are bootable then you have to write that whole NAND back - I'd imagine due to the encryption it would be a nightmare to track a change.

I really have no other ideas than the ones already written here^^

Don't worry you already have a solid base to mod things! The Switch is a really good console for that kind of stuff even if it gets messy sometimes.

Good luck and have fun!

P.S. Yeah that oven thing is all over the place and people just use it for reflow stuff just like putting a pizza in there. It grosses me out xC
For reflowing I am using flux and a heat gun with nozzle and temp control as minimum (+ heat sensor for the surface). To reflow the wifi chip I would definitly remove the shielding so enough heat passes the chip. For the switch it shouldn't be neccessary but a heating station wouldn't hurt for preheating the boards. Reflowing is not that hard but I suggest starting with easier stuff to get a feel for it. It is not the ultimate cure, if the solder's quality is too poor then only reballing would help and then shit gets expensive really fast.
Thanks for all the suggestions/info, really appreciate it. And yeah no oven reflowing for the Switch XD
 
  • Like
Reactions: GothicIII
I got this switch for a steal, and I knew the wifi chip was faulty, but bluetooth worked, and still works, and I used a dock with an ethernet connection to be online, after I decided to mod it with picofly, I guess the wifi chip got more damaged during the disassembly process? After that CFW or not, it doesn't want to boot, keeps crashing with wlan.autoge.

So no, I didn't do anything with the firmware because I didn't get to even boot into Atmospheré.
To be able to even try and fix the Switch, having CFW working would be a very useful thing to have.

The WiFi chip <in normal conditions> would not get damaged by disassembling the console, or else, it wouldn't be possible to do it and fix other hardware issues, (like replacing the joysticks), without the risk of damaging such module.

Do you think it could be a firmware problem? Because I did give it to one tech who tried to chip it but failed, and I'm not sure what he could've done to the device while trying to patch it or something. But he said he failed to install it physically.
This tech "might" not have had the proper tools to replace such small component on the board or the skills to do it, either way, he should've told you so from the very beginning instead of taking the risk of damaging even more the console.

Then a second Tech just soldered the chip and gave it to me to install stuff myself.
I don't get this part very clearly, what do you mean by: "gave it to me to install stuff myself"?

Did he gave you a disassembled console for you reassemble it? (Very un-professional if that's the case).

Here is a snippet of the Crash Report

Atmosphère Crash Report (v1.7):
Result: 0x0 (2000-0000)

Process Info:
Process Name: wlan.autoge
Program ID: 0100000000000016
Process ID: 0000000000000066
Process Flags: 00001137
User Exception Address: 0000002b525f0000
Exception Info:
Type: User Break
Address: 0000000505e14878 ([67b92196] + 0x14878)
Break Reason: 0x0
Break Address: 00000036acd7cb1c
Break Size: 0x4
That program ID in bold, is the one causing the problem, if you can manage to boot Hekate and run a payload, you would be able to replace a known to be working version of it (from another NAND), and replace it on your Switch's NAND backup to test if that fixes the problem.

I've used DowngradeFixer payload within Hekate to fix a Switch where the owner had downgraded the OFW using Daybreak.
And used it before to fix an issue where the OFW's NAND had Airplane mode enabled when the backup was made, and afterwards it was disabled and its firmware downgraded, causing a non booting loop on the Switch console.

You can also try using NANDFixPro to do some more advanced NAND fixing procedures, but I haven't used it myself, so I can't ensure it will work, but it's worth the try.

Considering that the Switch is a paperweight in its current state, you can decide by yourself if it's worth trying.
 
To be able to even try and fix the Switch, having CFW working would be a very useful thing to have.

The WiFi chip <in normal conditions> would not get damaged by disassembling the console, or else, it wouldn't be possible to do it and fix other hardware issues, (like replacing the joysticks), without the risk of damaging such module.


This tech "might" not have had the proper tools to replace such small component on the board or the skills to do it, either way, he should've told you so from the very beginning instead of taking the risk of damaging even more the console.


I don't get this part very clearly, what do you mean by: "gave it to me to install stuff myself"?

Did he gave you a disassembled console for you reassemble it? (Very un-professional if that's the case).


That program ID in bold, is the one causing the problem, if you can manage to boot Hekate and run a payload, you would be able to replace a known to be working version of it (from another NAND), and replace it on your Switch's NAND backup to test if that fixes the problem.

I've used DowngradeFixer payload within Hekate to fix a Switch where the owner had downgraded the OFW using Daybreak.
And used it before to fix an issue where the OFW's NAND had Airplane mode enabled when the backup was made, and afterwards it was disabled and its firmware downgraded, causing a non booting loop on the Switch console.

You can also try using NANDFixPro to do some more advanced NAND fixing procedures, but I haven't used it myself, so I can't ensure it will work, but it's worth the try.

Considering that the Switch is a paperweight in its current state, you can decide by yourself if it's worth trying.
Just to clear things up about the techs. The first guy, I honestly have no idea what he did lol, but yeah, never going back there.

The second tech was solid though, he just did the hardware job. When I said he gave it to me to "install stuff myself", I just meant he left the software part for me to handle, like getting Atmosphère on the SD card and booting it up.

The WiFi chip was already dying even before the first tech touched it, but the console at least booted back then.

Anyway, I tried out DowngradeFixer like you suggested but that didn't fix it, unfortunately. I'll definitely look into NANDFixPro next. Like you said, the Switch is pretty much a paperweight at this point so I've got nothing to lose by trying.

Appreciate the help.
Post automatically merged:

Funny thing is, I actually KINDA patched the wlan module. I disabled the specific instruction that was causing the initial crash. But now for some reason the audio sysmodule is crashing. As was mentioned before, its probably that a bunch of other sysmodules try to communicate with the wlan one, so the system crashes when they get nothing back.

Wondering why Audio though, I know the Audio works on the switch through Lakka.

Atmosphère Crash Report (v1.7):
Result: 0x265 (2101-0001)

Process Info:
Process Name: audio
Program ID: 0100000000000014
Process ID: 0000000000000065
Process Flags: 00001137
User Exception Address: 0000002d811b3000
Exception Info:
Type: User Break
Address: 0000004ea66116a8 ([e163d0b7] + 0x116a8)
Break Reason: 0x0
Break Address: 0000007d00468db8
Break Size: 0x4
 
Last edited by hitori5532,
Try rebuilding the NAND from scratch using NANDFixPro (Level 3 I believe).

So you would discard the software part of the formula and you could focus on the hardware.
 
  • Like
Reactions: hitori5532
My release day Switch's wifi chip went bad with BT still working much like yours. It would hang indefinitely on the Nintendo/Atmosphere boot logo.

The trick was to just let it sit there until the batteries drained completely and then recharge it overnight. After that it booted just fine. Enabled flight mode, and it worked for a few months before I had to repeat the process.

No idea if this applies to a Mariko unit, but might be worth a try at least.

At some point I got around to reflowing the chip, which fixed it permanently.
 
Try rebuilding the NAND from scratch using NANDFixPro (Level 3 I believe).

So you would discard the software part of the formula and you could focus on the hardware.
Unfortunately that didn't help, so hardware issue it is.

My release day Switch's wifi chip went bad with BT still working much like yours. It would hang indefinitely on the Nintendo/Atmosphere boot logo.

The trick was to just let it sit there until the batteries drained completely and then recharge it overnight. After that it booted just fine. Enabled flight mode, and it worked for a few months before I had to repeat the process.

No idea if this applies to a Mariko unit, but might be worth a try at least.

At some point I got around to reflowing the chip, which fixed it permanently.
I actually saw your post about that. Unfortunately I already tried that twice and it didn’t change anything. At this point I might have to look into reflowing the chip.
 
I mean if it is hardware messing with software won't really fix it, so messing with NAND doesn't fix it.
 
Check the 201 capacitors and traces immediately next to the CPU shielding going to the WiFi module. They regularly get knocked off/scratched if a tool slips when attempting to pry off the shield. You could also try to get it into maintenance mode with an ethernet cable to see if it would update the official firmware. Rebuilding the nand manually with your existing prodinfo should accomplish the same thing though.
 
Unfortunately that didn't help, so hardware issue it is.


I actually saw your post about that. Unfortunately I already tried that twice and it didn’t change anything. At this point I might have to look into reflowing the chip.

Ah okay. Yeah, then reflowing is what I'd try next too if I were you. Also check the aforementioned caps up while you're at it.

Note that the peripheral components around the chip are really tiny, you might want to use a fair bit less airflow than normal to avoid them blowing away. The mobo isn't all that thick, you'll get away with it. Also, snap a clear photo of the area around the chip before so you know where everything goes if the worst should happen. Iirc I used my standard temp, 460 deg C, and tried to be as quick as possible about it.

Also, don't fall for the temptation to reflow the chip with the mobo in place, just bite the bullet and remove it from the console first.

If that doesn't help, I've noticed that there are spare chips available on Aliexpress, Ebay, etc. The market for it indicates that the actual chips break sometimes. Given that they are so tiny, it should be possible to ball them without stencil/paste, just using the iron, regular leaded tin, and some good flux.
 

Site & Scene News

Popular threads in this forum