Toggle sidebar

Tutorial  Updated

How to skip the "Connect Joycons" system init screen

I've seen this asked a lot over the years and since someone asked it today and I recently mapped out all the Settings saves, I decided to test my theory that the answer was there. It was.

Use case: You are stuck at the system initialize screen with the 'connect joycons' animation but you don't have joycons or one or both rails is broken.

TL;DR for those who already know how to edit system saves: Dump the SystemSettings save 8000000000000050, change the byte at offset 0x29484 from 0 to 1, repack, sign and replace the save.

Tools required:
  • hactoolnet (fire up your command line skills)
  • Lockpick_RCM (if you have an existing dump from this console a fresh dump is not required)
  • TegraExplorer (if you're familiar with HacDiskMount you can use that instead)
  • HxD (or hex editor of choice, this one is just free, lightweight, capable, and ad-free)
Steps:
  1. Use Hekate/Nyx and make a full Raw EMMC backup if you never have! This is the first rule of any hacking endeavor.
  2. If you don't have a key file, use Lockpick_RCM to dump keys from either sysnand or emunand, it doesn't matter which for this purpose. This will dump the key file to SD in /switch/prod.keys.
  3. Reboot to RCM if needed and push the TegraExplorer payload.
  4. Use the Volume keys to navigate to and select either [SYSTEM:/] EMMC (for sysnand) or [SYSTEM:/] EMUMMC (for emunand).
  5. Acknowledge the warning regarding modifying your system NAND and breathe easy since you made a backup, right? RIGHT? Please go back and do that if you haven't. Press Power to continue.
  6. Select save (this might take a minute to load if using file-based emunand).
  7. Select 8000000000000050, then select Copy to clipboard.
  8. Navigate back to the main menu by selecting Folder -> previous folder twice.
  9. Select [SD:/] SD CARD.
  10. Select Clipboard -> Current folder and wait for the copy to complete.
  11. Navigate back to the main menu by selecting Folder -> previous folder.
  12. Select Exit then either reboot to RCM or power off.
  13. Mount the SD card on your computer either using a card reader or by pushing the Memloader payload (this is always recommended to reduce stress on the SD reader connector component).
  14. Open a command prompt (eg. press Win+R and type cmd then press Return).
  15. Navigate to where you unzipped hactoolnet or drag the executable onto the command prompt window (this is a handy trick that makes the next few steps easier; Windows automatically enters the whole path to whatever you drop on it).
  16. I don't know what drive letter you mounted your SD as, but you do! So I'm going to pretend it's Z: but if it's something else, use that instead.
  17. [Note: if the console is Mariko (red-box, new/chipped or Switch Lite) you may need to edit prod.keys by changing "save_mac_key" to "save_mac_key_00" if you get an error like "Unable to sign save file."] If you dragged hactoolnet into the window, you'll have c:\whatever\hactoolnet.exe already populated, so after that, type a space then -t save -k z:\switch\prod.keys z:\8000000000000050 --outdir z:\syssave so your whole command should look like:
    Code: 
    c:\whatever\hactoolnet.exe -t save -k z:\switch\prod.keys z:\8000000000000050 --outdir z:\syssave
    Again, please edit this so it matches your own path to hactoolnet and SD mount point.
  18. Open z:\syssave\file in HxD.
  19. Press Ctrl+G to open the Go to Offset dialogue, and type in the number 29484 then select OK. The cursor should be hovering over a byte that reads 00.
  20. Type 01 then press Ctrl+S to Save.
  21. Go back to your command prompt and similarly enter c:\whatever\hactoolnet.exe -t save -k z:\switch\prod.keys z:\8000000000000050 --replacefile file z:\syssave\file. Verify that hactoolnet prints:
    Code: 
    Replaced file /file
Successfully signed save file with key <key>
  22. Eject the SD from the computer, reinsert into console, however you did it, get back to RCM with the SD inserted and inject TegraExplorer.
  23. Select [SD:/] SD CARD.
  24. Select 8000000000000050, then select Copy to clipboard.
  25. Navigate back to the main menu by selecting Folder -> previous folder.
  26. Use the Volume keys to navigate to and select either [SYSTEM:/] EMMC (for sysnand) or [SYSTEM:/] EMUMMC (for emunand), making the same choice as in Step 4.
  27. Acknowledge the warning, press Power to continue.
  28. Select save (as before, this might take a minute to load if using file-based emunand).
  29. Select 8000000000000050, then select Delete file.
  30. Acknowledge the warning, press Power to delete, wait for completion.
  31. Select Clipboard -> Current folder and wait for the copy to complete.
  32. Navigate back to the main menu by selecting Folder -> previous folder twice.
  33. Select Exit then do whatever you need to do to reboot, with or without CFW.
  34. You're done! Instead of the joycon connect animation you should get a screen asking you to accept the Eula then reboot, after which you should be in the OS!
 
Last edited by shchmue, , Reason: clarify step 4 & 26
  • Like
  • Love
Reactions: Deleted member 753700, RocketRobz, samto and 48 others
Click to expand...
Thank you for this amazing guide. I bought a 2nd hand switch with a faulty left rail. The guide still works today on Switch firmware 17.0.
 
shchmue said:
I've seen this asked a lot over the years and since someone asked it today and I recently mapped out all the Settings saves, I decided to test my theory that the answer was there. It was.

Use case: You are stuck at the system initialize screen with the 'connect joycons' animation but you don't have joycons or one or both rails is broken.

TL;DR for those who already know how to edit system saves: Dump the SystemSettings save 8000000000000050, change the byte at offset 0x29484 from 0 to 1, repack, sign and replace the save.

Tools required:
  • hactoolnet (fire up your command line skills)
  • Lockpick_RCM (if you have an existing dump from this console a fresh dump is not required)
  • TegraExplorer (if you're familiar with HacDiskMount you can use that instead)
  • HxD (or hex editor of choice, this one is just free, lightweight, capable, and ad-free)
Steps:
  1. Use Hekate/Nyx and make a full Raw EMMC backup if you never have! This is the first rule of any hacking endeavor.
  2. If you don't have a key file, use Lockpick_RCM to dump keys from either sysnand or emunand, it doesn't matter which for this purpose. This will dump the key file to SD in /switch/prod.keys.
  3. Reboot to RCM if needed and push the TegraExplorer payload.
  4. Use the Volume keys to navigate to and select either [SYSTEM:/] EMMC (for sysnand) or [SYSTEM:/] EMUMMC (for emunand).
  5. Acknowledge the warning regarding modifying your system NAND and breathe easy since you made a backup, right? RIGHT? Please go back and do that if you haven't. Press Power to continue.
  6. Select save (this might take a minute to load if using file-based emunand).
  7. Select 8000000000000050, then select Copy to clipboard.
  8. Navigate back to the main menu by selecting Folder -> previous folder twice.
  9. Select [SD:/] SD CARD.
  10. Select Clipboard -> Current folder and wait for the copy to complete.
  11. Navigate back to the main menu by selecting Folder -> previous folder.
  12. Select Exit then either reboot to RCM or power off.
  13. Mount the SD card on your computer either using a card reader or by pushing the Memloader payload (this is always recommended to reduce stress on the SD reader connector component).
  14. Open a command prompt (eg. press Win+R and type cmd then press Return).
  15. Navigate to where you unzipped hactoolnet or drag the executable onto the command prompt window (this is a handy trick that makes the next few steps easier; Windows automatically enters the whole path to whatever you drop on it).
  16. I don't know what drive letter you mounted your SD as, but you do! So I'm going to pretend it's Z: but if it's something else, use that instead.
  17. [Note: if the console is Mariko (red-box, new/chipped or Switch Lite) you may need to edit prod.keys by changing "save_mac_key" to "save_mac_key_00" if you get an error like "Unable to sign save file."] If you dragged hactoolnet into the window, you'll have c:\whatever\hactoolnet.exe already populated, so after that, type a space then -t save -k z:\switch\prod.keys z:\8000000000000050 --outdir z:\syssave so your whole command should look like:
    Code: 
    c:\whatever\hactoolnet.exe -t save -k z:\switch\prod.keys z:\8000000000000050 --outdir z:\syssave
    Again, please edit this so it matches your own path to hactoolnet and SD mount point.
  18. Open z:\syssave\file in HxD.
  19. Press Ctrl+G to open the Go to Offset dialogue, and type in the number 29484 then select OK. The cursor should be hovering over a byte that reads 00.
  20. Type 01 then press Ctrl+S to Save.
  21. Go back to your command prompt and similarly enter c:\whatever\hactoolnet.exe -t save -k z:\switch\prod.keys z:\8000000000000050 --replacefile file z:\syssave\file. Verify that hactoolnet prints:
    Code: 
    Replaced file /file
Successfully signed save file with key <key>
  22. Eject the SD from the computer, reinsert into console, however you did it, get back to RCM with the SD inserted and inject TegraExplorer.
  23. Select [SD:/] SD CARD.
  24. Select 8000000000000050, then select Copy to clipboard.
  25. Navigate back to the main menu by selecting Folder -> previous folder.
  26. Use the Volume keys to navigate to and select either [SYSTEM:/] EMMC (for sysnand) or [SYSTEM:/] EMUMMC (for emunand), making the same choice as in Step 4.
  27. Acknowledge the warning, press Power to continue.
  28. Select save (as before, this might take a minute to load if using file-based emunand).
  29. Select 8000000000000050, then select Delete file.
  30. Acknowledge the warning, press Power to delete, wait for completion.
  31. Select Clipboard -> Current folder and wait for the copy to complete.
  32. Navigate back to the main menu by selecting Folder -> previous folder twice.
  33. Select Exit then do whatever you need to do to reboot, with or without CFW.
  34. You're done! Instead of the joycon connect animation you should get a screen asking you to accept the Eula then reboot, after which you should be in the OS!
Click to expand...
shchmue said:
I've seen this asked a lot over the years and since someone asked it today and I recently mapped out all the Settings saves, I decided to test my theory that the answer was there. It was.

Use case: You are stuck at the system initialize screen with the 'connect joycons' animation but you don't have joycons or one or both rails is broken.

TL;DR for those who already know how to edit system saves: Dump the SystemSettings save 8000000000000050, change the byte at offset 0x29484 from 0 to 1, repack, sign and replace the save.

Tools required:
  • hactoolnet (fire up your command line skills)
  • Lockpick_RCM (if you have an existing dump from this console a fresh dump is not required)
  • TegraExplorer (if you're familiar with HacDiskMount you can use that instead)
  • HxD (or hex editor of choice, this one is just free, lightweight, capable, and ad-free)
Steps:
  1. Use Hekate/Nyx and make a full Raw EMMC backup if you never have! This is the first rule of any hacking endeavor.
  2. If you don't have a key file, use Lockpick_RCM to dump keys from either sysnand or emunand, it doesn't matter which for this purpose. This will dump the key file to SD in /switch/prod.keys.
  3. Reboot to RCM if needed and push the TegraExplorer payload.
  4. Use the Volume keys to navigate to and select either [SYSTEM:/] EMMC (for sysnand) or [SYSTEM:/] EMUMMC (for emunand).
  5. Acknowledge the warning regarding modifying your system NAND and breathe easy since you made a backup, right? RIGHT? Please go back and do that if you haven't. Press Power to continue.
  6. Select save (this might take a minute to load if using file-based emunand).
  7. Select 8000000000000050, then select Copy to clipboard.
  8. Navigate back to the main menu by selecting Folder -> previous folder twice.
  9. Select [SD:/] SD CARD.
  10. Select Clipboard -> Current folder and wait for the copy to complete.
  11. Navigate back to the main menu by selecting Folder -> previous folder.
  12. Select Exit then either reboot to RCM or power off.
  13. Mount the SD card on your computer either using a card reader or by pushing the Memloader payload (this is always recommended to reduce stress on the SD reader connector component).
  14. Open a command prompt (eg. press Win+R and type cmd then press Return).
  15. Navigate to where you unzipped hactoolnet or drag the executable onto the command prompt window (this is a handy trick that makes the next few steps easier; Windows automatically enters the whole path to whatever you drop on it).
  16. I don't know what drive letter you mounted your SD as, but you do! So I'm going to pretend it's Z: but if it's something else, use that instead.
  17. [Note: if the console is Mariko (red-box, new/chipped or Switch Lite) you may need to edit prod.keys by changing "save_mac_key" to "save_mac_key_00" if you get an error like "Unable to sign save file."] If you dragged hactoolnet into the window, you'll have c:\whatever\hactoolnet.exe already populated, so after that, type a space then -t save -k z:\switch\prod.keys z:\8000000000000050 --outdir z:\syssave so your whole command should look like:
    Code: 
    c:\whatever\hactoolnet.exe -t save -k z:\switch\prod.keys z:\8000000000000050 --outdir z:\syssave
    Again, please edit this so it matches your own path to hactoolnet and SD mount point.
  18. Open z:\syssave\file in HxD.
  19. Press Ctrl+G to open the Go to Offset dialogue, and type in the number 29484 then select OK. The cursor should be hovering over a byte that reads 00.
  20. Type 01 then press Ctrl+S to Save.
  21. Go back to your command prompt and similarly enter c:\whatever\hactoolnet.exe -t save -k z:\switch\prod.keys z:\8000000000000050 --replacefile file z:\syssave\file. Verify that hactoolnet prints:
    Code: 
    Replaced file /file
Successfully signed save file with key <key>
  22. Eject the SD from the computer, reinsert into console, however you did it, get back to RCM with the SD inserted and inject TegraExplorer.
  23. Select [SD:/] SD CARD.
  24. Select 8000000000000050, then select Copy to clipboard.
  25. Navigate back to the main menu by selecting Folder -> previous folder.
  26. Use the Volume keys to navigate to and select either [SYSTEM:/] EMMC (for sysnand) or [SYSTEM:/] EMUMMC (for emunand), making the same choice as in Step 4.
  27. Acknowledge the warning, press Power to continue.
  28. Select save (as before, this might take a minute to load if using file-based emunand).
  29. Select 8000000000000050, then select Delete file.
  30. Acknowledge the warning, press Power to delete, wait for completion.
  31. Select Clipboard -> Current folder and wait for the copy to complete.
  32. Navigate back to the main menu by selecting Folder -> previous folder twice.
  33. Select Exit then do whatever you need to do to reboot, with or without CFW.
  34. You're done! Instead of the joycon connect animation you should get a screen asking you to accept the Eula then reboot, after which you should be in the OS!
Click to expand...
Thanks for your time and solution, its works fine for me! THANKS
 
Hi, I'm sorry, this is probably a dumb question, but is it possible to enter RCM on a switch if I just got it and it shows the "insert Joycon" screen? I'm trying to enter RCM using a jig and it just doesn't work no matter what I do. I don't get what I'm doing wrong.
 
Thank you for the guide! Just a heads-up for anyone wondering—it still works for firmware version 18.1.0.
 
shchmue said:
Note: if the console is Mariko (red-box, new/chipped or Switch Lite) you may need to edit prod.keys by changing "save_mac_key" to "save_mac_key_00" if you get an error like "Unable to sign save file."
Click to expand...

I know this is an old thread but how would I go about doing this? I have a chipped v2 switch and even though I got my original keys the CMAC key it's using is all 0

EDIT: Figured it out. All you had to do was open it in Notepad++ and edit the keys files that way. This still works
 
Last edited by Haki,
HI schmue, i just want to let you know that it worked very well, firstly it confused me because i did it twice and i restarted to atmosphere and didtnt work, then i tried stock and it worked, ty!!!, now, it modified the stock, right? so, that means i could get banned? i would love a fast answer because i want to know if ill get banned. I really appreciate what you did, thank you
Post automatically merged:

HI schmue, i just want to let you know that it worked very well, firstly it confused me because i did it twice and i restarted to atmosphere and didtnt work, then i tried stock and it worked, ty!!!, now, it modified the stock, right? so, that means i could get banned? i would love a fast answer because i want to know if ill get banned. I really appreciate what you did, thank you
 
1ed23854-7650-463a-b0a0-8b00f71e62f9.jpeg


New firmware new problems i guess, i dont get an EULA screen i get a setup guide and at the end i have to press the home button but, both rails are damaged so I'm not able to do that, if i reboot i'm back at the same joycon screen, any ideas for formware 20.2.0 ???
 
donalu456 said:
HI schmue, i just want to let you know that it worked very well, firstly it confused me because i did it twice and i restarted to atmosphere and didtnt work, then i tried stock and it worked, ty!!!, now, it modified the stock, right? so, that means i could get banned? i would love a fast answer because i want to know if ill get banned. I really appreciate what you did, thank you
Post automatically merged:

HI schmue, i just want to let you know that it worked very well, firstly it confused me because i did it twice and i restarted to atmosphere and didtnt work, then i tried stock and it worked, ty!!!, now, it modified the stock, right? so, that means i could get banned? i would love a fast answer because i want to know if ill get banned. I really appreciate what you did, thank you
Click to expand...
and how did you do it? I did everything to the letter but when I modify the file that it creates when using cmd and then I use Hxd to modify it and then I go to patch it again it tells me that the keys are incorrect. Any solution? Maybe I did it wrong. I need help plss
Post automatically merged:

donalu456 said:
HI schmue, i just want to let you know that it worked very well, firstly it confused me because i did it twice and i restarted to atmosphere and didtnt work, then i tried stock and it worked, ty!!!, now, it modified the stock, right? so, that means i could get banned? i would love a fast answer because i want to know if ill get banned. I really appreciate what you did, thank you
Post automatically merged:

HI schmue, i just want to let you know that it worked very well, firstly it confused me because i did it twice and i restarted to atmosphere and didtnt work, then i tried stock and it worked, ty!!!, now, it modified the stock, right? so, that means i could get banned? i would love a fast answer because i want to know if ill get banned. I really appreciate what you did, thank you
Click to expand...
and how did you do it? I did everything to the letter but when I modify the file that it creates when using cmd and then I use Hxd to modify it and then I go to patch it again it tells me that the keys are incorrect. Any solution? Maybe I did it wrong. I need help plss
 
shchmue said:
I've seen this asked a lot over the years and since someone asked it today and I recently mapped out all the Settings saves, I decided to test my theory that the answer was there. It was.

Use case: You are stuck at the system initialize screen with the 'connect joycons' animation but you don't have joycons or one or both rails is broken.

TL;DR for those who already know how to edit system saves: Dump the SystemSettings save 8000000000000050, change the byte at offset 0x29484 from 0 to 1, repack, sign and replace the save.

Tools required:
  • hactoolnet (fire up your command line skills)
  • Lockpick_RCM (if you have an existing dump from this console a fresh dump is not required)
  • TegraExplorer (if you're familiar with HacDiskMount you can use that instead)
  • HxD (or hex editor of choice, this one is just free, lightweight, capable, and ad-free)
Steps:
  1. Use Hekate/Nyx and make a full Raw EMMC backup if you never have! This is the first rule of any hacking endeavor.
  2. If you don't have a key file, use Lockpick_RCM to dump keys from either sysnand or emunand, it doesn't matter which for this purpose. This will dump the key file to SD in /switch/prod.keys.
  3. Reboot to RCM if needed and push the TegraExplorer payload.
  4. Use the Volume keys to navigate to and select either [SYSTEM:/] EMMC (for sysnand) or [SYSTEM:/] EMUMMC (for emunand).
  5. Acknowledge the warning regarding modifying your system NAND and breathe easy since you made a backup, right? RIGHT? Please go back and do that if you haven't. Press Power to continue.
  6. Select save (this might take a minute to load if using file-based emunand).
  7. Select 8000000000000050, then select Copy to clipboard.
  8. Navigate back to the main menu by selecting Folder -> previous folder twice.
  9. Select [SD:/] SD CARD.
  10. Select Clipboard -> Current folder and wait for the copy to complete.
  11. Navigate back to the main menu by selecting Folder -> previous folder.
  12. Select Exit then either reboot to RCM or power off.
  13. Mount the SD card on your computer either using a card reader or by pushing the Memloader payload (this is always recommended to reduce stress on the SD reader connector component).
  14. Open a command prompt (eg. press Win+R and type cmd then press Return).
  15. Navigate to where you unzipped hactoolnet or drag the executable onto the command prompt window (this is a handy trick that makes the next few steps easier; Windows automatically enters the whole path to whatever you drop on it).
  16. I don't know what drive letter you mounted your SD as, but you do! So I'm going to pretend it's Z: but if it's something else, use that instead.
  17. [Note: if the console is Mariko (red-box, new/chipped or Switch Lite) you may need to edit prod.keys by changing "save_mac_key" to "save_mac_key_00" if you get an error like "Unable to sign save file."] If you dragged hactoolnet into the window, you'll have c:\whatever\hactoolnet.exe already populated, so after that, type a space then -t save -k z:\switch\prod.keys z:\8000000000000050 --outdir z:\syssave so your whole command should look like:
    Code: 
    c:\whatever\hactoolnet.exe -t save -k z:\switch\prod.keys z:\8000000000000050 --outdir z:\syssave
    Again, please edit this so it matches your own path to hactoolnet and SD mount point.
  18. Open z:\syssave\file in HxD.
  19. Press Ctrl+G to open the Go to Offset dialogue, and type in the number 29484 then select OK. The cursor should be hovering over a byte that reads 00.
  20. Type 01 then press Ctrl+S to Save.
  21. Go back to your command prompt and similarly enter c:\whatever\hactoolnet.exe -t save -k z:\switch\prod.keys z:\8000000000000050 --replacefile file z:\syssave\file. Verify that hactoolnet prints:
    Code: 
    Replaced file /file
Successfully signed save file with key <key>
  22. Eject the SD from the computer, reinsert into console, however you did it, get back to RCM with the SD inserted and inject TegraExplorer.
  23. Select [SD:/] SD CARD.
  24. Select 8000000000000050, then select Copy to clipboard.
  25. Navigate back to the main menu by selecting Folder -> previous folder.
  26. Use the Volume keys to navigate to and select either [SYSTEM:/] EMMC (for sysnand) or [SYSTEM:/] EMUMMC (for emunand), making the same choice as in Step 4.
  27. Acknowledge the warning, press Power to continue.
  28. Select save (as before, this might take a minute to load if using file-based emunand).
  29. Select 8000000000000050, then select Delete file.
  30. Acknowledge the warning, press Power to delete, wait for completion.
  31. Select Clipboard -> Current folder and wait for the copy to complete.
  32. Navigate back to the main menu by selecting Folder -> previous folder twice.
  33. Select Exit then do whatever you need to do to reboot, with or without CFW.
  34. You're done! Instead of the joycon connect animation you should get a screen asking you to accept the Eula then reboot, after which you should be in the OS!
Click to expand...
Is this possible on MacBook?? I got so far and followed all steps correctly but didn’t have any luck. I think it went wrong when signing the save file as I am hactoolnet via the terminal. So confused and will probably try find a friend to use their joycons. But if anyone could help that would be so appreciated
 
Starrr2 said:
Is this possible on MacBook?? I got so far and followed all steps correctly but didn’t have any luck. I think it went wrong when signing the save file as I am hactoolnet via the terminal. So confused and will probably try find a friend to use their joycons. But if anyone could help that would be so appreciated
Click to expand...

The instruction is for windows.
 

Site & Scene News

Go to forum More news

Popular threads in this forum

Dusk for switch (TLoZ Twilight Princess port)

Homebrew  New Homebrew "Foil Server"?

Homebrew  Full List of N64 Recompilation Switch ports

Hacking  WiFi chip failing and can't boot. is it possible to enable Airplane Mode by editing system save files directly?

Homebrew Tutorial Translation Project  CS2SX — Write Nintendo Switch Homebrew in C#

Homebrew  Sonic Unleashed Recompiled (Homebrew Port)

Is it fixable

Hacking Emulation  Switch Prod Keys downloading from sites okay?