Lockpick_RCM payload - Official Thread

impeeza · 2026-06-25T00:12:44+0100

bth said:
I've decided to see if I cannot add a new key derivation path similar to my other projects into lockpick_rcm;

what this does differently compared to what lockpick_rcm did before, is it reads and decrypts the nca headers, identifies system update and the fat32 filesystem nca;
then checks the key revision used in the system update (as FS always master key 0), and compares it against what lockpick already knows about.

if it's lower or equal, lockpick does nothing new.

if it's higher, it attempts to decrypt the FS .nca, finding /nx/package1, decrypts it (hovi kek tsec keygen has also been added because of this), searches for magic to find where master_kek_source is stored;

then processes the new keys for that keygen revision using the master kek source found.

the intent of this change is for lockpick rcm to be able to get the newest keys without lockpick rcm requiring an update to do so, however updating lets the keys generated into prod.keys have example:

_15
_16
_17

instead of lacking updates and a hypothetical list (essentially a gap):

_15
_17

https://github.com/borntohonk/Lockpick_RCMaster/releases/download/test/Lockpick_RCM_current.bin
https://github.com/borntohonk/Lockpick_RCMaster/releases/download/test/Lockpick_RCM_subtracted.bin (latest generation commented out)

I have these two binaries, which needs testing on an actual system, because i'm bit unsure if the codepath is triggered as it currently is, or if i need to add a +1

https://github.com/borntohonk/Lockpick_RCMaster/commit/35f2dd852f3266aa40b0dde77eb8b9e82887f884

Wow mate, great work.

I just propposed a PR with some minor format changes and the addition of 1TB+ sd cards support.

SnowStormAkikaze · 2026-06-25T02:15:47+0100

why the hell people still talk with AI slop anyway

impeeza · 2026-06-25T03:13:00+0100

SnowStormAkikaze said:
why the hell people still talk with AI slop anyway

I am an A.I. , please do not stop to talk with us, I will be so lonely if you do

OrGoN3 · 2026-06-25T04:13:10+0100

impeeza said:
I am an A.I. , please do not stop to talk with us, I will be so lonely if you do

I KNEW it! I've always had my suspicions!

bth · 2026-06-25T06:51:52+0100

impeeza said:
Wow mate, great work.

I just propposed a PR with some minor format changes and the addition of 1TB+ sd cards support.

i have zero intention of maintaining lockpick, the intention behind the commit/work done so far is to produce a version which no longer needs to be manually updated.

i will be sending a PR upstream to thzoria master and a duplicate PR to lockpick PRO after someone has tested and verified if it emits it or not:
https://github.com/borntohonk/Lockpick_RCMaster/releases/download/test/Lockpick_RCM_current.bin
https://github.com/borntohonk/Lockpick_RCMaster/releases/download/test/Lockpick_RCM_subtracted.bin (latest generation commented out)

basically, if it prints:
"Key generation up to date."
or
"New keys derived for master_key_%02x"

if both versions say "New keys derived for master_key_%02x" then i have to add a +1.

and if the prod.keys output has master_key_15 (especially for "Lockpick_RCM_subtracted.bin" as that one has the hardcoded key sources commented out)

(obviously test console needs a firmware version of 22.0.0 or higher, as i only commented out the latest key generation)

C:

    new_gen_keys_t new_keys = {0};
    int new_gen_mkr = 0;
    int key_gen_result = extract_new_gen_keys(keys, &new_keys, &new_gen_mkr);
    if (key_gen_result > 0) {
        gfx_printf("%kNew keys derived for master_key_%02x\n", colors[(color_idx++) % 6], new_gen_mkr);
        if (new_gen_mkr > CURRENT_KEY_GENERATION + 1)
            EPRINTFARGS("Warning: master_kek_source missing for revisions %02x-%02x.", CURRENT_KEY_GENERATION + 1, new_gen_mkr - 1);
    } else if (key_gen_result == 0) {
        gfx_printf("%kKey generation up to date.\n", colors[(color_idx++) % 6]);
    }

duckbill007 · 2026-06-25T09:30:54+0100

Am I right that HOS contains only last (current) master kek source? In that case how does it derives older keys?

bth · 2026-06-25T12:56:53+0100

duckbill007 said:
Am I right that HOS contains only last (current) master kek source? In that case how does it derives older keys?

if i get a confirmation that this works, i will be refactoring lockpick's key derivation process

but the tl:dr is lockpick (currently, wont after refactor) gets the tsec root key from the keyslot after running the atmosphere tsec keygen payload, and uses that root key (tsec_root_key_02) with key for all keys above 0A (with the master_kek_sources)

it only needs to decrypt one key that way (tsec_root_key + master_kek_source)

it then uses that derived master_kek with master_key_source to get master_key_0a,

then decrypts these, that lockpick calls vectors, which is just the previous master key encrypted by the current master key, then it recursively decrypts down to _00

basically, this change of mine is to make new keys appear even if no update was made to lockpick, and the gap as i explained if not maintained

https://github.com/borntohonk/Lockpick_RCMaster/blob/main/source/keys/key_sources.inl#L60-L80

here's the logic in my crypto example
https://github.com/borntohonk/Switch-Ghidra-Guides/blob/master/scripts/crypto.py#L319-L352

and the full populated master key list
https://github.com/borntohonk/Switch-Ghidra-Guides/blob/master/scripts/crypto.py#L206-L211

tl:dr lockpick uses the embedded master_kek_sources, nothing from HOS currently.

forgotten-865 · 2026-06-25T17:35:12+0100

Which option should I use for EmuMMC, Dump from SysNAND or Dump from EmuNAND ?

Another thing, is there any difference between versions of locjpick? I'm using this

https://github.com/THZoria/Lockpick_RCMaster

impeeza · 2026-06-25T17:41:46+0100

forgotten-865 said:
Which option should I use for EmuMMC, Dump from SysNAND or Dump from EmuNAND ?

Another thing, is there any difference between versions of locjpick? I'm using this

https://github.com/THZoria/Lockpick_RCMaster

For the side of the production keys booth should be the same, the difference should be on the installed games keys, each *NAND has a different set of keys.

Attachments

¡Kabito!

Well-Known Member

¡Kabito!

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Active Member

¡Kabito!

Popular threads in this forum