Lockpick_RCM payload - Official Thread


Description

Lockpick_RCM is a bare metal Nintendo Switch payload that derives encryption keys for use in Switch file handling software like hactool, hactoolnet/LibHac, ChoiDujour, etc. without booting Horizon OS.

Source: https://github.com/shchmue/Lockpick_RCM
Payload: https://github.com/shchmue/Lockpick_RCM/releases

Due to changes imposed by firmware 7.0.0, Lockpick homebrew can no longer derive the latest keys. In the boot-time environment however, there are fewer limitations. That means the new keys are finally easy to dump!

Usage
  • Launch Lockpick_RCM.bin using your favorite payload injector or chainload from Hekate by placing it in /bootloader/payloads
  • Upon completion, keys will be saved to /switch/prod.keys on SD
  • If the console has Firmware 7.x, the /sept/ folder from Atmosphère or Kosmos release zip containing both sept-primary.bin and sept-secondary.enc must be present on SD or else only keyblob master key derivation is possible (ie. up to master_key_05 only)
Big thanks to CTCaer
For Hekate and all the advice while developing this!

Known Issues
  • Chainloading from SX will hang immediately due to quirks in their hwinit code, please launch payload directly
 

Attachments

  • AB1248EA-8BB9-448B-83F5-FF68C2579FB1.jpeg
    AB1248EA-8BB9-448B-83F5-FF68C2579FB1.jpeg
    11.2 KB · Views: 0
Last edited by shchmue,
I thought that there was no need to update Lockpick any further?
there isn't a need for it other than consistency;

it has a feature for dumping the latest keys regardless if its updated or not; but one can keep it up to date despite that.

it's more of a fallback feature i added incase for whatever reason it becomes DMCA target by nintendo again (although the original DMCA takedown was false, not filed by nintendo or legal firm representing nintendo)
 
some tools like hactool need you have a local copy of the keys on your hard drive and lockpick is a easy and quick way to get them
Doesn't hactool have a built in keygenerator yet? It should get modded to just drag a firmware folder onto it and build a keyfile. Maybe that would be a good feature and relatively easy to add.
 
Doesn't hactool have a built in keygenerator yet? It should get modded to just drag a firmware folder onto it and build a keyfile. Maybe that would be a good feature and relatively easy to add.
That is a cool idea, the repo is public, nothing stop you to make the pr. thanks.
 
That is a cool idea, the repo is public, nothing stop you to make the pr. thanks.
I already have a working windows keygen (and all the new keys) so no need for me to make it, but obviously it can't be shared on here due to the rules, but yes you're correct and I could implement it if I wanted, I just wondered if it's already been done or not.
 
Doesn't hactool have a built in keygenerator yet? It should get modded to just drag a firmware folder onto it and build a keyfile. Maybe that would be a good feature and relatively easy to add.
my version of hactool is capable of that: https://github.com/borntohonk/hactool/blob/master/pk11_extract_key_sources.c
I more or less just copied my other work for the lockpick change that does more or less the same.
I already have a working windows keygen (and all the new keys) so no need for me to make it, but obviously it can't be shared on here due to the rules, but yes you're correct and I could implement it if I wanted, I just wondered if it's already been done or not.
i have an universal pure python library capable of it, as well as automatically deriving keys from input firmware files
https://github.com/borntohonk/Switch-Ghidra-Guides/blob/master/scripts/process_firmware.py#L164-L199

and yes it has already been done, just as you describe, but i will consider adding a sub-command specifically for taking firmware input and outputting new keyset into hactool as well
 
  • Like
Reactions: Blythe93
my version of hactool is capable of that: https://github.com/borntohonk/hactool/blob/master/pk11_extract_key_sources.c
I more or less just copied my other work for the lockpick change that does more or less the same.
:wub::wub::wub:

i have an universal pure python library capable of it, as well as automatically deriving keys from input firmware files
https://github.com/borntohonk/Switch-Ghidra-Guides/blob/master/scripts/process_firmware.py#L164-L199

and yes it has already been done, just as you describe, but i will consider adding a sub-command specifically for taking firmware input and outputting new keyset into hactool as well
Wow, that is nice, and will be great to have the parameters to read a folder and extract the pod.keys.

We will never be able to thank you enough.
 

Site & Scene News

Popular threads in this forum