Hacking Atmosphere-NX - Custom Firmware in development by SciresM

tivu100 · Apr 30, 2018

WaterBotttle said:
Just had an interesting idea. It's possible to use the bootrom exploit to lie to the boot-loader about the number of e-fuses blown, so therefore it should be possible to use a higher firmware version 5.0+ with spoofed e-fuses and then "downgrade" to the original firmware version after Atmosphere has been released (Because the e-fuses haven't changed)

The only downside would be requiring the bootrom exploit at every boot. (It might even be a good idea to purposefully break the signature of the bootloader (by patching out the anti-downgrade checks) so it doesn't normally run and update the e-fuses (In case you forget to boot in RCM mode)

It's plenty of work which is better used to implement Atmosphere CFW to support higher FW, then working on finding vulnerability which may result in untethered exploit for higher FW in the future. Downgrading is only worth the effort when it's vital to install some kind of exploit which is not possible at higher FW (3DS when we need to downgrade to 9.2 for CFW, or to 2.1 so we can obtain OTP.bin back in the date for coldboot...). Switch is already wide open for even latest FW, so the effort should be toward something else, especially new hardware revised Switch is at the corner.

WaterBotttle said:
At the moment there isn't a usable public CFW for the switch. From what I understand it should be a lot easier to just change one cached e-fuse value and then boot from the eMMC than create a CFW, so think of this idea as a stop gap solution to play higher FW games while the CFW is finished.

Thing is you're taking about the perspective of from people with higher FW want CFW sooner. CFW is scheduled to release for all FW during the summer, so it wouldn't be too long especially as open source when people with skills have time, it would make huge progress.

From perspective of lower FW users and people with insufficient budget (memory card space issue), they want the ability to boot CFW from SYSNAND on latest version than making EMUNAND and lose space to system data. So in the end, the end goal would be making CFW workable on newer SYSNAND without the dependence on EMUNAND, and eventually unethered coldboot

guily6669 · Apr 30, 2018

Maximilious said:
I actually upgraded from a 2K series to my 6700K a few years ago haha. Mine was definitley on it's last legs though and I saw a notable boost.

If you're hitting a bottleneck then it may be on your motherboards BUS (think of it as the highway from your CPU to your RAM, more lanes means more traffic can flow), but I couldn't see an i5 hitting any bottlenecks unless you're using a traditional HDD or a really really cheaply made (off brand) mobo or memory.

Try squad and you will see bottleneck on probably all CPUs, maybe the latest 8700K won't have it much...

Draxzelex · Apr 30, 2018

tivu100 said:
From perspective of lower FW users and people with insufficient budget (memory card space issue), they want the ability to boot CFW from SYSNAND on latest version than making EMUNAND and lose space to system data. So in the end, the end goal would be making CFW workable on newer SYSNAND without the dependence on EMUNAND, and eventually unethered coldboot

SciresM has specifically stated that Atmosphere is designed to be an EmuNAND CFW. Although I don't know why he chose to design it around EmuNAND, someone would have to code Atmosphere to run with SysNAND. Also the purpose of EmuNAND is to have a way of recovering a bricked Switch. 3DS scene used EmuNAND until they found a way to restore the NAND. So until someone develops a way to do that for the Switch, everyone will have to use EmuNAND if they don't want to risk that from happening.

WaterBotttle · Apr 30, 2018

Draxzelex said:
SciresM has specifically stated that Atmosphere is designed to be an EmuNAND CFW. Although I don't know why he chose to design it around EmuNAND, someone would have to code Atmosphere to run with SysNAND. Also the purpose of EmuNAND is to have a way of recovering a bricked Switch. 3DS scene used EmuNAND until they found a way to restore the NAND. So until someone develops a way to do that for the Switch, everyone will have to use EmuNAND if they don't want to risk that from happening.

Should be possible (Easier even to use Sysnand, but you would have to boot into RCM mode every boot)

"This will either involve patching up the FS module, or writing/implementing an EL2 driver. If the latter, will need support in custom TZ." https://github.com/Atmosphere-NX/Atmosphere/issues/8

Draxzelex · Apr 30, 2018

WaterBotttle said:
Should be possible (Easier even to use Sysnand, but you would have to boot into RCM mode every boot)

"This will either involve patching up the FS module, or writing/implementing an EL2 driver. If the latter, will need support in custom TZ." https://github.com/Atmosphere-NX/Atmosphere/issues/8

Oh yeah, it would be relatively simple for a developer to do but not exactly for an average joe like me. I'm just wondering why he's only developing it for EmuNAND solely and not just both.

TheCyberQuake · Apr 30, 2018

That just boots into RCM. Still need a USB host to deliver the RCM exploit

ombus said:
I read that 1.0.0 has a software way to use fusee glee without a pc. We just corrupt that one part that someone said and it will boot in the recovery each time without the jig mod. After that just use the software way in 1.0.0 to use glee then it boots cfw. Dunno why you said software is tethered.

Edit. I could be wrong here. Just saying.

tivu100 · Apr 30, 2018

Draxzelex said:
SciresM has specifically stated that Atmosphere is designed to be an EmuNAND CFW. Although I don't know why he chose to design it around EmuNAND, someone would have to code Atmosphere to run with SysNAND. Also the purpose of EmuNAND is to have a way of recovering a bricked Switch. 3DS scene used EmuNAND until they found a way to restore the NAND. So until someone develops a way to do that for the Switch, everyone will have to use EmuNAND if they don't want to risk that from happening.

I don't follow.

For 3DS, EMUNAND was needed for long time before a9hl then b9s came into the scene. Why? The ability to update game, play new game and go online, since you can't update SYSNAND past 9.2 at the time without losing CFW (you have to downgrade, and new firmware update from Nintendo often patches vulnerabilities for downgrade)

On Switch, EMUNAND is needed for older FW since if you update, the e-fuse blows and you lose the unethered coldboot. Also there is a chance new hardware revised Switch would require implementation of EMUNAND if CFW become possible. It's not always easy to pawn vulnerabilities for bootrom exploit. Even kernel exploit is scarce. So until at least it's possible to unethered coldboot SYSNAND on newer FW, EMUNAND is still convenient for lower FW original Switch as they can unethered cold boot

guily6669 · Apr 30, 2018

But hell with the fast progression I'm not even dying for a untethered exploit anymore, now that is on android and I always have it with me everywhere I will probably either add a button on my joy-con or use a magnetic switch soldered inside and in like a minute we have the exploit running

.

I just can't wait to see is CFW and I can't deny I really want to see what TX comes up with...

horokeusama · Apr 30, 2018

sarkwalvein said:
There are reasons that might justify not updating, I myself don't find them convincing enough.

Right now, it seems you will need to teether your exploit each time you cold boot.
Due too reasons, if it ever happens, it would be more probable that you don't need to do that on lower firmwares, in case some appropriate software exploit is found on them.

notimp said:
For 1.0.0 and 3.0.0 such software entry points are confirmed (booting RCM without shortening controller pin 10). For 4.1.0 one is being worked on.

That said, it might be quicker to always use a jig (hardware thingy you put into the controller rail before you boot). We don't know yet.

There might be negatives for shorting controller pin 10 permanently (the thing the jig does temporarily), those have to be explored as well, some might depend on N as well (could ban console from online for having it permanently shorted).

Currently you also need to use a powered USB device connected to the USB port to execute the exploit (that works on "every" firmware) after every boot, this hopefully will go away in the near future as well.

All of what you just read are potential usability problems, that might have people resort to getting some form of "modchip" in the future - or not. Depending on how well they can get solved, and how important it is for people to quickly boot into CFW.

CFW on its own, just sits on your SD card, and either does nothing, or gets booted by the approaches just listed. "If I haz CFW, I don't have to think about anything" does not hold true.

Also waiting for how Nintendo will react to CFW is a good idea as well - because depending on that, some people might wan't to gravitate to one solution and not the other.

1.0.0 also has a high chance of being the only FW version where "turn it on, and everything just works" might become reality. Without any form of hardmod.

3.0.0 still is the only FW version that can run homebrew (with little issues) right now (don't ask how 1.0.0 and 2.1.0 can as well - look for it in this forum).

4.1.0 is still the most "current" firmware with a chance of a non hardware assisted method. In the mid term future.

This my dear "what should I do" champion, is complexity.

So do us all a favor and wait for at least two months, until Atmosphere actually gets released, instead of asking "what should I do?" questions now.

Less and less people are willing to give you an excursion in "what the current situation is", because there is about 2-5 in total who might be willing to do so in here - and they have been abused by people like you "what should I do? - is the only reason why I register in forums" too freaking much already.

Simple answers not available yet. Wait for tutorials that talk to you in a language you unterstand ("Five easy steps to - you wouldnt believe...").

"And if I update anyway?" You will always be able to use some form of hardmod (modchip for more ease of use), if you are on the first hardware revision (20 million Switches, up to about now (new revision is being produced)). How this factors into ease of use - we dont know yet.

Maybe we laugh about you, because you updated, and now you have to pay for a modchip install. Maybe thats the most "economical way" for everyone. It all now depends on implementation. Thats currently ongoing.

"But can you tell me what I should do, because I wan't.."

Zipp it. We already did this, a dozen of times in the last five days. You are just not reading.

You are highjacking threads, because you want people who want this forum to be about different conversations as well, to do your bidding.

Thanks for the information. And stop whining for christ sake, writing a full essay complaining that people are asking questions on a forum only shows how frustrated you are with your life, notimp.

ombus · Apr 30, 2018

TheCyberQuake said:
That just boots into RCM. Still need a USB host to deliver the RCM exploit

What i read is that a software solution exist on 1.0.0 to send the exploit without a pc. The rcm one can enter by corrupting one thing.

TheCyberQuake · Apr 30, 2018

ombus said:
What i read is that a software solution exist on 1.0.0 to send the exploit without a pc. The rcm one can enter by corrupting one thing.

1.0.0 has jamais vu, which is not FG but will be able to warmboot into cfw once it comes out. Deja vu should also allow that when we eventually see that release as well. But for now the only software method that is currently public just boots a 1.0.0 system into RCM. We also likely won't see Deja vu for a while because the devs are trying to hold onto that for as long as possible.

Draxzelex · May 1, 2018

tivu100 said:
I don't follow.

For 3DS, EMUNAND was needed for long time before a9hl then b9s came into the scene. Why? The ability to update game, play new game and go online, since you can't update SYSNAND past 9.2 at the time without losing CFW (you have to downgrade, and new firmware update from Nintendo often patches vulnerabilities for downgrade)

On Switch, EMUNAND is needed for older FW since if you update, the e-fuse blows and you lose the unethered coldboot. Also there is a chance new hardware revised Switch would require implementation of EMUNAND if CFW become possible. It's not always easy to pawn vulnerabilities for bootrom exploit. Even kernel exploit is scarce. So until at least it's possible to unethered coldboot SYSNAND on newer FW, EMUNAND is still convenient for lower FW original Switch as they can unethered cold boot

TheCyberQuake said:
1.0.0 has jamais vu, which is not FG but will be able to warmboot into cfw once it comes out. Deja vu should also allow that when we eventually see that release as well. But for now the only software method that is currently public just boots a 1.0.0 system into RCM. We also likely won't see Deja vu for a while because the devs are trying to hold onto that for as long as possible.

Everyone has to tether for the time being. Tethering is needed to send the payloads, not boot into RCM. Unless you're on firmware 1.0, you're going to need to tether to run Fusee Gelee. This is why I don't see the point to EmuNAND since the only differences so far in OFWs are how we boot into RCM. Even playing online with a CFW on EmuNAND may not be 100% safe so that's not entirely a good reason either. I don't want to speculate what the Mariko Switches will require because they will be their own animal, needing their own host of exploits.

But I'm pretty sure we only need to tether once to install CFW. Once its installed into the Switch, we will probably have the option to boot into whatever firmware we want since Atmosphere bypasses the security measures according to Ktemkin.

CaptainHIT · May 1, 2018

I need this bad!

Crazy-S · May 1, 2018

CaptainHIT said:
I need this bad!

Then wait for it...

WaterBotttle · May 1, 2018

Draxzelex said:
Everyone has to tether for the time being. Tethering is needed to send the payloads, not boot into RCM. Unless you're on firmware 1.0, you're going to need to tether to run Fusee Gelee. This is why I don't see the point to EmuNAND since the only differences so far in OFWs are how we boot into RCM. Even playing online with a CFW on EmuNAND may not be 100% safe so that's not entirely a good reason either. I don't want to speculate what the Mariko Switches will require because they will be their own animal, needing their own host of exploits.

But I'm pretty sure we only need to tether once to install CFW. Once its installed into the Switch, we will probably have the option to boot into whatever firmware we want since Atmosphere bypasses the security measures according to Ktemkin.

As far as I understand you probably won't need to be tethered if you are on 4.1.0 and below, due to there being a trustzone exploit. This should be all you need to launch CFW.

The reason why EmuNAND is necessary is because we can't really write to the NAND. Any change you make will be written fine, but if you were to restart your console normally it will not boot because the signature is wrong.

This also means that you won't be able to install CFW to the NAND.

tivu100 · May 1, 2018

Draxzelex said:
Everyone has to tether for the time being. Tethering is needed to send the payloads, not boot into RCM. Unless you're on firmware 1.0, you're going to need to tether to run Fusee Gelee. This is why I don't see the point to EmuNAND since the only differences so far in OFWs are how we boot into RCM. Even playing online with a CFW on EmuNAND may not be 100% safe so that's not entirely a good reason either. I don't want to speculate what the Mariko Switches will require because they will be their own animal, needing their own host of exploits.

But I'm pretty sure we only need to tether once to install CFW. Once its installed into the Switch, we will probably have the option to boot into whatever firmware we want since Atmosphere bypasses the security measures according to Ktemkin.

I think you're confused and having some misconception here:

Look at iOS device: Unethered coldboot method is FW version related. New FW version patch the old method and you need to find another in case new apps require latest FW version. More often than not the untethered method took ages before someone release it! Some exploit works on many firmware versions, but doesn't mean it definitely works on new FW.

What you implied is something like a9lh and b9s for the 3DS which we're not there yet. CFW here needs exploit to run, and the exploits we have, the most convenient lies with older FW version. It's harder/less convenient up the ladder. As other poster you quoted gave the outline of how it works: Older FW version would allow self sustainable on the Switch without extra hardmod step, connection to other devices...

Just because every one can enter RCM and use Fusee Gelee, doesn't mean it's good idea for other to lose out on untethered method on lower firmware. 1.0 then 3.0 then 4.0 and 5+ would eventually get looked at. Just because the focus is on pushing CFW for latest FW sooner, doesn't mean it's the best for community. Look at it like this: Let's say developers put all their time to develop CFW for latest FW and also release an untethered cold boot for latest firmware. The next day Nintendo patches the untethered cold boot method. So what? You have to update again for online featur thus losing untethered coldboot and have to wait a bit (or a long time) for some changes to make CFW fully work on the newer new FW version!!! Back to square one. With EMUNAND, once you get an unethered coldboot without fear for new update until you have something like a9hl or b9s of 3DS, so you can go on full space saving mode.

It only needs little patience as the schedule for release CFW for all FWs is this summer. And developers are working hard. They sound like being very busy at the moment so you can speculate that once they have more free time, progression would be quicker?

Quantumcat · May 1, 2018

Draxzelex said:
Also the purpose of EmuNAND is to have a way of recovering a bricked Switch. 3DS scene used EmuNAND until they found a way to restore the NAND.

No, the purpose of emuNAND is to be able to run higher firmwares than what you need to launch CFW. For eg on 3DS first there was only a software exploit known in 4.x, if you wanted to run games that required higher firmware then you needed an emuNAND. Then 9.2 then 11.2. You could always make NAND backups and restore them whether or not you used an emuNAND, either through tools launched the same way as CFW or through a hardmod. The 3DS only stopped needing emuNAND when we stopped needing to launch CFW through software, when we got A9LH.

CaptainHIT · May 1, 2018

Crazy-S said:
Then wait for it...

So do I!

TheGreek Boy · May 1, 2018

where can i download a compiled atmosphere cfw?

leerpsp · May 1, 2018

TheGreek Boy said:
where can i download a compiled atmosphere cfw?

not out yet... your too soon.

--------------------- MERGED ---------------------------

leerpsp said:
not out yet... your too soon.

will after seeing you asked for compiled after re-reading your comment yes there is some compiled ones out there but as far as I know it does not boot yet.

Hacking Atmosphere-NX - Custom Firmware in development by SciresM

Well-Known Member

GbaTemp is my Drug

Well-Known Member

Well-Known Member

Well-Known Member

Certified Geek

Well-Known Member

GbaTemp is my Drug

Well-Known Member

Well-Known Member

Certified Geek

Well-Known Member

Well-Known Member

Pessimist

Well-Known Member

Well-Known Member

Dead and alive

Well-Known Member

Well-Known Member

Well-Known Member

Similar threads

Popular threads in this forum