Hacking Question Possibility of pre-CFW NAND chip hardmod in the future?

kje123 · May 24, 2018

Basically the title. Would it be possible to recreate the switch NAND chip and sell it with a CFW pre installed to avoid EmuNAND? I'm not sure how Ninty's patent would affect manufacturing, nor do I know if it's even possible in the first place.

NeoSlyde · May 24, 2018

kje123 · May 24, 2018

NeoSlyde said:
No.

well, you must be fun at parties.

gamesquest1 · May 24, 2018

probably device specifc encryption in use, its pretty much standard at this point....plus with anti-downgrade protections in place, you would need the OS to match what the system was already on

basically you have a better chance of making a custom RCM payload that just wipes the nand and rebuilds it with a matching stock image

RHOPKINS13 · May 24, 2018

No, for the same reason we can't "pre-install" CFW on our regular NAND and boot it. We don't have a way of bypassing signature checks aside from using RCM to launch payloads over USB. At least for now.

mikey420 · May 24, 2018

The switch's NAND contains per console specific information that would need to be extracted and injected into the new chip not to mention the signature verifications performed by the bootloader which would need to be defeated. In short no.

gabru · May 24, 2018

kje123 said:
Basically the title. Would it be possible to recreate the switch NAND chip and sell it with a CFW pre installed to avoid EmuNAND? I'm not sure how Ninty's patent would affect manufacturing, nor do I know if it's even possible in the first place.

If you contact Daru to hack Ninty systems to get the blueprints you have two options: buy the automatas and rent a place to build the chip's or ask a China's manufacture (because they give a shit about copyrighted shit) to make that chip. Good luck with that.

kje123 · May 24, 2018

mikey420 said:
The switch's NAND contains per console specific information that would need to be extracted and injected into the new chip not to mention the signature verifications performed by the bootloader which would need to be defeated. In short no.

couldn't it be possible to inject that info needed to the CFW chip as a sort of "first time setup"?

--------------------- MERGED ---------------------------

gabru said:
If you contact Daru to hack Ninty systems to get the blueprints you have two options: buy the automatas and rent a place to build the chip's or ask a China's manufacture (because they give a shit about copyrighted shit) to make that chip. Good luck with that.

i mean, it really shouldnt be hard to manufacture the chip. iirc, its a pretty basic 32gb eMMc module. my concern was more how much the board needed to be altered so the (theoretical) manufacturer wouldnt be hit with a big ol lawsuit from ninty.

NeoSlyde · May 24, 2018

kje123 said:
couldn't it be possible to inject that info needed to the CFW chip as a sort of "first time setup"?

--------------------- MERGED ---------------------------

i mean, it really shouldnt be hard to manufacture the chip. iirc, its a pretty basic 32gb eMMc module. my concern was more how much the board needed to be altered so the (theoretical) manufacturer wouldnt be hit with a big ol lawsuit from ninty.

And where you will get a valid unique id

and valid unique keys

)))))

Mazamin · May 24, 2018

WTF, this topic is no sense
If an user is able to install a nand chip, he's also able to install a cfw in emunand lol

kje123 · May 24, 2018

Mazamin said:
WTF, this topic is no sense
If an user is able to install a nand chip, he's also able to install a cfw in emunand lol

not necessarily

the eMMc that contains the OS is on a small chip that actually plugs into the mainboard, making for a super easy hardmod if you could remanufacture the chip and flash a custom firmware on it. my question was more if it's possible to do it from a technical standpoint. (judging by the replies its probably too much work to make it worth it tho lmao)

just trying to make conversation while we wait for atmosphere ;p

EDIT: here's a pic of the chip, literally just plugs right in

Deleted-442439 · May 24, 2018

Nothing is impossible, but the crypto makes it highly unlikely that we will ever get anything like that + it would be expensive compared to other hardmods.

The best hardmod you can get with current methods is soldering a small chip to the D+ / D- test points on the PCB that injects a USB payload on powerup.

kje123 · May 24, 2018

jjbredesen said:
Nothing is impossible, but the crypto makes it highly unlikely that we will ever get anything like that + it would be expensive compared to other hardmods.

The best hardmod you can get with current methods is soldering a small chip to the D+ / D- test points on the PCB that injects a USB payload on powerup.

would it be possible to decrypt those keys needed with the master keys BBB has released, or are those different keys? im not quite sure what they're for or what they do. (at this point it's probably crossed the line into illegal tho lmao)

WaterBotttle · May 24, 2018

This isn't really possible. The Bootrom checks the eMMC chip for properly signed code.

So this would only be possible if you could write a new Bootrom (Hint: rom stands for read only memory)
Or if you could sign your own custom firmware (You would need Nintendo's private key)

Both of these are wildly impractical.

Reploid · May 24, 2018

kje123 said:
well, you must be fun at parties.

asked a question.
Got an answer.
Attacked the answerer cause the answer wasn't what he expected.

Deleted-442439 · May 24, 2018

kje123 said:
would it be possible to decrypt those keys needed with the master keys BBB has released, or are those different keys? im not quite sure what they're for or what they do. (at this point it's probably crossed the line into illegal tho lmao)

masterkeys in the context of BBB is not the same as the true master key used to sign by Nintendo. It is private, and unless a Nintendo employee wants to leak it I don't think we will ever be able to bypass it. We write to the bootrom, so there is no workaround right now :/

TheSynthax · May 24, 2018

kje123 said:
would it be possible to decrypt those keys needed with the master keys BBB has released, or are those different keys? im not quite sure what they're for or what they do. (at this point it's probably crossed the line into illegal tho lmao)

It is literally impossible to achieve this, and horribly impractical. Why would a new NAND need to be manufactured for SysNAND CFW? We'll be able to flash SysNAND CFW soon enough and use a modchip to boot it. Doesn't matter if you manufacture a new NAND, the boot ROM that handles the security checks is etched into the CPU itself, not written to a memory chip. There are physical copper traces embedded within the silicon chip that produce a small bit of executable binary code (this is the bootROM) which is uploaded to the RAM. The only public method of bypassing the security checks involves putting this bootROM into firmware update mode and sending a payload too large for it to check properly, so the signature checks are bypassed entirely. This requires a modchip or something to upload the payload via USB.

Could a replacement NAND be manufactured though? Yes. Very easily. But you would need an original NAND backup to flash to it.

kje123 · May 26, 2018

Reploid said:
asked a question.
Got an answer.
Attacked the answerer cause the answer wasn't what he expected.

i always forget sarcasm doesnt translate very well over text. ah well

Hacking Question Possibility of pre-CFW NAND chip hardmod in the future?

this title is false

Let us start the game

this title is false

Nabnut

Geek

Well-Known Member

Well-Known Member

this title is false

Let us start the game

Well-Known Member

this title is false

Attachments

Deleted-442439

Guest

this title is false

Well-Known Member

Well-Known Member

Deleted-442439

Guest

Well-Known Member

this title is false

Similar threads

Popular threads in this forum