Hacking WIP [Trinket] [Rebug] [Others] SWITCHBOOT_UF2 / FUSEE_UF2 modchip software

FunThomas

Well-Known Member
Member
Joined
Jan 10, 2016
Messages
652
Trophies
0
XP
2,016
Country
Gambia, The
Hi Matty,

the detection in switchboot v1 for the straps is it based on hardware detection of straps connected or the config made in the eeprom(Part1) ?

if the joycons are not connected the strap detection does not work it says not detected for joycon strap. but both switches get me vol+ strap not detected :-(

both were flashed with *JOYCON_VOLUME.uf2 and TRINKET_REBUG_SWITCHBOOT_PART2_V1.UF2
after some reboot it says all 3 straps detected yes, i don't know the circumstances why it detect wrong or if my cables are not stable but it's not as reliable as i thought

does pressing minus at the bootup influence the detection of the straps ?

could you please explain what modchip payload setting and mode settings means and the possible values ?
 
Last edited by FunThomas,

mattytrog

You don`t want to listen to anything I say.
OP
Member
Joined
Apr 27, 2018
Messages
3,708
Trophies
0
Age
48
XP
4,328
Country
United Kingdom
Hi Matty,

the detection in switchboot v1 for the straps is it based on hardware detection of straps connected or the config made in the eeprom(Part1) ?

if the joycons are not connected the strap detection does not work it says not detected for joycon strap. but both switches get me vol+ strap not detected :-(

both were flashed with *JOYCON_VOLUME.uf2 and TRINKET_REBUG_SWITCHBOOT_PART2_V1.UF2
after some reboot it says all 3 straps detected yes, i don't know the circumstances why it detect wrong or if my cables are not stable but it's not as reliable as i thought

does pressing minus at the bootup influence the detection of the straps ?

could you please explain what modchip payload setting and mode settings means and the possible values ?

Right... This is how the strap detection works...

Once we have sent the payload, you cannot change values on-screen ( you could, if you fit extra straps, maybe to serial, or hijack the USB port - though that would prevent anything else connecting to it.)

The very very first boot, there is a "runonce" section, that will check for the USB strap and return true if there is voltage on USB bus (ie when a cable is plugged in). So, for example, if you disconnect STRAIGHT after flashing, the strap might not be detected. This value gets locked and the code is never ran again... UNLESS you reflash the UF2 or use the EEProm reset in the vol+ button combo.

The vol+ strap... The moment you press vol+, at ANY time, this will update the value, save it to the chip and on the NEXT reboot, the info will be updated.

Same for the joycon strap. When you plug a joycon in, a potential is sensed on "pin 10" and this value is stored to eeprom... Again, once you reboot, it will show.

All values are "permanently" locked, as it is not necessary to keep looking for them once detected.

This is exactly how the "multi-payload" works (excluding where multiple payloads are in the actual chip).

In a multi-payload situation...

Example... The chip is looking for "payload1.bin"

So the bytes that are sent are (im paraphrasing here) - 0x p, 0x a, 0x y, 0x l, 0x o, 0x a, 0x d" then if payload1 is selected, 0x31 is sent... Payload2.bin, would be 0x32 etc etc. This chopping and changing allows similar code to be reused and save having duplicated parts of a c array on the chip, therefore giving you more space.


So... If you want all straps to show correctly, when you first flash the UF2, keep USB connected, connect a joycon and press vol+ at least once. Then reboot the chip / console.

If your straps are correct, they will NOW be updated.

Like I say, it is impossible to change the cosmetic values once the payload has sent. The only way around that is implementing some kind of serial communication. But this will more-than-likely push the stack over the 126296 limit.


"But how does it update from the other direction then?" I hear you ask...

Simple...

The payload is pushed byte-to-byte to a buffer prior to triggering the exploit. During this "byte-by-byte" stream, the appropriate values for straps are gathered, and the "byte-stream" is chopped and modified on the fly.

So different values are sent to the buffer prior to exploit running.
 
Last edited by mattytrog,
  • Like
Reactions: FunThomas

mattytrog

You don`t want to listen to anything I say.
OP
Member
Joined
Apr 27, 2018
Messages
3,708
Trophies
0
Age
48
XP
4,328
Country
United Kingdom
2019032520024800-57B4628D2267231D57E0FC1078C0596D.jpg


@Adr990
 

mattytrog

You don`t want to listen to anything I say.
OP
Member
Joined
Apr 27, 2018
Messages
3,708
Trophies
0
Age
48
XP
4,328
Country
United Kingdom
OK... Bit of an update coming tomorrow.

Switchboot Part2 v1.10 - mostly behind-the-scenes stuff

Changelog:

Hekate (my mod 4.9.1 - All modes apart from mode 3)
  • Battery info added back
  • More efficient selecting of backup folder
  • Corrected a couple of typos (translated - I`m too old to be learning new sh*t)
  • sept reboot implemented correctly(ish) this time when dumping all keys - nothing wrong with how it was before, just used too much space
  • Other bugfixes and optimisations
  • Completely silent "payload.bin" & "payload<number>.bin" launching - hold down a vol button while you power-on to get into menu - this part identical in functionality to the basic Fusee-UF2 - and as fast.
Argon-NX (unofficial 0.3.1 - mode 3):
  • Touch screen reliability hopefully improved
  • Multiple screenshots now possible
Not mandatory to update. But if you want to, you can.
 

mattytrog

You don`t want to listen to anything I say.
OP
Member
Joined
Apr 27, 2018
Messages
3,708
Trophies
0
Age
48
XP
4,328
Country
United Kingdom
So, if I'm right... Now 1.10 is same fast as Fusee-UF2??
No. It has the same fast booting of Fusee-UF2 and is completely transparent.

BUT... If you hold a vol button then press power to power on, keep holding, you will be taken to the menu.

Where you will find...

All the Hekate options you know and love

Plus:

  • Dump all keys from device
  • Launch a payload from SD root as well as /payloads folder
  • Multiple backups into numbered folders (I didn`t like the original Hekate approach)
  • No need to mess around dragging files from backup to restore folder as with normal Hekate
  • A "safe" backup which will backup BOOT0/1 & PRODINFO to a new folder called "safe" on SD root.
  • Restore JUST prodinfo if you wish (for brick-testers) - If you run a malicious NSP, just reboot and restore PRODINFO. PRODINFO killing is all they can really do to brick a console and the only thing that is non-recoverable.
  • Modchip info on screen
  • Instead of using a "payload.bin", you can rename to "payload1.bin". This will activate "multi-payload mode". So if you have straps fitted, pick a different payload via HARDWARE.
  • If you are in a position to change mode, changing to mode 3 will turn your chip into an "Argon-NX" chip, where you can use this natively.
Anyway... enough bullshit. Better carry on.
 

josete2k

Well-Known Member
Member
Joined
Apr 24, 2009
Messages
680
Trophies
1
Age
43
Location
Spain
XP
1,609
Country
Spain
Holding vol button will be compatible with sxos?

If I want to go to the sxos menu I have to keep vol+ pressed while booting SXOS. .
 

mattytrog

You don`t want to listen to anything I say.
OP
Member
Joined
Apr 27, 2018
Messages
3,708
Trophies
0
Age
48
XP
4,328
Country
United Kingdom
OK post 2 updated.

Made an example SD card. Either good for empty cards or copy over existing files.

Example SD contains some Argon-NX graphics, OEM style bootlogo and a basic 0.8.6 Atmosphere setup with sigpatches to get you going.
 
  • Like
Reactions: Adr990 and Gismor

Gismor

Well-Known Member
Member
Joined
Nov 12, 2018
Messages
119
Trophies
0
Age
39
XP
631
Country
Germany
Boot into your payload, so you are at at the menu... Double-press reset, select something to boot. Cfw / keys whatever...

Switchboot will pop up
i boot to hekate. press twice the backside of the switch (reset buton from rebug) i boot in my CFW and now i connect the USB cable is this right?
 

mattytrog

You don`t want to listen to anything I say.
OP
Member
Joined
Apr 27, 2018
Messages
3,708
Trophies
0
Age
48
XP
4,328
Country
United Kingdom
i boot to hekate. press twice the backside of the switch (reset buton from rebug) i boot in my CFW and now i connect the USB cable is this right?
Almost!

1) boot to hekate
2) double press reset
3) connect
4) boot something
 
  • Like
Reactions: Gismor

Gismor

Well-Known Member
Member
Joined
Nov 12, 2018
Messages
119
Trophies
0
Age
39
XP
631
Country
Germany
Almost!

1) boot to hekate
2) double press reset
3) connect
4) boot something

thanks dosent know this option works perfect =)

--------------------- MERGED ---------------------------

have try the new version 1.1
it works perfect on the rebug thanks Matty for your great work =)
 
  • Like
Reactions: mattytrog

mattytrog

You don`t want to listen to anything I say.
OP
Member
Joined
Apr 27, 2018
Messages
3,708
Trophies
0
Age
48
XP
4,328
Country
United Kingdom
thanks dosent know this option works perfect =)

--------------------- MERGED ---------------------------

have try the new version 1.1
it works perfect on the rebug thanks Matty for your great work =)
Thank-you for the feedback sir!
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    Xdqwerty @ Xdqwerty: sigh