Hacking Hack SXOS

mspy said:

Humm now that SX OS seems to not be updated anymore I wonder if Tinfoil would consider removing the SX license requirements that atm we need to have in order to unlock all of it's potential. Even better would be if they implemented a XCI Loader, if anyone were to do it I guess Tinfoil would be my best bet.

Also regarding XCI Loader, and speaking from a perspective of someone who doesn't know anything about coding, would it be possible to salvage anything from any of the Switch emulators out there like yuzu or Ryujinx, as in learning how they load/play XCI files and try to import the method to the Switch itself? These emulators are open-source but I don't really know if it would be of any help for a potential XCI Loader project on the Switch itself.

Click to expand...

You would think that Blawar would remove the license checks but since he is close to TX maybe he knows something about the future of SXOS that we do not, which may be the reason that the license checks have not been removed yet. I've lost count of how many times I have said this but until Gary Bowser's lawsuit is over we can't say with 100% certainty that TX is dead. Yes it looks that way but what would you do if a big corporation was trying to sue you for millions of dollars? Especially given that Gary was illegally extradited from the Dominican Republic. When shit hits the fan you shut the fuck up. Could they have already given up? Sure. But there's no way to know until the lawsuit is over.

As for XCI loading. All the knowledge needed to do it is public, it's just hard to do in a legal way. The reason emulators are able to do it is because they don't have to work around Nintendo's firmware. They can just mount the image and start executing the NSO. On physical hardware you have to patch system modules, emulate the game card reader, redirect file read operations, etc. Once Atmosphere reimplements the FS system module it should be a lot easier to do, but that isn't on the road map until next year iirc and even then it might get delayed.

Edit: To be clear, Atmosphere is not going to add XCI loading support, but when they reimplement the FS system module it will make it easier for a third party developer to add XCI loading.

It would be easier to design a dedicated website to generate the license.

CompSciOrBust said:

You would think that Blawar would remove the license checks but since he is close to TX maybe he knows something about the future of SXOS that we do not, which may be the reason that the license checks have not been removed yet. I've lost count of how many times I have said this but until Gary Bowser's lawsuit is over we can't say with 100% certainty that TX is dead. Yes it looks that way but what would you do if a big corporation was trying to sue you for millions of dollars? Especially given that Gary was illegally extradited from the Dominican Republic. When shit hits the fan you shut the fuck up. Could they have already given up? Sure. But there's no way to know until the lawsuit is over.

Click to expand...

Why would you be able to say if TX is dead or not when the lawsuit is over? Even if Gary is clear of the charges I don't see why TX would suddenly start releasing new versions of SX OS. Rumour has it that Gary was just some public relations sort of guy and not a developer of anything. Now we could argue that TX is just laying low for the time being...

CompSciOrBust said:

As for XCI loading. All the knowledge needed to do it is public, it's just hard to do in a legal way. The reason emulators are able to do it is because they don't have to work around Nintendo's firmware. They can just mount the image and start executing the NSO. On physical hardware you have to patch system modules, emulate the game card reader, redirect file read operations, etc. Once Atmosphere reimplements the FS system module it should be a lot easier to do, but that isn't on the road map until next year iirc and even then it might get delayed.

Edit: To be clear, Atmosphere is not going to add XCI loading support, but when they reimplement the FS system module it will make it easier for a third party developer to add XCI loading.

Click to expand...

I do not know exactly the inner workings of any of the Switch emulators out there, in fact I have never used any of them myself, but at least on the case of Ryujinx, from what I've seen, you need to have the Switch firmware at hand to perform some sort of install of it on the emulator itself in order to make it work. That said, the emulator may not have to rely on the switch firmware it installs to load XCI as you said so, I really don't know.

CompSciOrBust said:

You would think that Blawar would remove the license checks but since he is close to TX maybe he knows something about the future of SXOS that we do not, which may be the reason that the license checks have not been removed yet. I've lost count of how many times I have said this but until Gary Bowser's lawsuit is over we can't say with 100% certainty that TX is dead. Yes it looks that way but what would you do if a big corporation was trying to sue you for millions of dollars? Especially given that Gary was illegally extradited from the Dominican Republic. When shit hits the fan you shut the fuck up. Could they have already given up? Sure. But there's no way to know until the lawsuit is over.

As for XCI loading. All the knowledge needed to do it is public, it's just hard to do in a legal way. The reason emulators are able to do it is because they don't have to work around Nintendo's firmware. They can just mount the image and start executing the NSO. On physical hardware you have to patch system modules, emulate the game card reader, redirect file read operations, etc. Once Atmosphere reimplements the FS system module it should be a lot easier to do, but that isn't on the road map until next year iirc and even then it might get delayed.

Edit: To be clear, Atmosphere is not going to add XCI loading support, but when they reimplement the FS system module it will make it easier for a third party developer to add XCI loading.

Click to expand...

Good writeup.

mspy said:

Why would you be able to say if TX is dead or not when the lawsuit is over? Even if Gary is clear of the charges I don't see why TX would suddenly start releasing new versions of SX OS. Rumour has it that Gary was just some public relations sort of guy and not a developer of anything. Now we could argue that TX is just laying low for the time being...

Click to expand...

I briefly was friends with Gary before he was arrested. I'm not sure what or how much I should say about him but if Gary was a PR person for TX, and Nintendo is going after him this hard despite not developing any of TX's products, don't you think that might spook the people that did have an involvement with the development of TX products? If it was me I'd feel more at ease continuing development if Gary is found innocent. And this is assuming that Gary really is just a PR person. Nintendo claims he had much deeper involvement in TX but who knows if that is actually true? Looking through the public court documents I know a lot of the charges against him are total bullshit.

Gary is getting shafted right now. He was supposed to be held in the Dominican for 24 hours before being extradited. He was in the US just a few hours after he was arrested. His rights were violated and I haven't seen anyone talking about it, I only know about it because a mutual friend of ours pointed it out. If they're doing this to the PR guy imagine how fearful people with real involvement with TX must be.

mspy said:

I do not know exactly the inner workings of any of the Switch emulators out there, in fact I have never used any of them myself, but at least on the case of Ryujinx, from what I've seen, you need to have the Switch firmware at hand to perform some sort of install of it on the emulator itself in order to make it work. That said, the emulator may not have to rely on the switch firmware it installs to load XCI as you said so, I really don't know.

Click to expand...

I'm not very familiar with the inner workings of Switch emulators either but XCI files are Card Images (hence the CI). Basically just like an NSP (Nintendo Submission Package) they contain a bunch of NCA files (Nintendo Content Archive) and one of those NCAs contains an NSO (Not sure what it stands for but it's the Switch version of an EXE, NRO is actually like a DLL). For an emulator to load a game all it has to do is start executing the NSO. It doesn't care if the NSO came from a XCI, NSP, or even if you just handed it a raw file manually extracted using hactool. On the Switch it does care where the NSO comes from since you have to tell it where to look.

When you install an NSP all the Switch does is extract the NCA files from it, dump them in to the /contents/ folder on your nand (if you install it to the SD it's the same but encrypted), then register the files in a database to say that those NCA files belongs to that game. Then when you load the game from the start menu the Switch will open each of those NCA files and look at what they contain, 3d models, textures, and one of them will contain the NSO. Fun fact when you download games from the eshop you don't even download an NSP. The files are downloaded as a bunch of separate NCA files.

When you load a game from a cart on the Switch first the Switch talks to the card reader, the card reader then mounts the card as a storage device, and then the Switch can see all the NCA files on it and from there the process is the same as an NSP. If you want to mount the XCI as a file rather than the physical card you have to modify the firmware to talk to a card reader emulator (in the case of SXOS it runs in the TX sys-module), the card reader emulator will then read the XCI from the SD and pass the data back along to the Switch firmware. This might sound easy but the amount of work that goes in to emulating the card reader, patching the firmware to talk to the emulator instead of the physical card reader, etc is huge. The card reader is it's own separate system from the Switch with it's own processor and firmware and fuses and stuff. It's call Lotus. More info here: https://switchbrew.org/wiki/Lotus3

The way TX does this, if what I have heard is true, is by just putting the real Lotus firmware in the emulator and making it read stuff from the SD Card when it tries to access the physical pins. This isn't legal though. Another way to do it which would be legal is to just find the function in the FS sys-module and tell it when it tries to access the card reader to not do that but instead stream the XCI file from the SD. This would be very hard to do without a reimplementation of FS though.

Going to ping @ZachyCatGames because he knows more about this stuff than me so maybe he can correct me if I got something wrong or he has something to add.

CompSciOrBust said:

I briefly was friends with Gary before he was arrested. I'm not sure what or how much I should say about him but if Gary was a PR person for TX, and Nintendo is going after him this hard despite not developing any of TX's products, don't you think that might spook the people that did have an involvement with the development of TX products? If it was me I'd feel more at ease continuing development if Gary is found innocent. And this is assuming that Gary really is just a PR person. Nintendo claims he had much deeper involvement in TX but who knows if that is actually true? Looking through the public court documents I know a lot of the charges against him are total bullshit.

Gary is getting shafted right now. He was supposed to be held in the Dominican for 24 hours before being extradited. He was in the US just a few hours after he was arrested. His rights were violated and I haven't seen anyone talking about it, I only know about it because a mutual friend of ours pointed it out. If they're doing this to the PR guy imagine how fearful people with real involvement with TX must be.

Click to expand...

From what I've read, a new version of SXOS is unlikely because there is no more money to be made which in the end of the day is what TX is all about (making money). By that I mean that Gary allegedly was the one who made the money flow and with him out of the picture TX is pretty much in the dark, maybe this is why nintendo went hard on him or maybe nintendo just didn't have much more leads to pursue. This is a likely scenario because the SX website where you activate your license and all that is actually up but all other sites where you use to buy the licenses are gone or do not sell them anymore. Also let us not forget that there was a new version os SXOS released upon a new nintendo firmware update some time after Gary was arrested which kinda confirms that he was not a developer or if he was there were more people involved on it capable of updating SXOS.

CompSciOrBust said:

When you load a game from a cart on the Switch first the Switch talks to the card reader, the card reader then mounts the card as a storage device, and then the Switch can see all the NCA files on it and from there the process is the same as an NSP. If you want to mount the XCI as a file rather than the physical card you have to modify the firmware to talk to a card reader emulator (in the case of SXOS it runs in the TX sys-module), the card reader emulator will then read the XCI from the SD and pass the data back along to the Switch firmware. This might sound easy but the amount of work that goes in to emulating the card reader, patching the firmware to talk to the emulator instead of the physical card reader, etc is huge. The card reader is it's own separate system from the Switch with it's own processor and firmware and fuses and stuff. It's call Lotus. More info here: https://switchbrew.org/wiki/Lotus3

The way TX does this, if what I have heard is true, is by just putting the real Lotus firmware in the emulator and making it read stuff from the SD Card when it tries to access the physical pins. This isn't legal though. Another way to do it which would be legal is to just find the function in the FS sys-module and tell it when it tries to access the card reader to not do that but instead stream the XCI file from the SD. This would be very hard to do without a reimplementation of FS though.

Click to expand...

If it is as you describe then it is really impressing that SXOS managed to support XCI years ago, pretty much from the get-go if I am not mistaken. I always thought that if TX did it from the very beginning than it shouldn't be that hard to someone else also come up with a way to implement the feature on Atmosphere itself, enough time has passed, legally or not, the internet is a big place, it is not like you can't drop some piece of code anonymously somewhere. And I say that because people always rant about TX being a subpar group that is just ripping off Atmosphere, so if that is indeed the case, in my mind it should be a piece of cake to have a free alternative to the SXOS XCI loader, but reading what you said, maybe the guys at TX are not that naive after all, not to mention that so far they are the only ones who presented a working solution for the Mariko units while others previously to the SX Core release were mocking them saying they had nothing.

All that said, and assuming TX is not planning on releasing any new versions of SXOS, it would be nice if they just released the SXOS code already, or at least the XCI loader part.

CompSciOrBust said:

I'm not very familiar with the inner workings of Switch emulators either but XCI files are Card Images (hence the CI). Basically just like an NSP (Nintendo Submission Package) they contain a bunch of NCA files (Nintendo Content Archive) and one of those NCAs contains an NSO (Not sure what it stands for but it's the Switch version of an EXE, NRO is actually like a DLL). For an emulator to load a game all it has to do is start executing the NSO. It doesn't care if the NSO came from a XCI, NSP, or even if you just handed it a raw file manually extracted using hactool. On the Switch it does care where the NSO comes from since you have to tell it where to look.

When you install an NSP all the Switch does is extract the NCA files from it, dump them in to the /contents/ folder on your nand (if you install it to the SD it's the same but encrypted), then register the files in a database to say that those NCA files belongs to that game. Then when you load the game from the start menu the Switch will open each of those NCA files and look at what they contain, 3d models, textures, and one of them will contain the NSO. Fun fact when you download games from the eshop you don't even download an NSP. The files are downloaded as a bunch of separate NCA files.

When you load a game from a cart on the Switch first the Switch talks to the card reader, the card reader then mounts the card as a storage device, and then the Switch can see all the NCA files on it and from there the process is the same as an NSP. If you want to mount the XCI as a file rather than the physical card you have to modify the firmware to talk to a card reader emulator (in the case of SXOS it runs in the TX sys-module), the card reader emulator will then read the XCI from the SD and pass the data back along to the Switch firmware. This might sound easy but the amount of work that goes in to emulating the card reader, patching the firmware to talk to the emulator instead of the physical card reader, etc is huge. The card reader is it's own separate system from the Switch with it's own processor and firmware and fuses and stuff. It's call Lotus. More info here: https://switchbrew.org/wiki/Lotus3

The way TX does this, if what I have heard is true, is by just putting the real Lotus firmware in the emulator and making it read stuff from the SD Card when it tries to access the physical pins. This isn't legal though. Another way to do it which would be legal is to just find the function in the FS sys-module and tell it when it tries to access the card reader to not do that but instead stream the XCI file from the SD. This would be very hard to do without a reimplementation of FS though.

Going to ping @ZachyCatGames because he knows more about this stuff than me so maybe he can correct me if I got something wrong or he has something to add.

Click to expand...

Just got up, but I think that sounds about right.
A couple things ig:
NSO = Nintendo Static Object
NRO = Nintendo Relocatable Object
XCIs are more complicated than NSPs, they have multiple hfs0 (almost the same as pfs0 except the files are hashed) partitions for the required system update, game itself, etc.
A program NCA contains both the game assets and executables.

mspy said:

From what I've read, a new version of SXOS is unlikely because there is no more money to be made which in the end of the day is what TX is all about (making money). By that I mean that Gary allegedly was the one who made the money flow and with him out of the picture TX is pretty much in the dark, maybe this is why nintendo went hard on him or maybe nintendo just didn't have much more leads to pursue. This is a likely scenario because the SX website where you activate your license and all that is actually up but all other sites where you use to buy the licenses are gone or do not sell them anymore. Also let us not forget that there was a new version os SXOS released upon a new nintendo firmware update some time after Gary was arrested which kinda confirms that he was not a developer or if he was there were more people involved on it capable of updating SXOS.

Click to expand...

This assumes that TX was only in it for the money though. While I believe that was the primary factor the TX guys also loved the scene, despite what people might tell you. I know they have sent free hardware to homebrew developers before and didn't even request anything in return, no shout outs or anything. They gave one guy around $400 to get his lite repaired after he bricked it and sent him a free SX Lite. They also sent me a free chip after my RCM exploitable console suffered hardware failure. These are just two incidents but they aren't isolated cases.

As for Gary being behind the money, I really doubt this. There is an email address publicly available on their website for you to contact if you want to buy their products in bulk. This address handles all financial stuff afaict and the person behind it has a different manner of speaking to Gary. There is one person I suspect who might be behind it but I think it is more likely that it is some random Chinese guy based on how he talked. It's false that TX is a Chinese company but there are definitely some Chinese people in it. I'm almost certain that the hardware development team is in China (although Gary has a degree in electrical engineering, so if he is part of TX maybe he had a hand in it). That email address always seemed to be active during day time in China.
All of this is based on little interaction with the address though. I talked to it a bit but not a lot. Maybe anyone else here who has contacted it can confirm what I have said.

In regards to other websites shutting down, they were not operated by TX. TX didn't sell their product directly to consumers, they'd sell them to retailers in bulk who then resold them. Resellers started dropping like flies just after the SX Cores started shipping because Nintendo were sending cease and desist notices to anyone selling or installing the chips. People will say TX should have expected this because of the nature of the chip but I think it's worth noting that TX did this exact same thing with the Xbox 360 and almost no one got in trouble during the entire lifespan of the console. The RGH chips for the 360 used the exact same attack method as the SX Core and Microsoft didn't bother to try suing them. I think one or two people got hit with C&Ds but nowhere near as many as Nintendo sent to resellers of the SX Core in just a few months. The only thing MS did to try to combat 360 chips was a console revision near end of life, 3 or 4 years after the chips released which patched the vulnerability. Nintendo on the other hand has decided to try to sue anyone that they can.

mspy said:

If it is as you describe then it is really impressing that SXOS managed to support XCI years ago, pretty much from the get-go if I am not mistaken. I always thought that if TX did it from the very beginning than it shouldn't be that hard to someone else also come up with a way to implement the feature on Atmosphere itself, enough time has passed, legally or not, the internet is a big place, it is not like you can't drop some piece of code anonymously somewhere. And I say that because people always rant about TX being a subpar group that is just ripping off Atmosphere, so if that is indeed the case, in my mind it should be a piece of cake to have a free alternative to the SXOS XCI loader, but reading what you said, maybe the guys at TX are not that naive after all, not to mention that so far they are the only ones who presented a working solution for the Mariko units while others previously to the SX Core release were mocking them saying they had nothing.

All that said, and assuming TX is not planning on releasing any new versions of SXOS, it would be nice if they just released the SXOS code already, or at least the XCI loader part.

Click to expand...

People have always said bad stuff about TX, even before they released the SX Pro / SX OS, but it's not like most say. Yes SX OS did include code stolen from Atmosphere, but the reason they did this was to A: catch up with the open source scene, and B: to maintain compatibility for all CFW users. That doesn't make what they did ok but it is an explanation. Fwiw people in the CFW scene have always riped each other off. This happened on the PSP when teams would reverse engineer each other's CFWs to steal features and relatively recently on the 3DS open source devs reverse engineered and then used Gateway's exploits while also denouncing them as a bad company. Afaik Gateway didn't even use stolen code. People hated them because they made money (and yes bricking people but that came after the initial hatred).

Despite all this though TX still brought stuff to the table. They were the first to show off a Switch booting CFW after a bootrom exploit, they were the first to give us Emunand on the Switch, the first to give us Cheats using dmnt, and much more. Let's not forget that the entire scene were for some reason convinced that the exploit used for the SX Core was patched in Mariko's bootrom. Even after they showed off videos of an SX Lite running SX OS people were coming up with wild theories like it was the YouTube app playing a video or they somehow managed to fit an Erista's internals in to a lite (I heard a member of ReSwitched said that, although I didn't see them say it first hand). Then after beta testers got the chip people started saying new things like it could be patched in software, which also turned out to be total bullshit. TX have done some bad things with stealing code for sure but they were never lazy or stupid.

As much as the scene hates TX, I think it's good to have a financially motivated group around. No one is forcing anyone to use their products but the people who choose to buy them end up funding more R&D in to exploitation methods that the free open source devs can't do because they don't have the financial backing of TX. The only way for TX to get that financial backing is to sell their products and the only reason people buy their products is because they are innovative and consumer friendly. If TX had quit the scene years ago like many desperately wanted so that they could say "I told you so" we might have never seen Mariko get hacked.

Not to diss the open source scene, I love it and not everyone is like that. Plus they provide good competition that forces TX to innovate. The people in the open source scene who talk shit about TX (often rightfully so) are ignoring the obvious benefits that TX brings to the table. I never understood why people that TX never ripped off (the only case of TX ripping people off that I know of is Atmosphere) hate TX so much. TX did nothing to them yet they'll take every opportunity to say bad things about TX.

Has anyone decompiled SX OS yet to get that XCI mounting code? That's ultimately what we're after. Playing games without having to install them first.

Jayro said:

Has anyone decompiled SX OS yet to get that XCI mounting code? That's ultimately what we're after. Playing games without having to install them first.

Click to expand...

Crack on, first you will need to find all the decryption keys, then map those to to addresses, then write code to decrypt those address sections. The decrypt and reverse engineer.

Get back to us in a year or two when you have done all of that.

CompSciOrBust said:

As much as the scene hates TX, I think it's good to have a financially motivated group around. No one is forcing anyone to use their products but the people who choose to buy them end up funding more R&D in to exploitation methods that the free open source devs can't do because they don't have the financial backing of TX. The only way for TX to get that financial backing is to sell their products and the only reason people buy their products is because they are innovative and consumer friendly. If TX had quit the scene years ago like many desperately wanted so that they could say "I told you so" we might have never seen Mariko get hacked.

Not to diss the open source scene, I love it and not everyone is like that. Plus they provide good competition that forces TX to innovate. The people in the open source scene who talk shit about TX (often rightfully so) are ignoring the obvious benefits that TX brings to the table. I never understood why people that TX never ripped off (the only case of TX ripping people off that I know of is Atmosphere) hate TX so much. TX did nothing to them yet they'll take every opportunity to say bad things about TX.

Click to expand...

That makes a lot of sense. Being able to make money was probably a key factor on their group that like you said allowed for R&D, but that came back to bite them in a way that I think it was probably because they were selling their products that nintendo went after them in the first place.
Btw do you see TX returning, maybe rebranding or something like that?
Also I do not know if TX ever did something like it in the past, but is there any chance they simple release the SXOS code to the public?

mspy said:

That makes a lot of sense. Being able to make money was probably a key factor on their group that like you said allowed for R&D, but that came back to bite them in a way that I think it was probably because they were selling their products that nintendo went after them in the first place.
Btw do you see TX returning, maybe rebranding or something like that?
Also I do not know if TX ever did something like it in the past, but is there any chance they simple release the SXOS code to the public?

Click to expand...

It's possible that their programmers and others involved could come under new management as a different name. And the chance of the code being publicly released is so small because it would be of no benefit to them.

Tomato123 said:

It's possible that their programmers and others involved could come under new management as a different name. And the chance of the code being publicly released is so small because it would be of no benefit to them.

Click to expand...

I don't see them releasing the code, they made a big thing about the CR4 XL and the CR3 Pro, and never actually released the source for the timing methods on those chips. I mean sure the scene made alternatives, and china did eventually clone the CR3 Pro, but afaik no source ever came from TX, and it wasn't long after that they had a rebranding and supported XBLS / Gateway. both were just money hungry products.

i just wanted to say great work i tested this out and it worked on my switch.
Im on 11.0.0 firmware and boot both atom and sx
again great work would be nice if we could get this fully cracked for updating

mspy said:

That makes a lot of sense. Being able to make money was probably a key factor on their group that like you said allowed for R&D, but that came back to bite them in a way that I think it was probably because they were selling their products that nintendo went after them in the first place.
Btw do you see TX returning, maybe rebranding or something like that?
Also I do not know if TX ever did something like it in the past, but is there any chance they simple release the SXOS code to the public?

Click to expand...

I am hopeful that TX will return, maybe not this generation but who knows? As for source code, I think some stuff will be open sourced but not officially. I know a couple of the Devs want to open source what they've worked on but they're waiting until they are absolutely 100% sure that TX is permanently dead. Most of the Devs I know only worked on small utilities though. Not the juicy stuff like SXOS.

If I send people the proper files can someone please generate me the proper license key I can’t seem to get the program working

Moved to atmosphere + tinfoil, not looking back, dump this trash before you guys get lost in transalation.

On the final step and I figured out how to run the .py file but when I do I get a “crypto” error? Any help

lexluth0r said:

On the final step and I figured out how to run the .py file but when I do I get a “crypto” error? Any help

Click to expand...

you need to open CMD or Powershell, and install PyCryptoDome. That'll fix it

CompSciOrBust said:

Yes SX OS did include code stolen from Atmosphere, but the reason they did this was to A: catch up with the open source scene, and B: to maintain compatibility for all CFW users.

Click to expand...

This is 100% false. They used Atmosphere code because they could not do their own coding. If Atmosphere were never released, SXOS would not exist. Like I have stated before, TX are not developers, they are nothing more than a name. Odds are that TX did not even create xci loading, they most likely paid an independent developer for that feature. Just like they have attempted to bribe homebrew developers to only support SXOS.