About payloads?

MrFromthedepths4

New Member
OP
Newbie
Joined
Oct 18, 2021
Messages
1
Trophies
0
Age
29
XP
59
Country
United States
So I’m curious about the rmc but I’m not entirely sure what payloads do and how to use them I can’t seem to find any actual details on what it does. Does it work like an action replay/gameshark for games ? Every time I see something about the rcm loader they briefly mention payloads and they never talk about what it does
 

thesjaakspoiler

Well-Known Member
Member
Joined
Nov 20, 2018
Messages
1,064
Trophies
0
Age
124
XP
1,593
Country
Afghanistan
RCM is the ReCovery Mode for Tegra chips.
The Tegra boots from a small program inside the Tegra and has a number of boot options.
Usually the Tegra boots from the eMMC (NAND flash memory chip) but in case that gets corrupted, Tegra chips have a feature where they can boot from a bootloader send over the USB port as well.
That USB boot mode is not enabled by default.
To active booting from USB, 1 pin from the joycon connector needs to be connected to the ground and you need to push down the volume - button.
That signals the Tegra to wait for a boot program to be send over USB.
This is the'payload' that people are talking about.
The Tegra reads this payload and executes it.
This for example enabled the Tegra to repair the eMMC memory or initialize it in the factory.
Nintendo left this standard recovery mode on in the first series of Switches.
Usually this would not be much of a problem as there are several security features that will prevent unofficial boot loaders from starting up the system with system admin rights.
But that is where Nintendo also made another mistake with their security model and this enabled some smart guys to create their own bootloader and start up the OS that is on the Switch with special rights so they could enable Homebrew apps.
In later models, Nintendo fixed the security model and although you can still inject your own bootloader, it is not possible to start up the operating system on the Switch with privileged rights.
Only with a hardware modchip from SX, you can bypass this fix from Nintendo.
The SX modchip is pretty complex and uses voltage glitching to gain access to the security model of the Switch.
This idea came from the PS-Vita and Yifan Lu wrote a whole scientific paper on it.
https://yifan.lu/2019/01/10/injecting-software-vulnerabilities-with-voltage-glitching/
Soon after this paper, the SX modchip appeared on the scene.

With AutoRCM, the booting process is purposely corrupted, forcing the Tegra to boot with an USB payload.
With this hack, you won't need to ground that joycon pin or hold the volume down.
You can just inject the payload through USB.
That saved 1 step in the process.
 
  • Like
Reactions: MrFromthedepths4

Draxzelex

Well-Known Member
Member
Joined
Aug 6, 2017
Messages
19,056
Trophies
2
Age
29
Location
New York City
XP
13,525
Country
United States
So I’m curious about the rmc but I’m not entirely sure what payloads do and how to use them I can’t seem to find any actual details on what it does. Does it work like an action replay/gameshark for games ? Every time I see something about the rcm loader they briefly mention payloads and they never talk about what it does
Payloads cause a buffer overflow which inadvertently causes the console to read any code afterwards as legitimate allowing users to fully exploit the console.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • Psionic Roshambo @ Psionic Roshambo:
    Because Vita had no gamez
    +1
  • K3Nv2 @ K3Nv2:
    Nah it took years to figure out android ports
  • Psionic Roshambo @ Psionic Roshambo:
    Really in hindsight Sony botched the Vita so badly
  • K3Nv2 @ K3Nv2:
    Sony botched their own computers
  • Xdqwerty @ Xdqwerty:
    @SylverReZ, i might add some ps1 games and some other PS2 games too
  • Xdqwerty @ Xdqwerty:
    But first lemme finish downloading Sonic generations (taking days cuz it weighs 8 GB and downloading heavy stuff slows down wifi connection and thus i have to keep the download paused)
  • Xdqwerty @ Xdqwerty:
    Nvm it's not days it's weeks
  • Xdqwerty @ Xdqwerty:
    And also bc i forget to resume the download
  • Psionic Roshambo @ Psionic Roshambo:
    PS1 and PS2 and PSP only Sony consoles I would buy lol
  • Psionic Roshambo @ Psionic Roshambo:
    I bought a PS3 and had a love hate relationship with it
  • K3Nv2 @ K3Nv2:
    So it was your child
    +3
  • Psionic Roshambo @ Psionic Roshambo:
    Lol Methilina?
  • K3Nv2 @ K3Nv2:
    Sonylina
  • Psionic Roshambo @ Psionic Roshambo:
    Methosolize the meth philosopher who said "To steal or steal, it's on the way to the pawn shop"
  • K3Nv2 @ K3Nv2:
    The pawnshop won't even take it
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    Ask not what the pawn shop will give you, but what you can steal from the pawn shop!
  • K3Nv2 @ K3Nv2:
    Slightly used adult toys in the plastic bag
    +3
  • Psionic Roshambo @ Psionic Roshambo:
    "Look it's still in the wrapper!!!!" "Mam that is a condom.... Please take it out of the store"
  • Xdqwerty @ Xdqwerty:
    @K3Nv2, those are from @AncientBoi
    +1
  • Xdqwerty @ Xdqwerty:
    Also which one of the games i already have on my PS3 should I delete?
  • PandaPandel @ PandaPandel:
    so if I do have the playstation 3, it boots, its worth modding and fixing? What are some key benifits to it?
  • Psionic Roshambo @ Psionic Roshambo:
    Did you delete the update files and other languages?
    Psionic Roshambo @ Psionic Roshambo: Did you delete the update files and other languages?