Any way to edit profile and fake link account?

Discussion in 'Switch - Exploits, Custom Firmwares & Soft Mods' started by lolboy, Dec 15, 2018.

  1. TotalJustice

    TotalJustice GBAtemp Regular

    Member
    3
    Jan 28, 2017
    United Kingdom
    Just the official NES emulator requires it to my knowledge.
     
  2. satel

    satel Luigi's Big Brother

    Member
    7
    Nov 3, 2004
    Laos
    plus Dark Souls, Star Drone & one other game i can't remember the name of it

    — Posts automatically merged - Please don't double post! —

    6.2 but i don't think firmware version is an issue,just make sure you make a nand backup first. hackdiscmount require few steps but is easy to do,i think goldleaf crashes the switch but not sure as i have not tried it
     
  3. t1op

    t1op Advanced Member

    Newcomer
    3
    Nov 13, 2016
    United States
    I accomplished this with a lot of distress.

    ***UPDATED***

    First, things I tried that didn't work:
    -updating from 6.0.0 to 6.1.0. Made no difference. All my Switches were on 6.0.0, so I don't know about other firmwares.
    -DevMenu account stuff. It just froze.
    -copying 8000000000000010 file over with Goldleaf. Crashed instead of copying. Tried this before and after a Factory Reset (Initialization).
    -backing up the system partition and using hekate to just restore that. Definitely doesn't work.
    -I tried updating all my sd files and found out that SXOS 2.6/2.6.1 is incompatible for loading REINX (using SX Pro dongle).

    PREPARATION
    1. Update PC drivers to recognize the Switch.
    >Download Zadig. Run the program. Plug the Switch in with USB C cable. Select Nintendo Switch in the first drop down box. Select libusbK (v3.0.7.0) in the box to the right of the green arrow. Then press the install button. Reset PC. Repeat the above, to make sure it installed correctly. (You don't need to reinstall if it installed correctly, but if you have to install again, reset the PC again.)
    2. Get file 8000000000000010 from the files shared in this thread.
    3. Get TegraRcmSmash and hacdiskmount for the PC
    4. Get the following payloads: hekate_ctaer, biskeydump, memloader, REINX.

    BACKUP
    (cause it's easy in this process to mess up your NAND, brick your Switch, and lose all your save files)
    1. Make a NAND backup (I used hekate>tools>backup>full emmc backup. I also recommend backing up Boot 0/1 also. Sometimes they are necessary to restore the NAND.)
    2. Backup all of your saves with Checkpoint. Checkpoint allows you to select all multiple games for backup after pressing Y. If you skip this step your saves won't be deleted, but you will have to insert your SD card into your computer rename the save folders, adding a name at the end of each, or your game will freeze after you try to restore the save to a user. You also won't be able to easily distinguish the save of one user vs another. This will also be necessary to restore the saves of any games that have been uninstalled.
    3. Note anything special about your Users so you can recreate them, because they will be deleted when you inject the new profile.

    INJECT THE PROFILE
    Step 1. Get your Biskeys
    1a. Copy the contents of the "sample" folder from memloader to SD root
    1b. Run payload biskeydump.bin, press a volume key to create device.keys.
    1c. Remove the SD card, insert in PC and open the file with Notepad.
    Step 2. Access your NAND by USB
    2a. Enter RCM with USB C cable connected to PC.
    2b. Drag and drop memloader.bin onto TegraRcmSmash.exe.
    2c. On the Switch use the volume/power keys to select ums_emmc.
    2d. Open hacdisckmount with administrator privileges. Select Physical Drive, it will come up as Linux UMS disk 29 GB.
    Step 3. Replace 8000000000000010
    3a. Select the SYSTEM partition.
    3b. Enter BISKEY 2, first half in the first box, second half in the second.
    (TIP: If you paste the entire key into the first box, it will cut off half way and you can see where to start copying the second half so you can paste that in the second box.)
    3c. Find the mounted drive in File Explorer (A:?) and Select the Saves Folder.
    3d. Find and Delete 8000000000000010.
    3e. Copy the replacement file into the folder.
    3f. Unmount. Close the window. File>Close.
    3g. Power off Switch (hold Power for 10s).

    RUN REINX
    >Run payload REINX at least once (SXOS/OFW won't work until you do).
    ***You should now have a linked profile. You can rename it and use it as you like***

    RESTORE USERS AND SAVES
    >You'll have to recreate the users.
    >Use Checkpoint to restore your saves.
    >Run each game once with the User and you can then restore your saved game to that user. Unfortunately, each save has to be restored one at a time. If there is an easier way, please share.
    >If you didn't use Checkpoint earlier, all of your saves are still there. In Checkpoint they will be assigned to an empty space user. You can back them up, add a name to the end of the folder on your computer, then restore them to a user.

    RESTORE NAND OPTION FOR INJECTING THE PROFILE
    If for some reason you don't want to use the USB method, you can do the much longer process of modifying your NAND dump.
    1. Copy your NAND dump to your computer as a backup. (Really, don't skip this.)
    2. Open hacdisckmount with administrator privileges. Select file, then find your NAND dump ON YOUR SD card.
    3. Perform Step 3 above.
    4. Restore the NAND backup. (With hekate, you need to move the nand backup to the root:/backup/?????/restore folder. "?????"=variable number)

    TROUBLESHOOTING
    If you get stuck on a black screen when you try to run REINX at the end...
    You probably need to initialize your system (Factory Reset: delete all users, save data, and games)
    1. Without a jig, hold down Vol + & - and power to enter Maintenance Mode. If you can't get to Maintenance Mode for some reason, restore your NAND then repeat this step.
    2. Select Initialize system (the version that includes deleting users and data).
    3. Turn the system on normally and go through startup and create a simple user (it will be overwritten).
    4. Turn the system off and REPEAT Step 2-3 of Injecting the Profile above.
     
    Last edited by t1op, Apr 10, 2019
    motchee, IFeastOnSouls and deadf1sh like this.
  4. OrGoN3

    OrGoN3 GBAtemp Addict

    Member
    8
    Apr 23, 2007
    United States
    What did you do to accomplish this full reset?
     
  5. t1op

    t1op Advanced Member

    Newcomer
    3
    Nov 13, 2016
    United States
    In settings, at the bottom, format options, initialize device. This is the switch version of factory reset
     
  6. t1op

    t1op Advanced Member

    Newcomer
    3
    Nov 13, 2016
    United States
    I am here attempting to upload the save file. I added the txt extension. You will need to delete the extension for usage.

    — Posts automatically merged - Please don't double post! —

    Question 1: If there is some way to keep NSP installed to the SD card, that would save a lot of time... If anyone knows of one, please let me know! (I've still got 4 switches to go)

    Question 2: Is there some way to transfer Users. Whenever I try it fails because I'm using 90DNS (and I would get banned for CFW if I wasn't).
     

    Attached Files:

    motchee likes this.
  7. etraxz

    etraxz Newbie

    Newcomer
    1
    Apr 10, 2019
    Sweden

    Nice!
    Is this possible on SXOS Emunand? Im not sure if step 6 would do anything to the emunand.
     
  8. OrGoN3

    OrGoN3 GBAtemp Addict

    Member
    8
    Apr 23, 2007
    United States
    Nice. Thank you. I assume we have to load ReiNX up because it edits a file in cal0/prodinfo. So you'd definitely want to make sure to follow the steps you laid out. Perhaps OP can update with your info?
     
  9. t1op

    t1op Advanced Member

    Newcomer
    3
    Nov 13, 2016
    United States
    I don't use the Emunand since I accidently banned my Switch with an SXOS license by trying to update a game way back when. But that is a great question.
    There should be a work around for whatever REINX is doing... whatever that is.

    However, without any help from the tech savvy people here who actually know what's going on under the hood, I would try this:
    Perform this procedure on your regular NAND and then make a new Emunand.
    You may need to be on 6.0.0-6.2.0 to do this, as some people have suggested... If so, I'd turn on AutoRCM and use choidujournx to get on 6.0.0 then make a new emunand. At this point you can restore the regular NAND backup to the physical NAND (assuming you want to be on whatever firmware you started with), then go ahead and use the new Emunand. (You can also turn AutoRCM off at this point if you don't use it normally.)

    Not sure if I missed anything since I don't use the Emunand, but that might get the job done... Mind you I have no idea if using choidujournx to swap your NAND back and forth is detectable by Nintendo. I don't know how it could be since you are doing full NAND restoration, but you might want to check with someone else here if you keep your regular NAND up to date for online purposes. If you are just keeping it at a low firmware in hopes of a cold boot hack at some point, this will probably be ok since using choidujournx doesn't burn fuses while in AutoRCM.
     
  10. ZachyCatGames

    ZachyCatGames GBAtemp Advanced Maniac

    Member
    8
    Jun 19, 2018
    United States
    Hell
    uh. That doesn’t touch prodinfo at all, only touches some save data in the system partition
     
  11. OrGoN3

    OrGoN3 GBAtemp Addict

    Member
    8
    Apr 23, 2007
    United States
    Then why is using reinx required?
     
  12. designgears

    designgears GBAtemp Regular

    Member
    3
    Aug 8, 2016
    United States
    Actually, your saves will remain, Edizon won't see them. Checkpoint will see them, you'll see a nameless black square in the user selection. You can back them up at any time after doing the link account hack. However, since the name is missing Checkpoint will write some invisible character that is a pita to deal with in windows. The easiest solution for dealing with those is to use 7zip to remove the invisible character and add a name to the save on the sdcard. It doesn't matter what name you put in there, or just delete the space and invisible character at the end, it will still work to backup/restore the save.
     
  13. ZachyCatGames

    ZachyCatGames GBAtemp Advanced Maniac

    Member
    8
    Jun 19, 2018
    United States
    Hell
    Gateway probably fucked up something, that’s usually the reason why stuff doesn’t work on SXOS
     
  14. t1op

    t1op Advanced Member

    Newcomer
    3
    Nov 13, 2016
    United States
    I cannot confirm this. I just initialized my Switch. I ran a game with my newly injected user then opened Checkpoint. I can't see the saves from any user that was on this Switch. I can only see saves from a different Switch that I had backed up and put on the SD card.
     
  15. designgears

    designgears GBAtemp Regular

    Member
    3
    Aug 8, 2016
    United States
    That's would be why. :)
     
  16. t1op

    t1op Advanced Member

    Newcomer
    3
    Nov 13, 2016
    United States
    I'm confused. Step 3 from above is "initialize switch". What did you mean in your original comment: "Actually, your saves will remain"?
     
  17. designgears

    designgears GBAtemp Regular

    Member
    3
    Aug 8, 2016
    United States
    No need to initialize, not sure why it says to do that.
     
  18. t1op

    t1op Advanced Member

    Newcomer
    3
    Nov 13, 2016
    United States
    Thank you! You are right!

    I tried several times and it didn't work until I did, but I was also trying to use Goldleaf and restore only the System partition using a NAND restore, so I think when I finally did it right I probably forgot to run REINX at the end.
    However, it may be an issue for some Switches that you need to Initialize... I can't turn back time to verify. So if for some reason, the regular process doesn't work, Factory Reset is a good way to troubleshoot (assuming you backed everything up properly).
     
    Last edited by t1op, Apr 10, 2019
  19. OrGoN3

    OrGoN3 GBAtemp Addict

    Member
    8
    Apr 23, 2007
    United States
    Then why doesn't it work with normal atmosphere?
     
  20. ZachyCatGames

    ZachyCatGames GBAtemp Advanced Maniac

    Member
    8
    Jun 19, 2018
    United States
    Hell
    Oh, it doesn't work with AMS either? Dunno then
     
    OrGoN3 likes this.
Loading...