Hacking Atmosphere-NX - Custom Firmware in development by SciresM

[MatMaf]

Now this is sad! I understand banning a user account. But banning a console altogether? That's insane!

You really think that's "insane"? It's what the Xbox 360 did, it's what the PS3 did, and the 3DS and the Wii U and the PS4. You get an account banned for minor things, you got a console banned for hacking or using CFW. CFW/hacks don't only affect one user. Imagine if you could just keep going online and using online hacks by making a new user account over and over again? Of course Nintendo are going to ban your console, this really shouldn't have to be explained.

 

[Wierd_w]

I think Ozone will be a better name. The exploit is like a hole in the ozone layer.

I like Atmosphere. It lets the air in, and allows the console to breathe.

 

[TheCyberQuake]

I think Ozone will be a better name. The exploit is like a hole in the ozone layer.

It really wouldn't. I think that's an awful name. Especially considering it isn't a hole in the horizon that makes this a thing. It's atmosphere because it runs above horizon OS, ie the "above the horizon" mantra. It's also why we have the fusee gelee name, which translates to frozen rocket, ie a coldboot exploit that launches it above horizon OS into atmosphere CFW.
Ozone doesn't relate as well to what the exploits and softwares are and accomplish.

 

[M7L7NK7]

The name is fine and at this point changing it would be weird

 

[Viri]

I don't give a shit about the name, as long as it works!

 

[smf]

Has anyone considered using a hacked zsun wifi dongle?

I haven't seen anyone do that, but people have used raspberry pi zero and android phones.

It's still kinda annoying though. Especially as hekate doesn't support sleep mode yet.

 

[Wierd_w]

I haven't seen anyone do that, but people have used raspberry pi zero and android phones.

It's still kinda annoying though. Especially as hekate doesn't support sleep mode yet.

Indeed. That's why I said I would wait for atmosphere to reach initial public release. (Current hekate is very much alpha, WIP software. It is bound to have all kinds of problems.)
I mention the zsun, because it is like, 8 to 12$ on amazon. WAY cheaper than a Pi, does not need a battery pack or power brick (powered by the switch's USB port that it is plugged into), and much smaller than a normal Pi. The whole unit could live inside the switch dock. Also doubles as a poor man's NAS/local DNS server/filter if you set it up that way. Quite a bit of bang for the buck if you put the custom firmware on it.

As long as the source for the payload injection suite is available, and it runs on linux (which it must if Pis are used), then it's just a minor set of hoops away.

 

[isoboy]

I don't give a shit about the name, as long as it works!

It's all a cover up to teach the community french.

 

[Waveracer]

(I just made an account to post, been lurking for months)
I just had a random thought. Everyone keeps harping about how the Fusee Gelee image loading is painful with tethering--

Has anyone considered using a hacked zsun wifi dongle? Those things have supported openWRT for a very long time, and are VERY compact. They are essentially a single board computer powered by, and equipped with a USB port. (the default firmware puts the device in gadget mode, but a little pokery can put the port in normal mode.)

Here's my thoughts on high-portability booting:

Put a two position switch on the right joycon using the solder-pad hardmod approach. Position 1 is "open", (pins not shorted together), position 2 is "Closed", (pins shorted together.) 2 position slide switches are small, and would be fairly painless to install on a joycon. That way you dont have to keep jabbing things into the connector port, and you can turn off the behavior with the switch.

Payload provided via a hacked zsun in normal USB mode, attached with a USB-C adapter. Runs a boot script that starts the injector, which then waits for the switch. (or vise-versa, whichever boots faster. Possibly put a "Sleep 5" in the script so that we know for sure the switch booted first, etc.)

Tethered coldboot would then be as easy as "flip homebrew switch, Insert dongle, turn on."

When Atmosphere-NX reaches initial public release, I will see about getting the above working.

I expect Atmosphere to skip the pin entry method and Android tethering somehow because that's something that won't probably work in the future or in newer consoles. I expect it to cold boot on its own like 3DS CFW, perhaps not on launch day though, whether it uses emuNAND or sysNAND.

 

[Wierd_w]

I expect Atmosphere to skip the pin entry method and Android tethering somehow because that's something that won't probably work in the future or in newer consoles. I expect it to cold boot on its own like 3DS CFW, perhaps not on launch day though, whether it uses emuNAND or sysNAND.

While Sciresm has dropped hints that 4.1.0 has software entrypoints for direct entry on boot, I fully expect that FG will be needed at the very least for the initial foot in the door, and will likely be needed for many firmware versions, especially future ones. It might not be so trivial to update the boot loader code in the Tegra SoC, even at the factory. That means tethered booting will likely be a thing that hangs around unless a far bigger hole is found.

As such, I think having a toggling joycon and a portable injector fob would be good medicine, even with full direct-boot capability.

 

[TheCyberQuake]

I expect Atmosphere to skip the pin entry method and Android tethering somehow because that's something that won't probably work in the future or in newer consoles. I expect it to cold boot on its own like 3DS CFW, perhaps not on launch day though, whether it uses emuNAND or sysNAND.

You must be new to the hacking scene. The 3ds got very lucky with the exploits it got. The unfortunate thing is many people got started with console hacking with the 3ds. The unfortunate fact is most consoles don't get a persistent, offline untethered coldboot exploit. That's if they get a coldboot exploit.
And an exploit like that won't just materialize because you hope it does.
Just be happy it can even do what it currently does.
Supposedly there are others bugs in the bootrom so we may see one in the future, but don't expect one. Instead just be pleasantly surprised if it does happen.

I HOPE for an untethered exploit, but I don't expect it.

 

[Waveracer]

You must be new to the hacking scene. The 3ds got very lucky with the exploits it got. The unfortunate thing is many people got started with console hacking with the 3ds. The unfortunate fact is most consoles don't get a persistent, offline untethered coldboot exploit. That's if they get a coldboot exploit.
And an exploit like that won't just materialize because you hope it does.
Just be happy it can even do what it currently does.
Supposedly there are others bugs in the bootrom so we may see one in the future, but don't expect one. Instead just be pleasantly surprised if it does happen.

I HOPE for an untethered exploit, but I don't expect it.

I am not complaining so your answer is misguided and off. I didn't even expect Switch to be hacked so soon and I've never said anything negative about this Switch hack. I am aware that 3DS is not the same, but I am also aware that newer firmware and hardware might be patched and that Atmosphere might be aimed at getting a bigger door to get in. Whether that happens or not is not up to any of us. I am just saying my thoughts which is what the thread is for.

--------------------- MERGED ---------------------------

While Sciresm has dropped hints that 4.1.0 has software entrypoints for direct entry on boot, I fully expect that FG will be needed at the very least for the initial foot in the door, and will likely be needed for many firmware versions, especially future ones. It might not be so trivial to update the boot loader code in the Tegra SoC, even at the factory. That means tethered booting will likely be a thing that hangs around unless a far bigger hole is found.

As such, I think having a toggling joycon and a portable injector fob would be good medicine, even with full direct-boot capability.

Yes, the only way in at the moment is that so making it easier and more convenient makes sense. I was just speculating.

 

[naitsa]

Hi, im not posting on here often, but i was following the whole scene very closely since the switches launch and there is one thing im trying to get for a long time now but im still confused:

Was`nt it stated multiple times that SciresM works on the CFW especially for being able to hack the upcoming Pokemon games without loosing online access on switch? Isn`t that the whole point in having a custom firmware? Being able to still use online features on EMUnand while keeping a vulnerable SYSnand? So that you still can launch/ install homebrew apps on your system while updating your EMUnand and access Eshop and Online Play? I mean if thats not the point in having a full fledged custom firmware then why people just dont use Fusee-Gelee to be able to launch Homebrew apps and thats it? Ok yeah you can install those apps to your system with custom firmware which wouldnt be possible otherwise but besides that? Now lots of people are stating that online bans are possible/likely using CFW. Dont get me wrong i get that there is a inevitable risk in modding your system and that you COULD get banned of course, thats not my problem. But i will surely HAVE to take the risk once everything is out. Now lots of people are talking about for example don`t going online with CFW and that you shouldnt ever connect to Nintendo servers running Custom Firmware or even Further: Maybe Updating SYSnand to go online with a coldbootet original FW and booting into EMU nand vi fusee-gelee for all the other stuff. Everytime i hear such things im thinking about if im missing something? Isn`t the mainly reason for even developing a CFW that you PREVENT your SYSnand from getting updatet and taht you get the whole online bang via EMUnand. Said directly: Isn`t the main reason for developing a CFW being able to get onto the nintendo servers using it? If you try to avoid that (i know its a risk no matter how good you try to hide its implementation) whats the whole point in developing or using it then? You just could use pegaswitch (on regarding firmwares) or fusee-gelee to boot Homebrew apps without it then. Am i missing something important here?

On top of that: dont put me into that whining crowd: "uh bla bla why cant we get online with CFW without risk? why dont i have CFW since ysterday? ehere are my backups etc?" Im soo glad this scene moves at more than lightspeed and i want to give a HUGE thanks to everyone involved especially SciresM! Im just wondering whats the point in CFW then and if im missing out on something.

 

[Wierd_w]

Hi, im not posting on here often, but i was following the whole scene very closely since the switches launch and there is one thing im trying to get for a long time now but im still confused:

<snip>

While a tool is developed to scratch one person's specific itch (in this case, the CFW is a needed milestone for modified Pokemon), sharing the tool with others results in that tool being taken to interesting places. It is this sharing that allows this scene to move at superluminal velocities. When everyone holds all their cards tightly in their hands, and does not share, you end up with a glacially slow community.

For instance, already, even though Atmosphere is not yet ready for release, it has enabled hekate WIP on 4.xxx and 5.xxx in rapid succession. That is not something to sneer at. It allows homebrew developers to make updates to their codebases for the libnx libs, and to move forward and be ready on day one of the official release.

While probably not useful for most people, I fully intend to make a thread about cooking up a zsun injector fob, and adding a switch to my joycon. The zsun, being a fully enclosed, durable, and portable fob that is also a full SoC in and of itself with its own internal writable storage, and dual Wifi PHYs (and a microSD slot!) has all kinds of potential. It can sit as a man-in-the-middle between a switch and your actual network, can act as a means to host network filesystems, do any number of automated tasks against the switch's USB port from remote (SSH over wifi for the win yo) and a number of other things. I could see how developers could really love the thing, while still making FG booting painless for ordinary people too. (The device is painlessly easy to get OpenWRT on. There is a flashable firmware payload that the built in updater will accept.)

As I pointed out though, I intend to wait until Atmosphere is initial release, as I want a virgin nand to make the emunand from. That means I wont be making this project just yet. When the day comes, I will order a zsun from amazon, do the needful, and make a step by step writeup and share it. I lack the skills to work on Atmosphere, but I can sure help making install it painlessly easy.

The issue about people warning about Hekate, is that it writes data on the nand from operation, because it does not currently do emunand. As such, you will not have a clean facade to present to nintendo when you want to pull something from the estore, or play online. Atmosphere intends to circumvent the whole thing by not touching the actual NAND, and hosting a full deploy on emunand that can be any version, which you can install and use anything you like on. Useage telemetry data will be written on the emunand, not the sysnand.

 

[salamandrusker]

I still have many doubts about atmosphere, will it be possible or not to load a backup of our cartridges from the sd? I have not seen any proof in the absence of 1 month to go

 

[M7L7NK7]

We're lucky Atmosphere even exists this early

 

[Randall Stevens]

Indeed. That's why I said I would wait for atmosphere to reach initial public release. (Current hekate is very much alpha, WIP software. It is bound to have all kinds of problems.)
I mention the zsun, because it is like, 8 to 12$ on amazon. WAY cheaper than a Pi, does not need a battery pack or power brick (powered by the switch's USB port that it is plugged into), and much smaller than a normal Pi. The whole unit could live inside the switch dock. Also doubles as a poor man's NAS/local DNS server/filter if you set it up that way. Quite a bit of bang for the buck if you put the custom firmware on it.

As long as the source for the payload injection suite is available, and it runs on linux (which it must if Pis are used), then it's just a minor set of hoops away.

Do you mean the ESP8266 microcontrollers? They are like $5 and already being used for ps4. The guy that created the injection software already has it for the Switch.

 

[naitsa]

thanks @Wierd_w for the reply. I like your ideas of that specific tool you mentioned. maybe you could link such a thing here? never seen such thing before. But my main question stays:
If lots of people aren`t planning to go online with CFW, even more they in fact are trying to avoid it, whats the point in even having CFW then?

 

[tecfreak]

Now lots of people are talking about for example don`t going online with CFW and that you shouldnt ever connect to Nintendo servers running Custom Firmware or even Further: Maybe Updating SYSnand to go online with a coldbootet original FW and booting into EMU nand vi fusee-gelee for all the other stuff. Everytime i hear such things im thinking about if im missing something?

As the exploit / the boot rom isn't patchable and you always will have the possibility to inject some payload at this very early stage and no matter what nintendon't will do in the future, then why taking the risk going online with a modified firmware?
Only for the possibility of a softmod / untethered coldboot? No, thanks.

The other thing is, that you always have to keep your fw up to date to be able to use the online services. Doing so with a customized firmware you are dependent on the author of the cfw patches who has to keep up with every newely released original firmware and adapt to it.

A seperate offline cfw isn't dependent on any updates provided by nintendon't to run some homebrew or whatever.

I know this all comes with some inconvenience, but in my opinion the benefits outweigh.

 

[naitsa]

As the exploit / the boot rom isn't patchable and you always will have the possibility to inject some payload at this very early stage and no matter what nintendon't will do in the future, then why taking the risk going online with a modified firmware?
Only for the possibility of a softmod / untethered coldboot? No, thanks.

The other thing is, that you always have to keep your fw up to date to be able to use the online services. Doing so with a customized firmware you are dependent on the author of the cfw patches who has to keep up with every newely released original firmware and adapt to it.

A seperate offline cfw isn't dependent on any updates provided by nintendon't to run some homebrew or whatever.

I know this all comes with some inconvenience, but in my opinion the benefits outweigh.

Hmm. I kind of get that but...if people plan on updating their sysnand for going online with original Firmware, why are they even excited/waiting for CFW or planning on using it. Couldnt they just use payloads to launch the app they want without the need of CFW? Why using CFW when you dont plan on going online with it..i mean... do you even need it then? HWats the purpose of it? I thought its whole purpose was avoiding updating sysnand