Toggle sidebar

Hacking Atmosphere-NX - Custom Firmware in development by SciresM

  • Thread starter Thread starter Waze0613
  • Start date Start date
  • Views Views 2,792,945
  • Replies Replies 9,395
  • Likes Likes 93
SciresM said:
Today was a big milestone -- for the first time, on hardware, Atmosphere managed to load the kernel, receive an smc (smcCpuOn), and successfully turn on a second CPU core that executes our code.

Video of that below.

Lots and lots of work went into that by TuxSH and I (and a few other contributors <3), and of course there's lots and lots of work still to do, but it's cool to see the stuff that's been done working on hardware.

Click to expand...

Good shit. Keep it up, and take your time.
 
SciresM said:
Today was a big milestone -- for the first time, on hardware, Atmosphere managed to load the kernel, receive an smc (smcCpuOn), and successfully turn on a second CPU core that executes our code.

Video of that below.

Lots and lots of work went into that by TuxSH and I (and a few other contributors <3), and of course there's lots and lots of work still to do, but it's cool to see the stuff that's been done working on hardware.

Click to expand...
Good work man. Can't believe you guys have gotten the console this broken in merely a year. Can't even begin to imagine how much work it took.
Can't wait to watch this continue to develop.
 
  • Like
Reactions: Boot_8046
Bowl0l said:
Sorry for being clueless.
does CFW = access to eShop?
Thanks for the hard work, SciresM.
Click to expand...

Custom Firmware is a modification to your system that allows you the ability to control what firmware your console is on, as well as leaving a hole punched in the security so you can execute programs of your choosing.
If you are on the latest firmware, you have access to the eShop.
 
Last edited by HexZyle,
  • Like
Reactions: Bowl0l
SciresM said:
Today was a big milestone -- for the first time, on hardware, Atmosphere managed to load the kernel, receive an smc (smcCpuOn), and successfully turn on a second CPU core that executes our code.

Video of that below.

Lots and lots of work went into that by TuxSH and I (and a few other contributors <3), and of course there's lots and lots of work still to do, but it's cool to see the stuff that's been done working on hardware.

Click to expand...

GOOD work！
thanks for your effort！
 
@SciresM If you allow me a bit of constructively meant critique:

While you have certainly made progress (cudos), there is still a lot of work to be done. A bit more then the people who are currently contributing can produce in the near future, I think.

I would like you to reconsider your exploit disclosure policy. Not many people are fit to implement exploits or are interested in doing so in general - esp. when a bunch of people have already implemented them (waste of time being second, possibly costs weeks to do proper esp. on 2.0+).

However, there is an entirely different group of people interested in OS development (a good amount more then those who are interested in exploits probably) who can read specs, reverse code, implement hardware initialization, os drivers, patches and loaders. And who would be super interested in contributing to a custom firmware.

You are currently missing out on these people because they don"t have an exploit to be able to develop on their switch.

As such, I belief that progress is currently hindered by that exploit wall, for not much of a reason. I really see very little benefit in not readying the exploit for 3.0 (which most have) and releasing it to get more developers to help out.

I would be interested in your thoughts. Thanks for your efforts!
 
Last edited by Onibi,
  • Like
Reactions: ipkryss
Solid924 said:
Is there a possibility that we get something like Freeshop in the future for the switch?
Click to expand...
For various reasons related to how the Switch works, it is highly unlikely we will ever have anything like freeShop on the Switch. If/when people have access to game-piracy on the Switch, it will likely require a more manual approach (e.g. the Wii U).

Onibi said:
@SciresM If you allow me a bit of constructively meant critique:

While you have certainly made progress (cudos), there is still a lot of work to be done. A bit more then the people who are currently contributing can produce in the near future, I think.

I would like you to reconsider your exploit disclosure policy. Not many people are fit to implement exploits or are interested in doing so in general - esp. when a bunch of people have already implemented them (waste of time being second, possibly costs weeks to do proper esp. on 2.0+).

However, there is an entirely different group of people interested in OS development (a good amount more then those who are interested in exploits probably) who can read specs, reverse code, implement hardware initialization, os drivers, patches and loaders. And who would be super interested in contributing to a custom firmware.

You are currently missing out on these people because they don"t have an exploit to be able to develop on their switch.

As such, I belief that progress is currently hindered by that exploit wall, for not much of a reason. I really see very little benefit in not readying the exploit for 3.0 (which most have) and releasing it to get more developers to help out.

I would be interested in your thoughts. Thanks for your efforts!
Click to expand...
Anyone is free to join in the development of Atmosphere NX, fork it, etc. There's no reason to release any exploit before the release of a functional CFW. Otherwise, Nintendo is just going to patch released exploits with no benefit to the community (i.e. no quicker access to CFW).

In addition, the reluctance to release exploits isn't all about not having a usable CFW yet. Even when a functional CFW has been released, it's hard to decide when to release a hard-earned exploit that Nintendo will almost certainly patch. The longer it takes for an exploit to be released, the more Switch systems that will be vulnerable to the exploit when it is eventually released.

My understanding is the exploits for 1.0.0 are going to be made public first because most if not all of them have already been patched in one way or another on newer versions. However, exploits for anything above 1.0.0 require at least some exploits, specifically the TrustZone exploits, that are still functional on 4.1 and (potentially) beyond.

2.0.0-3.0.0 require fewer exploits that haven't already been patched, so that's part of why they will receive a release sooner than 3.0.1+ but later than 1.0.0.
 
Last edited by Lacius,
  • Like
Reactions: PsiAeon
Solid924 said:
Is there a possibility that we get something like Freeshop in the future for the switch?
Click to expand...
Sadly I think not. Everyone say Nintendo improved the security a lot and won't allow that very easily.

What can appear later is a similar app but that could download locally from other server the backups, but I'm sure Nintendo would close that servers very fast and the owners get jailed, I would never risk making a server like that my self...
 
Lacius said:
Anyone is free to join in the development of Atmosphere NX, fork it, etc. There's no reason to release any exploit before the release of a functional CFW. Otherwise, Nintendo is just going to patch released exploits with no benefit to the community (i.e. no quicker access to CFW).
Click to expand...

The development so far is focused on exo (secure monitor). To work on it, you need to run it on Hardware. The visible CFW parts - services and kernel patches will probably (hopefully!) land mostly after the initial release. The initial kernel / service patching should be quite bare-bones. (Assuming EL2 emunand).

Lacius said:
In addition, the reluctance to release exploits isn't all about not having a usable CFW yet. Even when a functional CFW has been released, it's hard to decide when to release a hard-earned exploit that Nintendo will almost certainly patch. The longer it takes for an exploit to be released, the more Switch systems that will be vulnerable to the exploit when it is eventually released.

My understanding is the exploits for 1.0.0 are going to be made public first because most if not all of them have already been patched in one way or another on newer versions. However, exploits for anything above 1.0.0 require at least some exploits, specifically the TrustZone exploits, that are still functional on 4.1 and (potentially) beyond.

2.0.0-3.0.0 require fewer exploits that haven't already been patched, so that's part of why they will receive a release sooner than 3.0.1+ but later than 1.0.0.
Click to expand...

As I understand it, the trustzone execution is not patch-able and has been disclosed already (including how to get there on 1.0.). Newer firmwares have mitigated the issue but additional exploits have been found each time to restore the entry. As such, you are right, that each FW needs additional exploits, however I think for 3.0, they have been named to be fixed by now (e.g. memory controller, sm) or don't seem fix-able (e.g. CMAC/CBC same key ... ...).

So over all, I am not sure how many secrets a 3.0 release would divulge / imply for a future firmware to be fixed. But it does not seem like a lot can be done that has not been done by now.
 
  • Like
Reactions: mendezagus, TotalInsanity4 and sakiage
I'm gonna probably be chewed out for asking this, but that's probably the worst that could happen to me.

Will 4.1.0 require a game as an exploit?

Sent from my SM-T280 using Tapatalk
 
NANASHI89 said:
I'm gonna probably be chewed out for asking this, but that's probably the worst that could happen to me.

Will 4.1.0 require a game as an exploit?

Sent from my SM-T280 using Tapatalk
Click to expand...

No. User level exploits are almost exclusively done via the browser. On 1.0 a game was needed to trigger the browser (because it had no eshop/ captive portal). You may need one to update to a specific FW at some point thou. For now - no.

That said, I don"t think 4.0>= has a real entry point (User / Kernel) yet at all (you will have to wait a good while for anything)
 
TheGreek Boy said:
he said so many times 3.0.1, 3.0.2 and 4.x.x will get stuff at the same time
Click to expand...

I'm sorry guys and thank you SciresM for all your hard work. I really want to ask this question and according to these forums it has been asked a million times but i cannot find concrete evidence to the answer all i can find is what's in the sticky which is obviously this :

  • 3.0.1 - 3.0.2 are interchangeable, and also good. If you're on them, *stay* on them. They'll get stuff later than 2.0.0-3.0.0 because they don't have the sm bug, and thus require more privilege escalation to use deja vu. But it will be sooner than 4.x.
Now i have a switch that i have been patiently sitting on with firmware 3.0.1 since November. I'm happy to sit on it as there's no real game's calling me at the moment but i keep reading post's like the one above conflicting whats in the sticky. Now Obviously if i can update to 4.x before the big N rectify all vulnerabilities it's obviously going to better for future game releases but i really don't want to be sitting on a switch with firmware 4.X while all the patient switch owners on 3.0.1 are using there newly hacked consoles.

I'm truly sorry for having to ask this question again but can someone please show me some concrete evidence that 4.x.x is the same as 3.0.1

Thanks in advance
 
  • Like
Reactions: HexZyle
KOPHEAD said:
I'm sorry guys and thank you SciresM for all your hard work. I really want to ask this question and according to these forums it has been asked a million times but i cannot find concrete evidence to the answer all i can find is what's in the sticky which is obviously this :

  • 3.0.1 - 3.0.2 are interchangeable, and also good. If you're on them, *stay* on them. They'll get stuff later than 2.0.0-3.0.0 because they don't have the sm bug, and thus require more privilege escalation to use deja vu. But it will be sooner than 4.x.
Now i have a switch that i have been patiently sitting on with firmware 3.0.1 since November. I'm happy to sit on it as there's no real game's calling me at the moment but i keep reading post's like the one above conflicting whats in the sticky. Now Obviously if i can update to 4.x before the big N rectify all vulnerabilities it's obviously going to better for future game releases but i really don't want to be sitting on a switch with firmware 4.X while all the patient switch owners on 3.0.1 are using there newly hacked consoles.

I'm truly sorry for having to ask this question again but can someone please show me some concrete evidence that 4.x.x is the same as 3.0.1

Thanks in advance
Click to expand...
this line is old, before 4.x trustzonehax
 

Site & Scene News

Go to forum More news

Popular threads in this forum