Hacking AutoRCM with the Nintendo Switch 101

[Draxzelex]

DISCLAIMER
The following applies to users who do not use a modchip, dongle, or other hardmod with their Nintendo Switch console.

What is AutoRCM?Enabling/Disabling AutoRCMAutoRCM ProsAutoRCM ConsShutting Down with AutoRCMDrained Switch BatteryAutoRCM FAQ & Misconceptions

1. AutoRCM is a "brick" that corrupts BOOT0 which is a part of your NAND. It is a brick in the sense that your console automatically boots into RCM (as the name implies) which is not only a black screen but requires you to send a payload to actually use the console. If you don't have a way of sending a payload nearby, then your console will remain in RCM hence acting like a brick. However it can easily be reversed usually using the same tool that was used to enable it in the first place. One of the main uses for AutoRCM is the removal of a jig for hacking your Switch but it can also be used to prevent fuses from being burnt for people who wish to downgrade in the future.
2. There are many different tools that can not only enable AutoRCM but disable it as well. The golden rule is to never mix 2 different types of AutoRCM. This means never enable more than 1 type of AutoRCM and always disable AutoRCM with the same tool you used to enable it. This is because some tools install AutoRCM slightly differently and because they disable AutoRCM depending on how it was installed, installing another type of AutoRCM would make it harder to disable AutoRCM altogether (a franken-AutoRCM, if you will). Below are a list of tools that can enable and disable AutoRCM.
   
   • Briccmii
   • Hekate
   • ChoiDujour (can only enable AutoRCM)
   • ChoiDujourNX
   • SX OS (no visual display if AutoRCM is enabled/disabled)
   • ReiNX Toolkit (no visual display if AutoRCM is enabled/disabled)
3. 
   
   • Removes the need for a jig or something else conductive for entering RCM but you still need to send a payload with via USB with a computer/dongle
   • Is the only tool that is 100% effective at booting the console into RCM
   • Can be used to prevent fuses from being burnt as long as its enabled
4. 
   
   • Shutting down/rebooting a console with AutoRCM enabled from Horizon aka CFW/OFW will cause it to reboot into RCM except if you are using Atmosphere version 0.8.4 or greater which you can check by going to System Settings and looking at your current firmware
   • Performing a system update either via online, cartridge, or a local system update will disable AutoRCM except if you are using Atmosphere version 0.8.1 or greater which you can check by going to System Settings and looking at your current firmware
   • If you do not have a way of sending a payload while the console is off, it will act like a brick when you turn it on as it will only boot into RCM which can only be utilized via sending a payload
   • AutoRCM reduces the charge rate of the Switch in RCM. However the exact amount varies slightly. You can click the Spoiler below for a detailed explanation of the differences between charging in RCM with and without AutoRCM enabled which was discovered by CTCaer.
   Spoiler: AutoRCM Charge Rates

   So, Switch charges and does not charges in RCM. xD
   
   The results (battery was 89%):
   
   
   The switch can charge normally the battery, if the BCT is intact!
   In RCM AND in hekate menu.
   *BCT is the boot configuration table that autoRCM corrupts.
   
   Tests showed that it was charging with the same current, as in Horison OS.
   The current it was drawing with 89% battery, was 800mA - 1000mA, using Switch wall adapter. On PC, it was the max the hub could give.
   
   
   ------------------------------------
   
   
   The switch cannot charge normally with a corrupt BCT (AutoRCM).
   In hekate, it shows similar behavior (read below).
   Extra emphasis on the "normally".
   
   With autoRCM, basically a corrupt BCT, the switch behaves differently.
   There are 2 behaviors that I saw when connecting to the switch wall charger:
   

   • Common - It was draining 140-250mA.
   • Common (in hekate) - 200mA - 400mA
     
   • Rare (normally if you connect charger after powering off from HOS) - Drain of alternating 250mA and 1000mA, with surges of 2.5A.

   
   ------------------------------------
   
   Summary - facts:
   

   1. Switch can charge completely normally in RCM or Hekate with a BCT intact
      • The percent % in Horizon OS, after a RCM charge, is not fake.
   2. Switch does not charge normally with AutoRCM, a.k.a corrupt BCT.
      1. Either it charges very slowly or sometimes with a broken slow/fast/slow/fast charge pattern:
      2. Or this behavior is current taken from the USB controller or the BPMP (Nvidia's Boot and Power management processor)
      • In AutoRCM, the Charge IC probably can't update the battery calibration file and could make the percent fake.

   I don't know for behavior .3 what really happens and what Switch does. This can be easily examined, by connecting a current multimeter between battery and switch and check the readings.

   
   
5. Because (usually) a console with AutoRCM reboots back into whenever you try turning it off, you either have to perform extra steps to shut it down or use certain CFW which will be detailed down below. Except for CFW that can shut down from Horizon aka CFW/OFW, a console with AutoRCM enabled can only be properly shut down from RCM. The following are examples of shutting down a console with AutoRCM properly.
   
   • Use Hekate's Power Off function
   • Performing a manual shutdown in RCM which is holding the power button for 12 seconds. This is not to be confused with a manual shutdown in Horizon aka CFW/OFW which causes the console to reboot into RCM much like powering off or rebooting the console normally
   • Press Power Off from Horizon, wait 10-15 seconds for it to reboot into RCM while its plugged in via USB, then send SX Loader with boot.dat on the micro SD inserted in the console or ReiNX.bin
   • Power off normally while running a version of Atmosphere 0.8.4 or greater which you can check by going to System Settings and looking at your current firmware
6. AutoRCM does not drain the battery. What does drain the battery is leaving the console in RCM which can happen due to an improper shutdown. This happened to many users very early in the Switch scene because we were not aware that turning off a console with AutoRCM enabled would cause it to reboot back into RCM. However some users still have this happen by accident and wind up with a console that is either dead or nearly dead. There was another misconception that the Switch could not recharge with a dead battery and AutoRCM but this was also debunked. Meaning even if your Switch runs out of battery, you can always recharge it. Depending on whether or not a payload will work on your console will change how you can charge it.
   
   If your console can still accept payloads...
   
   
   1. Press the Power button once
   2. Press and hold the Power button for 12 seconds
   3. Press the Power button once
   4. Connect it to your computer via USB
   5. Send Hekate as a payload
   6. Choose the "Power Off" function
   7. DO NOT unplug your console from this point as now your console will normally recharge. It should gain enough charge to boot up into CFW/OFW in about 10-15 minutes. It should also be noted that this method is the only way to charge the console while keeping it off as trying to charge it in any other scenario will turn on the Switch.
   
   If your console cannot accept payloads...
   
   
   1. Press the Power button once
   2. Press and hold the Power button for 12 seconds
   3. Either plug the Switch into your computer via USB or the dock while the dock is connected to the charger
   4. Wait about 30 minutes to an hour
   5. Try sending a payload such as Hekate. If it succeeds, use Hekate's "Power Off" function and keep the console plugged in so it can continue charging at a faster rate. If the payload did not work, try charging the console for longer or charge it elsewhere
7. 
   
   • Q: Does the console become permanently bricked if it has AutoRCM and no battery?
   • A: No, the console will accept charge even with AutoRCM enabled and an empty battery. The only issue is it will accept a reduced charge rate with an empty battery and AutoRCM enabled because it will be stuck charging in RCM until it has enough battery to accept a payload.
   
   
   • Q: I heard AutoRCM drains battery. Is this true?
   • A: AutoRCM never drained battery. What people thought was AutoRCM draining the battery was actually the misconception that shutting down the console normally would work when AutoRCM was enabled which was not the case. Instead this process causes the Switch to reboot back into RCM after 10-15 seconds. RCM drains the battery at a rate of about 5% per hour.
   
   
   • Q: How do I avoid draining battery in RCM?
   • A: Simply turn off the console properly. Read the "Shutting Down with AutoRCM" tab for more detailed information about this subject.
   
   
   • Q: How do I know my console with AutoRCM has been fully shut off?
   • A: The only way to verify if a Switch has been properly powered down while AutoRCM is enabled is by having the device plugged into another device that can read if it is in RCM before powering it down. Plugging the Switch into another device after powering it down will turn it on, with or without AutoRCM.
   
   
   • Q: Do the different tools that enable AutoRCM affect the way AutoRCM works?
   • A: No, AutoRCM functions identically no matter how you install it. It is best practice to use the same tool one used to enable AutoRCM for disabling it as well.
   
   
   • Q: I want to disable AutoRCM but I forgot how I enabled it. What should I do?
     
   • A: Hekate/Briccmii can reverse any type of AutoRCM.
   
   
   • Q: Should I use AutoRCM?
   • A: This is more of a personal decision as AutoRCM can still be dangerous in the wrong hands. Some of that has been mitigated what with Atmosphere now implementing a proper shutdown but if a child or someone else presses the Power button while you are at work, you may come home to a Switch running low on battery. I personally use it as it is more reliable than any jig out there and don't have to worry about other people accidentally turning the console on but weigh the pros and cons with your own situation and decide if AutoRCM is for you.

 

[TheZander]

With a modchip installed the console would just reboot them right.

 

[Draxzelex]

With a modchip installed the console would just reboot them right.

Unless you flashed SX Loader, the console will always reboot with whatever payload you sent. And even with SX Loader, you must use Horizon's or SX OS' Power Off option. A manual shutdown will put you into a perpetual loop with SX Loader.

 

[OkazakiTheOtaku]

I don't understand this. I'm not saying that this information is invalid, but anecdotally this is not what I experience.
I use Rajikosto's AutoRCM and shut down within Horizon, and it really does fully shut it down.

 

[DocAmes1980]

We know. However the detailed post is appreciated.

 

[palantine]

It may be possible to make a homebrew that properly shuts down. I'll look into it tomorrow.

 

[Dfroberts86]

I thought mine was also doing the same thing, but after testing some more, I can confirm that mine does a full shutdown from horizon when I hold for 12 seconds. My phone does not detect rcm mode until I press the power button again to turn it on.

Sent from my BND-L24 using Tapatalk

 

[loler55]

I thought mine was also doing the same thing, but after testing some more, I can confirm that mine does a full shutdown from horizon when I hold for 12 seconds. My phone does not detect rcm mode until I press the power button again to turn it on.

Sent from my BND-L24 using Tapatalk

same here sx os 12 sec power down then i have to power on for a sec to get into rcm

 

[Dfroberts86]

I'm using rajnx with autorcm enabled from is loader.

Sent from my BND-L24 using Tapatalk

 

[Zumoly]

Thanks for the PSA.
However I'd suggest restarting and injecting the payload instead of rebooting and waiting for 10-15 seconds.
Also for anyone in a survival situation (Switch without dongle/cable and on low battery) you should manually shut down (hold power button for 12 seconds, 15 to make sure) from horizon instead if counting on the sleep function.

 

[Phenj]

Using the Power OFF button in the SX-OS menu (with license) puts me back in RCM.

 

[Andalitez]

I use a Gemma M0, it flashes yellow when its ready to send a payload.I have SX OS loaded on there.
When it detects my device in RCM, it stops flashing and sends the payload which causes the switch to boot.
I've shut down my switch from HOS, plugged in my flashing Gemma M0 and it continued to flash until i hit the power button (which made it boot)

So im not sure how its different from your experience,but i've added the hekate.bin on the root of my SD card there too just in case i need to open SX Menu and load Hekate to Shut Down

 

[mariogamer]

Heh. Now time to me to complain about not posting a thread about it.It would not be as nice as this one tho so thanks

If I remember I got the same result.
(tho if someone can detail why in both case it doesn't shutdow....)

It may be possible to make a homebrew that properly shuts down. I'll look into it tomorrow.

Power off needs access to the pmc if I remember, which need TrustZone to be accessed. So not the classic homebrew way.

However, custome trustzone (exosphere for example) can be made to handle some specific signal from users (like "true power off" or "reboot into rcm)

So yeah might be more complex than just writing a homwbew that shutdown, but easily doeable. (I saw that you've made a cfw for the 3ds? So yeah for experienced deb it's not a problem)

 

[Rune]

I haven't consistently tested this but when I first installed AutoRCM, I noticed I couldn't shut down my Switch either. You think it's shut down but if you give it about 10 seconds, it would reboot back into RCM eventually. I haven't tried shutting down from a bootloader menu so don't know if that would work. But a normal shut down from Horizon doesn't work.

 

[GothicIII]

Thank you! I didn't know it was possible to shutdown with autorcm installed. Using sx dongle to shutdown now. Works as long no usb cable is plugged in into switch and pc (switch goes immediatly into rcm that way).

 

[Garrincho]

It may be possible to make a homebrew that properly shuts down. I'll look into it tomorrow.

Let us know how that goes, it'd be pretty great!

 

[KsAmJ]

so long thread short:

• just reboot /power off from horizon
• holding the vol+ send the sx payload
• then select options->power off

Works every time like a charm

 

[Draxzelex]

I don't understand this. I'm not saying that this information is invalid, but anecdotally this is not what I experience.
I use Rajikosto's AutoRCM and shut down within Horizon, and it really does fully shut it down.

Are you charging the console after doing so? Are you using any dongle? I can easily test this by letting my console drain battery but I've seen it reboot into RCM when I press Power Off from Horizon. In fact, that is how I am able to send SX Loader without touching the Power button or reconnecting the USB cable. The only other explanation would be that the USB connection reboots the console into RCM but this is untrue with Hekate's Power Off option no matter how long I keep it plugged in.

same here sx os 12 sec power down then i have to power on for a sec to get into rcm

Try powering it off without your license. That is the only part I cannot reproduce. Also all testing is done without any hardmods so do not use those either. Lastly, it reboots into RCM after around 10-15 seconds so wait at least a minute before you're confident it didn't reboot.

I'm using rajnx with autorcm enabled from is loader.

Sent from my BND-L24 using Tapatalk

RajNX is literally just Hekate with Atmosphere's IPS patches. I admit I didn't try it in my initial testing but just like every other CFW/bootloader, the console rebooted into RCM after 10-15 seconds. However now I am testing to see if there is any battery drain meaning it was in RCM the whole time. Its possible your phone wasn't detecting the console in RCM at first possibly due to not waiting at least a minute before touching the power button. I'd also recommend using a Windows computer.

UPDATE: The console drained around 55% in about 9 hours doing what you recommended so either perform a similar test or provide video proof of the console not entering RCM after performing a manual shutdown because I've now proven in 2 different ways it will drain battery regardless of whatever CFW or type of AutoRCM you use.

Thanks for the PSA.
However I'd suggest restarting and injecting the payload instead of rebooting and waiting for 10-15 seconds.
Also for anyone in a survival situation (Switch without dongle/cable and on low battery) you should manually shut down (hold power button for 12 seconds, 15 to make sure) from horizon instead if counting on the sleep function.

I agree with the first part but the second option, the manual shut down from Horizon won't turn off the console. The manual shutdown in RCM is reserved for the dongle/cable-less and its easy to get to without performing a manual shutdown in Horizon. Either use the Restart function or the new EasyPower homebrew which will both cause the console to reboot into RCM almost instantaneously.

 

[OkazakiTheOtaku]

Are you charging the console after doing so? Are you using any dongle? I can easily test this by letting my console drain battery but I've seen it reboot into RCM when I press Power Off from Horizon. In fact, that is how I am able to send SX Loader without touching the Power button or reconnecting the USB cable. The only other explanation would be that the USB connection reboots the console into RCM but this is untrue with Hekate's Power Off option no matter how long I keep it plugged in.

I made a homemade LEDE dongle with a guide on GBATemp. If I plug the switch into the dongle while the console is powered on, and within Horizon choose the regular "Shut Down" option, the console is truly shut down and does not automatically reboot into a payload. If I disconnect it, and then plug it back in, the Switch wakes up from the power source and reboots with the payload.

 

[Draxzelex]

I made a homemade LEDE dongle with a guide on GBATemp. If I plug the switch into the dongle while the console is powered on, and within Horizon choose the regular "Shut Down" option, the console is truly shut down and does not automatically reboot into a payload. If I disconnect it, and then plug it back in, the Switch wakes up from the power source and reboots with the payload.

Ah okay, that is fine. I don't have a dongle so I can't test that. This thread is for those of us who don't have a hardmod. Thank you for the clarification. I mentioned this point in the Disclaimer btw