1. TheRenegade

    OP TheRenegade Newbie
    Newcomer

    Joined:
    Mar 15, 2020
    Messages:
    3
    Country:
    United Kingdom
    Hi guys,

    This is my first post asking for some advice.

    I was given a Nintendo switch which is dead. It goes straight to the blue screen when powered on. I found out that it is an unpatched unit. Just to make sure that the RCM and payload injection works, I followed some steps which brought up a QR code on the screen. I'm guessing it's ok. So I found a very detailed video on youtube in which the guy describes how to remedy the blue screen issue by rebuilding the NAND. I thought I'd give it a shot.

    I downloaded all the files and got two new memory cards. 1 Sandisk 64GB and 1 Samsung Evo Plus 64GB (it's all i could get my hands on). I formatted the Sandisk card as normal using the PC (exFAT) and tried to inject a payload to it so I could back up the NAND. However the payload just won't go on. According to TegraRcmGUI 2.6, the payload injection is successful.

    RCM Device detected
    Preset "PAYLOAD_FILE" set to : K:\Switch\atmosphere-0.8.6-master-994d7d5+hbl-2.1+hbmenu-3.0.1\fusee-primary.bin
    Invoking TegraRcmSmash.exe with args : "K:\Switch\atmosphere-0.8.6-master-994d7d5+hbl-2.1+hbmenu-3.0.1\fusee-primary.bin"
    TegraRcmSmash (32bit) 1.2.1-3 by rajkosto
    Opened USB device path \\?\usb#vid_0955&pid_7321#5&1cc0e58a&0&3#{aa0dbd45-3117-f331-5c49-76bf65225042}
    RCM Device with id 4003FC150000000805633C6401101062 initialized successfully!
    Uploading payload (mezzo size: 92, user size: 89280, total size: 155496, total padded size: 155648)...
    Switched to high buffer
    Smashing the stack!
    Smashed the stack with a 0x7000 byte SETUP request!
    Payload successfully injected

    Then I thought that the card might need formatting to FAT32 after doing that I tried again but still no luck. I've tried the other card as well and several different payloads but I always end up with the same issue. I did manage to get some text on the screen a few times. I have tried the latest version of Hekate and Atmosphere.

    "Welcome to Atmosphere" - in the DOS style text but it didn't go any further.
    "{ERROR} Fatal Error: An exception occurred"

    I have a feeling that this is recoverable as it's clearly not patched, enters RCM mode and I have tested it for the exploit.

    Any help would be very much appreciated. I am computer savvy but this is something a little bit newer to me so please be gentle. :P

    Thanks in advance






     
  2. Draxzelex

    Draxzelex GBAtemp Legend
    Member

    Joined:
    Aug 6, 2017
    Messages:
    12,026
    Country:
    United States
    Follow this tutorial. Never ever follow video guides as they are outdated the moment they are uploaded and not made by any trusted developers.
     
  3. TheRenegade

    OP TheRenegade Newbie
    Newcomer

    Joined:
    Mar 15, 2020
    Messages:
    3
    Country:
    United Kingdom
    Thanks for getting back to me. I have tried doing this but no matter what I do I just cannot get the switch to boot into Hekate.

    No RCM device detected
    RCM Device detected
    Invoking TegraRcmSmash.exe with args : "F:\Switch\hekate_ctcaer_5.2.0_Nyx_0.9.0\hekate_ctcaer_5.2.0.bin"
    TegraRcmSmash (32bit) 1.2.1-3 by rajkosto
    Opened USB device path \\?\usb#vid_0955&pid_7321#5&1cc0e58a&0&3#{aa0dbd45-3117-f331-5c49-76bf65225042}
    RCM Device with id 4003FC150000000805633C6401101062 initialized successfully!
    Uploading payload (mezzo size: 92, user size: 122339, total size: 188555, total padded size: 192512)...
    Smashing the stack!
    Smashed the stack with a 0x7000 byte SETUP request!
    Payload successfully injected

    According to TegraRcmGUI, it's worked but the screen stays blank.
     
  4. SheriffBuck

    SheriffBuck Advanced Member
    Newcomer

    Joined:
    Jan 6, 2020
    Messages:
    76
    Country:
    United Kingdom
    I have the same issue with board I've recently purchased for repair. Seems to be stuck in RCM mode and TegraRCMSmash confirms that the stack has been smashed with a 0x7000 byte request, but it then hangs with no message saying the payload has been successfully injected. Did you make any progress?
     
Draft saved Draft deleted
Loading...

Hide similar threads Similar threads with keywords - injecting, Nintendo, payloads