Hacking Hardware Emmc Backup question

[Schn1ek3]

Hello,

Can anyone make a backup of a removed emmc chip?

Unfortunately I don't know how to do this and all I can find is a very specific adapter under Linux to backup all partitions.

I would like to save my switch data, but the chip inside the switch does not work.

I am hoping that someone here can help me and maybe read out the chip with boot0, boot1 and rawnand backup.

If someone knows a method how I can build an adapter for reading out with simple soldering work, that would also be a solution I can live with.

I am hoping to restore my switch with a new emmc, it is already installed and Hekate is already working.

I would be really grateful if you could help me.

Thanks for everyone

 

[jkyoho]

it is already installed and Hekate is already working

If so, why not just backup from Hekate?

 

[Schn1ek3]

If so, why not just backup from Hekate?

because hekate did not work with the old chip.
Or is it possible to connect the chip to the switch via USB to make a backup?

 

[jkyoho]

because hekate did not work with the old chip.
Or is it possible to connect the chip to the switch via USB to make a backup?

Ok, so basically you are currently having a new blank emmc with working hekate and trying to extract data from old emmc?

 

[linuxares]

You mean take emmc from another Switch and plug in to yours for example? If so, no. The keys won't match to decrypt the data.

Do you even have the keys for the dead emmc?

 

[Schn1ek3]

Ok, so basically you are currently having a new blank emmc with working hekate and trying to extract data from old emmc?

yes.

You mean take emmc from another Switch and plug in to yours for example? If so, no. The keys won't match to decrypt the data.

Do you even have the keys for the dead emmc?

No i will the emmc from this switch. i don`t have the Keys, i hope i can get this with the Backup from the original emmc.

 

[impeeza]

yes.


No i will the emmc from this switch. i don`t have the Keys, i hope i can get this with the Backup from the original emmc.

if you removed the chip from the console, the only way is as you stated using an USB adapter which only works on Linux.

And after you have that backup, that backup can only be used on the original console, or only can be read if you have the ORIGINAL console unique keys. there is no other way. the console unique keys are outside the EMMC and you can only recover them on the original board. the mainboard, CPU and NAND contents are linked by the keys.

 

[jkyoho]

if old emmc is the module you will need nxmmcblk or similar reader.
else you will need a programmer to directly program emmc bga like this

Like @impeeza states, old backup can only be read with married SOC console keys(which is in prodinfo from old emmc). You need to dump the old emmc backup and restore to new emmc and use hekate read out your unique keys. If everything goes smooth, you would have a chance dump you savedata or rest into your new emmc

 

[Schn1ek3]

if you removed the chip from the console, the only way is as you stated using an USB adapter which only works on Linux.

And after you have that backup, that backup can only be used on the original console, or only can be read if you have the ORIGINAL console unique keys. there is no other way. the console unique keys are outside the EMMC and you can only recover them on the original board. the mainboard, CPU and NAND contents are linked by the keys.

So my only option is Linux, I want to restore the backup on the original console. My Switch wouldn't start anymore, so I changed emmc and also installed a modchip.
the modchip was installed first and i couldn't read the old emmc with it. that's why i changed to an empty emmc.
Now I'm hoping to back up the old emmc to get the original switch running again.
If there is someone here who can make such a backup, I would like to take advantage of that otherwise I have to organize an adapter stick and deal with Linux a little.

Thanks for the tip, that gives me hope

 

[impeeza]

So my only option is Linux, I want to restore the backup on the original console. My Switch wouldn't start anymore, so I changed emmc and also installed a modchip.
the modchip was installed first and i couldn't read the old emmc with it. that's why i changed to an empty emmc.
Now I'm hoping to back up the old emmc to get the original switch running again.
If there is someone here who can make such a backup, I would like to take advantage of that otherwise I have to organize an adapter stick and deal with Linux a little.

Thanks for the tip, that gives me hope

to restore on the original console, yes you only can do it on linux, but a virtual machine can do the trick.

 

[jkyoho]

to restore on the original console, yes you only can do it on linux, but a virtual machine can do the trick.

Only Linux can read boot0/1, but actually boot0/1 can be shared(same model: i.e v1/ v2 or lite or OLED) or re-create with prod.key, so Windows system actually can do most part of backup/restore

 

[Schn1ek3]

if old emmc is the module you will need nxmmcblk or similar reader.
else you will need a programmer to directly program emmc bga like this

Like @impeeza states, old backup can only be read with married SOC console keys(which is in prodinfo from old emmc). You need to dump the old emmc backup and restore to new emmc and use hekate read out your unique keys. If everything goes smooth, you would have a chance dump you savedata or rest into your new emmc

Thanks for the tips, if I can't get the savegames back, that would be okay. The main thing is that I can use my Switch normally again That would be the most important thing.
So I can only read out the keys if I can make a backup.

Only Linux can read boot0/1, but actually boot0/1 can be shared(same model: i.e v1/ v2 or lite or OLED) or re-create with prod.key, so Windows system actually can do most part of backup/restore

So would a backup from rawnand be sufficient?

to restore on the original console, yes you only can do it on linux, but a virtual machine can do the trick.

Thank you
is it possible to simply solder the emmc to an sd card to read it or do i have to buy an adapter?

 

[impeeza]

Only Linux can read boot0/1, but actually boot0/1 can be shared(same model i.e v/ v2 or lite or OLED) or re-create with prod.key, so Windows system actually can do most part of backup/restore

if you have access to original console, you can export the prod.key needed. using RCM_PickLock

Yes you can connect the EMMC to any SD Card reader and dump as RAW the data of the only partition available DO NOT FORMAT IT OR YOU WILL LOSSE EVERYTHING.

Using the dumped keys and NXNandTool you can extract the savegames and any data you like from the dumped raw partition

 

[jkyoho]

So would a backup from rawnand be sufficient?

Yes, that should be enough, but no harm to backup boot0/1 if Linux is accessible

Post automatically merged: Jul 22, 2024

if you have access to orignal console, you can export the prod.key needed.

Yes,with original working emmc . I meant in the emmc adapter/programmer process without console.

 

[impeeza]

How the Switch NAND Adapters works:

Almost any SD card reader can read eMMC chips. However they only access the main partitions.
After discovering a Realtek card reader with rtsx Linux driver in an old laptop was able to read all partitions, the adapters was created to be able to read the boot0 and boot1 partitions too.

So if you have a eMMC chip, you can connect that chip to any SD Card reader and dump the main partitions as raw data, by example using DD:

sudo dd if=/dev/mmcblk0 of=rawnand.bin

or Using EmuTool https://gbatemp.net/threads/emutool...er-sd-switch-emu-type-on-sxos-and-more.550756


That data is encrypted, so you need the keys to be able to read the contents, for that you can use the script:

https://gbatemp.net/threads/extract-save-from-nand-backup.514261/


Or NxNandManager https://github.com/eliboa/NxNandManager and following the guide https://gbatemp.net/threads/recovering-games-saves-from-nand-using-nxnandmanager-and-jksv.620758/

do not forget, you need the prod.keys file dumped from your console using Lockpick_RCM or Picklock_RCM V 1.9.12

 

[Schn1ek3]

How the Switch NAND Adapters works:




So if you have a eMMC chip, you can connect that chip to any SD Card reader and dump the main partitions as raw data, by example using DD:

sudo dd if=/dev/mmcblk0 of=rawnand.bin

or Using EmuTool https://gbatemp.net/threads/emutool...er-sd-switch-emu-type-on-sxos-and-more.550756


That data is encrypted, so you need the keys to be able to read the contents, for that you can use the script:

https://gbatemp.net/threads/extract-save-from-nand-backup.514261/


Or NxNandManager https://github.com/eliboa/NxNandManager and following the guide https://gbatemp.net/threads/recovering-games-saves-from-nand-using-nxnandmanager-and-jksv.620758/

do not forget, you need the prod.keys file dumped from your console using Lockpick_RCM or Picklock_RCM V 1.9.12

Thank you, that helps me a lot.

Do I have to consider anything when soldering from emmc to sdcard, perhaps solder components to it or simply solder 1 to 1 to the same signals?
or do you have any instructions?

 

[jkyoho]

Thank you, that helps me a lot.

Do I have to consider anything when soldering from emmc to sdcard, perhaps solder components to it or simply solder 1 to 1 to the same signals?
or do you have any instructions?

totally depends on what emmc and reader you have. the module one or emmc chip itself

 

[impeeza]

On this thread there is a set of pines and their definition. you mus exercise caution when soldering because the pins are very small and can be tear of easy.

https://gbatemp.net/threads/switch-oled-256gb-nand-upgrade.608377/page-12#post-10461393

The adapters are the best solution.

 

[Schn1ek3]

totally depends on what emmc and reader you have. the module one or emmc chip itself

I only have a microsd to usb adapter. i would solder the emmc to the micro usb pins and then read it out with the adapter.

On this thread there is a set of pines and their definition. you mus exercise caution when soldering because the pins are very small and can be tear of easy.

https://gbatemp.net/threads/switch-oled-256gb-nand-upgrade.608377/page-12#post-10461393

The adapters are the best solution.

Thank you, I noticed when changing the emmc that the pins are very small cost me a lot of nerves

Post automatically merged: Jul 22, 2024

I have tried to read out the prod.keys. This is the result. Is that ok or are the keys unusable?

sorry for the large picture

 

[linuxares]

Hmm I don't like that cal0 isn't working. Have you used Tinfoil incognito or Incognito Rcm on it?