Hacking Extract safe files from EmuMMC backup without keys

[mars547]

Hi there.

I'm looking for a way to extract save files from the EmuMMC Backup of my Switch V1 patched.
Unfortunately the card reader port on the pcb is broken and I have no way to boot into hekate to read the prod keys.

The method I tried was with NxNandManager but due to the NAND encryption I need the keys from my switch to extract anything.
I also tried using a different Switch, inserted the SD Card from the broken Switch there to extract the keys from the EmuMMC, but due to the files not matching to the hardware it was not successful.
Using the keys from another Switch also was a faiure.
Every method I found so far requires you to extract the keys from the Switch first.

Is there a way to extract the save files without the prod key or bis keys or any method to extract the keys from EmuMMC directly?
Any help is appreciated.

 

[OrGoN3]

Hi there.

I'm looking for a way to extract save files from the EmuMMC Backup of my Switch V1 patched.
Unfortunately the card reader port on the pcb is broken and I have no way to boot into hekate to read the prod keys.

The method I tried was with NxNandManager but due to the NAND encryption I need the keys from my switch to extract anything.
I also tried using a different Switch, inserted the SD Card from the broken Switch there to extract the keys from the EmuMMC, but due to the files not matching to the hardware it was not successful.
Using the keys from another Switch also was a faiure.
Every method I found so far requires you to extract the keys from the Switch first.

Is there a way to extract the save files without the prod key or bis keys or any method to extract the keys from EmuMMC directly?
Any help is appreciated.

No. Your NAND itself is encrypted with your device-specific BIS keys. You need to have dumped those at any point (they do not change) to be able to decrypt your NAND to then get your saves.

Get a new card reader and replace it, or get somebody who can. You can NOT use another console's BIS keys. You need YOUR console's BIS keys.

You can try https://github.com/rajkosto/biskeydump#usage since it doesn't require an SD card. I doubt it'll work since it was never updated, but meh, who knows.

LockPick_RCM might also be able to display your BIS Keys, possibly even TegraExplorer (i'm not positive about this one).

 

[mars547]

No. Your NAND itself is encrypted with your device-specific BIS keys. You need to have dumped those at any point (they do not change) to be able to decrypt your NAND to then get your saves.

Get a new card reader and replace it, or get somebody who can. You can NOT use another console's BIS keys. You need YOUR console's BIS keys.

LockPick_RCM might also be able to display your BIS Keys, possibly even TegraExplorer (i'm not positive about this one).

Thanks for your reply. I'll try it out even if the chances are slim.
The Switch is on its way to a repair shop.