http://www.ktemkin.com/faq-fusee-gelee/

Kate has collected and answered the most common questions she's gotten regarding Fusée Gelée. Most notably she explains the three "types" of FG hacks, software, hardware (temporary) and hardware (permanent).

Enjoy!

Kate herself responded to this thread on page 26, thanks Kate!

There's a lot more here than I can easily respond to, so apologies if I miss posts or gloss over points.



This is correct-- while there likely will be software chains around for these things in the future, I don't see them as coming along as quickly as f-g. We don't have a non-coldboot exploit chain at all for 5.0.0-- and we haven't looked yet, as we've had other things to focus on and coldboot works. We do have one for 4.1.0, but it's centered around a couple of exploits that we don't want to burn-- we're hoping to use them to get an opportunity to poke around inside T214/Mariko.



I don't view you as particularly hostile, no. I don't know if challenge is generally a good thing-- sometimes you do have to accept that other people have different ethics or viewpoints from yourself and let that pass, especially if they're just doing stuff for fun-- but I don't view your post as hostile.



Jamais Vu (1.0.0 TrustZone hack) isn't my bug, but has been written up, and is just awaiting someone with the skills to have time to do a public interpretation. Déjà Vu is currently centered around the exploit I mentioned above, and we definitely want to hold onto that for as long as it's applicable. It's entirely a Switch bug, too, so I don't see it as being something that needs responsible disclosure.



For Déjà Vu, absolutely. (explained in last quote)



I don't agree that things like tweeting are ego. This is something I work on because I find it a lot of fun to hack on things, and there's definitely an aspect in which it makes me happy when seeing the results of things makes other people happy. There's also an aspect in which I hope that showing these things are possible inspires people to want to learn e.g. reverse engineering. This stuff is cool; and I want to share the excitement with others and lift them up as much as I can.

You don't have to believe me on that or like that that's my goal. I won't hold it against you if you don't.



I honestly support people updating when it makes sense; and I recognize that there's a conflict between holding back information and enabling others to make reasonable decisions about that. I don't like or feel good about secrecy, and I know it has implications. I've tried to be as clear as I can about the costs regarding updating without crossing the line into giving things away.



I think we've been pretty clear that 4.1.0 will eventually see a non-coldboot, software-only exploit with the same level of power. That's actually been posted on the ReSwitched Discord's FAQ for months, but I know the message gets skewed as its gets communicated over to other places. That's part of why I'm here, now-- I want to help clear things up.

The interactions between the operating system and the bootloader-- say on reboot-- are actually fairly limited; and knowing what any of them are is enough to point people at the particular section of bootrom that's vulnerable. That's why I'm not commenting on Fusée Gelée and how it relates to software-only solutions right now. I have said e.g. above that since there's no public way of getting the privileges necessary to run things, 4.1.0 isn't going to see a pure software solution that the public can use at the time that f-g is released. Software exploits will likely come in time; and it's possible we'll come up with things that are even easier than f-g.



I'm not sure if they'll take it seriously enough. I don't know how they are internally-- but I can't just assume they'll fail to do anything and skip disclosure. Honestly, I don't think a "security advisory" is really a bad thing, either-- there are definitely applications of Tegra chips that I and/or the public don't know about. If giving NVIDIA notice gives them time to explain exactly what's dangerous and allow their customers to remove and replace units from places where the vulnerability can cause harm, I consider that a win, and well worth delaying some public switch hacks by a few months.

I'll also say that my fear that vendors won't take the vulnerability seriously is a huge reason I'm so keen to get things out there-- and why I provided a date after which I'll tell the public what's going on that I've said was non-negotiable. I want to make sure this doesn't get hidden, and that people understand exactly what f-g can and can't accomplish, to minimize FUD while also letting people understand the actual risks are associated with using a vulnerable device.



It changes this from an exploit that's going to be usable before the affected people know it's a thing to something that people may have a chance to react to. Making the vulnerability public without disclosure really increases the odds someone is capable of using it to do bad.

I didn't really give NVIDIA a chance to sell-off stock; though. I've said publicly multiple times that there are bugs in Tegra processors well before NVIDIA reached out to me seeking disclosure. If anything, I think telling the public that these vulnerabilities exist while pursuing disclosure helps developers interested in using Tegra chips in the future ask the right question.



I've already said that while pure-software stuff is doable on 4.1.0; it'll be a wait. As far as I'm remembering, the only part of the chain that could require multiple tries to work is PegaSwitch, which is our browser-based entry point, and I haven't even tried the browser entry point that'll eventually be public to see how reliable it is. SciresM did the work to get our non-coldboot exploit working on 4.1.0; not me.



Yeah, that's hard-- especially as everyone has a different view as to how inconvenient things are. I don't know of a way to communicate this better without more details.

Incidentally, the 'inconvenience' verbiage came from SciresM and I discussing our respective views on updating. I think SciresM is more towards the opinion that people should hold back more often, where I'm more of the opinion that updating can be a good and reasonable option sometimes. The way we wound up phrasing things is a compromise between views.



(I'm going to assume this meant "on the hacking side". If not I'm not sure what hacking site you're referring to.)

Updating to latest just closes the possibility of using software exploits launched from Horizon, which can make setup more difficult. I know you'd like to know how much, but I unfortunately don't have a good way of qualifying that. As I've mentioned, if you're suffering from not being able to use your 3.0.1+ Switch, you probably do want to upgrade and just risk things being more inconvenient in the future. Worst comes to worst, if you decide you can't tolerate the inconvenience, you upgrade and then wind up having to figure out a modchip.

The downgrade protection fuses literally mean nothing to a system with f-g, which can entirely skip the downgrade check. Incidentally, SciresM actually accidentally bricked one of his systems in a way such that it was always failing the downgrade checks, and he's been able to use f-g to get that system up and running again.



I don't think that's clear at all, nor do I want to confirm or deny this. Sorry.



I think you're making a bunch of assumptions here, and that's maybe not a great idea. I'm not saying you're necessarily right or wrong; just that I don't think your assumptions are founded.



I don't think this contradicts. This is talking about vulnerabilities that aren't f-g; not because f-g doesn't work on 4.1.0, but because it's possible we may come up with vulnerabilities that are even nicer on 4.1.0 in the future.



I'm being as clear as I feel I can, and adding clarifications e.g. here where I think it helps. There will be different names for the the ways you can use f-g eventually; and I'll be fully open about everything once the summer rolls around and I'm not putting the disclosure timeline in jeopardy.



I know and have said about that this "bring your own exploit" business makes development exclusive, and that's exclusionary and I really don't like it-- I just don't see a way around it. I would love to get more developers and more perspective, and that's why my release date for f-g is tied to my disclosure timeline and not in particular to Atmosphère's release.




I've tried to point out approximately what the difficulty would be for some of the options to kind of provide this, but this is a hard thing to accomplish. In this case, providing details that are more specific really points a finger at vulnerability details, so there's not much I'm comfortable sharing. I've shared what I could-- as a data point, some of the other teams have outright stated that they think I've shared too much already and made things obvious. I don't agree or necessarily care about their opinons, but c'est la vie.



Well, this isn't the case. This has been disclosed to Nintendo, too-- as NVIDIA shares their vulnerability findings with downstream customers. It's more general malicious actors that I'd be worried about.



See above-- but I don't think I'd advise specifically updating to 4.1.0 unless that gives you enough access to the games you want.



I'm also super glad that we can do a lot of our work in the open. I hope there's a lot more of it in the future-- and I'd love to stream some of it.



I find the requirement disheartening as well, but I think this is the right way to do things, for now. I've explained my rationale above; feel free to ask questions.



I'm not sure why people are against communication, here. There were definite benefits to talking about f-g in the first place; including that it demonstrates that Tegra chips are vulnerable-- which hopefully influences buying decisions in the future and puts pressure on NVIDIA to seek as much of a fix as they can. After that there seemed to be definitely benefits to talking about more details, even in the limited sense that I'm able to. I've tried to give people more information than the nothing they would have had so they could have more of an idea whether it's be a good idea to e.g. pre-order a modchip or update their system. I know it can be frustrating to not get full disclosure, and that more information would help people to make a better or more conclusive decision, but full disclosure isn't an option until this summer. I don't think that's a reason to hold back information.



I don't have specific answers to your questions, unfortunately-- but I think it sounds like the main purpose of this Switch is as a gaming device and maybe you should upgrade and enjoy playing games with your son.



I don't think that asking for clarification is criticism. It might be rude to push me to answer something I said I wouldn't, but I don't think there's harm in answer.



I don't think I've said anything about opening the console or not. See above for my views on updating?



I'm not sure where you got this impression, or why you're confident about things enough to claim you know about the internal values or working of ReSwitched. This is also easily disprovable just from public information--Hedgeberg has tested out f-g on stream. I don't see it as great opsec to enumerate how many people have access to the vulnerability, but we've long had a policy of only giving exploit details to those who actually want to know them and are in a position where they can use them to help. This is a basic security precaution and not about trust.

I'm actually not sure how this is relevant to the broader discussion. Based on your post history, I can tell that you strongly support TX and the option they're providing, and you're welcome to that, but I think throwing around generic unfounded criticism of RS doesn't do much good and distracts from me answering community questions.



I don't think they're obviously more convenient, as they exist right now. They're both inherently however-tethered-you-consider-PegaSwitch, take a bunch of time to run, and rely on a pegaswitch entry point.



That's not correct-- everyone on a current hardware revision will be able to install and use CFW the day it's released, if they're willing to put in the effort and potentially take on some minor risk.



I'm actually not sure what you mean by this entire post? Sorry about that-- I'd love to address your ideas, but unfortunately I can't figure out your meaning.



That was about me having fun by trying to see if a DIY, cheap modchip option is reasonable. It turns out it is. As you've noted, it's not necessary on any firmware. I just really like the idea that the open exchange of knowledge -- especially when profit's not a motive -- can result in creation of neat options for the community. ^-^



Yep; that's exactly what it means.



I don't think this has been at all implied-- and you'd be hard pressed to find a way to make a solder-less Arduino option that even remotely fits in the Switch case.

I should also clarify that the DIY option isn't solderless.

If you have or are going to get the game anyway, you can. Those versions are pretty much interchangeable in the long-term.



Yep-- and it's possible at some point that we'll allow you to install Fake News without Puyo using f-g/Atmosphère. The original plan was to release Atmosphère for 1.0.0 first while we tried to figure out how to deal with Fusée Gelée, but we actually wound up with a disclosure schedule that was faster than we'd thought.

 

[BelmontSlayer]

Thanks for the quick reply, I wonder what kind of a hardmod do we require, if you could explain further that would be fine, and if you couldn't that's fine too.

Kate has said multiple times that the "hardmod" is the equivalent of shorting pins with a pair of tweezers. Nothing too hard, most users should be able to do something this easy.

 

[Kerbangman]

Maybe they are all waiting for Pokemon to be released

 

[TotalInsanity4]

@ktemkin After reading all the answers I was left with more questions than answers. The first thing I do not understand is why wait for the summer if the work is already done, perhaps to give time to nintendo or nvidia? Were you thanked for the information on the bug? As soon as there is mariko, we will see something liberated that is not a video circulating in a closed circle. I do not mean to offend but I value the word of the people and this community very much. On the other hand I would like to say some information about the type of mochip that can be used and what I would like more is a connection scheme to solder or bridge in different harmod options. I understand that this information could be given as we do not have access to the soft that will go into the modchip and therefore is not revealing anything transcendental anyway that reason prevents you from releasing things? Thank you for your answers and I hope you have not felt offended with any questions

There's not much to not get at this point, they gave fair disclosure to NVidia due to the fact that this hardware flaw affects every Tegra family device they produce, and they feel comfortable that summer will have given NVidia enough time to get their proverbial shit together before they unleash a hack on the world that they won't be able to revoke. There's nothing Nintendo can do about the bug on already released hardware, though

 

[sarkwalvein]

@ktemkin After reading all the answers I was left with more questions than answers. The first thing I do not understand is why wait for the summer if the work is already done, perhaps to give time to nintendo or nvidia? Were you thanked for the information on the bug? As soon as there is mariko, we will see something liberated that is not a video circulating in a closed circle. I do not mean to offend but I value the word of the people and this community very much. On the other hand I would like to say some information about the type of mochip that can be used and what I would like more is a connection scheme to solder or bridge in different harmod options. I understand that this information could be given as we do not have access to the soft that will go into the modchip and therefore is not revealing anything transcendental anyway that reason prevents you from releasing things? Thank you for your answers and I hope you have not felt offended with any questions

It's all written up there, if you want to read the exact words then look up the FAQ and the few previous posts from ktemkin up in this thread. But in summary, it's still not being released so that NVIDIA and etc might have time to deal with it, respecting the word she gave to them when setting that deadline out of her own volition.

I don't know why would you want to know if she was thanked, that seems kind of private and not useful information, like what a paparazzi would ask perhaps. But oh well, I can't answer that.

It will be released on summer, no matter when Mariko comes out.

Regarding a modchip, I don't think it was stated that a modchip was actually to be developed? Perhaps it was said, don't know, but AFAIK it only was said that "it was possible to do it".
In any case, what was really stated was that you may require "a simple hard mod" that would perhaps require something not more complex than "unplugging a ribbon cable". I guess you can either interpret that or wait until they release full information about all of this, that means on summer (before September 22nd), as far as I know, for the reasons stated above.

 

[TotalInsanity4]

Regarding a modchip, I don't think it was stated that a modchip was actually to be developed? Perhaps it was said, don't know, but AFAIK it only was said that "it was possible to do it".

I recall her saying that they might release specs for building an open-source modchip depending on certain conditions, I just don't recall what those were

 

[Crazy-S]

"Modchip" or entry point seems to be likely via the SD Card Port or the Ribbon cable that leads to the adapter
I've just watched the "proof" modchip video and saw the SD Card adapter lying next to the console wth an microsd inserted.

Spoiler: IMAGES

Can be something but can also be nothing ;P

 

[Samus20XX]

@ktemkin

First of all, thanks for your hardwork. You're pretty amazing ^^ "pretty" being a huge understatement here

So this trivial hardmod, were you being literal when you said its as simple as shorting a fuse with tweezers?

EDIT: Just wanna say sorry in advance in case im misquoting you ;p

 

[Quantumcat]

I know the drama with JustPingo and Hykem. But, what exactly is the story on Team Salt?

They promised to release IOSU for Wii U, and kept everyone up to date with news of their development, showed off POCs etc, and never delivered. From memory they blamed the community for getting too hyped (even though they made it happen with their announcements etc).

 

[smf]

Kate has said multiple times that the "hardmod" is the equivalent of shorting pins with a pair of tweezers. Nothing too hard, most users should be able to do something this easy.

That is one way to do the hardmod, but not one that most people would find satisfactory as you have to do it every time you load CFW.

 

[Kioku]

They promised to release IOSU for Wii U, and kept everyone up to date with news of their development, showed off POCs etc, and never delivered. From memory they blamed the community for getting too hyped (even though they made it happen with their announcements etc).

Actually, there was some very salty entitlement. People demanding an exact release date, and heckling them saying it was all a hoax. Yeah, I remember that. TBF, there was some shared arrogance. So that part really wasn't a surprise.

 

[Ghassen-ga]

That is one way to do the hardmod, but not one that most people would find satisfactory as you have to do it every time you load CFW.

Is this true? Is the coldboot the only way to run the cfw anyway?

 

[BL4Z3D247]

That is one way to do the hardmod, but not one that most people would find satisfactory as you have to do it every time you load CFW.

No, you're not going to need to disassemble your switch every time you want to boot it. I consider the 'inconvenient' process something I'd be willing to do on the main Switch the spouse and I use for games; and I definitely don't have the patience to take out all those tiny screws every time I want to boot.

 

[Ghassen-ga]

T
That's good to hear (one should probably go back and read all of her replies before he embarrasses himself any further ).

 

[Tempest228]

I'm confused here. So you don't need Deja Vu or anything to work Fusee Gelee? Will it just be a one and done for the "simple hardmod"?

 

[TotalInsanity4]

I'm confused here. So you don't need Deja Vu or anything to work Fusee Gelee? Will it just be a one and done for the "simple hardmod"?

If I understand correctly, then yes

Also I love everything about your avatar

 

[ktemkin]

@ktemkin Are you going to update your faq with these replies? I think its important for people who know about it but not this thread to see your replies.

Yeah, I'll probably do an update in a few days-- gives me more of a chance to batch up the questions I've been answering and coalesce them into FAQ entries.

@ktemkin Can I assume that 2.0.0 can be lumped in with 1.0.0?

2.x systems would be lumped in with 3.0.0 and lower-- they have sm:h / smhax, but aren't running the critically insecure 1.0.0

@ktemkin Can you just clarify what a "hold grail" exploit is?.

The reason I ask is because from what I understand wrt 1.0.0, I thought that FW version was thoroughly PWNED by ReSwitched team already.

So, unsure what more could be missing that would constitute a greater level of system control than what's currently possible, public or otherwise.

That's true-- the F-G coldboot exploit actually gives us the highest level of privilege possible, so you could say that all switches have been compromised completely. However, it's not perfect, as the path to get there still requires you to go through a bunch of steps; and 1.0.0 requires you to either have access to Puyo Puyo Tetris or the Trivial Hardmod.

I recall her saying that they might release specs for building an open-source modchip depending on certain conditions, I just don't recall what those were

Were there conditions? Well, I plan to release designs for an open-source modchip-- though I'm not sure of timeline. Once F-G's public, they'll either be immediately released or worked on in public.

I'll also at some point do a write-up showing how you can implement one yourself from the kind of parts you can find on Adafruit/Sparkfun/Microcenter.

"Modchip" or entry point seems to be likely via the SD Card Port or the Ribbon cable that leads to the adapter
I've just watched the "proof" modchip video and saw the SD Card adapter lying next to the console wth an microsd inserted. [/SPOILER]
Can be something but can also be nothing ;P

Oh, no-- that definitely wasn't intended to imply that. It's just hard to keep those things from falling out when the Switch back is open-- at least if you don't put the screw back in.

The bootROM actually doesn't contain any reachable code-paths for touching the SDMMC controller that drives the SD card slot, so that'd have to be a very clever exploit. ^-^

@ktemkin
First of all, thanks for your hardwork. You're pretty amazing ^^ "pretty" being a huge understatement here

So this trivial hardmod, were you being literal when you said its as simple as shorting a fuse with tweezers?

Thanks. ^-^

I was trying to convey a level of difficulty, while also throwing a nod to Team Twiizers original address-range re-routing from the Wii days.

That is one way to do the hardmod, but not one that most people would find satisfactory as you have to do it every time you load CFW.

Yep-- I then continue on in the FAQ to say there's a trivial twist that's roughly equivalent to "snipping a pin" that makes it so you don't have to do that every time.

(I might actually be overstating the difficulty/risk a bit here with "snipping a pin". I just don't want to risk misrepresenting it.)

Is the coldboot the only way to run the cfw anyway?

You can use Jamais Vu or theoretically Déjà Vu (which aren't coldboot and are software-only exploits) to start the CFW, too. Coldboot's just nice because it gives you control literally from boot.

I'm confused here. So you don't need Deja Vu or anything to work Fusee Gelee? Will it just be a one and done for the "simple hardmod"?

If you do the simple hardmod, you don't need any software exploit, no. It's pretty much a one-exploit chain-- two if you count the hardmod.

(Is that what you mean by "one and done"? You also don't have to repeat the hardmod again.)

 

[Xandroz]

sorry to bother you again with the 1.0 questions. now i have puyo and will install fake news, will i need it later on or i can discard it,

also from my understanding from the replies we arent getting coldbooot exploit now but in the future correct, unless i need the coldboot from the start i have to go hardmod, So F-G and as time goes on i will have full control as development goes on, i dont mind that i used to open the hack manually each time i had the vita untill i was finally able to coldboot,


Final situation if i go hard mod from the start, will the dejavu or the other exploits benifit me in the future or wont differ as i have access, i dont mind opening the switch and doing whats needed, but if im gonna wait and get it all as cfw then i can wait.

thank you once again and the RS Team and sorry to bother you with the 1.0 thing, just needed more clearance kn that.

 

[VashTS]

@ktemkin on the temp....now i know its vaporware LUL

excited for the exploit, thanks for the work is what i really mean to say

 

[punderino]

If you do the simple hardmod, you don't need any software exploit, no. It's pretty much a one-exploit chain-- two if you count the hardmod.

(Is that what you mean by "one and done"? You also don't have to repeat the hardmod again.)

If there's a simple hardmod and that's the only thing you have to do why would you make a modchip?

 

[ktemkin]

If there's a simple hardmod and that's the only thing you have to do why would you make a modchip?

b-b-but TX has a modchip

The modchip automates things a bit-- makes everything that much more convenient.
(Sorry, this is one of those questions I'm going to have to dodge a bit until release. It'll be clear soon.)