http://www.ktemkin.com/faq-fusee-gelee/

Kate has collected and answered the most common questions she's gotten regarding Fusée Gelée. Most notably she explains the three "types" of FG hacks, software, hardware (temporary) and hardware (permanent).

Enjoy!

Kate herself responded to this thread on page 26, thanks Kate!

There's a lot more here than I can easily respond to, so apologies if I miss posts or gloss over points.



This is correct-- while there likely will be software chains around for these things in the future, I don't see them as coming along as quickly as f-g. We don't have a non-coldboot exploit chain at all for 5.0.0-- and we haven't looked yet, as we've had other things to focus on and coldboot works. We do have one for 4.1.0, but it's centered around a couple of exploits that we don't want to burn-- we're hoping to use them to get an opportunity to poke around inside T214/Mariko.



I don't view you as particularly hostile, no. I don't know if challenge is generally a good thing-- sometimes you do have to accept that other people have different ethics or viewpoints from yourself and let that pass, especially if they're just doing stuff for fun-- but I don't view your post as hostile.



Jamais Vu (1.0.0 TrustZone hack) isn't my bug, but has been written up, and is just awaiting someone with the skills to have time to do a public interpretation. Déjà Vu is currently centered around the exploit I mentioned above, and we definitely want to hold onto that for as long as it's applicable. It's entirely a Switch bug, too, so I don't see it as being something that needs responsible disclosure.



For Déjà Vu, absolutely. (explained in last quote)



I don't agree that things like tweeting are ego. This is something I work on because I find it a lot of fun to hack on things, and there's definitely an aspect in which it makes me happy when seeing the results of things makes other people happy. There's also an aspect in which I hope that showing these things are possible inspires people to want to learn e.g. reverse engineering. This stuff is cool; and I want to share the excitement with others and lift them up as much as I can.

You don't have to believe me on that or like that that's my goal. I won't hold it against you if you don't.



I honestly support people updating when it makes sense; and I recognize that there's a conflict between holding back information and enabling others to make reasonable decisions about that. I don't like or feel good about secrecy, and I know it has implications. I've tried to be as clear as I can about the costs regarding updating without crossing the line into giving things away.



I think we've been pretty clear that 4.1.0 will eventually see a non-coldboot, software-only exploit with the same level of power. That's actually been posted on the ReSwitched Discord's FAQ for months, but I know the message gets skewed as its gets communicated over to other places. That's part of why I'm here, now-- I want to help clear things up.

The interactions between the operating system and the bootloader-- say on reboot-- are actually fairly limited; and knowing what any of them are is enough to point people at the particular section of bootrom that's vulnerable. That's why I'm not commenting on Fusée Gelée and how it relates to software-only solutions right now. I have said e.g. above that since there's no public way of getting the privileges necessary to run things, 4.1.0 isn't going to see a pure software solution that the public can use at the time that f-g is released. Software exploits will likely come in time; and it's possible we'll come up with things that are even easier than f-g.



I'm not sure if they'll take it seriously enough. I don't know how they are internally-- but I can't just assume they'll fail to do anything and skip disclosure. Honestly, I don't think a "security advisory" is really a bad thing, either-- there are definitely applications of Tegra chips that I and/or the public don't know about. If giving NVIDIA notice gives them time to explain exactly what's dangerous and allow their customers to remove and replace units from places where the vulnerability can cause harm, I consider that a win, and well worth delaying some public switch hacks by a few months.

I'll also say that my fear that vendors won't take the vulnerability seriously is a huge reason I'm so keen to get things out there-- and why I provided a date after which I'll tell the public what's going on that I've said was non-negotiable. I want to make sure this doesn't get hidden, and that people understand exactly what f-g can and can't accomplish, to minimize FUD while also letting people understand the actual risks are associated with using a vulnerable device.



It changes this from an exploit that's going to be usable before the affected people know it's a thing to something that people may have a chance to react to. Making the vulnerability public without disclosure really increases the odds someone is capable of using it to do bad.

I didn't really give NVIDIA a chance to sell-off stock; though. I've said publicly multiple times that there are bugs in Tegra processors well before NVIDIA reached out to me seeking disclosure. If anything, I think telling the public that these vulnerabilities exist while pursuing disclosure helps developers interested in using Tegra chips in the future ask the right question.



I've already said that while pure-software stuff is doable on 4.1.0; it'll be a wait. As far as I'm remembering, the only part of the chain that could require multiple tries to work is PegaSwitch, which is our browser-based entry point, and I haven't even tried the browser entry point that'll eventually be public to see how reliable it is. SciresM did the work to get our non-coldboot exploit working on 4.1.0; not me.



Yeah, that's hard-- especially as everyone has a different view as to how inconvenient things are. I don't know of a way to communicate this better without more details.

Incidentally, the 'inconvenience' verbiage came from SciresM and I discussing our respective views on updating. I think SciresM is more towards the opinion that people should hold back more often, where I'm more of the opinion that updating can be a good and reasonable option sometimes. The way we wound up phrasing things is a compromise between views.



(I'm going to assume this meant "on the hacking side". If not I'm not sure what hacking site you're referring to.)

Updating to latest just closes the possibility of using software exploits launched from Horizon, which can make setup more difficult. I know you'd like to know how much, but I unfortunately don't have a good way of qualifying that. As I've mentioned, if you're suffering from not being able to use your 3.0.1+ Switch, you probably do want to upgrade and just risk things being more inconvenient in the future. Worst comes to worst, if you decide you can't tolerate the inconvenience, you upgrade and then wind up having to figure out a modchip.

The downgrade protection fuses literally mean nothing to a system with f-g, which can entirely skip the downgrade check. Incidentally, SciresM actually accidentally bricked one of his systems in a way such that it was always failing the downgrade checks, and he's been able to use f-g to get that system up and running again.



I don't think that's clear at all, nor do I want to confirm or deny this. Sorry.



I think you're making a bunch of assumptions here, and that's maybe not a great idea. I'm not saying you're necessarily right or wrong; just that I don't think your assumptions are founded.



I don't think this contradicts. This is talking about vulnerabilities that aren't f-g; not because f-g doesn't work on 4.1.0, but because it's possible we may come up with vulnerabilities that are even nicer on 4.1.0 in the future.



I'm being as clear as I feel I can, and adding clarifications e.g. here where I think it helps. There will be different names for the the ways you can use f-g eventually; and I'll be fully open about everything once the summer rolls around and I'm not putting the disclosure timeline in jeopardy.



I know and have said about that this "bring your own exploit" business makes development exclusive, and that's exclusionary and I really don't like it-- I just don't see a way around it. I would love to get more developers and more perspective, and that's why my release date for f-g is tied to my disclosure timeline and not in particular to Atmosphère's release.




I've tried to point out approximately what the difficulty would be for some of the options to kind of provide this, but this is a hard thing to accomplish. In this case, providing details that are more specific really points a finger at vulnerability details, so there's not much I'm comfortable sharing. I've shared what I could-- as a data point, some of the other teams have outright stated that they think I've shared too much already and made things obvious. I don't agree or necessarily care about their opinons, but c'est la vie.



Well, this isn't the case. This has been disclosed to Nintendo, too-- as NVIDIA shares their vulnerability findings with downstream customers. It's more general malicious actors that I'd be worried about.



See above-- but I don't think I'd advise specifically updating to 4.1.0 unless that gives you enough access to the games you want.



I'm also super glad that we can do a lot of our work in the open. I hope there's a lot more of it in the future-- and I'd love to stream some of it.



I find the requirement disheartening as well, but I think this is the right way to do things, for now. I've explained my rationale above; feel free to ask questions.



I'm not sure why people are against communication, here. There were definite benefits to talking about f-g in the first place; including that it demonstrates that Tegra chips are vulnerable-- which hopefully influences buying decisions in the future and puts pressure on NVIDIA to seek as much of a fix as they can. After that there seemed to be definitely benefits to talking about more details, even in the limited sense that I'm able to. I've tried to give people more information than the nothing they would have had so they could have more of an idea whether it's be a good idea to e.g. pre-order a modchip or update their system. I know it can be frustrating to not get full disclosure, and that more information would help people to make a better or more conclusive decision, but full disclosure isn't an option until this summer. I don't think that's a reason to hold back information.



I don't have specific answers to your questions, unfortunately-- but I think it sounds like the main purpose of this Switch is as a gaming device and maybe you should upgrade and enjoy playing games with your son.



I don't think that asking for clarification is criticism. It might be rude to push me to answer something I said I wouldn't, but I don't think there's harm in answer.



I don't think I've said anything about opening the console or not. See above for my views on updating?



I'm not sure where you got this impression, or why you're confident about things enough to claim you know about the internal values or working of ReSwitched. This is also easily disprovable just from public information--Hedgeberg has tested out f-g on stream. I don't see it as great opsec to enumerate how many people have access to the vulnerability, but we've long had a policy of only giving exploit details to those who actually want to know them and are in a position where they can use them to help. This is a basic security precaution and not about trust.

I'm actually not sure how this is relevant to the broader discussion. Based on your post history, I can tell that you strongly support TX and the option they're providing, and you're welcome to that, but I think throwing around generic unfounded criticism of RS doesn't do much good and distracts from me answering community questions.



I don't think they're obviously more convenient, as they exist right now. They're both inherently however-tethered-you-consider-PegaSwitch, take a bunch of time to run, and rely on a pegaswitch entry point.



That's not correct-- everyone on a current hardware revision will be able to install and use CFW the day it's released, if they're willing to put in the effort and potentially take on some minor risk.



I'm actually not sure what you mean by this entire post? Sorry about that-- I'd love to address your ideas, but unfortunately I can't figure out your meaning.



That was about me having fun by trying to see if a DIY, cheap modchip option is reasonable. It turns out it is. As you've noted, it's not necessary on any firmware. I just really like the idea that the open exchange of knowledge -- especially when profit's not a motive -- can result in creation of neat options for the community. ^-^



Yep; that's exactly what it means.



I don't think this has been at all implied-- and you'd be hard pressed to find a way to make a solder-less Arduino option that even remotely fits in the Switch case.

I should also clarify that the DIY option isn't solderless.

If you have or are going to get the game anyway, you can. Those versions are pretty much interchangeable in the long-term.



Yep-- and it's possible at some point that we'll allow you to install Fake News without Puyo using f-g/Atmosphère. The original plan was to release Atmosphère for 1.0.0 first while we tried to figure out how to deal with Fusée Gelée, but we actually wound up with a disclosure schedule that was faster than we'd thought.

 

[Maximilious]

Nothing I have pointed out has been vague - no one has been able to dispute any of it. And it's "she".

Apologies then. And by vague I meant what we can gather from Kate's posts. I've just seen you post about this same point several times throughout the thread. At the end of the day, we all have to wait anyway no matter the outcome, release or no release.

 

[TheCyberQuake]

My concern is that there's multiple pieces of evidence pointing to this turning out like Hykem. It is better to have healthy scepticism than take everything at face value and ignore anything that doesn't match. As I have said before I'll be very happy if it all turns out to be a coincidence and everything gets released when they say it will. Just reserving my "I told you so" rights by expressing what I have noticed and not keeping it to myself.

--------------------- MERGED ---------------------------


Nothing I have pointed out has been vague - no one has been able to dispute any of it. And it's "she".

I don't see how this would end up as another hykem situation, especially considering the other people in the team, especially SciresM, both know about the exploit and are major believers in public release. Like absolute worst case I can see happening is it getting delayed for some reason, but at least for FG I just don't see any chance of that happening.
There can be a number of reasons to not publicly announce the exact disclosure window, and it's probably just to be courteous to nvidia, even if a nda was not signed.

 

[Draxzelex]

A disclosure window has a set date. It's specified up to a specific date it won't be made public. We don't know what the date is, but disclosure windows always have a specific date and is called a window because it's a set period (or window) of time that the vulnerability won't be publicly disclosed by that person, not because the end date is not determined.
There could be multiple reasons not to publicly announce the exact time frame either.

Honestly, she probably hasn't given the fusée gelée reveal date to us because she knows that people would confuse the reveal of the exploit with the release of software. I'm certain she has a date in mind, and I'm certain she gave that date to Nvidia, who in turn gave information on the exploit and the disclosure date to their downstream customers (i.e., Nintendo). There's no reason to publicly reveal the date right now; it would just create confusion and unnecessary hype.

Ah, this honestly does make sense. Especially since the release of one is not tied in any way, shape, or form to the other. I think I was just taking the terminology between "date" and "window" too literally. My bad. Although the inner skepticist in me is praying that this is the case and not something silly or worse...

No, she said releasing Summer 2018, that means summer, not fall. NVidia would have been notified well before this, and the fact that there's already a hardware identifier for a chip revision in Switch firmware 5.0.0 indicates that they've had enough time to at least get to advanced prototyping phase with a hardware fix

So basically my initial thought process was Kate was giving Nvidia the chance to release something that patches the exploit during the three months of summer 2018. Kate will release her exploit once it has been fixed. In the event of a worse case scenario that Nvidia does not release anything by the end of summer 2018, this is when Kate would have theoretically released it which would be the end of summer 2018/beginning of fall 2018 depending on how technical you wanted to be. But since I misinterpreted the definition of a disclosure window, my point is moot.

 

[subcon959]

I honestly think the vague release time is to do with TX.

 

[reminon]

She doesn't need to do that on her own - when she opens it to the public (not in a big release way but in a way that interested and informed people can access it), people will help (not to mention there's supposed to be a whole team behind it). And in any case, if it isn't ready for public consumption yet (for documentation reasons or anything else) why pretend that it is being held over just for the disclosure window? Why would the team not do things in the following order: 1. inform nvidia etc, 2. work on everything that needs to be worked on including documenting, then finally 3. announce info and say it is just waiting for the disclosure window to pass (in which they will know the date they are waiting for)?
Either it is being held over for development/documentation or it is being held over for the disclosure window. And I don't think the documentation is going to take so long that she doesn't know if it will be complete in June or in August. In development you can run into horrible problems that you just don't know how to solve and you never anticipated, so taking a month or two longer than expected would be common. But when you're writing, and you know what you're writing about, what unexpected problem can you have? Your notepad application gets a virus?
Either it is because development is not finished or she just wants the heaps of extra attention that comes from people continually asking, once June is here, "is it released yet? Is it released yet?" that she can milk until she finally decides to release it late August. If it was just for the disclosure window there could be a date, since it is what the team decides, not something unexpected that they can't anticipate.

She said the disclosure period was less than 90 days. Plus it's already been disclosed now...So.. . Even more less than 90 days.

 

[ShadowOne333]

So basically my initial thought process was Kate was giving Nvidia the chance to release something that patches the exploit during the three months of summer 2018. Kate will release her exploit once it has been fixed.

There is no patch to fix a hardware exploit magically.
There has to be a hardware revision for all Nvidia Tegra X1 dependant devices, and for that, Kate gave Nvidia the 90 days disclosure dealine so they can take the appropriate countermeasures to said exploit.

ALL currently released and sold devices with the known vulnerability are, and will be, exploitable at the time of release of Fussy Jelly, unless all devices are called back to get a revisioned hardware back or replace the bootrom with the updated one (Mariko most likely)

 

[andijames]

There is no patch to fix a hardware exploit magically.
There has to be a hardware revision for all Nvidia Tegra X1 dependant devices, and for that, Kate gave Nvidia the 90 days disclosure dealine so they can take the appropriate countermeasures to said exploit.

ALL currently released and sold devices with the known vulnerability are, and will be, exploitable at the time of release of Fussy Jelly, unless all devices are called back to get a revisioned hardware back or replace the bootrom with the updated one (Mariko most likely)

Whilst you're right there is no magic way to fix a current exploit this does give them a chance to fix the software fault at a ROM level in the factory - hence the disclosure period and time for them to get the fix deployed. It's responsible and commendable in my eyes.

 

[smf]

Incorrect

No, it's certainly correct that I believe that no matter what Kate has said. We'll know for sure if they are released on the same day.

Whilst you're right there is no magic way to fix a current exploit this does give them a chance to fix the software fault at a ROM level in the factory - hence the disclosure period and time for them to get the fix deployed. It's responsible and commendable in my eyes.

This is why it would be nice if we knew when the disclosure happened, because people buying Switches after the disclosure might have bought a non vulnerable one without knowing.

 

[ScarletDreamz]

I would prefer signature patches, instead of EmuNand to be honest, but again, who wouldn't

 

[ShadowOne333]

I would prefer signature patches, instead of EmuNand to be honest, but again, who wouldn't

Same boat here.

 

[andijames]

This is why it would be nice if we knew when the disclosure happened, because people buying Switches after the disclosure might have bought a non vulnerable one without knowing.

I get your point but that's kind of against a disclosure .That isn't for your benefit or for mine more for the manufacturer. Personally we should just be grateful we have this Trojan horse available that usually isn't. If you want a unit that's exploitable and dig around enough you can make an educated guess on whether you're getting an exploitable unit. Nintendo are never going to disclose that nor the person who is trying to be ethical.

 

[Draxzelex]

There is no patch to fix a hardware exploit magically.
There has to be a hardware revision for all Nvidia Tegra X1 dependant devices, and for that, Kate gave Nvidia the 90 days disclosure dealine so they can take the appropriate countermeasures to said exploit.

ALL currently released and sold devices with the known vulnerability are, and will be, exploitable at the time of release of Fussy Jelly, unless all devices are called back to get a revisioned hardware back or replace the bootrom with the updated one (Mariko most likely)

Uh...thank you...? While I do appreciate the sentiment to try and correct what you believe is someone possessing incorrect information, I already knew it can't be fixed software-wise but with a hardware revision. Also, I believe I know where you obtained that 90 day figure.

Well, in this case the vulnerability's not actually patchable, so I have no idea what kind of window would be reasonable for communication and/or part replacement. If it were theoretically patchable, usually a standard disclosure window would be around 90 days.

As you can see, that number assumes the exploit is patchable, which we both know it is not. So the current disclosure deadline, which involves a non-patchable vulnerability, is not set to 90 days. But if I am wrong, feel free to bring up a quote from outside of gbatemp because as far as I know, she has not stated the length of the deadline.

No, it's certainly correct that I believe that no matter what Kate has said. We'll know for sure if they are released on the same day.

Dude, you're basically saying Kate is lying about when she's gonna release Fusée Gelée.

 

[Eddypikachu]

nvm

 

[subcon959]

Whilst you're right there is no magic way to fix a current exploit this does give them a chance to fix the software fault at a ROM level in the factory - hence the disclosure period and time for them to get the fix deployed. It's responsible and commendable in my eyes.

How does the disclosure period affect the deployment of a fix for future hardware revisions? It's not a time sensitive issue at all. Disclosure windows are only useful for software patches that work on existing hardware. None of the exploitable systems out in the wild get any benefit from the delay. I think your commendation might be misguided in this case.

 

[andijames]

How does the disclosure period affect the deployment of a fix for future hardware revisions? It's not a time sensitive issue at all. Disclosure windows are only useful for software patches that work on existing hardware. None of the exploitable systems out in the wild get any benefit from the delay. I think your commendation might be misguided in this case.

Iirc this exploit can be fixed via software through the ROM (for disclosure Read Only Memory) which can only be flashed at the factory. No matter the hardware exploit at this point if the software is hardened then it wouldn't be an issue. They can reflash a fix at the factory level .They will do. They will probably harden through hardware revisions too. Please tell me where this is misguided?

 

[subcon959]

Iirc this exploit can be fixed via software through the ROM (for disclosure Read Only Memory) which can only be flashed at the factory. No matter the hardware exploit at this point if the software is hardened then it wouldn't be an issue. They can reflash a fix at the factory level .They will do. They will probably harden through hardware revisions too. Please tell me where this is misguided?

Because no one is about to recall every Tegra device out there to do that. Once the disclosure has been made, that's all they need to implement the hardware revision. There's no difference between waiting 3 months or 1 day after that initial disclosure. In fact, by waiting longer you are allowing the existing exploitable base to grow larger, whereas if you threatened a quick release there would be much more pressure to restock shelves with fixed units quickly.

 

[andijames]

Because no one is about to recall every Tegra device out there to do that. Once the disclosure has been made, that's all they need to implement the hardware revision. There's no difference between waiting 3 months or 1 day after that initial disclosure. In fact, by waiting longer you are allowing the existing exploitable base to grow larger, whereas if you threatened a quick release there would be much more pressure to restock shelves with fixed units quickly.

That's not how the world works though. They aren't going to recall devices that is true but they can prevent future devices from being vulnerable. If it's software preventable in FUTURE editions then they will patch it. Given its not a backwards compatible patch (ROM remember) then they're giving a forward lead time not backwards. To prevent FUTURE devices from being compromised. That is responsible disclosure.

 

[TheCyberQuake]

Uh...thank you...? While I do appreciate the sentiment to try and correct what you believe is someone possessing incorrect information, I already knew it can't be fixed software-wise but with a hardware revision. Also, I believe I know where you obtained that 90 day figure.

As you can see, that number assumes the exploit is patchable, which we both know it is not. So the current disclosure deadline, which involves a non-patchable vulnerability, is not set to 90 days. But if I am wrong, feel free to bring up a quote from outside of gbatemp because as far as I know, she has not stated the length of the deadline.

Dude, you're basically saying Kate is lying about when she's gonna release Fusée Gelée.

Actually in a live stream a week or so ago she stated they had less than 90 days.

 

[subcon959]

To prevent FUTURE devices from being compromised. That is responsible disclosure.

Future devices cannot be compromised by knowing the current vulnerability anyway so I'm not following your reasoning.

 

[andijames]

Future devices cannot be compromised by knowing the current vulnerability anyway so I'm not following your reasoning.

Really? They can be if they're not fixed. They won't be fixed unless they know the vulnerability and patch it.. that's the whole circle! The disclosure period says they will RELEASE the vulnerability after a certain time. That's what they call a disclosure period. Once it's out in the wild I'd they were not patched then all current and future devices would be vulnerable.

You're welcome.