Oh well, being bleeding edge and using the tools that are not updated...
bootloader_key = unhexlify("FB61357AB9DEE1C9D4C49F6488349EF0")
bootloader_ctr = unhexlify("5BCF60493E61BCB930FD44C7FAC0EE09")
bootloader = 'bootloader_88000000.bin'
#bootloader
bootloader_off = 0x5B6DE0
bootloader_size = 0x4A000
bootloader_base = 0x88000000
bootload = open(bootloader.format(bootloader_base), "wb")
bootload.write(aes_ctr_dec(b[bootloader_off:bootloader_off+bootloader_size], bootloader_key, bootloader_ctr))
bootload.close()Open extracted bootloader_88000000.binwith ida64:
Set processor type to: Arm Little Endian
Uncheck - create segments/load as code segment
Next popup box - just press ok
Next popup box - just press yes
Next popup box - just press ok
In ida main menu - Edit/select all
Right click on code window and select - code
Chose Analyze from popup.
Subs will be on left side...
View - open subviews/strings.
Select from strings menu - license.dat - then click on the sub1_1DC8+1A0 address (inspect the sub)
Select from strings menu - Genuine boot - then click on sub_748c+1E8 (inspect the sub)0x19cfe8 Sha256 bootloader
it is in the payload80. but you won't find it. it is encrypted
lockpick misses the package1_key because it's wiped by the tsec firm and/or sept.
Two things to highlight:The hybrid firmware method has been known by many people for ages. That Twitter thread just made it more widely known. Here's me and @ZachyCatGames discussing it in the TX Discord on March 23rd. Like Zachy said though it's not a great idea because if people try it now with 12.0.0 they could brick.
As for SX Save Manager, they use Google Cloud as a backend so if you trust Google with your privacy you can trust SXSM. It's mainly used by people with multiple consoles afaict but I just like having my saves backed up to the cloud incase something happens to my Switch and SD Card. I have lost all of my saves before when my Erista died but SXSM makes it easy to back up every save to the cloud automatically.
Edit: Also people use to bitch about Switch Online not having cloud saves so it's obviously something people want. SXSM works on banned consoles, the saves are easily accessible if you want to modify them, and it's a one time purchase included with SXOS instead of a monthly / annual fee.
Is it safe to install 12.0.0 with this spoof installed?
As I said before, it is not using Xecuter's servers. It's using Google Drive as a backend. Anyone who has used the app knows this. If you can trust Google you can trust SX Save Manger.
If you have the “spoof” installed, then update to 12.0.0, it’ll be fine.
With the Xecuter cloud, I was referring to the cloud they have on Google Drive.
Google Drive is the cloud. Also you don't even need the credentials to upload arbitrary files, you can do that from inside the app.
