Hacking Hack SXOS

[tivu100]

Worth updating to the hacked license?

 

[silien3]

I want a hack for sx supporting the latest firmware not this eternal debate on sx and atmo annoying

 

[CompSciOrBust]

I want a hack for sx supporting the latest firmware not this eternal debate on sx and atmo annoying

Not going to happen unless the source code leaks or TX releases an official update.

 

[angrynewraze]

I also want a hack for sx to supporting latest firmware update.

 

[sys64738]

Anybody can write a step-to-step guide, with download links and latest files for noobs like me, how to hack SXOS ?
It's too many entrys to read back and I don't know which page's guide is the latest...
Thanks.

 

[XD2020]

Thanks to @Reacher17

Here's the guide with the graphics and new hacks, with this everything will work the same as on original sxos 3.10
======================================================================================

**SXOS currently only supports Switch firmware up to 11.0.0** - any newer firmware will fail, you can downgrade using AtmosphereNX and then create an emunand running 11.0.0 firmware for use with SXOS.

1: Copy an untouched clean SXOS 3.10 boot.dat to your sd card root directory and Use SXOS payload to launch it.
2: Launch SXOS - and if you don't have license-request.dat - this will be created on the root of your micro sd card.
3: Copy license-request.dat from your switch to the extracted folder you download from this post.
4: Copy a clean SXOS 3.10 boot.dat to the folder and rename it to boot.dat.orig (this will keep it from being modified).
5: Click SXOS-GFX.exe - this will create a new folder called out that will contain some bin files which a created from the themes folder (you can remove this be clicking on SXOS-GFX.exe again)
6: If you have python 3.9 installed - run SX_License_Hack.py and boot.dat and license.dat should be created.
7: Copy the newly created boot.dat and license.dat to the root of your micro sd card.
8: Use SXOS payload to launch.

**note - SXOS extra hekate icon can be modded at line 310 (BL.write(b'argon/payloads/hekate.bin') to launch any payload you want, just change the path to the payload you with to launch, line 314 contains the name for that icon - once again change this to what you want.**

Also autoboot code was commented out - you can re-enable this again in the script if you want to show the SXOS options during boot - or just press the volume + button to bring up the options menu.

I get Zpevdo.B detected when trying to download this.

 

[winchen]

I copy 3.1.0 boot.dat then rename to boot_ori.dat in the folder of script.
SX_License_Hack_Spoof.py would generate boot.dat and license.dat
I copy boot.dat and license.dat into my SD card.
But Switch always shows boot.dat error.

I think this sxos hack is for erista, not for hard modding mariko.

 

[winchen]

I copy 3.1.0 boot.dat then rename to boot_ori.dat in the folder of script.
SX_License_Hack_Spoof.py would generate boot.dat and license.dat
I copy boot.dat and license.dat into my SD card.
But Switch always shows boot.dat error.

I think hack sxos is for erista(RCM) but not for mariko(hard modding sx core)

 

[vlvt]

hopefully we will get something for the latest firmware update too. Fingers crossed.

 

[angrynewraze]

hopefully we will get something for the latest firmware update too. Fingers crossed.

no point if the games that are coming out will be also patched for 11.0 fw.

 

[angrynewraze]

after running this script my sxos keeps rebooting to payload whenever I try to reboot my switch from the sxos cfw how do I stop that from happening and make it so the switch reboots naturally back to to the emunand sxos cfw?

 

[Beast101]

Followed all the steps and am able to boot into cfw on sysnand but when I load cfw emunand it just goes to ofw. Also any xci I try go to game but just stays on the games loading screen the whole time tried super Mario party munches odyssey and yoshi crafted world all stay on loading screens

 

[MMS4MSU]

I would appreciate any help getting this running. I have tried every hack file in this thread and the chronoss09 GitHub but cannot boot to the sx os cfw-it only goes to a blue screen. It will not boot using the python script with the lic-request nor boot.dat alone. I can install a hidden emunand without any invalid license error and tried a couple of versions of python.

 

[AndryJKT]

Hi, i have managed to boot the latest sxos and update ofw to 11.0 via offline with no issue. But i face two problems here :
- some XCI crash during play but if i installed them, they run smoothly
- some XCI keep on asking for software update with no option to continue without update. Try to update the xci with nscbuilder and install the xci, still facing same warning.
Really appreciate your though on this. Thanks.

 

[spotanjo3]

I used atmosphere and tin woo to installed XCI files.

Now, I want to try this one and it works for me. I have a question. How do I edit License status: Free License to something else?

And everyone tried it will have the same Console fingerprint numbers/alphabetics ? Or we will each have a different Console fingerprint numbers/alphabetics ?

And you have to install XCI files using SD Card for SXOS to installing it, correct ? Sorry about few questions.

 

[whitezombie]

I used atmosphere and tin woo to installed XCI files.

Now, I want to try this one and it works for me. I have a question. How do I edit License status: Free License to something else

I have not tired it but I assume it's this line in the script.

#ROMMENU.bin
rom_in = open(rommenu, "wb")
rom_in.write(aes_ctr_dec(bootin[0x11EBA40:0x15c8080], fw_key, fw_ctr))

rom_in.seek(0x126d4+0x610)
rom_in.write(unhexlify("C3FFFF17"))
rom_in.seek(0x124FC+0x610)
rom_in.write(unhexlify("01248052"))
rom_in.seek(0x125e0+0x610)
rom_in.write(unhexlify("A30C00F00600805263C00B91"))

rom_in.seek(0x13AAD0)
rom_in.write(b'License Free By'+END)
rom_in.seek(0x1A92F0+0x610)
rom_in.write(b'Reacher17'+END)

 

[silien3]

https://gist.github.com/hexkyz
with all this the dev should one day be able to find a way to update sxos no for me everything is gibberish

i hope someone can figure out how to update and distribute the method for other dev and that updates will come out

 

[BaamAlex]

i hope someone can figure out how to update and distribute the method for other dev and that updates will come out

The people could update it. But because it is closed source, we can't.

 

[spotanjo3]

I have not tired it but I assume it's this line in the script.

#ROMMENU.bin
rom_in = open(rommenu, "wb")
rom_in.write(aes_ctr_dec(bootin[0x11EBA40:0x15c8080], fw_key, fw_ctr))

rom_in.seek(0x126d4+0x610)
rom_in.write(unhexlify("C3FFFF17"))
rom_in.seek(0x124FC+0x610)
rom_in.write(unhexlify("01248052"))
rom_in.seek(0x125e0+0x610)
rom_in.write(unhexlify("A30C00F00600805263C00B91"))

rom_in.seek(0x13AAD0)
rom_in.write(b'License Free By'+END)
rom_in.seek(0x1A92F0+0x610)
rom_in.write(b'Reacher17'+END)

What tool and is it in boot.dat or in license.dat ?

 

[whitezombie]

That's in the python script, the .py file. You can edit it with any text editor.