Hacking RELEASE How to build clean BOOT0/1 files

[RealYoti]

What you need:

• Firmware dump in a form of multiple .nca and .cnmt.nca files
• The latest hactool utility: use autobuilds or my fork (bundled)
• Dump prod.keys from the target firmware or newer w/ Lockpick

How to use:

• Unpack firmware files to some dir (I will call it "working dir")
• Put content of the reBoot_20220506 archive to the working dir
• Put the prod.keys file to the working dir
• Run the recreate_boot_by_yoti.bat file

In the end

you will have four new files: BOOT0_ERISTA, BOOT0_MARIKO, BOOT1_ERISTA and BOOT1_MARIKO. Get two of this for your Switch and rename them to BOOT0 and BOOT1. It's illegal to distribute this files here so feel free to make your own!​

Caution:

• DO YOUR OWN BACKUP FIRST AND KEEP THEM IN A SAFE PLACE!!!
• Do not use this script to create boots from firmwares prior to 6.2.0
• This new boots will be with disabled AutoRCM ('cause they are clean)

Some examples:
All good (as of v20210719 and 12.1.0 OFW):

Recreate boot partitions script by Yoti (v20210719)
Wait...
1_66fc6e8b60142f07d33da61ff37cc9d6 [Normal]
2_753020bff878f29b66fcf840b96430b3 [SafeMode]
Done!!!

All good (as of v20210418 and 12.1.0 OFW):

Recreate boot partitions script by Yoti (v20210418)
Wait...
1_66fc6e8b60142f07d33da61ff37cc9d6 [FAT32 Normal]
2_753020bff878f29b66fcf840b96430b3 [FAT32 SafeMode]
3_25bb90ed24664b791d0e2cc1b707ea30 [exFAT Normal]
4_2e386f2d8ab6bbac6d1057d0b52746eb [exFAT SafeMode]
Done!!!

Missing hactool or prod.keys or firmware files:

Recreate boot partitions script by Yoti (v20210418)
Done!!!

Wrong (outdated) prod.keys file:

Recreate boot partitions script by Yoti (v20210418)
Wait...
Error: section 0 is corrupted!
Error: section 0 is corrupted!
Error: section 1 is corrupted!
<...>
Done!!!

Official repository: https://github.com/Yoti/nsw_boot_0_1-files-generator

 

[crazy_p]

Thank's for sharing you're a "Golden Boy"!

 

[yyoossk]

Exception EFOpenError in module injector.exe at 000AD0E3.
Cannot open file "D:\reBoot_20210418\BOOT0_ERISTA"

--------------------- MERGED ---------------------------

Recreate boot partitions script by Yoti (v20210418)
Done!!!


But nothing happens
12.1.0
is this real?
or fake?

--------------------- MERGED ---------------------------

what is keys.prod?
prod.keys?


There are too many unclear points
useless

 

[RealYoti]

But nothing happens

You are doing something wrong.

is this real?

Yes for sure. Look at my screenshot.

what is keys.prod?

Fixed, thanks!

 

[yyoossk]

12.1.0
Exception EFOpenError in module injector.exe at 000AD0E3.
Cannot open file "D:\reBoot_20210418\BOOT0_ERISTA"

 

[RealYoti]

@yyoossk BOOT0_ERISTA is made by copying BOOT file from the script archive. I will try to do it another way. Will provide an update after two or three days.

 

[RealYoti]

@yyoossk try new version (reBoot_20210719).

 

[deejay87]

Hi, i try and got this

 

[hausa51]

thanks, it's working very well (FW 12.1.0, reBoot_20210719) ...

 

[RealYoti]

@deejay87 open Windows command prompt, type "find /?" (without quotes), press Enter and show me result. I think you have some development software (like devkitPro Updater) that breaks Windows command line utilites. You must edit Windows environment variable named "Path" and put "devkitPro/msys2" lower than "C:\Windows" and "C:\Windows\system32".

@hausa51 great! You may also check your files with mine via MD5 hashes:
BOOT0_ERISTA 59dd8129de0c7f9c239d0111ae3ccd99
BOOT0_MARIKO a6b7442c0632d106094295f122252cd1
BOOT1_ERISTA 49c68f846b024a1cc57d916e9cc83dd9
BOOT1_MARIKO 2406cfa3162dad2c6620d93cb57726dc

 

[yyoossk]

@yyoossk try new version (reBoot_20210719).

thx!
success!

 

[hausa51]

@hausa51 great! You may also check your files with mine via MD5 hashes:
BOOT0_ERISTA 59dd8129de0c7f9c239d0111ae3ccd99
BOOT0_MARIKO a6b7442c0632d106094295f122252cd1
BOOT1_ERISTA 49c68f846b024a1cc57d916e9cc83dd9
BOOT1_MARIKO 2406cfa3162dad2c6620d93cb57726dc

All files have identical MD5 hashes...

 

[deejay87]

Exact, thanks now it work

 

[RealYoti]

@hausa51 it's strange 'cause they are made from different files. May be you have incomplete firmware dump? I got mine from Darthsternie.

 

[josete2k]

I only get four 4MB files fullfillled with 00

 

[josete2k]

Solved.

I had to place the prod.keys file in my $HOME/.switch directory and delete the "- k prod.keys" from the bat

 

[RealYoti]

$HOME/.switch

If you are using some Linux based distro, the script was only tested on Windows.

 

[josete2k]

If you are using some Linux based distro, the script was only tested on Windows.

No, no... Windows

 

[RealYoti]

@josete2k there is no $VAR on Windows, only %VAR% ones.

 

[josete2k]

@josete2k there is no $VAR on Windows, only %VAR% ones.

I mean my user directory.

I had to place the prod.keys file in a folder named ".switch" in my user's directory.