Tutorial How to skip the "Connect Joycons" system init screen

shchmue

Developer
OP
Developer
Joined
Dec 23, 2013
Messages
785
Trophies
0
XP
2,211
Country
United States
I've seen this asked a lot over the years and since someone asked it today and I recently mapped out all the Settings saves, I decided to test my theory that the answer was there. It was.

Use case: You are stuck at the system initialize screen with the 'connect joycons' animation but you don't have joycons or one or both rails is broken.

TL;DR for those who already know how to edit system saves: Dump the SystemSettings save 8000000000000050, change the byte at offset 0x29484 from 0 to 1, repack, sign and replace the save.

Tools required:
  • hactoolnet (fire up your command line skills)
  • Lockpick_RCM (if you have an existing dump from this console a fresh dump is not required)
  • TegraExplorer (if you're familiar with HacDiskMount you can use that instead)
  • HxD (or hex editor of choice, this one is just free, lightweight, capable, and ad-free)
Steps:
  1. Use Hekate/Nyx and make a full Raw EMMC backup if you never have! This is the first rule of any hacking endeavor.
  2. If you don't have a key file, use Lockpick_RCM to dump keys from either sysnand or emunand, it doesn't matter which for this purpose. This will dump the key file to SD in /switch/prod.keys.
  3. Reboot to RCM if needed and push the TegraExplorer payload.
  4. Use the Volume keys to navigate to and select either [SYSTEM:/] EMMC (for sysnand) or [SYSTEM:/] EMUMMC (for emunand).
  5. Acknowledge the warning regarding modifying your system NAND and breathe easy since you made a backup, right? RIGHT? Please go back and do that if you haven't. Press Power to continue.
  6. Select save (this might take a minute to load if using file-based emunand).
  7. Select 8000000000000050, then select Copy to clipboard.
  8. Navigate back to the main menu by selecting Folder -> previous folder twice.
  9. Select [SD:/] SD CARD.
  10. Select Clipboard -> Current folder and wait for the copy to complete.
  11. Navigate back to the main menu by selecting Folder -> previous folder.
  12. Select Exit then either reboot to RCM or power off.
  13. Mount the SD card on your computer either using a card reader or by pushing the Memloader payload (this is always recommended to reduce stress on the SD reader connector component).
  14. Open a command prompt (eg. press Win+R and type cmd then press Return).
  15. Navigate to where you unzipped hactoolnet or drag the executable onto the command prompt window (this is a handy trick that makes the next few steps easier; Windows automatically enters the whole path to whatever you drop on it).
  16. I don't know what drive letter you mounted your SD as, but you do! So I'm going to pretend it's Z: but if it's something else, use that instead.
  17. If you dragged hactoolnet into the window, you'll have c:\whatever\hactoolnet.exe already populated, so after that, type a space then -t save -k z:\switch\prod.keys z:\8000000000000050 --outdir z:\syssave so your whole command should look like:
    Code:
    c:\whatever\hactoolnet.exe -t save -k z:\switch\prod.keys z:\8000000000000050 --outdir z:\syssave
    Again, please edit this so it matches your own path to hactoolnet and SD mount point.
  18. Open z:\syssave\file in HxD.
  19. Press Ctrl+G to open the Go to Offset dialogue, and type in the number 29484 then select OK. The cursor should be hovering over a byte that reads 00.
  20. Type 01 then press Ctrl+S to Save.
  21. Go back to your command prompt and similarly enter c:\whatever\hactoolnet.exe -t save -k z:\switch\prod.keys z:\8000000000000050 --replacefile file z:\syssave\file. Verify that hactoolnet prints:
    Code:
    Replaced file /file
    Successfully signed save file with key <key>
  22. Eject the SD from the computer, reinsert into console, however you did it, get back to RCM with the SD inserted and inject TegraExplorer.
  23. Select [SD:/] SD CARD.
  24. Select 8000000000000050, then select Copy to clipboard.
  25. Navigate back to the main menu by selecting Folder -> previous folder.
  26. Use the Volume keys to navigate to and select either [SYSTEM:/] EMMC (for sysnand) or [SYSTEM:/] EMUMMC (for emunand), making the same choice as in Step 4.
  27. Acknowledge the warning, press Power to continue.
  28. Select save (as before, this might take a minute to load if using file-based emunand).
  29. Select 8000000000000050, then select Delete file.
  30. Acknowledge the warning, press Power to delete, wait for completion.
  31. Select Clipboard -> Current folder and wait for the copy to complete.
  32. Navigate back to the main menu by selecting Folder -> previous folder twice.
  33. Select Exit then do whatever you need to do to reboot, with or without CFW.
  34. You're done! Instead of the joycon connect animation you should get a screen asking you to accept the Eula then reboot, after which you should be in the OS!
 
Last edited by shchmue, , Reason: clarify step 4 & 26

Campbell915

New Member
Newbie
Joined
Mar 15, 2020
Messages
1
Trophies
0
Age
18
XP
14
Country
United States
Hey I am a total noob at this whole switch hacking stuff and found this post to be the only one on the internet that would solve my problem. The connector for one of my rails broke and I got used to it. For some reason I factory reset my switch and forgot about the broken connector, causing me to be stuck at the connecting screen. Is their anything you can do to help me understand the instructions more clearly because as of now I dont even know how to do any of the steps.

Thanks
 

GinGear

New Member
Newbie
Joined
Jun 24, 2018
Messages
4
Trophies
0
Age
23
XP
258
Country
United States
Would it be a good idea to try loading the edited file via layeredfs to see if you patched it correctly? Before making the change more permanent
 

shchmue

Developer
OP
Developer
Joined
Dec 23, 2013
Messages
785
Trophies
0
XP
2,211
Country
United States
Would it be a good idea to try loading the edited file via layeredfs to see if you patched it correctly? Before making the change more permanent
LayeredFS is for assets not saves. please do keep an unmodified save if you want, but that’s covered by the Nand backup I advised
 

Dathuss

Well-Known Member
Newcomer
Joined
Mar 29, 2018
Messages
49
Trophies
0
XP
271
Country
France
Hello, I have a problem with your tutorial, the switch just won't boot up after launch. Is this tutorial working in 9.2.0 ? Is it really the byte 29484 ? Also, hactoolnet says everytime "Failed to match key device_key_4x, rsa_oaep_kek_generation_source, and rsa_private_kek_generation_source" but still correctly encrypts/decrypts the save. Is this a known bug ?
 

shchmue

Developer
OP
Developer
Joined
Dec 23, 2013
Messages
785
Trophies
0
XP
2,211
Country
United States
Hello, I have a problem with your tutorial, the switch just won't boot up after launch. Is this tutorial working in 9.2.0 ? Is it really the byte 29484 ? Also, hactoolnet says everytime "Failed to match key device_key_4x, rsa_oaep_kek_generation_source, and rsa_private_kek_generation_source" but still correctly encrypts/decrypts the save. Is this a known bug ?
i don’t think anything changed in any of the modules i reversed to work this out between 9 and 9.2.0. failed key match warnings are fine. the console was booting and stuck on the connect joycon screen before you did the guide?
 

Dathuss

Well-Known Member
Newcomer
Joined
Mar 29, 2018
Messages
49
Trophies
0
XP
271
Country
France
i don’t think anything changed in any of the modules i reversed to work this out between 9 and 9.2.0. failed key match warnings are fine. the console was booting and stuck on the connect joycon screen before you did the guide?
Well I resolved the problem just now, and it wasn't your tutorial's fault, the biskeys I dumped were just corrupted, and now I could skip the screen. Thank you very much for your tutorial, the switch I bought had a broken connector for the right joycon, and without you, it would have been softbricked. Just a question, how did you find this trick ?
 

shchmue

Developer
OP
Developer
Joined
Dec 23, 2013
Messages
785
Trophies
0
XP
2,211
Country
United States
I reverse engineered settings services then a bit of ... I can’t remember which. I think it was in qlaunch. But whatever accesses the InitialLaunchSettings flag field and worked out what was checked there in order to skip the JoyCon connect screen. Glad you got it working!
 

MCRUBY

New Member
Newbie
Joined
Apr 29, 2020
Messages
2
Trophies
0
Age
32
XP
71
Country
United States
It gets stuck at a black screen after the nintendo logo


Replaced file /file
Unable to sign save file. Do you have all the required keys?
EDIT: I did not have the sept folder
 
Last edited by MCRUBY,

MaterTip

Member
Newcomer
Joined
Apr 27, 2020
Messages
11
Trophies
0
Age
29
XP
42
Country
United States
Can this be done without rcm mode i got nand backup and prod keys already. how are you getting in rcm if right side is broken?
 

mattlport

New Member
Newbie
Joined
Nov 28, 2010
Messages
1
Trophies
0
XP
4
Country
United States
thank you much sir,, worked on my EMMC first try, but then when i tried to boot into Atmosphere, I got the joy con initialize screen,, sooo im assuming i need to do the same thing to my EMUMMC... thank you again
 
D

Deleted User

Guest
Hello, I have a problem with your tutorial, the switch just won't boot up after launch. Is this tutorial working in 9.2.0 ? Is it really the byte 29484 ? Also, hactoolnet says everytime "Failed to match key device_key_4x, rsa_oaep_kek_generation_source, and rsa_private_kek_generation_source" but still correctly encrypts/decrypts the save. Is this a known bug ?
Hey, how do you fix it? I get the same error and I cant find how to fix it
 

Kmcomofo

New Member
Newbie
Joined
Jul 11, 2020
Messages
4
Trophies
0
Age
24
XP
41
Country
France
Hey, how do you fix it? I get the same error and I cant find how to fix it
Hey! I had the same exact problem! I fixed it importing the Sept folder from atmosphere before extracting the keys with lockpick! Then the guide works just fine. Just put the Sept folder in the root of your SD card!
 
General chit-chat
Help Users
    AncientBoi @ AncientBoi: [grabs my official Star Trek Disruptor] come in