Hello guys, this is my first post here! I just got a MIG Switch card out of curiosity and I was tinkering with it. For those who don't know, it's used by placing XCI dumps as well as other game specific bin files in the sd card of the MIG Switch, and are obtained from the original cartridge by using an app like nxdumptool. Two of these bin files are mandatory to get the game to boot: Initial Data.bin and Certificate.bin. They stay the same for every cartridge of a specific game. Now, if you want to use an XCI dump from a shady website it's impossible to get it to work without those files. By using the Certificate.bin from another game it has no problem, but this does not count for the Initial Data.bin. So I looked for a way to obtain this Initial Data from an XCI file and read a bit of the XCI file documentation from switchbrew dot org. Here's what I understood so far: The Switch checks if the cartridge is valid by doing a challenge–response authentication on the Initial Data. The Package ID is contained both on the XCI and the Initial Data, on positions 0x110 and 0x0 respectively. The Initial Data hash is on the XCI at position 0x160. It is calculated by doing a SHA-256 hash on the full Initial Data content. So I was wondering, is there a way to to construct a functional Initial Data file starting from an XCI dump? I also tried a reverse approach by editing the Package ID in the Initial Data from another game, generating the Initial Data hash and putting it in the XCI file but is not enough to get the Switch believe it's a real game. Sorry if this may seem stupid but let me know what you think.

duckstation for Switch

catlover007 · 2024-04-22T04:06:40+00:00

duckstation is an excellent Playstation 1 emulator by Stenzek. It has a very good compabiility and it is quite performant. It also supports all kinds of enhancements such as high resolution rendering and PGXP which can lessen the "wobble" and...

I need help | rebuild my keyblobs for stock fw 4.1.0 | GBAtemp.net

iCRON

Well-Known Member

Newcomer

Level 7

Nov 18, 2022

Hello people, long time ago i was able to use my switch with the atmosphere 'booting without keyblobs on <6.2'-feature and i have created an emummc on 15.0.1 with hekate. Now i want to fix my stock sysmmc on 4.1.0 but i must rebuild my brocken keyblobs 1-5 to make this possible.

I used
https://gbatemp.net/threads/can-someone-with-a-banned-switch-help-me-repair-mine.577354/page-3
https://gbatemp.net/threads/keyblob-0-to-5-corrupted.548659/
and the google search but i have a problem by using linkle https://github.com/MegatonHammer/linkle

Situation: i will recover my sysmmc with the instructions above, dumped my 4.1.0 prod.keys with lockpick_rcm, used linkle with 'linkle keygen -k prod.keys' and i must now get my 'encrypted_keyblob_01-05' to can overwrite these into my boot0. But linkle don't give me the encrypted keyblobs. All other keys are valid in my prod.keys file but here is the problem.

How can i get this step to work? Do i have missed something or are anything wrong with my prod.keys? The dev of linkle seems to be offline for years and don't answer in his issue tracker. Now i hope for help here.

Important: I don't update my sysmmc because the cardridge slot firmware fuses, i have an emummc for sysupdates and for other reasons. Thx anyway for help.

Hacking I need help | rebuild my keyblobs for stock fw 4.1.0

Well-Known Member

Similar threads

Popular threads in this forum