Misc Just a theory about Switch hacking.

[GreenDuck65777]

Is it possible to use the official method for transferring photos/videos to load a corrupted picture (or video), which will overflow the console buffer and transfer it to some kind of “safe mode”. Most likely, for the console to recognize this photo/video, you need to take them in the format of the Nintendo Switch itself (such as 1280x720 and the desired aspect ratio, or the name of this picture/video must match a similar screenshot/video that you plan to use, and so on...). Is this even possible? Or does the Nintendo Switch have some kind of write protection?

P.S.
I wrote this through a translator, so please forgive me my grammar. Remember it's just a theory and no need for insulting me. Thanks for understanding

 

[masagrator]

Is it possible to use the official method for transferring photos/videos to load a corrupted picture (or video),

No. There are multiple factors preventing that, but first and foremost: Pictures and videos are digitally signed with your console key. Trying to upload file without correct digital sign will result in Album refusing to read it.

 

[viper3344]

No

 

[GreenDuck65777]

No. There are multiple factors preventing that, but first and foremost: Pictures and videos are digitally signed with your console key. Trying to upload file without correct digital sign will result in Album refusing to read it.

So you can only make Switch => PC, but not PC => Switch. I get it. It was interesting topic to think about (for me). Thanks for the answer

 

[impeeza]

Is it possible to use the official method for transferring photos/videos to load a corrupted picture (or video), which will overflow the console buffer and transfer it to some kind of “safe mode”. Most likely, for the console to recognize this photo/video, you need to take them in the format of the Nintendo Switch itself (such as 1280x720 and the desired aspect ratio, or the name of this picture/video must match a similar screenshot/video that you plan to use, and so on...). Is this even possible? Or does the Nintendo Switch have some kind of write protection?

P.S.
I wrote this through a translator, so please forgive me my grammar. Remember it's just a theory and no need for insulting me. Thanks for understanding

It's almost impossible, because this time Big N learned from their errors, the Userland is so isolated from SYSland which no calls from one can be done to upper level, even if you compromise Userland, there is no way to get low level access so no real usable exploit will be possible.

 

[masagrator]

So you can only make Switch => PC, but not PC => Switch. I get it. It was interesting topic to think about (for me). Thanks for the answer

It can be done, but you need to sign image/video. We have tools for that. But we cannot retrieve console key without hacking it first, so whole journey is pointless.

And after hacking unit you can disable digital sign check with system_settings.ini

 

[pinbi7]

Psp used a simmilar method back in the days using a corrupted png to get a buffer over flow

 

[M7L7NK7]

Psp used a simmilar method back in the days using a corrupted png to get a buffer over flow

Exactly, back in the day.. it'll never happen again

 

[masagrator]

Psp used a simmilar method back in the days using a corrupted png to get a buffer over flow

Actually it was TIFF, not png. It's named ChickHEN. I was using it to hack my first PSP.

Switch album supports only jpg images and mp4 x264 videos.

 

[GreenDuck65777]

Actually it was TIFF, not png. It's named ChickHEN. I was using it to hack my first PSP.

Switch album supports only jpg images and mp4 x264 videos.

So Switch's album (and the whole OS) almost invincible to users hands?

 

[impeeza]

So Switch's album (and the whole OS) almost invincible to users hands?

Nop, only completely isolated and virtualized to the kernel and low level functions

 

[Ondrashek06]

I mean... if it was THAT easy to install homebrew to a Switch, we wouldn't still be here 7 years later, opening our Switch units and risking irreversible damage to install modchips either for unpatched coldboot or for any homebrew on patched.

 

[GreenDuck65777]

I mean... if it was THAT easy to install homebrew to a Switch, we wouldn't still be here 7 years later, opening our Switch units and risking irreversible damage to install modchips either for unpatched coldboot or for any homebrew on patched.

Yeah I know, but it was interesting topic to think about.

 

[linuxares]

Wasn't bannerbomb a buffer overflow thanks to a oversized image?

Isn't images and videos on the Switch also in a sandbox?

 

[SylverReZ]

Wasn't bannerbomb a buffer overflow thanks to a oversized image?

You mean a malformed banner (banner.bnr)?

 

[masagrator]

Isn't images and videos on the Switch also in a sandbox?

They are not, but because of privileges system mumbo jumbo it's not possible to overwrite executable code, execute code outside of R-X mapping or buffer overflow to another process without whole system refusing to do that and just forcing system to crash.

 

[linuxares]

You mean a malformed banner (banner.bnr)?

Aye that one

They are not, but because of privileges system mumbo jumbo it's not possible to overwrite executable code, execute code outside of R-X mapping or buffer overflow to another process without whole system refusing to do that and just forcing system to crash.

Ah, well its much more secure than the wii atleast

 

[ack]

lol, this is cute. firstly, the switch is using industry standard techniques and the industry wisened up to this malformed image kind of technique a while ago. (except maybe SVGs?) Secondly, the switch has ASLR, which means that the place of everything in RAM is randomized. So even if the programmer who wrote the album was an absolute idiot and didn't put in checks, you would just be overwriting some random part of memory. Not very useful, unless you're willing to load the image, crash, reboot, repeat, until the aslr is juuust right and your exploit works. Which would take longer than you would live. Even if that was defeated, there are measures beyond those two.