Toggle sidebar

Front-page Hacking RELEASE  Updated

Lockpick_RCM payload - Official Thread


Description
Lockpick_RCM is a bare metal Nintendo Switch payload that derives encryption keys for use in Switch file handling software like hactool, hactoolnet/LibHac, ChoiDujour, etc. without booting Horizon OS.

Source: https://github.com/shchmue/Lockpick_RCM
Payload: https://github.com/shchmue/Lockpick_RCM/releases

Due to changes imposed by firmware 7.0.0, Lockpick homebrew can no longer derive the latest keys. In the boot-time environment however, there are fewer limitations. That means the new keys are finally easy to dump!

Usage
  • Launch Lockpick_RCM.bin using your favorite payload injector or chainload from Hekate by placing it in /bootloader/payloads
  • Upon completion, keys will be saved to /switch/prod.keys on SD
  • If the console has Firmware 7.x, the /sept/ folder from Atmosphère or Kosmos release zip containing both sept-primary.bin and sept-secondary.enc must be present on SD or else only keyblob master key derivation is possible (ie. up to master_key_05 only)
Big thanks to CTCaer
For Hekate and all the advice while developing this!

Known Issues
  • Chainloading from SX will hang immediately due to quirks in their hwinit code, please launch payload directly
 

Attachments

  • AB1248EA-8BB9-448B-83F5-FF68C2579FB1.jpeg
    AB1248EA-8BB9-448B-83F5-FF68C2579FB1.jpeg
    11.2 KB · Views: 0
Last edited by shchmue,
  • Like
Reactions: FanNintendo, Deleted member 753700, DefenderOfHyrule and 77 others
Click to expand...
rave420 said:
Hey, thanks for the fast reply. Is there any practical purpose for Picklock_RCM_unc.bin? Could I chainload such an uncompressed payload from, say, hekate's payload launch menu? I was vaguely aware that there is a size limit for payloads injected via the RCM exploit, but I don't know if that applies to all payloads loaded through other means as well.

Though, I am not sure why I would want to do such a thing. Is the uncompressed payload simply a build artifact, or is it there for another reason?
Click to expand...
Nop, is just a step on the build of the payload, if the final payload is to big. Then is compared with the unc one, in some rare cases the unc version ciuld be smaller than the compressed one
 
It tell you right here what the unc is for

Code: 
all: $(OUTPUTDIR)/$(TARGET).bin $(LDRDIR)
    @echo "--------------------------------------"
    @echo -n "Uncompr size: "
    $(eval BIN_SIZE = $(shell wc -c < $(OUTPUTDIR)/$(TARGET)_unc.bin))
    @echo $(BIN_SIZE)" Bytes"
    @echo "Uncompr Max:  140288 Bytes + 3 KiB BSS"
    @if [ ${BIN_SIZE} -gt 140288 ]; then echo "\e[1;33mUncompr size exceeds limit!\e[0m"; fi
    @echo -n "Payload size: "
    $(eval BIN_SIZE = $(shell wc -c < $(OUTPUTDIR)/$(TARGET).bin))
    @echo $(BIN_SIZE)" Bytes"
    @echo "Payload Max:  126296 Bytes"
    @if [ ${BIN_SIZE} -gt 126296 ]; then echo "\e[1;33mPayload size exceeds limit!\e[0m"; fi
    @echo "--------------------------------------"

To clarify, read from there and down and you will see what it does
 
  • Love
Reactions: rave420 and impeeza
linuxares said:
It tell you right here what the unc is for

Code: 
all: $(OUTPUTDIR)/$(TARGET).bin $(LDRDIR)
    @echo "--------------------------------------"
    @echo -n "Uncompr size: "
    $(eval BIN_SIZE = $(shell wc -c < $(OUTPUTDIR)/$(TARGET)_unc.bin))
    @echo $(BIN_SIZE)" Bytes"
    @echo "Uncompr Max:  140288 Bytes + 3 KiB BSS"
    @if [ ${BIN_SIZE} -gt 140288 ]; then echo "\e[1;33mUncompr size exceeds limit!\e[0m"; fi
    @echo -n "Payload size: "
    $(eval BIN_SIZE = $(shell wc -c < $(OUTPUTDIR)/$(TARGET).bin))
    @echo $(BIN_SIZE)" Bytes"
    @echo "Payload Max:  126296 Bytes"
    @if [ ${BIN_SIZE} -gt 126296 ]; then echo "\e[1;33mPayload size exceeds limit!\e[0m"; fi
    @echo "--------------------------------------"

To clarify, read from there and down and you will see what it does
Click to expand...

What are you suggesting, that I read the contents of the makefile, like I am some sort of programmer? Surely you must be jesting!

In all seriousness, thanks for pointing me in that direction, it is all much clearer now ♥.
 
  • Love
Reactions: impeeza
  • Like
Reactions: Tyvar1, Blauhasenpopo, BigOnYa and 1 other person
Picklock is the same as Lockpick, just renamed.

It will work on 17.0.1 since no new keys updated from 17.0.0
 
  • Like
Reactions: impeeza
  • Love
  • Like
Reactions: mspy and impeeza
How should I go about using Lockpick on a chipped Switch? It boots right to Hekate so I assume I cannot send a payload the way I was accustomed to (using NS-USB Loader).

Edit: I think I figured it out, there is an option to dump from sysnand or emunand, does it matter?
 
Gorkensnorkel said:
How should I go about using Lockpick on a chipped Switch? It boots right to Hekate so I assume I cannot send a payload the way I was accustomed to (using NS-USB Loader).

Edit: I think I figured it out, there is an option to dump from sysnand or emunand, does it matter?
Click to expand...
You use the Lockpick.bin as a payload thru Hekate. Dump sysnand.
 
  • Like
Reactions: Tyvar1, Gorkensnorkel, impeeza and 1 other person
Just informing your guys that i will be stepping down and out of the switch scene. I had to sell my switch and thus i am unable to continue homebrewing and what not. The Lockpick by Mudkip is exactly the same i had so there is no reason not to switch over to that one. I will take my Git instance down and reuse my pi for other projects, so the source will be gone too (But again, mudkips is the same source)
 
  • Sad
  • Like
  • Wow
Reactions: morarin, SkullHex2, E1ite007 and 12 others
Slluxx said:
Just informing your guys that i will be stepping down and out of the switch scene. I had to sell my switch and thus i am unable to continue homebrewing and what not. The Lockpick by Mudkip is exactly the same i had so there is no reason not to switch over to that one. I will take my Git instance down and reuse my pi for other projects, so the source will be gone too (But again, mudkips is the same source)
Click to expand...
Sorry to hear that but We have to thank you so much for all your work, effort and gifts you have give us for so long time.

Regards from Colombia.
 
  • Like
Reactions: Blythe93, Tyvar1, peteruk and 2 others
Slluxx said:
Just informing your guys that i will be stepping down and out of the switch scene. I had to sell my switch and thus i am unable to continue homebrewing and what not. The Lockpick by Mudkip is exactly the same i had so there is no reason not to switch over to that one. I will take my Git instance down and reuse my pi for other projects, so the source will be gone too (But again, mudkips is the same source)
Click to expand...
Yes sorry to hear. Thanks for all your hard work and dedication. Hope your next step is awesome!
 
  • Like
Reactions: Blythe93, Tyvar1, impeeza and 1 other person

Site & Scene News

Go to forum More news

Popular threads in this forum

Dusk for switch (TLoZ Twilight Princess port)

Homebrew  New Homebrew "Foil Server"?

Homebrew  Full List of N64 Recompilation Switch ports

Hacking  WiFi chip failing and can't boot. is it possible to enable Airplane Mode by editing system save files directly?

Homebrew Tutorial Translation Project  CS2SX — Write Nintendo Switch Homebrew in C#

Is it fixable

Homebrew  Sonic Unleashed Recompiled (Homebrew Port)

Hacking Emulation  Switch Prod Keys downloading from sites okay?