Toggle sidebar

Front-page Hacking RELEASE  Updated

Lockpick_RCM payload - Official Thread


Description
Lockpick_RCM is a bare metal Nintendo Switch payload that derives encryption keys for use in Switch file handling software like hactool, hactoolnet/LibHac, ChoiDujour, etc. without booting Horizon OS.

Source: https://github.com/shchmue/Lockpick_RCM
Payload: https://github.com/shchmue/Lockpick_RCM/releases

Due to changes imposed by firmware 7.0.0, Lockpick homebrew can no longer derive the latest keys. In the boot-time environment however, there are fewer limitations. That means the new keys are finally easy to dump!

Usage
  • Launch Lockpick_RCM.bin using your favorite payload injector or chainload from Hekate by placing it in /bootloader/payloads
  • Upon completion, keys will be saved to /switch/prod.keys on SD
  • If the console has Firmware 7.x, the /sept/ folder from Atmosphère or Kosmos release zip containing both sept-primary.bin and sept-secondary.enc must be present on SD or else only keyblob master key derivation is possible (ie. up to master_key_05 only)
Big thanks to CTCaer
For Hekate and all the advice while developing this!

Known Issues
  • Chainloading from SX will hang immediately due to quirks in their hwinit code, please launch payload directly
 

Attachments

  • AB1248EA-8BB9-448B-83F5-FF68C2579FB1.jpeg
    AB1248EA-8BB9-448B-83F5-FF68C2579FB1.jpeg
    11.2 KB · Views: 0
Last edited by shchmue,
  • Like
Reactions: FanNintendo, Deleted member 753700, DefenderOfHyrule and 77 others
Click to expand...
impeeza said:
Guys with the help of @Zoria here are a summary of the steps normally used to upgrade the code of LockPick when a new firmware is released.


Lockpick code is heavy based on Hekate, when a new Firmware is released some files must be changed to upgrade values for the new firmware, those values are taken by Hekate and LockPick from the most recent commit of Atmosphère supporting the new firmware. The values used by Atmosphère are found using a script created by SciresM as he shown on the stream about upgrading Atmosphère to FW 20.

So for upgrade LockPic you need to change some files, as far I know:

  • /source/keys/crypto.h, for this file you need to upgrade three sections, the values can be extracted from exosphere/program/source/boot/secmon_boot_key_data.s or fusee/program/source/fusee_key_derivation.cpp from Atmosphère repo, the next table summarize the sections where you can get them.
[TABLE=full]
[TR]
[TH]Name on file CRYPTO.H[/TH]
[TH]Section Name on secmon_boot_key_data.s[/TH]
[TH]Function Name on fusee_key_derivation.cpp[/TH]
[/TR]
[TR]
[TD]device_master_kek_sources[/TD]
[TD]Production Device Master Kek Sources.[/TD]
[TD]DeviceMasterKekSources[/TD]
[/TR]
[TR]
[TD]device_master_kek_sources_dev[/TD]
[TD]Development Device Master Kek Sources.[/TD]
[TD]DeviceMasterKekSourcesDev[/TD]
[/TR]
[TR]
[TD]device_master_key_source_sources[/TD]
[TD]Device Master Key Source Sources.[/TD]
[TD]DeviceMasterKeySourceSources[/TD]
[/TR]
[/TABLE]

  • source/keys/key_sources.inl, for this file you need to upgrade five sections, the values can be extracted from exosphere/program/source/boot/secmon_boot_key_data.s or fusee/program/source/fusee_key_derivation.cpp from Atmosphère repo, the next table summarize the sections where you can get them.
[TABLE=full]
[TR]
[TH]Name on file KEY_SOURCES.INL[/TH]
[TH]Section Name on secmon_boot_key_data.s[/TH]
[TH]Function Name on fusee_key_derivation.cpp[/TH]
[/TR]
[TR]
[TD]master_kek_sources[/TD]
[TD]*not in secmon_boot_key_data*[/TD]
[TD]EristaMasterKekSource[/TD]
[/TR]
[TR]
[TD]master_key_vectors [/TD]
[TD]Production Master Key Vectors.[/TD]
[TD]MasterKeySources[/TD]
[/TR]
[TR]
[TD]master_key_vectors_dev [/TD]
[TD]Development Master Key Vectors.[/TD]
[TD]MasterKeySourcesDev[/TD]
[/TR]
[TR]
[TD]mariko_master_kek_sources [/TD]
[TD]Mariko Production Master Kek Source.[/TD]
[TD]MarikoMasterKekSource[/TD]
[/TR]
[TR]
[TD]mariko_master_kek_sources_dev[/TD]
[TD]Mariko Development Master Kek Source.[/TD]
[TD]MarikoMasterKekSourceDev[/TD]
[/TR]
[/TABLE]

  • /source/hos/hos.h for this file you need to add new KB_FIRMWARE_VERSION_xxxx and update KB_FIRMWARE_VERSION_MAX

  • /Versions.inc, modify the version number.
Click to expand...

I've been looking at this and checking the updated files.

Everything seems the same for 20.1.0 and Lockpick doesn't need to be updated right?.
 
  • Like
Reactions: Blythe93
impeeza said:
Keys have nothing to do with fuses, and the console have lots of unused fuses which therorically allow 100 firmware.
Click to expand...
Perhaps I'm messing terms in my head, but I was pretty sure this was the last possible new master key.

Edit: my bad about the fuses. Yes, there could even be thousands of them. I think I was thinking keyblobs. But I also though I remember reading from farn.....bth that this was the last master key. I just don't remember why.
 
Last edited by OrGoN3,
  • Love
Reactions: impeeza
OrGoN3 said:
Perhaps I'm messing terms in my head, but I was pretty sure this was the last possible new master key.
Click to expand...
if worth something:

fuses are small fuses INSIDE the tegra chip, they can be burn at will by software, the HOS at startup check the number of burnt fuses and the ones correspondant to actual firmware version. if the burnt fuses are less, the HOS burnt the number of needed fuses to match both numbers. if they are the same continue the loading, but if the number of burnt fuses are greater than the number of current firmware a panic is call and system will Halt, because a downgrade is detected.

Atmosphère put a virtual layer on the reading of the burnt fuses and always report the correct number of fuses matching to current firmware.


Keys are a set of numbers used to encrypt the firmware files on the NAND. the keys are generated on each firmware version with a new generation of keys, i really do not know the very process but the bootloader knows the numbers of the current firmware and send that numbers (keys) to the Secure CPU and that CPU read and decrypt the firmware from NAND if you don't provide the correct set of numbers the console will not boot because CPU can not decrypt the files on NAND.

Not all firmware have a new generation of keys, as far I know has been 85 firmware versions and revisions and only 20 key generations ( 0x00 to 0x13)
 
  • Like
Reactions: Tyvar1, Muxi, grimson and 2 others
impeeza said:
if worth something:

fuses are small fuses INSIDE the tegra chip, they can be burn at will by software, the HOS at startup check the number of burnt fuses and the ones correspondant to actual firmware version. if the burnt fuses are less, the HOS burnt the number of needed fuses to match both numbers. if they are the same continue the loading, but if the number of burnt fuses are greater than the number of current firmware a panic is call and system will Halt, because a downgrade is detected.

Atmosphère put a virtual layer on the reading of the burnt fuses and always report the correct number of fuses matching to current firmware.


Keys are a set of numbers used to encrypt the firmware files on the NAND. the keys are generated on each firmware version with a new generation of keys, i really do not know the very process but the bootloader knows the numbers of the current firmware and send that numbers (keys) to the Secure CPU and that CPU read and decrypt the firmware from NAND if you don't provide the correct set of numbers the console will not boot because CPU can not decrypt the files on NAND.

Not all firmware have a new generation of keys, as far I know has been 85 firmware versions and revisions and only 20 key generations ( 0x00 to 0x13)
Click to expand...
And if you check switchbrew you can see that some fuses held pubic and private keys.... Nevertheless, I clarified my previous post.
 
Hello, is LockpickRCM [v1.9.15].bin the latest version compatible with the latest firmware ?
 
yankii said:
I'm curious, is there homebrew to burn fuses for... fun?
Click to expand...
Afaik no. Updating the firmware without using a custom bootloader will burn your fuses.

EDIT: Even if a homebrew like this would exist, don't forget that you can't "unburn" the fuses. Once burnt=no way back.
 
  • Like
Reactions: Blythe93 and impeeza
BaamAlex said:
Afaik no. Updating the firmware without using a custom bootloader will burn your fuses.

EDIT: Even if a homebrew like this would exist, don't forget that you can't "unburn" the fuses. Once burnt=no way back.
Click to expand...
Correction: simply booting OFW with a higher version than your number of burnt fuses indicates, will burn them. It’s not part of the installation process, as far as I know.
 
  • Love
Reactions: impeeza
urherenow said:
Correction: simply booting OFW with a higher version than your number of burnt fuses indicates, will burn them. It’s not part of the installation process, as far as I know.
Click to expand...
I dunno how that works exactly. What i know is, when you update the console normally without a custom bootloader, your fuses are burnt. But not after every firmware update. There are firmware versions which didn't burn your fuses (silent updates or however it is called in english). And you're right, if your ofw expects a higher number of fuses, it will burn all the fuses required for the firmware. Hopefully, I've described that correctly.
 
urherenow said:
Correction: simply booting OFW with a higher version than your number of burnt fuses indicates, will burn them. It’s not part of the installation process, as far as I know.
Click to expand...
You are completely right.

As far I read on Atmosphère documentation, the process of check fuses is on HOS at startup:

When HOS is starting the fuses are compared:
  • If the console have the same number of burnt fuses than current HOS setting, nothing happens.
  • If the number of burnt fuses on the console are high than current HOS setting A KERNEL PANIC IS ISSUED and everything stops.
  • If the number of burnt fuses on the console are low than current HOS setting, the fuses are burnt to match.
The fuses are burnt ONLY after a full HOS loading, because if you are updating the HOS version and that fails you should be able to return to previous version by going on Safe Start.
 
  • Like
Reactions: Blythe93
I'm having issues, how to fix those errors? Why can't it derive master keys? I'd love to get title keys too.
Post automatically merged:

Rauamaak said:
I'm having issues, how to fix those errors? Why can't it derive master keys? I'd love to get title keys too.
Click to expand...
 

Attachments

  • lockpick_rcm.jpg
    lockpick_rcm.jpg
    64 KB · Views: 47
Now I got 212 keys for SysNAND and 213 keys for emuNAND. However, I get error during Titlekeys: "Save header is invalid" two times and "Failed to process es save" once. Unfortunately I don't get titlekeys
 

Site & Scene News

Go to forum More news

Popular threads in this forum

Dusk for switch (TLoZ Twilight Princess port)

Homebrew  New Homebrew "Foil Server"?

Homebrew  Full List of N64 Recompilation Switch ports

Hacking  WiFi chip failing and can't boot. is it possible to enable Airplane Mode by editing system save files directly?

Homebrew Tutorial Translation Project  CS2SX — Write Nintendo Switch Homebrew in C#

Homebrew  Sonic Unleashed Recompiled (Homebrew Port)

Is it fixable

Hacking Emulation  Switch Prod Keys downloading from sites okay?