Hacking Nintendo Switch bootrom dumped.

[Hanafuda]

A pretty sad step to third party devs..


Sent from my iPhone using Tapatalk

Yeah but there's no putting the paste back in the tube.

I'm just hoping this opens the door for >3.0 action. And it should. (I haven't bought a Switch yet for myself. My daughter has one but I don't mess with my kids' stuff.)

 

[V-Temp]

Yeah but there's no putting the paste back in the tube.

I'm just hoping this opens the door for >3.0 action. And it should. (I haven't bought a Switch yet.)

It doesn't.

 

[proflayton123]

When the times come to end user homebrew access that'll be nice, anything beyond that piracy related should be kept private


Sent from my iPhone using Tapatalk

 

[Hanafuda]

It doesn't.

Cuz need an exploit before you can make use of cutting in on the bootrom, I guess? Yeah, I see that. It'll come though.

 

[Chizko]

yep is for a common tegra t210, but is closer the same mounted on NS so is a start from a deeply research in the secure check.

 

[V-Temp]

Cuz need an exploit before you can make use of cutting in on the bootrom, I guess? Yeah, I see that. It'll come though.

Because we don't have access to the encryptions in TZ, because this is the T210 bootrom, and because the signage changed with 3.0.1+ encryption and the handshake is two ways. You'd need to do a lot, not least of which is find the encryption in other FWs or somehow reverse engineer (likely computationally impossible) the encryption algos.

And because every switch is factory-burned unique, so you'll never get access to the online. Or more accurately be immediately banned.

 

[Hanafuda]

Because we don't have access to the encryptions in TZ, because this is the T210 bootrom, and because the signage changed with 3.0.1+ encryption and the handshake is two ways. You'd need to do a lot, not least of which is find the encryption in other FWs or somehow reverse engineer (likely computationally impossible) the encryption algos.

And because every switch is factory-burned unique, so you'll never get access to the online. Or more accurately be immediately banned.

Damn, that bad huh? Well, it is what it is, but thanks for making my day LOL.

 

[V-Temp]

Damn, that bad huh? Well, it is what it is, but thanks for making my day LOL.

It means things don't come easy.

 

[ehnoah]

Question: Bootrom dump is nice, because they can start find issues in Bootrom, and if we can take-over Bootrom we won? Is it like Al9h or simlar?

 

[V-Temp]

Question: Bootrom dump is nice, because they can start find issues in Bootrom, and if we can take-over Bootrom we won? Is it like Al9h or simlar?

AL9H was an ARM9 loader, there is no ARM9 and we do not have access to TZ (the equivalent of the 3DS ARM9 function but considerably more secure and industry standard). The bootrom will let you get ahead of the Switch's full boot since this is the Tegra 210 bootrom, but its not going to suddenly "win" anything.

There is also no "winning" against physical burns in the hardware.

 

[zZJhoNZz]

So i have a question to devolvers, Aproximadely how much time is needing to create a homebrew and run it in the nintendo switch?

 

[Abu_Senpai]

More progress has been made eh? hehehe

 

[jt_1258]

Reswitched was very clear that they would not use *hax nomenclature because it's lazy. Frankly I agree. Other consoles get cool exploit names and 3ds was all just *hax. Kinda boring and doesn't sound as cool as giving it a clever name. Like pegaswitch playing off the name of the Pegasus exploit.

which following your logic is a lazy name they piggybacked off of themselves, hax and exploit seem similar givin the context we normally use them in

 

[TheCyberQuake]

which following your logic is a lazy name they piggybacked off of themselves, hax and exploit seem similar givin the context we normally use them in

Backing a name off of what it uses is different from using the same naming scheme for almost every exploit. It's lazy to simply take the exploited item and slap *hax on the end. No creativity in most 3ds exploit names.

 

[TheCyberQuake]

AL9H was an ARM9 loader, there is no ARM9 and we do not have access to TZ (the equivalent of the 3DS ARM9 function but considerably more secure and industry standard). The bootrom will let you get ahead of the Switch's full boot since this is the Tegra 210 bootrom, but its not going to suddenly "win" anything.

There is also no "winning" against physical burns in the hardware.

Well if there were some vulnerability early enough in the boot process in theory we could bypass the efuse check if I'm not mistaken. That's IF a vulnerability is there.

 

[Frysenberg]

Backing a name off of what it uses is different from using the same naming scheme for almost every exploit. It's lazy to simply take the exploited item and slap *hax on the end. No creativity in most 3ds exploit names.

That being said, a rose by any other name would smell as sweet.

 

[V-Temp]

Well if there were some vulnerability early enough in the boot process in theory we could bypass the efuse check if I'm not mistaken. That's IF a vulnerability is there.

Need more than just the dumped bootrom for that.

Remember, bootrom for the Tegra is only a piece of the puzzle (hell, I can get that off my Jetson board, its the same thing/chip), most of the steps are root-key locked with the encryption behind the TrustZone. So we need to find a way to make something for the bootrom that the bootrom will accept as a real command to bypass the eFuse check but that means we have to trick its encrypted security checks/handshakes. This would be the equivalent of sighax, you'd need the equivalent of the ARM9 full access. But unlike the 3DS/WiiU, the Switch also has oodles of console unique certifications and their encryptions are also tucked away in TZ, and are burned in at the factory level. So, in effect, we need to completely compromise the bootloader, and you still have a unique Switch so it can still be permanently blacklisted and have no server access.

So... yes? Actually now that I wrote that out it seems you said much the same thing. (Much as I can get the bootrom from a Jetson board, I cannot magically get a Switch running on the Jetson because I don't have any of the unique signage. In a lot of ways this is an educational dump that could inform but its not really guaranteed or maybe even likely to give us anything.)

Also this isn't Nintendo's bootrom, this is nVidia's. Start poking too far and publishing too much and I think you may have a very pissed, very aggressive company on your door. nVidia is more along the lines of Sony's draconian methods than Nintendo's '/shrug' methods.

That said, I am sure a large enough hole will be found. When it will be released is another matter.

 

[aykay55]

So does this potentially give us boot1hax?

 

[osaka35]

Excellent milestone reached far quicker than expected. Well done.

 

[the_randomizer]

Means one step closer to warez.

For those on 3.0.0 and below only

A pretty sad step to third party devs..


Sent from my iPhone using Tapatalk

If only there was empirical and irrefutable evidence that proves on how piracy ends up hurting game or console sales.