Hacking Hardware Picofly - a HWFLY switch modchip

[rulles]

V1 can boot up and act as an SD Card reader with a blank eMMC in place because you can inject a payload. Can’t do this with a Mariko. With Mariko you need a working eMMC so catch-22. This is where the cheap SDCard to eMMC reader comes in.

So, with a blank emmc and a emmc reader, I can clone the emmc and replace emmc in Mariko. Is that right?!

 

[impeeza]

So, with a blank emmc and a emmc reader, I can clone the emmc and replace emmc in Mariko. Is that right?!

that's correct, you first clone the actual MMC then you modify it.

 

[rulles]

that's correct, you first clone the actual MMC then you modify it.

So, if it's possible change the emmc, why anyone think in change the firmware in emmc and that way not necessary a mod chip?!
That is just one thought.

 

[szubiennica]

So, if it's possible change the emmc, why anyone think in change the firmware in emmc and that way not necessary a mod chip?!
That is just one thought.

you will stay offline forever

 

[NoXe]

I'm curious to know, on what firmware did you start reverse engineering. I've seen a lot of random firmware drop in this thread, i'm little bit lost but I wan't to try to reverse engineering to.

 

[szubiennica]

I'm curious to know, on what firmware did you start reverse engineering. I've seen a lot of random firmware drop in this thread, i'm little bit lost but I wan't to try to reverse engineering to.

on page 34 there is decrypted uf2 file, before that there is encrypted uf2 file that is probably working

 

[Piorjade]

Okay, I took a look at @Tafty 's boot0 dump, and obviously the unlocked ubuntu firmware does not use standard HWFLY-NX's BCT and payload, the keys are completely different:

Erista with HWFLY:

@Tafty 's Switch Lite (Mariko) with unlocked fw:

I'll take a look at the payloads..

 

[NoXe]

on page 34 there is decrypted uf2 file, before that there is encrypted uf2 file that is probably working

But this is an ubuntu only version, I've heard about a working version that boot in HOS but restricted to an specific pico id. Is that the one you try to reverse / bypass or whatever ?

 

[rulles]

you will stay offline forever

I understand your point, but I'm not saying replace all ofw, only the essencial to boot something like hetake or others, maybe an emunand.

 

[Raugo]

I understand your point, but I'm not saying replace all ofw, only the essencial to boot something like hetake or others, maybe an emunand.

If you replace something in the boot chain sequence you break the signature and then the console will not work. That is precisely the purpose of the chip.

 

[saladus]

You can dump the boot0 with hekate... I can provide anyone with the boot0 based on the current Linux firmware we have, but I can't post it here obviously, so it makes more sense for anyone that wants it to PM me and I will send it across.

send it my way as well if you don't mind. sorry for the inactivity, I've been kinda busy

 

[NoXe]

Why not understand the boot0 structure for build an other valid for pico ?

 

[Piorjade]

Alright so obviously because @Tafty 's Switch is a Lite/Mariko, the BCTs in there are encrypted at a certain point.

Does anybody know if the BCTs are encrypted with the Mariko KEK or BEK? Or is it the custom key? If it is the custom key, where can I find the private key so that I can decrypt the BCT? AFAIK there's only the public key modulus in the BCT

 

[impeeza]

So, if it's possible change the emmc, why anyone think in change the firmware in emmc and that way not necessary a mod chip?!
That is just one thought.

nop, because the firmware is encrypted using the own console keys, that's why there is a tutorial for recreate a sysnand using a donor one

 

[saladus]

looking through hwfly-nx and switchbrew wiki i can't help but notice that although the bct is supposedly encrypted, the mariko bct that hwfly-nx flashes is static, defined in mariko_bct.h. how would that work? are they all encrypted with the same key or what? i'd expect the encryption to be different from console to console. that's probably the case and i'm not understanding something

 

[Piorjade]

looking through hwfly-nx and switchbrew wiki i can't help but notice that although the bct is supposedly encrypted, the mariko bct that hwfly-nx flashes is static, defined in mariko_bct.h. how would that work? are they all encrypted with the same key or what? i'd expect the encryption to be different from console to console. that's probably the case and i'm not understanding something

I have the leaked BootROM specification PDF for the Mariko, it says that the BCT (can) be encrypted with a BEK (boot encryption key), this key is OEM specific, i.e. Nintendo has their own.

So HWFLY-NX probably has encrypted their BCT with the leaked BEK, however they got it. This, however, means that every Mariko has the same BEK.

 

[saladus]

I have the leaked BootROM specification PDF for the Mariko, it says that the BCT (can) be encrypted with a BEK (boot encryption key), this key is OEM specific, i.e. Nintendo has their own.

So HWFLY-NX probably has encrypted their BCT with the leaked BEK, however they got it. This, however, means that every Mariko has the same BEK.

would you mind totally not sending that pdf my way?

Post automatically merged: Feb 12, 2023

sha256(csecret_26)=cefe01c9e3eeef1a73b8c10d742ae386279b7dff30a2fbc0aabd058c1f135833 OEM key: Nintendo

although, i'm not getting the results i want.. maybe i'm just wack at decrypting or the key is bs . anyone who wants to try, you might get it better than me , aes-256 cbc, iv is all zeroes as per (at least i think that's what it's saying) the pdf

 

[Piorjade]

would you mind totally not sending that pdf my way?

Post automatically merged: Feb 12, 2023

although, i'm not getting the results i want.. maybe i'm just wack at decrypting or the key is bs . anyone who wants to try, you might get it better than me , aes-256 cbc, iv is all zeroes as per (at least i think that's what it's saying) the pdf

What did you use to generate this output?

 

[saladus]

What did you use to generate this output?

the key? i got it from a link someone sent earlier in the thread. https://gist.githubusercontent.com/...b2612ab62998243ce5e7877496466cabb77f/tsec.txt

 

[JackFrostSMT]

I'm amazed Nintendo hasn't busted down GitHub's doors to remove that just like they did with the original patched chip manufacturing