Hacking Pin layout of Switch's game card?

[smiba]

Hey everyone,

I'm currently starting a project for fun where I'm going to be reverse engineering the Switch game cards, and most likely develop a re-flashable game card after I've collected enough information about its internal working (and if its even possible).

However, Switch game cards are quite expensive at the moment and I'm honestly quite afraid of breaking my beloved Zelda before I finished it.

Did anyone already made some progress and gathered the pin layout of the game cartridge?

If not, how do I open my game card without breaking the plastic and ruining it?

-Cheers

 

[JackMacWindows]

The point of the card is that it is unopenable. Just finish Zelda, and then break it open

 

[Sonansune]

i thought sky3ds is a re-flashable "genuine" game card

 

[smiba]

The point of the card is that it is unopenable. Just finish Zelda, and then break it open

Ah for real? Too bad, I'll see.

i thought sky3ds is a re-flashable "genuine" game card

Oh oops, I'm too used to writing about 3DS'es haha.

Edited, I meant the Switch of course!

 

[FAST6191]

If a cart is too valuable to sacrifice to the cause can't you figure out the pinouts from the switch whcih is more readily pulled apart? Power, ground and any save lines should be easy enough to figure out.

 

[smiba]

I'd definitely be able to figure out some of the pins by inspecting the switch's cartridge reader itself
The most interesting part are the IO connections though, which are close to impossible to separate from each other even by checking their dataflow with my oscilloscope

I'm most interested in what kind of flash storage is being used and if there are any custom ICs that may make it harder to recreate a custom re-flashable cartridge

Maybe I could setup a small donation pool? 1 2 Switch sounds like the right victim as its probably the cheapest cartridge at the moment (~$40 second hand).
Having a donation pool would really help me deliver information to the community and possibly speed up the creation of flash cards to run homebrew.

Not sure what the rules on this forum are about donations and such, I just joined because I remembered this site being much of use back in my days with the NDS homebrew.

 

[Alkéryn]

I would break it open
option 1 : just buy the cheapest switch game, or take a reselled used one
but you might have some sucess with an hot air gun and a cutter

 

[smiba]

Yeah my current plan would be to buy a second hand copy of 1, 2, Switch! and use my hot air station to soften the plastic and cut it open.

I can provide:

- (Most likely) a pin out for Switch cartridges
- High resolution pictures of both sides of the PCB
- List of chips used and the values of any resistors and capacitors

I may provide:

A PoC for a Switch flash card able to run homebrew and software if the chips are identifiable

But is there an actual want for this information? I don't feel like blowing $40 on a cartridge if its just wasted haha
As a student every penny saved is appreciated

 

[Nezztor]

Yeah my current plan would be to buy a second hand copy of 1, 2, Switch! and use my hot air station to soften the plastic and cut it open.

I can provide:

- (Most likely) a pin out for Switch cartridges
- High resolution pictures of both sides of the PCB
- List of chips used and the values of any resistors and capacitors

I may provide:

A PoC for a Switch flash card able to run homebrew and software if the chips are identifiable

But is there an actual want for this information? I don't feel like blowing $40 on a cartridge if its just wasted haha
As a student every penny saved is appreciated

All contributions are welcome

 

[xile6]

Real hacker gotta get dirty.

Crack open your game and do some leg work.

 

[bennyman123abc]

Yeah my current plan would be to buy a second hand copy of 1, 2, Switch! and use my hot air station to soften the plastic and cut it open.

I can provide:

- (Most likely) a pin out for Switch cartridges
- High resolution pictures of both sides of the PCB
- List of chips used and the values of any resistors and capacitors

I may provide:

A PoC for a Switch flash card able to run homebrew and software if the chips are identifiable

But is there an actual want for this information? I don't feel like blowing $40 on a cartridge if its just wasted haha
As a student every penny saved is appreciated

Whether or not the information is wanted right now does not matter. Someone will want the information in the future (maybe the creator of Sky3DS can step in and make a Switch flashcart with the information provided? )

 

[Issac]

Yeah my current plan would be to buy a second hand copy of 1, 2, Switch! and use my hot air station to soften the plastic and cut it open.

I can provide:

- (Most likely) a pin out for Switch cartridges
- High resolution pictures of both sides of the PCB
- List of chips used and the values of any resistors and capacitors

I may provide:

A PoC for a Switch flash card able to run homebrew and software if the chips are identifiable

But is there an actual want for this information? I don't feel like blowing $40 on a cartridge if its just wasted haha
As a student every penny saved is appreciated

Not to rain on your parade, but even if you were able to make a home made card - you'd still need to be able to run unsigned code (most likely).
If it's worth it though? Well, the information might be useful for someone in the future - and if you don't try you will never learn. So it's either $40 wasted, or $40 invested in your hacking / engineering skills. And possibly $40 invested in the future of hacking the Switch, if someone finds your findings useful.

 

[smiba]

Alright, ordered a copy of 1, 2, Switch.

Will post results in the upcoming days.

Not to rain on your parade, but even if you were able to make a home made card - you'd still need to be able to run unsigned code (most likely).

Yeah, that's why I listed it as a PoC. I assume there is some kind of protection built in, hopefully someone else will make some progress in cracking it or hopefully there will be some more information out there about how it works and functions

 

[rilwal]

Not to rain on your parade, but even if you were able to make a home made card - you'd still need to be able to run unsigned code (most likely).

The whole point of Sky3DS is that it doesn't run any unsigned code, it just emulates what a legit cart would do on an electrical level. This is why Nintendo can't patch it for existing games, and only break it occasionally by physically modifying newer carts. The latest Sky has reprogrammable firmware so even that's only temporary now.

 

[MeAndHax]

Reaaally sketchy

If it would be that easy someone would have already did it... and you seem to have 10 messages?

 

[DarkenedMatter]

Reaaally sketchy

If it would be that easy someone would have already did it... and you seem to have 10 messages?

What's so sketchy about it? He already bought himself 1, 2, Switch and said he will publish his findings?

 

[migles]

But is there an actual want for this information? I don't feel like blowing $40 on a cartridge if its just wasted haha

obligaroty comment:
wasting 40 bucks only to make gateway and skyswitch jobs easier, and basically steal your work to their development

 

[Distrance]

What's so sketchy about it? He already bought himself 1, 2, Switch and said he will publish his findings?

The part where he has 10 messages is sketchy. After all unless you have at least two thousand posts, you clearly cannot know anything about anything, and even less about hacking or the like.. Because everyone who ever fiddles with hacking consoles is obviously a part of GBATemp community and has thousands of posts in it.

-_-

@MeAndHax That's one of the stupidest things I've read in a while.

 

[rilwal]

He's trying to scam us by doing research with his own money and sharing the findings! I fall for this one every time -_-

 

[smileyhead]

The part where he has 10 messages is sketchy. After all unless you have at least two thousand posts, you clearly cannot know anything about anything, and even less about hacking or the like.. Because everyone who ever fiddles with hacking consoles is obviously a part of GBATemp community and has thousands of posts in it.

this would not be the first time someone signed up to publish their findings. they could be a lurker for years.