Hacking PSA: Reports of Fusee gelee patched units in the wild

[c80]

That's why i said you need to press combination of buttons just like when you want to boot to bootloader in Android device, so maybe there is a way to use that.

This is how RCM works. The jig/wire/foil/whatever is used to 'press a button' to enter RCM. This has nothing to do with the exploit to execute the payload.

 

[aos10]

Nintendo launches their own "payload" by signing it. They don't need an exploit to force the system to run their software using a buffer overflow.

Gesendet von meinem Mi A1 mit Tapatalk

So, RCM is not an exploit?

 

[c80]

So, RCM is not an exploit?

Of course not

 

[Localhorst86]

This is how RCM works. The jig/wire/foil/whatever is used to 'press a button' to enter RCM. This has nothing to do with the exploit to execute the payload.

I guess that's where his confusion comes in. By shorting pin 10 we are basically pushing the physically non-existing home button.

Gesendet von meinem Mi A1 mit Tapatalk

 

[Localhorst86]

So, RCM is not an exploit?

No. RCM stands for ReCovery Mode

Gesendet von meinem Mi A1 mit Tapatalk

 

[aos10]

No. RCM stands for ReCovery Mode

Gesendet von meinem Mi A1 mit Tapatalk

I know, i meant the way to use jig to enter it, Nintendo may press several buttons to enable RCM, then they use their own payload which is signed on by them, so unless we don't have that payload we won't be able to do anything.
So our only hope is software hack.

 

[jimmyj]

I know, i meant the way to use jig to enter it, Nintendo may press several buttons to enable RCM, then they use their own payload which is signed on by them, so unless we don't have that payload we won't be able to do anything.
So our only hope is software hack.

never lose hope.

 

[linuxares]

I know, i meant the way to use jig to enter it, Nintendo may press several buttons to enable RCM, then they use their own payload which is signed on by them, so unless we don't have that payload we won't be able to do anything.
So our only hope is software hack.

They probably just have a machine of sort that hooks it all up. Probably they use somekind of sameway to enter RCM but the payloads themselves are accepted by the Nvidia bootloader.

 

[Localhorst86]

So our only hope is software hack.

Either a vulnerability in the software or another one in the hardware, yes. The current vulnerability has been removed for new models.



Gesendet von meinem Mi A1 mit Tapatalk

 

[c80]

So our only hope is software hack.

Of course a software hack like Fusée Gelée would be nice, or a browser based software hack would be nice too, but it's not our only hope. Maybe they find a possibility to crack the switch by a hardmod.

 

[Kaizer47]

managed to inject payload to my switch and boot hekate.
model: 2018 HAC-S-JXE-C3
Serial number:XAJ700361XXXXX
purchase it in march 2018

 

[Draxzelex]

One question, Can the fusee gelee patch be aplied to any switch updating a new firmware or something like that? Or is it just for the newest consoles?

Thank you!!!

Fusee Gelee is an exploit of the Nintendo Switch bootrom. The Nintendo Switch is bootrom read-only. Read-only means neither we nor Nintendo can edit it once it leaves the factory. You can fill in the rest

 

[V-Temp]

If RCM mode still works, then maybe we can find other ways to inject the payload, maybe by certain hardware, or press combination of button to activate inject payload, because even Nintendo when they need to fix bricked switchs they need to inject thief own payload.

Or maybe by solder something in the board.

RCM isn't an exploit though, so it "still working" isn't a metric. RCM has to work, its how they will do repairs or even make the system in the first place.

--------------------- MERGED ---------------------------

Fusee Gelee is an exploit of the Nintendo Switch bootrom. The Nintendo Switch is bootrom read-only. Read-only means neither we nor Nintendo can edit it once it leaves the factory. You can fill in the rest

Technically repairs will/can probably get you back a patched units too.

 

[SuppaMario]

I’m late to this party and bought a Switch on 3 days ago from Target/google express. I’m in the US. Will be delivered today. Hopefully it’s not patched...

Also if anyone post their serial number and whether or not it gets patched , could you indicate where your location is? I’ve read through this and so far only asia units get patched?


Sent from my iPhone using Tapatalk

 

[Ian095]

Well if what I heard is true in the long term these new consoles are still going to be exploitable with a known method being kept private at this time. I'm guessing if you bought it and updated it you'd be going further and further away from that opportunity.

 

[V-Temp]

Well if what I heard is true in the long term these new consoles are still going to be exploitable with a known method being kept private at this time. I'm guessing if you bought it and updated it you'd be going further and further away from that opportunity.

Only if they are on 4.1, and not upgraded past it.

 

[RHOPKINS13]

I'm not terribly worried. Devs haven't been scrambling to find new software exploits, because there's largely been no need to.

There are many hackable Switches out in the wild now, and I'm sure that Devs will be able to use those to find new software exploits that will work both on this new revision and the eventual Mariko units.

Unless Nintendo releases Mariko with a completely new revision of Horizon, that patches Deja Vu and changes a shit ton of memory locations (perhaps even a full re-write of Horizon), and ONLY releases those updates to new units, I doubt there will ever be a truly un-hackable Switch.

It will just be a matter of waiting until devs release their exploits, as always.

 

[charlieb]

The Vita did not have a microSD but a proprietary, expensive storage device. I agree, though, that having a standard, user expandable storage device is not a weak point.

Whoops you're right, i forgot i was using a SD adaptor. Still electrically the same (logic too as the adaptors are simply wires)

 

[Brottor]

Fusee Gelee is an exploit of the Nintendo Switch bootrom. The Nintendo Switch is bootrom read-only. Read-only means neither we nor Nintendo can edit it once it leaves the factory. You can fill in the rest

Thank you so much!!

 

[Erol]

what exactly does "out in the wild" mean? Where is the wild? So far only someone in ASIA had one, right? Is there anyone, who had this issue with a switch bought in Europe or Americas?