Hacking Discussion RCM by removing eMMC

[SanderJ]

My friend and I were able to discover that we can get into RCM and get it detected by Tegra by removing the eMMC, holding Vol+ and injecting a Payload and it works, with no JIG or Auto RCM too. He has just tried it on an XAJ40062 and it detects on Tegra, Payloads appear to go through but nothing appears on the screen but, RCM is detected. Something good or not relevant?

 

[linuxares]

It's known. RCM is the standard procediur if something fails with the Switch. RCM = ReCovery Mode

 

[SanderJ]

It's known. RCM is the standard procediur if something fails with the Switch. RCM = ReCovery Mode

Any good news for the newer units XAJ40062, because it's detected by this method. But not by the traditional jig method method

 

[linuxares]

If it's patched and firmware is updated, nope! Else any other method to enter RCM and push a payload should work.

 

[masterzero]

the problem is not entering rcm , but injecting the payload. On patched units you can access rcm but the vulnerability wont be there so patch injection wont work.