[RCM Payload] Hekate - CTCaer mod

Discussion in 'Switch - Exploits, Custom Firmwares & Soft Mods' started by CTCaer, May 1, 2018.

  1. CTCaer
    OP

    CTCaer GBAtemp Maniac

    Member
    10
    Mar 22, 2008
    Greece
    Hekate - CTCaer mod v4.9.1

    * Hekate is a Bootloader
    with fw patching, recovery tools and many more features. *

    * hekate or Εκάτη (in Greek) is a goddess in ancient greek religion and mythology. *
    * She was one of the main deities worshiped in Athenian households as a protective goddess and one who bestowed prosperity and daily blessings on the family. *
    * Here, it blesses your Nintendo Switch. *


    * CFW Launching for ALL current updates (1.0.0 - 7.0.1)
    * Supports booting of all current CFWs, Linux chainloading, payload tools
    * Auto boot
    * Modules/Plug-ins support
    * Full Atmosphère support w/Exosphère booting
    * Automatic RAW eMMC partial dumping
    * Restore eMMC

    * Working Sleep Mode on ALL firmware and downgraded ones with higher fuse count.
    * And many more



    [​IMG]



    Before you continue:
    Hekate - ipl, is a custom bootloader with extra features.
    It must not be confused with CFW, hbmenu and anything else that is on the Horizon OS (Switch's OS) side.
    E.g., hekate supports exFAT formatted sd cards, but if you never downloaded the exFAT update, it will not work on horizon os or any homebrew.
    So, please don't report problems that happen after leaving hekate - ipl (hbmenu can't see apps, etc).



    Summary:
    CTCaer mod is based on naehrwert's hekate - ipl. hekate is basically a custom Nintendo Switch bootloader with many advanced features.
    It supports all sd cards (except SDSC) and automatically chooses if it will dump in parts or not, based on your free space and sd card filesystem.
    Supports CFW launching in the following Switch updates (all current):
    • 1.0.0
    • 2.X.X (all)
    • 3.X.X (all)
    • 4.X.X (all)
    • 5.X.X (all)
    • 6.X.X
    • 7.0.X
    Comes with many additional features. For example you can see your SoC's fuses, eMMC info, SD card info, etc.



    Features guide:


    • [​IMG]
      • Launch
        Used to launch CFW and various Payloads.

        The main entries come from hekate_ipl.ini inside the bootloader/ folder.

        Inside you'll always find 2 options:
      • Payloads
        Let's you launch any binary payload inside the bootloader/payloads/ folder. This is useful for chainloading any released open source or closed source CFW bootloader. It can also launch any tool that comes in the form of a fusee payload.

      • More configs
        This combines all .ini found in bootloader/ini/ folder into one list based on the alphabetical order of the inis. Can be used for "drag n drop" releases, or uncluttering the main .ini file.
      [​IMG]
      • Options
        This lets you configure the auto boot options
        • Auto boot
          [​IMG]
          Let's you choose which CFW to autoboot.

        • Boot time delay
          [​IMG]
          Wait time on boot to allow you to enter bootloader menu by pressing VOL- (not volume up. It's volume down).

        • Custom boot logo
          Enable the use of a custom boot logo when auto booting.
          If a log is specified in the selected boot entry, it will be used
          If not or the logo was not found, bootlogo.bmp will be used.
          If nothing is found or custom boot logo is disabled, hekate's built in logo will be used.

        • Backlight
          Choose the preferred backlight value in %.


    • [​IMG]

      Notice
      : All the backup/restore functions support verification.
      That means, that when the bar turns green, hekate checks that the sd card written data and the eMMC data match.


      [​IMG]

      Verification options:

      As described above, this are the options for your backup and restore verification.
      You can disable it here if you want. Default is Full.
      Sparse: Only checks 4 bytes every 128Bytes. This is normally enough for block errors.
      Full: It creates sha256 hashes of your sd backup and eMMC data and compares it byte to byte.


      [​IMG]

      Backup eMMC BOOT0/1 (important!):
      This will backup the physical eMMC partitions BOOT0 and BOOT1. These are needed to complete your eMMC full backup.


      Backup eMMC RAW GPP (important!):
      Let's you backup the whole general purpose partition from your Switch's eMMC. This includes Switch system and user files.
      It's one of the 4 physical partitions that your eMMC has. The other are BOOT0, BOOT1 and RPMB (unused).
      Because the whole GPP is 29.1 GiB (31,268,536,320 B), there several automatic ways to back it up.

      1. Using exFAT formatted sd card which is 32GiB* and up:
      (* Some 32GB cards have less available free space than 29.1 GiB, so they may trigger partial backup)
      This will backup the whole physical partition as one big file.


      Troubleshooting when error occurs:
      There are some cases that your sd card will spit errors, either because of bad sectors, or bad I/O. In these cases from v1.5 and up, it will show a specific error, which you need to right it down to find out why.
      Sometimes though it can't be fixed.
      In these cases you can force partial backup, by creating a new file called partial.idx. You have to open it in a HEX editor and write these exactly hex values: 00 00 00 00 (the red is the LSB, because Little-endianess).
      The next time you'll try to run Backup eMMC RAW GPP, it will backup in parts of 2GB.
      (This specific file is attached here, if you have difficulties with hex editors. Just rename it from .idx.txt to .idx.)


      2. Using a FAT32 or an exFAT with smaller space than 29.1GiB:
      This will trigger the automatic partial backup.
      In this mode it will start backing up in 2GB parts or in 1GB if you have 8GB and smaller card.
      It backups your eMMC, until it fills your card. It also uses a file called partial.idx, so it know which is the next part to backup.
      When this is done you will see a similar message like the following procedure:
      1. After the session is done, press any key and Power off or Reboot rcm (if you want to skip step 3) Switch from the main menu
      2. Move the files from SD card to your PC to free some space
        Don't move the partial.idx file! This file, keeps tabs on which is the next part to backup.
      3. Unplug and re-plug USB while pressing Vol+ (skip if you rebooted into rcm from hekate's main menu)
      4. Run hekate_ctcaer_1.5.1.bin again and press Backup eMMC RAW GPP to continue with the next parts.
      5. Repeat steps 1-4 until you have 15 2GiB or 30 1GB files
      6. Join the files with your favorite cmd/app or use the scripts provided
      For step 6, there are also scripts inside a zip, provided in the download link below. Choose the correct one based on the parts size (15 x 2GB or 30 x 1GB) and based on your OS.
      Notice 1: Users that have a 8GB SD card and less, it will automatically backups with 1GB parts.
      Notice 2: If you have an unfinished partial backup and want to start anew, delete the partial.idx file first.
      Warning: When backing up the eMMC, in parts, you should not power on the switch normally and boot to Switch OS before done. Otherwise your finished backup will probably corrupt, because Switch OS writes on your eMMC even if it seems you done nothing.


      Troubleshooting when error occurs (write it down for better support):
      In this mode, it's easier to skip the problematic area of your sd card.
      1. First try to run Dump RAW eMMC again right away. It will try to continue from the last part it was trying to backup.
      2. If this does not work, move the already backed up files to your PC, without deleting/moving the partial.idx file.
      3. Run Backup eMMC RAW GPP again, and it will start backup.
      You may hit these problematic SD card areas. In this case, rinse and repeat the above steps, with always keeping the partial.idx file as it is.

      Notice on errors: If the errors persist, try to do a low level (full) format or try to run chkdsk /f /r /x Z: (where Z is your drive letter).


      Backup eMMC SYS
      (uneeded if you already backed up the RAW eMMC):
      The General Purpose physical partition, contains several GPT partitions.
      By using this option, you can backup all these partitions, except USER, as separate files.


      Backup eMMC USER (uneeded if you already backed up the RAW eMMC):
      As described above, this will backup the USER partition from your eMMC's General Purpose partition.




      [​IMG]

      Restore eMMC RAW GPP (Dangerous!):
      Do not use that if you don't know what you are doing! No one is responsible for messing with your device.
      You have a 10 second mandatory wait time before letting you start restore by pressing POWER.

      This let's you restore your eMMC general purpose partition. If hekate find the /Backup/<eMMC S/N>/Restore/rawnand.bin it will restore it and verify it.
      If it does not find it, it does nothing and shows Error (4).
      Partial restoring is now supported.


      Restore eMMC BOOT0/1 (Dangerous!):
      Do not use that if you don't know what you are doing! No one is responsible for messing with your device.
      You have a 10 second mandatory wait time before letting you start restore by pressing POWER.

      This let's you restore your eMMC BOOT0 and BOOT1 partitions.
      It will only restore the files at /Backup/<eMMC S/N>/Restore/BOOT0 and /Backup/<eMMC S/N>/Restore/BOOT1.
      If a file does not exists, it will be skipped and shows Error (4).


      Restore eMMC GPP partitions (Dangerous!):
      Do not use that if you don't know what you are doing! No one is responsible for messing with your device.
      You have a 10 second mandatory wait time before letting you start restore by pressing POWER.

      This let's you restore your eMMC GPP partitions.
      It restores only the files found in /Backup/<eMMC S/N>/Restore/Partitions/*
      Any file that is not found, it is skipped and shows Error (4).
      The USER partition requires exFAT.


      -------------------------------------


      Dump package1/2:
      This will dump and decrypt package1 and package2 from BOOT0 and BCPKG2-1-Normal-Main. It will also extract from it the secure monitor, warmboot, INI1 and kernel binaries.
      The above feature is intended for developer use.


      Fix SD files archive bit attribute:
      This was redesigned to fix the following:
      • All folders/files in SD card except Nintendo folder
      • Nintendo folder only
      The proposed usage is to run the first option and then the 2nd one. The 2nd one is especially needed if you restored Nintendo folder because you upgraded your SD card or you had corruption problems and needed to restore.


      Fix battery de-sync:
      This fixes the low battery monitor missconfiguration at PMIC max77160, produces by linux builds.
      The fix is instant and you can just boot into Horizon OS after that.


      AutoRCM:
      The AutoRCM, also known as briccmii, it is based on @Reisyukaku AutoRCM v2 and it smartly corrupts the boot configuration in BOOT0 partition.
      This allows the user to always boot/reboot into RCM, without the need of a jig.
      Because it writes to the eMMC, it must be used with caution and only if needed.
      Notice: Hekate is able to remove all variations of AutoRCM.




    • [​IMG]

      Ipatches & bootrom info:
      This will print your ipatches.
      It also includes an option to dump them and the unpatched/patched bootrom to the sd card, so you can examine them easier.


      Print fuse info:
      This will print your Tegra X1's fuses on your screen (plus your burnt fuses).
      It also includes an option to dump them to the sd card, so you can examine them easier.


      Print kfuse info:
      This will print your Tegra X1's kfuses on your screen.
      It also includes an option to dump them tothe sd card, so you can examine them easier.


      Print TSEC keys:
      This will print your Tegra X1's security co-processor's keys on your screen.


      Print eMMC info:
      This will print your eMMC info.
      You can see many things, like maximum speed allowed, manufacturer and model, all the physical partitions,all the GPT partitions, etc.


      Print SD Card info:
      This will print your current SD Card info.
      You can see many things, like maximum speed classes and speed grades allowed, manufacturer and model, total user space, free space, cluster size, etc.


      Print battery info:
      Lot's of info about your Battery Charger IC and Fuel Gauge IC.



      • Reboot (normal)
        Reboot normally, without any mods and CFW
      • Reboot (rcm)
        Reboot into Recovery mode again. Useful if you want to run another payload or you want to remove your sd card.
      • Power off
        Powers off the console.
      • About
        Displays info about this payload.


    Warning:
    Don't forget your console into RCM. This will drain your battery without a cable. And because, it does not have a battery cuttoff, it will completely drain it.
    If this happens, you should power off (if it didn't all ready) your console, and let it charge into normal mode (red battery icon top-left) for 20-30 minutes, to open. Better remove the sd card, if it has payloads/homebrew/eMMC files, because it will boot into Horizon OS.



    Changelog:
    v4.9.1

    • Cleaner Stock option via stock=1
      Check the hekate_ipl template for more on how to use it.
    • Important bugfixes on eMMC tools
      Fixed a 32bit vs 64bit bug where it was making verification fail. And also a text print misalignment.

    v4.9:

    Warning: Because of the new versioning changes, please delete sept/payload.bin.

    • Support for parsing Atmosphere's Fusée Secondary Storage (FFS0)
      Using "fss0={sd path}" allows you to parse kips, exosphere and warmboot from a fusee secondary binary.
      Exosphere and warmboot are overridable if these entries are defined after that.
      Additionally any extra kip can be loaded as before via kip1={sd path}/* for many, or kip1={sd path} for a sigle one
      Warning: Don't double load core kips like loader, pm, sm and ams_mitm. The result will be a hang.
    • Support for partial restore. Thanks to @emvym3two
      You can now restore using parts or FAT32. The only condition it that all parts must be in the sd card.
      It protects from fake sd cards, bad sectors and frequent I/O corruption. Aka, ~100% of cases.
    • Performance changes for Backup/Restore/Verification
      Aligned buffers will now up the speeds by a lot.
      Verfication is now set to Sparse mode by default.
      It protects from fake sd cards, bad sectors and frequent I/O corruption. Aka, ~100% of cases.
    • Change order of invoking sept.
      This is important, otherwise it can break tools like memloader.
      Until a semi-usb init solution is found, hekate will show bootlogo and allow you to go to menu.
      If >= 7.0.0 after that, it will run sept and then show logo again without a wait. For as long as rebuilding the boot process takes.
    • Smarter versioning for update.bin and sept payloads
      Now it supports hotfix versions and it's still compatible with old hekate versions.
      Sept is now updated via hekate's copy in IRAM. This negates the mandatory usage of update.bin and it copies always the most updated version.
      Additionally if sept/payload.bin is found that it's foreign, it is renamed and hekate takes its place for running sept. After that it renames the original payload back and continues with booting.
    • debugmode is now obsolete for atmosphere. It's enabled by default.
    • Some nasty stack corruption bugs were fixed
    v4.8:

    • Full 7.0.0/7.0.1 support.
      • The keys are generated via Atmosphère's sept.
      • Additionally the sept/payload.bin, if found that it is hekate, it gets updated via update.bin.
    • Reboot to a selected boot entry via HOS hb
      • You can now force a boot configuration on hekate by setting the boot storage in the hekate binary.
      • This can be done via a homebrew, which sets the ini entry that is desired to boot.
      • Additionally force boot to menu can also be achieved. Please check readme.md for more
    • Auto NoGC
      • It checks fuses and applies the patch automatically if higher firmware.
      • It is now a global config and set on auto by default. (0: Disabled, 1: Auto)
    • Fixed a bug with ini list, where it would hang when using wildcard * with kip1=.
    • Quality of life fixes under the hood, that ease user's life.
    • As always many bug fixes and some refactoring.
    Backlog from v4.6svc beta:
    • svcControlCodeMemory patches that helps dynarec on emulators.
    • Fixed sleep mode with debug mode when official 6.X.X secmon is used
    • Added RTC driver which now also disables wake up alarm when Auto HOS Power Off is used
      • Helps when users that use AutoRCM inject and power off pretty fast.
    • Fixed GPU on Linux when booting from warmboot
    • Added missing fallback auto calibration of sd cards and plus some small fixes.
    NOTE: You will need sept and a custom warmboot binary to boot 7.X.X.



    v4.6:

    • Fixed sleep for downgraded units with efuses count more than required.
    • Fixed update.bin chainloading and also forced hw init on update, in case it changes again in the future.
      This is a breaking fix and requires to have v4.6 to your modchip/dongle.
    • New archive bit fix
      It can now also fix the Nintendo folder. No more "corrupted" sd when upgrading sd card or restoring Nintendo folder.
    • Fixed UART debug printing. Thanks @hyln9
    • Auto HOS power is now disabled by default. Probably, most people learned what it does and can enable it from the Options menu.
    • Some small SMMU emulation for TSEC fixes for the unluckiest out there. Max wait time remains small.
    • Many many many fixes and also added some error msgs for restore and boot options.


    v4.5:

    • Full 6.2.0 support. Many thanks to @nwert and @balika011 for their help!
      -Supports Ninty's Secure Monitor and new Exosphere
      -Supports booting 6.2.0 with less than 8 fuses and custom pkg2
      -It has 100% success ratio
      -Added support to "Print TSEC keys" and "Dump pkg1/2" tools
    • Fixed YouTube HDCP issue. Thanks @hexkyz for taking the time to investigate.
    • Every file lister is now ignoring hidden files and .dot files. Thanks @StevenMattera
    • The Minerva Training Cell library for hekate was updated to latest version (v1.1)
    • Added "silent option to Auto HOS power off option. You can now choose if you want the logo to be shown. Thanks @Huntereb
    • Refactored the monolithic main.c to simpler grouped sections. Additionally hos.c took some love.
    • Many many bugfixes

    v4.2:

    • Support "*" folder wildcard in kip1 key
      Using <folder>/* can now parse and load all kip and kip1 files inside that folder.
    • Add option to enable/disable Auto HOS power off
      If you don't use a modchip/dongle you may find this feature annoying. Options->Auto HOS power off to disable.
    • Allow canceling of the verification process
      Now you can cancel backup and verification process. If backup phase is done, canceling in verification, will keep your files.
    • Some small bugfixes and support certain cfw on its stock version

    v4.1:

    • Full 6.0.0 support
      Secmon/ kernel patches, FS patches, sleep mode, hw config, etc.
    • Improved .ini/payload handling
      hekate_ipl.ini is no longer required and hekate does not hang on empty folders.
    • PWM backlight
      You can now change the backlight brightness.
    • Auto full power off when the device woke up from HOS' power off
      Usefull with modchips/dongles when using AutoRCM. (You can see it as a breathing backlight with hekate's logo).
    • Backup can be now cancelled when in the writing process (white bar), by pressing VOL UP + DOWN.
    • Self update chainloading properly checks for version number now to avoid uneeded loads.
    • Support payloads with broken/bad hw init...
    • Added ipatches info and dumping of patched/unpatched bootrom and ipatches
    • Corrected some hw config changes found in 5.x-6.0.0
    • More boot reasons and bootrom registers restores to normal
    • It now properly restores BCT on dev units from where it's supposed to.
    • Added warning message when the bootloader library for sleep mode is missing.
    • And many many bugfixes

    v4.0:
    • Added Payload launching. Supports: All current CFW bootloaders, Linux chainloading and payload tools.
      Use the new entry in Launch, Payloads. Autoboot is supported via inis to all payloads.
    • Added Ianos, our module support loading and launching. First module is LP0 (sleep mode).
    • Added support for split ini
      They should be located to bootloader/ini. All cfw bootloaders, payloads and linux payloads are supported, along with Horizon files.
      Autoboot support. Use the More configs menu in autoboot configuration.
    • Auto launch update for modchips. For users that do not like to always update their eeprom.
    • Add KIP1 patching support
    • Backup speed is now faster, by having bigger write speeds.
    • Backup folder now uses eMMC serial number.
    • AutoRCM now shows status and can unbrick all AutoRCM versions and types.
    • If sd card is missing asks to continue. No more accidental stock HOS launching.
    • Allow dumping of TSEC keys to sd card
    • Fixed display sanitization for all firmwares. No more white flash or black screen.
    • Fix critical bug to FatFs
    • Countless fixes and bugfixes
    • And many more..

    Everything hekate related, moved to bootloader folder.
    Check readme.md for more.


    Old Changelog:
    Warning: Spoilers inside!



    Download v4.9.1



    In windows, you can then use rajkosto's biskeydump and HacDiskMount to manipulate your raw eMMC dump.

    Thanks:
    naehrwert for the original code: https://github.com/nwert/hekate
    @rajkosto for his hekate - ipl commits and tools: https://github.com/rajkosto/
    And all other contributors in hekate repo.
     

    Attached Files:

    Last edited by CTCaer, Mar 9, 2019
    zxr750j, ELY_M, DaFixer and 119 others like this.
  2. Taffy

    Taffy If specified, this will replace the title that...

    Member
    6
    Mar 3, 2017
    United States
    Student
    Ah....this is clever! But how do you consolidate/re-join the parts afterwards?
     
    linuxaresisagaysob likes this.
  3. DSpider

    DSpider GBAtemp Advanced Fan

    Member
    5
    Mar 14, 2015
    Romania
    A better question would be is there a way to restore it?
     
    nyaina and linuxaresisagaysob like this.
  4. CTCaer
    OP

    CTCaer GBAtemp Maniac

    Member
    10
    Mar 22, 2008
    Greece
    Check OP, I've added a simple solution.
    You can still use whatever filer joiner exists though.
     
    nyaina and Taffy like this.
  5. Taffy

    Taffy If specified, this will replace the title that...

    Member
    6
    Mar 3, 2017
    United States
    Student
    iirc we only are able to dump things at this point.

    And if you're concerned about restoring things then you probably shouldn't be screwing with the console in the first place.

    edit: ninja'd

    I like it! Saves me a little money so I don't need to buy a bigger card!

    still will probably get one though
     
    Last edited by Taffy, May 1, 2018
  6. TheZander

    TheZander King of the Level 7's

    Member
    9
    Feb 1, 2008
    United States
    Level 7
    What's the firmware patching functionality of this?
     
  7. CTCaer
    OP

    CTCaer GBAtemp Maniac

    Member
    10
    Mar 22, 2008
    Greece
    You can replace various firmwares and functions with your own.
     
  8. rajkosto

    rajkosto GBAtemp Advanced Fan

    Member
    11
    Apr 6, 2017
    if you have enough space on your microSD for all of USER you should probably use mine, this one seems a LOT hackier.
     
    CymraegAce and CTCaer like this.
  9. sweetlilmre

    sweetlilmre Member

    Newcomer
    4
    Aug 15, 2010
    The instructions state "Warning: When dumping the USER partition, you should not power on the switch normally before done. Otherwise the USER contents will change."

    Why would reading the contents change the partition?

    -(e)
     
  10. aut0mat3d

    aut0mat3d GBAtemp Regular

    Member
    3
    Mar 15, 2017
    Australia
    If only one bit is written to the Filesystem which you are currently dumping xou have good chances to have it corrupted.
    And you are reading it in parts...
     
    CTCaer likes this.
  11. tecfreak

    tecfreak GBAtemp Regular

    Member
    3
    Apr 24, 2018
    Germany
    Berlin
    How do you know that it only reads from this partition?
     
  12. sweetlilmre

    sweetlilmre Member

    Newcomer
    4
    Aug 15, 2010
    If the warning means the dump would be corrupted then that makes sense. The wording was ambiguous.

    -(e)
     
  13. sweetlilmre

    sweetlilmre Member

    Newcomer
    4
    Aug 15, 2010
    Because I looked at the code and writing to the partition when dumping would be insane?

    -(e)
     
  14. aut0mat3d

    aut0mat3d GBAtemp Regular

    Member
    3
    Mar 15, 2017
    Australia
    That is the key, yes.
    I see no reason why the dumper should write to emmc. This would be verry dangerous and there is no reason to do so
     
  15. tecfreak

    tecfreak GBAtemp Regular

    Member
    3
    Apr 24, 2018
    Germany
    Berlin
    ^^
    The warning says that you shouldn't boot into the OFW while you are dumping your user partition in the case when you need to restart the system because you have not enough space on your sd card for a complete dump.

    Got it now?
     
    CTCaer likes this.
  16. CTCaer
    OP

    CTCaer GBAtemp Maniac

    Member
    10
    Mar 22, 2008
    Greece
    Because booting to Switch OS writes to the user partition.
    And that may render your unfinished backup corrupted, because one part of it changed.

    This tool does not write to your emmc by any means.

    EDIT:
    Fixed the ambiguous description in github
     
    Last edited by CTCaer, May 1, 2018
  17. sweetlilmre

    sweetlilmre Member

    Newcomer
    4
    Aug 15, 2010
    Thanks, makes sense :)
     
  18. TheZander

    TheZander King of the Level 7's

    Member
    9
    Feb 1, 2008
    United States
    Level 7
    Is this how they messed with the FW version field in the screenshots from months ago? What other system firmware changes are possible threw this?
     
  19. Ghost92

    Ghost92 GBAtemp Fan

    Member
    4
    Jun 29, 2017
    Colombia
    Do you think there is a possibility to dump the data directly to the PC ?. Like adding a driver to the useful load that allows to explore the data or transfer it to the connected PC after loading the Payload
     
  20. Carlos Escobar

    Carlos Escobar Member

    Newcomer
    2
    Jan 19, 2016
    Spain
    I have dumped the nand several times but part 6 is always skipped... I use a 32 gb sd and I dump all parts until part 6 hat I have to copy all contents of the sd to my pc and then boot again hetake to finish part 6 and 7 but 6 is always skipped. Anyone knows the reason?

    Regards,
     
    Last edited by Carlos Escobar, May 1, 2018
    dark8924 and Oriordan like this.
Loading...