Hacking [RCM Payload] Hekate - CTCaer mod

  • Thread starter CTCaer
  • Start date
  • Views 1,073,017
  • Replies 3,243
  • Likes 128

MrGizMo

Well-Known Member
Member
Joined
Jul 3, 2006
Messages
352
Trophies
0
Website
Visit site
XP
537
Country
Netherlands
Backing up your eMMC (nand) is fairly easy:
  1. Inject latest hekate
  2. Go to Tools -> Backup
  3. Run Backup eMMC BOOT0/1 (boot partitions)
  4. Run Backup eMMC RAW GPP (generic rawnand.bin partition. This will take a lot of time, because it is also verifying it)
  5. Done
Then you can find the 3 files in /backup/<your eMMC S/N>/. These are named BOOT0, BOOT1 and rawnand.bin
Together all 3, are your full backup.


So when you want to restore, you need that same folder structure?
 

bylaws

Well-Known Member
Member
Joined
Dec 11, 2018
Messages
129
Trophies
0
XP
1,655
Country
United Kingdom
@CTCaer does the device/hardware/nvidia/platform/t210/abca project on nv-tegra.nvidia.co m look like mariko? it seems to have the same hardware as the switch but with new pmic and some other changes.

EDIT: t210b01 is t214 according to nvida kernel commit message. Second rev of t210b01 abca has fan disabled, fanless switch? T210b01 has the security engine and its enabled in the abca DTS.
EDIT 2: should have looked back in history, I'm late :)
 
Last edited by bylaws,

CapCaveman

Well-Known Member
Newcomer
Joined
Dec 17, 2018
Messages
54
Trophies
0
XP
105
Country
Sweden
Backing up your eMMC (nand) is fairly easy:
  1. Inject latest hekate
  2. Go to Tools -> Backup
  3. Run Backup eMMC BOOT0/1 (boot partitions)
  4. Run Backup eMMC RAW GPP (generic rawnand.bin partition. This will take a lot of time, because it is also verifying it)
  5. Done
Then you can find the 3 files in /backup/<your eMMC S/N>/. These are named BOOT0, BOOT1 and rawnand.bin
Together all 3, are your full backup.

SDSetup's guide tells you to remove your SD card, insert it in your PC and "unload" the backup between steps 3 and 4. Is that really necessary, CTCaer?

Also, thank you for all your hard work.
 

sj33

Well-Known Member
Member
Joined
Oct 22, 2013
Messages
4,072
Trophies
2
XP
4,727
Country
Japan
It's not, as far as I know. I always backup both together.

I personally just back up boot0/1 and SYS (not USER) because this results in a significantly smaller backup and USER is only needed if you want to keep user data.
 
Last edited by sj33,
  • Like
Reactions: CapCaveman

shutupsitdown

Member
Newcomer
Joined
Oct 23, 2018
Messages
12
Trophies
0
Age
53
XP
103
Country
Canada
How can I remove Stock/OFW from the boot menu? I don't want my kids to accidentally select it. In fact, can I remove everything except Launch CFW? I can always take the SD card to a computer to reenable everything.
 

Draxzelex

Well-Known Member
Member
Joined
Aug 6, 2017
Messages
19,011
Trophies
2
Age
29
Location
New York City
XP
13,381
Country
United States
How can I remove Stock/OFW from the boot menu? I don't want my kids to accidentally select it. In fact, can I remove everything except Launch CFW? I can always take the SD card to a computer to reenable everything.
Why do you want to remove it? I don't know of any damage that will happen if they boot stock instead of CFW.
 
  • Like
Reactions: Lacius

Nazosan

Well-Known Member
Member
Joined
May 12, 2009
Messages
576
Trophies
1
XP
1,089
Country
United States
Why do you want to remove it? I don't know of any damage that will happen if they boot stock instead of CFW.
There is possibly some inherent danger like the fact that stock will phone home with stuff you don't want it to. Though if you're running CFWs you should go ahead and expect a ban sooner or later, I can't see any reason to rush it. Nice to hear it doesn't burn fuses at least though.

I don't know if removing it outright is ideal, but it does seem to me like it would make sense for it to maybe double check with you "are you sure you want to boot stock?"
 

shutupsitdown

Member
Newcomer
Joined
Oct 23, 2018
Messages
12
Trophies
0
Age
53
XP
103
Country
Canada
Booting OFW from hekate does not burn fuses, if that’s what you’re concerned about.

That's good to know. Honestly, I was confusing the boot loader as always being there as I'm so used to seeing it, but of course, I'm forcing that to appear so the options are fine. No need to remove them I'll go with autoboot instead. My main concern I suppose, is them taking the jig out. I was just about to turn AutoRCM on but I see it's marked dangerous... Why is it dangerous? Because I can't get back to OFW without turning it off?
 
Last edited by shutupsitdown,

Nazosan

Well-Known Member
Member
Joined
May 12, 2009
Messages
576
Trophies
1
XP
1,089
Country
United States
Autorcm makes sure it never boots without you sending a payload (eg Hekate or Atmosphere or whatever.) It is mostly just "dangerous" in that you can't boot without sending a payload and because when you reboot or shutdown it will go back to RCM instead of truly powering off (so your system is powered on but the screen is off and you can't really tell because it's in a super minimal state.) This will (very slowly) drain your battery and can go all the way down to the cutoff point at which point it will not let you power it back on until it is properly charged to a safe range again. To truly properly shut it down you have to either shut it down in Hekate or enable AutoHOS off (I've had a lot of problems with this with my SwitchMe for whatever reason) so it does that automatically if you told it to power off or if all else fails, if you hold the power button for that ~14 seconds or so it will forcefully shut it off.

I do recommend it, just you have to bear that part in mind.

EDIT: Oh yeah, and you have to remember that if you update the system normally it will "fix" your system by removing autorcm. If you update through ChoidujourNX it keeps autorcm. If you rely on autorcm it could make for an unpleasant surprise. Though I guess in a pinch it's not too hard to rig up a jig (but those fuses will be burned the moment it goes into the new OFW without Hekate upon rebooting, so really it's best to use ChoidujourNX.)
 
Last edited by Nazosan,

shutupsitdown

Member
Newcomer
Joined
Oct 23, 2018
Messages
12
Trophies
0
Age
53
XP
103
Country
Canada
Autorcm makes sure it never boots without you sending a payload (eg Hekate or Atmosphere or whatever.) It is mostly just "dangerous" in that you can't boot without sending a payload and because when you reboot or shutdown it will go back to RCM instead of truly powering off (so your system is powered on but the screen is off and you can't really tell because it's in a super minimal state.) This will (very slowly) drain your battery and can go all the way down to the cutoff point at which point it will not let you power it back on until it is properly charged to a safe range again. To truly properly shut it down you have to either shut it down in Hekate or enable AutoHOS off (I've had a lot of problems with this with my SwitchMe for whatever reason) so it does that automatically if you told it to power off or if all else fails, if you hold the power button for that ~14 seconds or so it will forcefully shut it off.

All very great info. Thank you. I'm leaving it docked with power at all times, so it sounds like it will be fine. I would also probably turn AutoHOS off, just so it's off when I want it off. It'll mostly sleep I'm sure, so they can resume quickly without fusing about.
 

Nazosan

Well-Known Member
Member
Joined
May 12, 2009
Messages
576
Trophies
1
XP
1,089
Country
United States
I would also probably turn AutoHOS off, just so it's off when I want it off.
To be clear, "on" is the "power off completely when the user selects power off" position. This is mostly for "modchips" that automatically send the payload before you necessarily can respond (though if you set a delay to press vol- to get the Hekate menu before auto-booting in your configuration this may or may not be sufficient for you to press the button and stop it.) If you use autorcm you will be in RCM mode upon rebooting/powering off and the only question is how it handles it from there.

Naturally this does not affect sleep mode.

EDIT: Oh, and to be a bit clearer, autohos off is specifically for the system software (OFW/CFW) not from Hekate. Power off in Hekate truly does shut the power off.
 
Last edited by Nazosan,

Krude

Well-Known Member
Member
Joined
May 18, 2013
Messages
344
Trophies
0
XP
1,198
Country
Gambia, The
EDIT: Oh yeah, and you have to remember that if you update the system normally it will "fix" your system by removing autorcm. If you update through ChoidujourNX it keeps autorcm. If you rely on autorcm it could make for an unpleasant surprise. Though I guess in a pinch it's not too hard to rig up a jig (but those fuses will be burned the moment it goes into the new OFW without Hekate upon rebooting, so really it's best to use ChoidujourNX.)
Not true anymore. The last two releases of Atmosphere will protect your AutoRCM when you update. I've updated to 6.2 normally and kept AutoRCM.
 

NoIdeaofAnything

Active Member
Newcomer
Joined
Nov 13, 2018
Messages
39
Trophies
0
Age
56
XP
427
Country
Austria
Anyone knows about the error:
failed to load keyblob ? cannot load firmware.

I am getting it quite regulary, but after trying to launch CFW another time it works normally.
 

Nazosan

Well-Known Member
Member
Joined
May 12, 2009
Messages
576
Trophies
1
XP
1,089
Country
United States
So I just found a reason why the idea of making it at least slightly harder to accidentally boot into stock might be a good idea. I apparently forgot to put my memory card back in last night. I was being a bit lazy and had already docked my Switch before turning it on. I thought I had just left the system suspended and sometimes the dock likes to make it go off first and make me turn it on. When it didn't come on the first time I thought it was just being finnicky and tried again. Apparently along the way I managed to make it boot straight into the OFW since I didn't have the memory card in. I don't have a connection setup, so it wouldn't have phoned home with any errors or anything, but it's still a bit disconcerting. If I did it could have though. I know a lot of people do have their's setup to connect.

Not true anymore. The last two releases of Atmosphere will protect your AutoRCM when you update. I've updated to 6.2 normally and kept AutoRCM.
Well that's pretty nice. I wonder how reliable that is? Of course, if you run something else (even if by accident) then it won't offer that protection. Perhaps still advantageous to stick to ChoidujourNX. Of course that way you can do it offline too anyway.
 

teelo

Well-Known Member
Member
Joined
Jul 28, 2017
Messages
109
Trophies
0
Age
52
XP
200
Country
New Zealand
Can I restore my clean NAND with a 32GB SD with the same split-files method it was originally backed up with? Or do I need to go buy a 64GB SD?
 

Draxzelex

Well-Known Member
Member
Joined
Aug 6, 2017
Messages
19,011
Trophies
2
Age
29
Location
New York City
XP
13,381
Country
United States
Can I restore my clean NAND with a 32GB SD with the same split-files method it was originally backed up with? Or do I need to go buy a 64GB SD?
The SD card needs 29.1 GB of free space so it can be restored as a single file. Unfortunately, Hekate does not support partial restoration although it was cited as a feature to be added way back in July.
 

fodder

STARMAN
Member
Joined
Aug 3, 2014
Messages
863
Trophies
0
XP
544
Country
United States
I just opened this issue on Github, but I'm posting it here as well for others to see and possibly chime in

https://github.com/CTCaer/hekate/issues/172

I am unable to boot into Atmosphere via Hekate. If I try to do so, there is text output that appears as if things are loading correctly and the Nintendo logo appears, but I get a black screen indefinitely (I've tried letting it sit for 20+ minutes, no change), right before the Switch logo.

I'm using Kosmos, and I've tried just about everything I and the people who were helping me on the Kosmos Discord could think of including:

  • Quick reformatting SD card (both FAT32 and exFAT)
  • Full reformatting SD card (FAT32)
  • Doing a surface test on SD card (0 read errors found)
  • Trying multiple versions of both Hekate and Kosmos (v4.5, v4.6 // v11.5, v11.7)
  • Trying multiple versions of Atmosphere
  • Updating 6.2.0 (orig. installed with system update prompt) => 6.2.0 (installed with ChoiDujoirNX, exFAT support enabled)
  • Trying with AutoRCM off/on
  • Trying with auto boot off/on
  • Unplugging USB from Switch as soon as Hekate is injected (I am using a computer to inject payloads)
Here's what Hekate says after I select CFW, before the Nintendo logo:

Initializing...

Identified Pkg1 ('20181107XXXXXX')
Keyblob Version 6

Loaded Pkg1 and keyblob
Decrypted and unpacked Pkg1
Patching Warmboot
Loaded warmboot.bin and secmon
Read Pkg2
Parsed ini1
Patching Kernel
Patching Kernel initial processes
Decomping FS KIP1 sect 0 of size 873176...
Applying patch 'nosigchk' on FS KIP1 sect 0
Rebuilt and loaded Pkg2

Booting...​

(No idea if the pkg1 number is identifying at all, but I replaced the last 6 digits with X)

Something random (or not) is that the Switch never seems to leave RCM mode when this is happening.

I'm not sure why this is happening, and nobody I've asked has an explanation so I am posting this issue as I think it might be related to Hekate. fusee_primary boots into Atmosphere normally, but I am unable to with Hekate.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: https://stockanalysis.com/stocks/ntdoy/market-cap/ I think they'll be alright