Hacking [RCM Payload] Hekate - CTCaer mod

  • Thread starter CTCaer
  • Start date
  • Views 1,072,138
  • Replies 3,243
  • Likes 128

CTCaer

Developer
OP
Developer
Joined
Mar 22, 2008
Messages
1,154
Trophies
0
XP
3,008
Country
Greece
Now if I have the Raw NAND dump..Do I absolutely need the USER and other ones or should I basically get all of them? And does the USER dump get the NAND & USER dump or just USER. Dumb questions maybe but I didn't see them in this thread.
No you don't need them.
You need BOOT0/1 and the rawnand.

The SYSTEM and USER are included in the rawnand.bin
 

link42586

Well-Known Member
Member
Joined
May 9, 2018
Messages
321
Trophies
0
Age
38
XP
1,184
Country
United States
No you don't need them.
You need BOOT0/1 and the rawnand.

The SYSTEM and USER are included in the rawnand.bin

Thank you I have modded systems since I can remember & know the more info I can gather the better off I am. Now my brothers NAND won't rip and gets 3 errors every time. error reading 512 blocks @ LBA 0316D200 (try 1) & 0316D400 & 316D600 mine is A samsung 64GB U3 that works fine & his is A sandisk 64GB U1 both formatted ExFat. I'll give mine A shot after I wipe it. Would it matter if I put mine directly in his with my data on it or should I wipe it first after I back it up.
 

CTCaer

Developer
OP
Developer
Joined
Mar 22, 2008
Messages
1,154
Trophies
0
XP
3,008
Country
Greece
You can use your sd card on his without wiping it. But first backup your stuff. The dump files will get overwritten.

The important now:
The errors you are reffering to have nothing to do with sd card.
It's about reading from eMMC.

The current code tries to read 10 times for each failing 512byte sector before failing.
If it continues, the dump is OK.

So what's the case?
It shows
error reading 512 blocks @ LBA 0316D200 (try 1)
error reading 512 blocks @ LBA 0316D400 (try 1)
error reading 512 blocks @ LBA 0316D600 (try 1)
And continues and finishes the dump
or
it shows a try 10 and then the dumping cuts off?

PS: I will add messages to inform user when the dumping fails in error cases like these in the next release.
 

link42586

Well-Known Member
Member
Joined
May 9, 2018
Messages
321
Trophies
0
Age
38
XP
1,184
Country
United States
You can use your sd card on his without wiping it. But first backup your stuff. The dump files will get overwritten.

The important now:
The errors you are reffering to have nothing to do with sd card.
It's about reading from eMMC.

The current code tries to read 10 times for each failing 512byte sector before failing.
If it continues, the dump is OK.

So what's the case?
It shows
error reading 512 blocks @ LBA 0316D200 (try 1)
error reading 512 blocks @ LBA 0316D400 (try 1)
error reading 512 blocks @ LBA 0316D600 (try 1)
And continues and finishes the dump
or
it shows a try 10 and then the dumping cuts off?

PS: I will add messages to inform user when the dumping fails in error cases like these in the next release.

It always finishes and says try 1 on all 3..Happened all 3 times I tried it. And for some reason his dumps come out segmented as if he doesn't have enough space (might not actually but it's close) and for some reason one of the sections is very small compared to the rest (other than the final section/piece) maybe section 12 or so i'll have to check tomorrow which one. But i'll free up some space and give it another go with the stuff u told me.
 

Lacius

Well-Known Member
Member
Joined
May 11, 2008
Messages
18,099
Trophies
3
XP
18,338
Country
United States
Now if I have the Raw NAND dump..Do I absolutely need the USER and other ones or should I basically get all of them? And does the USER dump get the NAND & USER dump or just USER. Dumb questions maybe but I didn't see them in this thread.
The raw NAND dump includes everything except boot0 and boot1.
 

CTCaer

Developer
OP
Developer
Joined
Mar 22, 2008
Messages
1,154
Trophies
0
XP
3,008
Country
Greece
It always finishes and says try 1 on all 3..Happened all 3 times I tried it. And for some reason his dumps come out segmented as if he doesn't have enough space (might not actually but it's close) and for some reason one of the sections is very small compared to the rest (other than the final section/piece) maybe section 12 or so i'll have to check tomorrow which one. But i'll free up some space and give it another go with the stuff u told me.
Only 1 try, means that the 2nd try succeeded.
It is strange though that the 12th part (which includes the LBA sectors 0x316D200-600) finishes with smaller size. It should be exactly 2,147,483,648 Bytes.
The code does not dictate sth like this, except if I'm missing sth..

The partial dump only starts if you have a lower space available or FAT32.
When it starts, it shows the available free space VS the dump space needed, in MiB.
 

padooo

Well-Known Member
Newcomer
Joined
Jan 14, 2009
Messages
80
Trophies
1
XP
424
Country
United States
OK, now with the release of hekateipl for 5.0.x I gotta ask...

Is this payload compatible with 5.0.x firmwares? I've read good 4 pages of thread and didn't see anything about compatibility, sorry if I missed anything.
 

link42586

Well-Known Member
Member
Joined
May 9, 2018
Messages
321
Trophies
0
Age
38
XP
1,184
Country
United States
I know you said the errors wasn't because of the sd card but I used my samsung 64GB U3 card and my brothers dump went through without errors. And it was A full dump not broken up..Right before that I tried his sandisk 64GB C10 A1 sd card (thought it was U1 but it wasn't) & that didn't work...part 13 was really small compared to the rest even though it was an empty card when I tried it no full dump for some reason. Both formatted to Fat32. My bad...Just realized I might not even be using your hekate release....so take what I said with A grain of salt.
 
Last edited by link42586,

CTCaer

Developer
OP
Developer
Joined
Mar 22, 2008
Messages
1,154
Trophies
0
XP
3,008
Country
Greece
OK, now with the release of hekateipl for 5.0.x I gotta ask...

Is this payload compatible with 5.0.x firmwares? I've read good 4 pages of thread and didn't see anything about compatibility, sorry if I missed anything.

I don’t think 1.2 can boot into 5.0.x yet
It should. But it probably can't launch HB Menu.
I haven't tried Jan4V's sd files yet, not launching to Switch OS though.

The hekateipl for 5.0.x has some extra security monitor patches that I think they patch Header signature, Version and Sections SHA2 for Package 2 (to be able to run a modified one?).
 
Last edited by CTCaer,

ThirdEyeCx

Active Member
Newcomer
Joined
May 4, 2018
Messages
39
Trophies
0
Location
USA
XP
219
Country
United States
Hey, just posting to say thanks since I just used this to do a raw full nand backup. It took about an hour or so and I used a 64GB sandisk sdxc card formatted in FAT32 and this is what it looked like after I removed it from the Switch and put it on my PC:
jSi1bMy.png

I then used the batch file to put them together.
 
Last edited by ThirdEyeCx,
  • Like
Reactions: CTCaer

CTCaer

Developer
OP
Developer
Joined
Mar 22, 2008
Messages
1,154
Trophies
0
XP
3,008
Country
Greece
@wicksand420 and @link42586
There is a trick that you can do:
First of all 90% should be the 12th part also. If another one except the last one is less than 2GB use this number in the following instead:
Move the successful files till the problematic one.
Create a file called partial.idx
With a hex editor, insert the part you want to continue from in HEX.
If it's the 12th, you must write 0C, which is 12 in HEX.
Go do the dump again and it will resume at 12th part.

@wicksand420
The above procedure is only if the card is FAT32 or the available free space is less than 31,268,536,320.

By the way I think I found why it does that and I will release a new version.
Be a little patient though, because my new release will have many changes and I have to make sure they are OK for upstream merging.
 

wicksand420

Well-Known Member
Member
Joined
Nov 13, 2016
Messages
2,787
Trophies
1
Age
39
XP
2,295
Country
United States
@wicksand420 and @link42586
There is a trick that you can do:
First of all 90% should be the 12th part also. If another one except the last one is less than 2GB use this number in the following instead:
Move the successful files till the problematic one.
Create a file called partial.idx
With a hex editor, insert the part you want to continue from in HEX.
If it's the 12th, you must write 0C, which is 12 in HEX.
Go do the dump again and it will resume at 12th part.

@wicksand420
The above procedure is only if the card is FAT32 or the available free space is less than 31,268,536,320.

By the way I think I found why it does that and I will release a new version.
Be a little patient though, because my new release will have many changes and I have to make sure they are OK for upstream merging.
Cool man, I'll try that out when I wake up. Thanks for all your hard work @CTCaer
 

link42586

Well-Known Member
Member
Joined
May 9, 2018
Messages
321
Trophies
0
Age
38
XP
1,184
Country
United States
@wicksand420 and @link42586
There is a trick that you can do:
First of all 90% should be the 12th part also. If another one except the last one is less than 2GB use this number in the following instead:
Move the successful files till the problematic one.
Create a file called partial.idx
With a hex editor, insert the part you want to continue from in HEX.
If it's the 12th, you must write 0C, which is 12 in HEX.
Go do the dump again and it will resume at 12th part.

@wicksand420
The above procedure is only if the card is FAT32 or the available free space is less than 31,268,536,320.

By the way I think I found why it does that and I will release a new version.
Be a little patient though, because my new release will have many changes and I have to make sure they are OK for upstream merging.
I switched to my samsung U3 sd card not my brothers sandisk card and it worked on both of our systems. Now I got both full dumps. So all good here but nice to know in the future.
 

Addconsult

Well-Known Member
Newcomer
Joined
Apr 29, 2018
Messages
61
Trophies
0
Age
40
XP
197
Country
Sweden
Hekate - ipl
CTCaer mod v1.2 - Automatic RAW eMMC partial dumping



Changelog:
V1.2:
  • Write errors to SD card are now fatal (as per FatFs/Diskio guidelines). You can still choose what to do though:
    • Abort and try again right away from the last part (recommended)
    • Continue (and potentially have a corrupt dump)
  • Fix SD card not mounting (by fixing the switch to low voltage 1.8v for these cards. Normally happening in Samsung sd cards)
  • Add high speed support for high voltage SD Cards


Description:

The main difference with the official hekate - ipl is support for automatic partial dumping for your Switch's eMMC.
Additionally, there are some other quality of life small changes.
  • It automatically starts partial dumping (even in exFAT formatted SD Cards), based on the available free space. Supports both FAT32 and exFAT.
  • If you have enough space and an exFAT formatted partition, it will automatically choose to dump the raw eMMC as one big file.
Detailed release notes:
This release lets you dump the USER partition, or the whole RAW eMMC.

The automatic partial dump is only activated if you don't have enough space in your SD card to dump the whole eMMC.

The partial dumping is done in 15 2GB parts.
This way you can even use a 4GB sd card to dump the whole eMMC.

Normal dumping Procedure:
If you have enough space, it will automatically dump your eMMC as one big file.

Partial dumping Procedure:
  1. Run hekate-ipl_ctcaer_1.2 payload
  2. Select "Dump RAW eMMC"
  3. When this is finished, press any key and Power off Switch from main menu
  4. Move the files from SD card to your PC to free some space
    Don't move the partial.idx file!
  5. Unplug and re-plug USB while pressing Vol+
  6. Run hekate-ipl_partial_dumping again and press Dump RAW eMMC to continue
  7. Join the files with your favorite cmd or app
Notice 1: Users that only have a 2GB or 4GB SD card, use the hekate-ipl_ctcaer_1.2_GBparts payload.
Notice 2: If you have an unfinished partial dumping and want to start anew, delete the partial.idx file first.

Warning: When dumping the eMMC, in parts, you should not power on the switch normally and boot to Switch OS before done. Otherwise your finished backup will probably corrupt, because Switch OS writes on your eMMC even if it seems you done nothing.


Download v1.2


There are also windows and linux scripts provided, that join these 15 2GB files into one.
In windows, you can then use rajkosto's biskeydump and HacDiskMount to manipulate your raw eMMC dump.


Thanks:
naehrwert for the original code: https://github.com/nwert/hekate
@rajkosto for his hekate - ipl commits and tools: https://github.com/rajkosto/hekate


Great work! Could you if you have time try to add your SD card patch (Samsung SDHC) https://gbatemp.net/threads/hekate-ipl-4-x-hbl-on-4-x.503471/ on this version ? Since it doesent support SDHC Cards and you found a workaround. Maybe you can apply the same code to that?

Best Regards
 

CTCaer

Developer
OP
Developer
Joined
Mar 22, 2008
Messages
1,154
Trophies
0
XP
3,008
Country
Greece
Great work! Could you if you have time try to add your SD card patch (Samsung SDHC) https://gbatemp.net/threads/hekate-ipl-4-x-hbl-on-4-x.503471/ on this version ? Since it doesent support SDHC Cards and you found a workaround. Maybe you can apply the same code to that?

Best Regards
All my changes are upstreamed to main nwert/hekate repo. He can just cherry pick the commits to his release.

But don't worry, my new version will have 4.xx/5.xx support.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    HiradeGirl @ HiradeGirl: Coming.