Hacking RELEASE biskeydump and HacDiskMount - Switch eMMC decryption/real-time mounting tools

[subcon959]

Sorry no I didn't know that part are you supposed to boot linux up first to dump your nand? I'm missing some information I thought it was just a case of getting your txt file onto your laptop and opening it with the app. How do you do the linux part to dump your nand? thanks.

This is just the keys to decrypt the NAND dump. You have to get linux running on your Switch to get the 29gig file to use with this. It's a bit of an ordeal so you might want to wait till someone releases a simple payload-based NAND dumper.

 

[Reecey]

This is just the keys to decrypt the NAND dump. You have to get linux running on your Switch to get the 29gig file to use with this. It's a bit of an ordeal so you might want to wait till someone releases a simple payload-based NAND dumper.

Yes I have just looked at the tut, I totally agree!

 

[subcon959]

Yes I have just looked at the tut, I totally agree!

Not to mention quite a few people are reporting battery problems since running linux. There was a tweet somewhere showing the payload dumper was nearly complete so I would just wait for that.

 

[Imancol]

Is there a way to dump the NAND of the Switch directly to the PC from a payload?

 

[rajkosto]

i made a script to convert hekate_ipl dumped eMMC partitions to RawNand.bin https://pastebin.com/vdCqxrci (you need to dump USER separately if you want it included into the RawNand.bin)

 

[DocAmes1980]

i made a script to convert hekate_ipl dumped eMMC partitions to RawNand.bin https://pastebin.com/vdCqxrci (obviously you will be missing USER as hekate_ipl does not dump that one)

It will be missing USER meaning what? User data? Like installed titles and save data?

Edit: Yes. It's installed games and save data.

 

[Zris96]

Can't we use this to set NeedUpdateVulnerability back to 0?

Edit: so we can be able to use SwitchBru DNS again

 

[Imancol]

HacDiskMount closes me every time I try to open Open Physical Drive. Use Windows 10

 

[rajkosto]

biskeydumpv5 is out, now validates the retrieved keys by reading out a keyblob and verifying its MAC, the QR code will have a red background if anything went wrong

 

[rajkosto]

made a hekate_ipl fork that lets you dump all the possible partitions(USER and BOOTx are separate menu options) : https://github.com/rajkosto/hekate/releases
also updated my hekate dumped parts to RawNand.bin script (to support reading the dumped USER.xx files) here: https://pastebin.com/vdCqxrci

 

[subcon959]

Very nice, can those that dump full NAND report back how long it took?

 

[aut0mat3d]

Very nice, can those that dump full NAND report back how long it took?

about 30 minutes incl. MD5 comparing

 

[rajkosto]

he was asking for people who dump it with hekate_ipl, which will be much slower than linux

 

[Naked_Snake]

now that i have my user dumped how do i find my BOTW save when i mount user to a drive with HacDiskMount

 

[rajkosto]

the savedata partition is just one of the increasingly numbered files in USER:/save you can compare by file size with what shows up in the switch data management screen

 

[ppmeis]

@rajkosto first of all thanks for your great job.

I'm using your bin actually, and screen says it's creating RawNand.bin file directly on SD card. Is USER partition included in it?

Thanks again.

 

[rajkosto]

the only thing not included in RawNand.bin is BOOT0/BOOT1 which are small and you can get from the relevant menu option

 

[Naked_Snake]

the savedata partition is just one of the increasingly numbered files in USER:/save you can compare by file size with what shows up in the switch data management screen

Thanks, anyway to convert it so I can put it in an editor and screw around with it they are all one file when I looked in the folders

 

[MonMonz]

i like your work so much
is there anyway to run biskeydump.bin via pegaswitch?

 

[rajkosto]

i like your work so much
is there anyway to run biskeydump.bin via pegaswitch?

make sure logging is enabled (because you wont be able to see all the keys in the debug pane) and evalfile this script: https://pastebin.com/QfBxeNt5

 

[T-Error]

BCPKG2-1 asks for the BIS Key. Which key do I have to use there? BIS KEY 0-3 didn't work and they are all I got besides of HWI; SBK; TSEC and DEVICE KEY.