Hacking So where are the gamesave exploits?

[RHOPKINS13]

So needless to say the Switch hacking community has exploded since Fusée was first released. We have linux, emulators, save managers, backup loading, emunand, mods, cheats, and more. Aside from the ipatched units, we're able to do just about everything you can think of involving a glorified tablet with wireless controllers.

AutoRCM can make things slightly more convenient, but damn, it sure would be nice if we didn't need to use a dongle, pc, or phone every time we wanted to use CFW.

Every console I can think of that could be softmodded had gamesave exploits. With the original Xbox Splintercell and MechAssault were the popular choices, on the Wii it started off with Twilight Princess, and then a bunch of other exploits were found, including several other gamesave exploits including Smash Brothers. I don't know that I'd call it a "softmod" but the PS2 had games like "007: Agent Under Fire" that you could use the swap trick with to load homebrew. Perhaps that doesn't count, as it's not really relying on a save file, but once Free MCBoot is installed you really can't get much simpler than that. PSP had multiple exploits, starting with GTA - Liberty City Stories, and DSi had Sudokuhax. The 3DS started with Cubic Ninja and later ended up with exploits for a ton of different games. Of course now it's easiest to just install Boot9Strap and your choice of CFW, but nonetheless there still were a bunch of different gamesave exploits to choose from.

Surprisingly though, no gamesave exploits have been released for Switch, even though we have access to debuggers and other tools that would make finding an exploit easier.

If we found a gamesave exploit, we'd be able to use RCM to boot into CFW once, run Checkpoint and install the exploit, and afterwards we'd be able to boot into OFW and use the game exploit to run homebrew. No more dongles or RCM jigs would be needed!

Heck, I'd bet we could even use Nintendo's Cloud Save service to hack a few ipatched Switches before getting blocked.

It just seems strange to me that these exploits existed for so many other consoles, but none yet for Switch. Why? With all the indie games available in the eShop, I can't imagine that all these game developers suddenly got that much better at protecting their code from vulnerabilities...

Sorry if it feels like I'm whining or begging, I'm really grateful for what we already have, and I lack the time and quite frankly the skills to try and come up with an exploit myself. But I feel like game exploits have been forgotten about now that we have RCM.

 

[linuxares]

Because they focus on the already open attack vectors? Who knows, they might already have a list of games ready to be released.

 

[EmanueleBGN]

You cannot export/import saves from/to the Switch

 

[link42586]

I think sciresm said something about ASLR or something like that. All I can remember. He had A saying like it was basically impossible. Someone can find it i'm sure.

 

[ghjfdtg]

Because ASLR makes it very very hard to exploit them. You need vulnerable saves and an infoleak at the same time to figure the memory layout out. On top of that there is no easy way to import modified saves.

 

[RHOPKINS13]

You cannot export/import saves from/to the Switch

Yes you can, Checkpoint does this beautifully. There are even sites around here where you can download saves that other people have published. As long as you have a way of loading homebrew, you can inject a save.

I think you may even be able to use HacDiskMount to inject the save without launching a full-blown CFW.

--------------------- MERGED ---------------------------

Because ASLR makes it very very hard to exploit them. You need vulnerable saves and an infoleak at the same time to figure the memory layout out. On top of that there is no easy way to import modified saves.

That's a very good point, but I would have expected ASLR to make cheats very difficult if not impossible to implement.

 

[masagrator]

Switch RCM is Independent of operating system. You cannot use game exploit to run unsigned payload on patched Switch.

Edit: maybe I misread something. Nvm.

 

[smf]

If we found a gamesave exploit, we'd be able to use RCM to boot into CFW once, run Checkpoint and install the exploit, and afterwards we'd be able to boot into OFW and use the game exploit to run homebrew. No more dongles or RCM jigs would be needed!

They obviously have better things to do with their time than make dongles redundant. You don't need a jig anyway, just install autorcm.

You'll end up having to use emunand and booting your switch, loading a game and then booting your switch again is way too inconvenient. Just use a dongle, it's easier.

 

[ghjfdtg]

That'sa very good point, but I would have expected ASLR to make cheats very difficult if not impossible to implement.

Cheat engines run on top of already exploited/modified systems allowing them to request the process memory layout. The cheats are offset based since absolute adresses don't work here anymore.

 

[SonyUSA]

You would be sandboxed into the game limitations on system resources even if you could save exploit a game, designing an escape exploit would be very troublesome and frankly not worth the effort since the system is wide open with RCM/Payload solutions. You know you can do an internal payload injector for very cheap? You could try looking into one of the Trinket mods.

 

[link42586]

Long story short. Gamesaves haven't been forgotten about when it comes to the switch. But i'm almost 100% sure sciresm has A saying floating around about how it's nearly impossible to exploit game saves on the switch. And this is what I was takling about ...

https://i.imgur.com/WOYaYhZ.png

 

[stitchxd]

You cannot export/import saves from/to the Switch

You can with the cloud save feature + an extra switch or friends switch (That is already hacked)

 

[link42586]

Having read what sciresm posted then..And with what we have now. And my knowledge of other hacking scenes. I wil say that what we have now. Will probably not be what we have in the end. It rarely ever happens that way. I would be surprised if what we have now is the only things that are ever found when the switch is long gone. Something else is already in the pipeline and we might not know about it. May never know about it. But something is always being looked into while the scene is hot.

 

[HexadecimalMantis]

I do hope we get some kind of savegame exploit in the distant future for lower firmwares. Wouldn't be surprised if it never happens though.