Switch 2: data gathering for possible modchip attack vectors

[Prof0nWear]

Thank you, SENSEI, for your wise words, we will follow you wherever you go. A KAMIKAZE attack might help???

Post automatically merged: Apr 9, 2025

As SciresM mentions DCLS could be enabled.

Dug this out in the T23X deployment guide, most likely very relevant considering the SW2 is using a T239 APU.

https://developer.download.nvidia.c...b237fba831828b197aa0e48bcaffb6cb15d392bd13a8c

Also mentions that MB1 BCT can be loaded over USB in RCM mode, but no doubt this will be more locked down this time around

 

[whitesword7]

My most anticipated homebrew has to be PCSX2 emu on switch 2

aethersx2 runs like crap on switchroot

 

[Prof0nWear]

Corrected T23X deployment guide link.

https://developer.download.nvidia.c...ubnZpZGlhLmNvbS8/ZmlsZW5hbWU9NDAzLmh0bWwifQ==

 

[mathew77]

Here's AGX Orin T23X Deployment Guide:

 

[appiekap]

To have SciresM to respond here is nothing short of thank you worthy.

Thank you firstly SciresM for everything you've done for this scene and secondly for responding here.

I do have a few questions if I may.

Obviously glitching is is almost likely completely unfeasible.

1) Obvious goals here would be to find a userland/kernel exploit, which would allow homebrew, which sadly will always be patched, the goal as most want is piracy, I do not as you do not also, want piracy... is there any known flaws in the current HorizonOS code that you know of that may be useable for a software based exploit on SW2? I understand obviously it may not be as straight forward as that, but to at least allow some form of homebrew via known exploit as I am assuming that the new horizonOS for SW2 will likely be based off of the same NX horizon code...

2) Do you know of any other additional security implementations that the SW2 has that the NX does not?

3) SW2 uses a translation layer to essentially emulate SW1 games, do you think something like mig-flash now that the NX Lotus cart encryption has been cracked that there could be some movement with an exploit via this route? again I understand Nintendo may have a work around for this these kinds of products for obvious reasons.

4) What would hypotheses will be the entry point into a hacked (homebrewed) SW2 be?

5) Will you be looking into hacking the SW2?

And lastly thank you, as someone with such a interest in hacking, I wish I could learn more deeply as to what you know from someone like you!

First of all, I don't have any hardware knowledge or any experience in hacking a device so bear with me.
Just trying some thoughts experiments.

Could it be possible to do some MITM attack to retrieve the Encryption Keys?

If one chip needs to send the key to an other chip, could you try to retrieve it in the middle?
Pretending to be the recipient chip.

 

[Prof0nWear]

First of all, I don't have any hardware knowledge or any experience in hacking a device so bear with me.
Just trying some thoughts experiments.

Could it be possible to do some MITM attack to retrieve the Encryption Keys?

If one chip needs to send the key to an other chip, could you try to retrieve it in the middle?
Pretending to be the recipient chip.

To answer this and all questions; I don't expect the switch 2 to be hacked, if at all, nor anytime soon, if ever.

 

[BoxNinPlay]

To answer this and all questions; I don't expect the switch 2 to be hacked, if at all, nor anytime soon, if ever.

I do believe that NS2 will be hacked at some point. Nothing is foolproof. However, I also believe there is a lot of uncertainty and that the time it takes for that to happen could take much longer than we imagine. I predicted 2 years, but now I'm reconsidering and leaving the issue of time open-ended.

 

[l7777]

First of all, I don't have any hardware knowledge or any experience in hacking a device so bear with me.
Just trying some thoughts experiments.

You can just stop right there. Not trying to be rude, but let's think about this for a moment. You self admit that you don't have expertise in the topic yet you're posing solution based on what?

Could it be possible to do some MITM attack to retrieve the Encryption Keys?

If one chip needs to send the key to an other chip, could you try to retrieve it in the middle?
Pretending to be the recipient chip.

All of these things are security 101. Assume your communications will be listened to. Ensure that even if those communications are intercepted they can't be used. This concept is as old as history.

 

[Skv0ra]

I "think" you missed the point. He's trolling, and it looks like he succeeded.

"This will just kill off 3rd party developer support and we will get lack luster Nintendo games"

Typically on Nintendo consoles the most popular games are the ones made by Nintendo, followed by a ton of 3rd party games, many of which are "lack luster" shovelware. Especially if you look through their eShops.

Ahem, "the most popular only working games are the ones made by Nintendo"

 

[Eye-V-Sore]

Based on everything discussed here so far, would it be smart to get a launch model so it's on the lowest possible firmware? Or will taking the hardware mod route make the FW version irrelevant?

I kinda don't want to spend the money on one at the moment, especially if it's just gonna sit in my closet until a mod debuts. But if it's important to get the V1 console with low firmware at launch, then I'll get one.

 

[Prof0nWear]

Based on everything discussed here so far, would it be smart to get a launch model so it's on the lowest possible firmware? Or will taking the hardware mod route make the FW version irrelevant?

I kinda don't want to spend the money on one at the moment, especially if it's just gonna sit in my closet until a mod debuts. But if it's important to get the V1 console with low firmware at launch, then I'll get one.

The very reason I have two pre-ordered, yes it will sit empty for a while no doubt, sadly.

But who knows what will be possible in the future on OG firmware, I'm sure there will be extensive interest in this though.

There were some Switch 1 exploits, but all fixed sadly

https://wiki.gbatemp.net/wiki/List_of_Switch_exploits

My plan is open second switch 2, set it up WITHOUT internet connection, DO NOT UPDATE ANY FIRMWARE, and then get it to the home screen so that when any exploits come in I can easily be ready.

Reason for the above is that Nintendo may ask for internet connection in order to "activate" switch 2 or something weird like that and that may require a fw upgrade.

So set it up when you get the second one

 

[Tofu_mommy]

Let's hope we can break tony hawk

You'd have to have a way to somehow put in your modified save files.

 

[fout21]

Or we just wait for a copy of Tony Hawk for the Switch 2

 

[ikynx]

switch 2 demo / QC unit apparently in the wild: https://www.reddit.com/r/NintendoSwitch2/comments/1k60vxf/a_switch_2_got_stolen/

 

[chrisrlink]

wonder if certain parts of the chain will be programable (by a private key only known to nintendo) to defeat any atempt at glitching via fw update

Post automatically merged: Apr 24, 2025

switch 2 demo / QC unit apparently in the wild: https://www.reddit.com/r/NintendoSwitch2/comments/1k60vxf/a_switch_2_got_stolen/

whoever has this needs a plane ticket to russia stat

 

[AceyBwoi]

Switch 2 PCB

 

[SylverReZ]

Switch 2 PCB

Those are better photos compared to the ones in the leak.

 

[loler55]

Switch 2 PCB

Frontpage News

 

[Paralel]

I think people who are expecting voltage glitching attacks to be viable (especially anywhere in the immediate future) are delusional, honestly.

The Switch 2's BPMP may or may not have DCLS, but let's assume for purpose of argument that it doesn't.

Anybody talking about voltage glitching just has not studied the boot flow: https://docs.nvidia.com/jetson/arch...R/BootArchitecture/JetsonAgxOrinBootFlow.html

View attachment 496438

Conventional glitching attacks on NX (and Mariko) pwn the BPMP, by making it accept a different public key. So, okay, let's say you replicate that attack verbatim, magically.

You've now pwned the BPMP. This gets you *nothing* on Switch 2, because all the BPMP does is handover to the PSC ("Platform Security Controller"), a custom NV-RISCV chip responsible for all actual cryptographic stuff/security on the platform.

You can't start the ccplex. You can't get any keys to decrypt anything. You could dump the bootrom, if you do a double glitch, probably. But that doesn't help you in any capacity, because unlike on NX, on the Switch 2 the whole chain of trust is designed around an insecure BPMP that happens to be secured anyway.

You can think of it as like when they added TSEC in 6.2.0 on the Switch, except this is baked in from the get-go, and NV-RISCV is likely actually secure (they claim formal verification, and I'm skeptical, but I still think it won't have the basic tsec problems). And you have to glitch to even get to that point.

So...yeah. I would tell people not to get their hopes up. You would need to glitch the PSC (completely blindly glitching a custom-architecture processor that NVidia gave hardware conference talks on how they designed to be anti-glitching?) or the ccplex (doesn't get you keys, everything you do there is potentially patchable by a firmware update?).

It's not like Mariko was for the Switch, it's a whole new game.

But, every complex system design/implementation has a flaw somewhere. Statistically, given the complexity of the system, it should contain several flaws in its design and/or implementation. Now, whether those flaws can be found, and if they are useful in any way for compromising the security of the system is a completely different matter. But, it does mean that it should at least be a possibility.

 

[l7777]

But, every complex system design/implementation has a flaw somewhere. Statistically, given the complexity of the system, it should contain several flaws in its design and/or implementation. Now, whether those flaws can be found, and if they are useful in any way for compromising the security of the system is a completely different matter. But, it does mean that it should at least be a possibility.

This, and the "it'll get cracked sometime", are silly arguments. Security is never about being foolproof and unbreakable, it's about delaying the bad actors for long enough that it no longer matters. If it takes 20 - 30 years to break the Switch 2 no one will care. This is by most definitions perfectly secure.