RELEASE Switch 7.0 key derivation: Lockpick_RCM payload

Discussion in 'Switch - Exploits, Custom Firmwares & Soft Mods' started by shchmue, Mar 4, 2019.


    34,161

    136
    Front-page RELEASE

    Description

    Lockpick_RCM is a bare metal Nintendo Switch payload that derives encryption keys for use in Switch file handling software like hactool, hactoolnet/LibHac, ChoiDujour, etc. without booting Horizon OS.

    Source: https://github.com/shchmue/Lockpick_RCM
    Payload: https://github.com/shchmue/Lockpick_RCM/releases

    Due to changes imposed by firmware 7.0.0, Lockpick homebrew can no longer derive the latest keys. In the boot-time environment however, there are fewer limitations. That means the new keys are finally easy to dump!

    Usage
    • Launch Lockpick_RCM.bin using your favorite payload injector or chainload from Hekate by placing it in /bootloader/payloads
    • Upon completion, keys will be saved to /switch/prod.keys on SD
    • If the console has Firmware 7.x, the /sept/ folder from Atmosphère or Kosmos release zip containing both sept-primary.bin and sept-secondary.enc must be present on SD or else only keyblob master key derivation is possible (ie. up to master_key_05 only)
    Big thanks to CTCaer
    For Hekate and all the advice while developing this!

    Known Issues
    • Chainloading from SX will hang immediately due to quirks in their hwinit code, please launch payload directly
     
    Discussion (136 replies)
  1. AliciaBurrito

    AliciaBurrito Member

    Newcomer
    3
    Sep 8, 2018
    United States
    Rei's Mommy
    This looks awesome, and should really help a lot of people who can't get into Horizon for whatever reason :)
     
    Daggot and shchmue like this.
  2. tomGER

    tomGER GBAtemp Fan

    Member
    7
    Feb 6, 2017
    Germany
    Awesome work!
     
    teamlocust and shchmue like this.
  3. Draxzelex

    Draxzelex GBAtemp Guru

    Member
    18
    Aug 6, 2017
    United States
    New York City
    RCMPick had potential...
     
    RHOPKINS13 and shchmue like this.
  4. LeviDL

    LeviDL Member

    Newcomer
    4
    Apr 6, 2017
    United States
    You're Awesome!
     
    shchmue likes this.
  5. Whovian NineThreeSixNine

    Whovian NineThreeSixNine Advanced Member

    Newcomer
    4
    May 3, 2016
    United States
    Congrats to ya, and thanks! :D
     
    shchmue likes this.
  6. Adran_Marit

    Adran_Marit Walküre's Hacker

    Member
    9
    Oct 3, 2015
    Australia
    42*South
    Ty for the release :)
     
    shchmue likes this.
  7. Vaatu

    Vaatu Advanced Member

    Newcomer
    2
    Sep 18, 2018
    United States
    My Room
    This is beyond cool! Good work :D
     
    shchmue likes this.
  8. ZachyCatGames

    ZachyCatGames GBAtemp Advanced Maniac

    Member
    8
    Jun 19, 2018
    United States
    Hell
    and people on 7.0.0 who want the new keys ;)
     
    shchmue likes this.
  9. Kadji

    Kadji Advanced Member

    Newcomer
    5
    Nov 16, 2006
    Germany
    Germany, NRW
    Its not mentioned and while I am fairly sure that it should work I have to ask: Is 7.0.1 also supported?
    And is the dereived key the same key that was needed when Atmosphere was still in "bring your own keys for 7.x support" mode?

    Thanks for clarifying.
     
    shchmue likes this.
  10. Beerus

    Beerus Gbatemp's God Of Destruction

    Member
    7
    May 3, 2017
    Canada
    Universe 7
    Ayyyy thanks dude this gonna bless bare manz
     
    shchmue likes this.
  11. shchmue
    OP

    shchmue GBAtemp Advanced Fan

    Member
    7
    Dec 23, 2013
    United States
    it supports every firmware :) but no the keys for BYOK on 7.x remain private, Sept uses them and clears them from memory.
     
  12. huma_dawii

    huma_dawii GBAtemp Psycho!

    Member
    10
    Apr 3, 2014
    United States
    Planet Earth
    Run this and then run lockpick?
     
  13. Kadji

    Kadji Advanced Member

    Newcomer
    5
    Nov 16, 2006
    Germany
    Germany, NRW
    Ok now I am a bit confused: If I understood right it *does* dump *some* 7.X keys if we provide RCM_Paylock with the files from Atmo / Kosmos.
    Are those the keys that would be used in the future to decrypt 7.X games (when they appear in the fututre)?

    Sorry if those questions have been answered for about 100 times, the whole 7.X situation is a bit messy and I am out of the loop (private stuff that is kinda ruining my life atm).
     
  14. shchmue
    OP

    shchmue GBAtemp Advanced Fan

    Member
    7
    Dec 23, 2013
    United States
    the only thing Lockpick does that this doesn't is derive titlekeys. so unless you want those this is all you need.

    — Posts automatically merged - Please don't double post! —

    it dumps and derives all the keys you need to decrypt 7.x files.
     
    huma_dawii likes this.
  15. bundat

    bundat ¿

    Member
    4
    Jul 25, 2018
    Antarctica
    Are these the keys TX needed for SX OS 7.x support?
     
  16. Draxzelex

    Draxzelex GBAtemp Guru

    Member
    18
    Aug 6, 2017
    United States
    New York City
     
  17. huma_dawii

    huma_dawii GBAtemp Psycho!

    Member
    10
    Apr 3, 2014
    United States
    Planet Earth
    I hope your life gets better :) stay strong.

    — Posts automatically merged - Please don't double post! —

    I got only 126 keys, normal? On 7.0.1
     
    lordelan likes this.
  18. shchmue
    OP

    shchmue GBAtemp Advanced Fan

    Member
    7
    Dec 23, 2013
    United States
    yes that's the count for 7.x

    though I'd caution generally not to be too focused on key count as long as you have those you need. for example, consoles on 6.2.0 can dump a master kek and tsec root key that can't be dumped on any other firmware but those are just intermediate calculations and aren't as important as their result for anyone using this software
     
    Quantumcat and huma_dawii like this.
  19. Nerdtendo

    Nerdtendo Your friendly neighborhood idiot

    Member
    7
    Sep 29, 2016
    United States
    I haven't really looked into what exactly I need but would this give me the keys for yuzu?
     
Loading...