Hardware Switch black screen, won't turn on, but seems to be charging

[technomancer]

Hello,

I am having a bit of an odd issue with a Switch that I have. The unit won't power on but when it is plugged in, it is drawing 14.7 volts at 0.5 amps and the battery, which was stone dead when i got it, was reading a voltage increase with a multi-meter and seems to be taking a charge. I unplugged all of the components from the board, did a bit of a visual inspection and there is no signs of corrosion or liquid damage. When I plugged the unit in without the battery, it would draw 14.7 volts at 0.09 amps and just stay there. I tried testing some of the capacitors around BQ24139 and M92T36 and didn't notice any of them shorted.

Any idea what I can do to help pin down the issue?

 

[bombob]

Try loading a payload

Sent from my SM-N960U using Tapatalk

 

[technomancer]

Try loading a payload

Sent from my SM-N960U using Tapatalk

Not really sure what you mean by that. The system has no signs of life outside of what I described above. I doubt it would take any inputs.

 

[bombob]

Not really sure what you mean by that. The system has no signs of life outside of what I described above. I doubt it would take any inputs.

Get an rcm gig or make your own ,and use tegra rcm to send a payload like Hekate to the switch. It might be software corruption which prevents you from booting.



Sent from my SM-N960U using Tapatalk

 

[technomancer]

Get an rcm gig or make your own ,and use tegra rcm to send a payload like Hekate to the switch. It might be software corruption which prevents you from booting.



Sent from my SM-N960U using Tapatalk

I think this thing is stuck in RCM mode. I plugged it into my computer and TegraRcmGUI was able to detected the switch and had the "RCM ok" at the bottom. I sent it the Hekate payload but am not able to get it to come to life. One post I read mentioned that, once the battery dies with autoRCM on, it doesn't want to come back to life unless you leave it charge for a long time? Not sure how accurate that. Have you heard of that problem/solution before?

 

[bombob]

Hold the power button for 30sec so it powers down and charge it for 2hours.Boot Hekate and make a nand backup,keys etc.Disable the autorcm and try booting normal

Sent from my SM-N960U using Tapatalk

 

[technomancer]

Hold the power button for 30sec so it powers down and charge it for 2hours.Boot Hekate and make a nand backup,keys etc.Disable the autorcm and try booting normal

Sent from my SM-N960U using Tapatalk

I let the unit charge for about 2 hours and tried to turn it on with both the power adapter in there as well as with just the battery but didn't see it come to life. When measuring the battery voltage at the connector (on both pairs) it was reading 4.2 volts while the Switch was plugged in and about 4.15 volts at the battery when I disconnect the battery from the unit. Maybe it needs to charge a while longer or do you think something else might be wrong with it?

 

[bombob]

Did it load hekate?

Sent from my SM-N960U using Tapatalk

 

[technomancer]

Did it load hekate?

Sent from my SM-N960U using Tapatalk

It didn't seem to do anything. I can hear the unit powering on at least some (you can hear the coil whine) but nothing on the screen. When I check the USB-C volt meter now, it was 0.19 amps when I plugged in the meter and when I held the power button for about 10 seconds, it dropped back to 0.11 amps. I assume this thing is still in RCM mode but not really sure what else to do aside from let it try and charge over night and try it again in the morning.

 

[bombob]

Do you know what is RCM mode? This is what you need to send Hekate payload.If it has autorcm or is stick with a software issue ,charging it till 2021 will not make it boot.Does tegrasmash recognize it as being on RCM?

Sent from my SM-N960U using Tapatalk

 

[technomancer]

Do you know what is RCM mode? This is what you need to send Hekate payload.If it has autorcm or is stick with a software issue ,charging it till 2021 will not make it boot.Does tegrasmash recognize it as being on RCM?

Sent from my SM-N960U using Tapatalk

I installed TegraRcmGUI on my PC, hooked the Switch up to it, saw Windows install a driver for the Switch and the TegraRcmGUI said "RCM O.K." on the screen with the Switch connected. I selected the hekate_ctcaer_5.2.1.bin payload and hit "Inject Payload" to which I saw the TegraRcmGUI output:

RCM Device detected
Invoking TegraRcmSmash.exe with args : "C:\Users\*******\Downloads\hekate_ctcaer_5.2.1_Nyx_0.9.1\hekate_ctcaer_5.2.1.bin"
TegraRcmSmash (32bit) 1.2.1-3 by rajkosto
Opened USB device path \\?\usb#vid_***********************
RCM Device with id *********************** initialized successfully!
Uploading payload (mezzo size: 92, user size: 122579, total size: 188795, total padded size: 192512)...
Smashing the stack!
Smashed the stack with a 0x0000 byte SETUP request!
Payload successfully injected

I then disconnected the Switch from my PC and attempted to boot it up but nothing shows on the display. I hear the unit doing something as I can hear coil whine but that's about it.

 

[bombob]

Is you switch vulnerable ?

Sent from my SM-N960U using Tapatalk

 

[technomancer]

Is you switch vulnerable ?

Sent from my SM-N960U using Tapatalk

Unfortunately, according to this guide, this Switch falls in the "Potentially Patched" range: https://nh-server.github.io/switch-guide/user_guide/getting_started/

 

[bombob]

I would take it apart and check if the emmc module is well seated or if there is no corrosion on the board

Sent from my SM-N960U using Tapatalk

 

[technomancer]

Looking at the EMMC under the microscope, I see what appears to be a little bit of corrosion under 3 of the caps on the bottom of the EMMC board. Testing them with a multi-meter in diode mode against the ground pad on the board and they didn't seem to be shorted to ground (or at least it only beeped on once side). I could replace those caps if I knew the values for each one but before I go through that trouble, does it make plausible sense as to why the unit is stuck in RCM mode?

On a side note about the EMMC board, is there supposed to be some insulator that goes between the board and the square metal cover it rests on? There seems to be some very thin felt or something that is on the top of the metal cover which seems to line up with the large copper pad on the bottom of the EMMC. There is also a larger rectangle of what appears to be a light adhesive at the edge of that metal cover (closest to the connector for the EMMC board) with a chunk of the adhesive missing.

Also, since the I got the "Smashed the stack with a 0x0000 byte SETUP request!" I assume it means its a patched unit as other posts I was looking at suggested you needed to get a code like 0x7000 (or was it 0x0700?) to be successful. Unless, of course TegraRcmGUI isn't what I should be using to attempt this (this is all pretty new to me after all) and you have a different program I should try.

Thanks again for your help thus far. if nothing else I am enjoying the learning process!