Hacking Switch boot procedure is now documented in switchbrew, and it has downgrade protection with fuses.

[isoboy]

Nintendo will not give up by reFUSING access.

 

[Deleted-355425]

Nintendo will not give up by reFUSING access.

oh man, you didnt.

 

[Deleted User]

well he got a point once you got entry to the system who gonna downgrade anyway ?

 

[isoboy]

The Switch itself Is the FUSElage of the whole console.

 

[lembi2001]

A lot of people are really conFUSEd about how this system works I can see. The wikipedia article actually provides a decent explanation of it.

 

[Futurdreamz]

A lot of people are really conFUSEd about how this system works I can see. The wikipedia article actually provides a decent explanation of it.

The Wikipedia page was pretty blank yesterday though... I found more info on the ANTIfuse page then.

 

[Deleted User]

well if nintendo can downgrade the switch so the end user will do sooner or later

 

[Ryccardo]

What do you exactly mean with this ?
Do you mean the Switch doesn't have the OTP Keys or that there is no exploit avaible to get them ?

The OTP's are used for signing/encrypting the Payloads to be legit on our Consoles ?
Does only the 3ds has the OTP's ? (I am sure that I heared on the 33c3 Derrek talking about Wii U OTP Dumping)

First, everyone should know that a PROM, also known as OTP ROM and usually shortened to OTP, is made of the exact same design of efuses that's being discussed here.
Efuse here has a similiar meaning to the disposable current-limiting component more commonly known as a fuse: something that allows electricity to pass, but can be burned out and then it will not pass anymore

"One time programmable" is wrong in the literal meaning: it comes unprogrammed (all bits = 1) and the only possible operations are reading a bit or setting it to 0 (permanently, outside of spontaneous regrowth which takes many years of non-use), but in reality it can be programmed as many times as you want - as long as bits will only change from 1 to 0

WiiU has anti-downgrade protections too (they're in EEPROM, meaning that it's actually possible to adjust the minimum bootable version, but nobody publicly did it - not like there's any hacking-related reason to downgrade, given the newest WiiU kernel version is more exploitable than ever)

Wii, DSi, 3DS, WiiU have OTP too, because they have different contents on every single console (some later DS games are said to be made out of PROM too - it's cheaper than real mask ROM for small production runs)

On the above consoles, the many encryption keys come from multiple sources: bootrom(s), otp, eeprom, cid (nand serial number), game headers, preprogrammed into system titles...

 

[BlastedGuy9905]

More info in: http://switchbrew.org/index.php?title=Package1

Downgrade check
The bootloader will check if someone attempted to downgrade it. A fuse array will be checked, if too many fuses are burnt the bootloader will detect a downgrade attempt. The fuse array and the expected number of burnt fuses is different on unit type 0 (non-retail) and unit type 1 (retail).

Panic
The panic function does the following things:

• It clears the stack
• It disables(?) and clears the security engine
• It sets a fuse (so that Nintendo knows that you attempted to mess with the bootloader)
• It clears the key area
• It clears the data for stage 2
• It signals over the debug interface that a panic occurred until the Switch is reset.

Wait, this doesn't prevent exploits/homebrew, right? It only prevents downgrading, that's what I understand.

 

[Deleted-355425]

meh this is what xbox 360 had, still got *****

Last edited by BORTZ, 3 minutes ago - Reason: I do not condone the use of that word

So we are censoring the word 'raped' now, Hope you are going to go through the whole forum and change it everywhere and not just single my post out, this place is going to the dogs.

 

[mariogamer]

Just use exploits for current firmware's, fuck the efuses.

--------------------- MERGED ---------------------------

Just to add, this is an effective method but come one people, this is Nintendo we are talking about.. and exploits are going to be found throughout the switches whole firmware life.

Lul..... At the beginning I was saying this..... But EVERY single software can be hacked/jailbreaked/rooted...... (da fuck why is there so many name ) (this may take time, but every single fix of a flaw get another flaw in, even PS3 can be hacked but well....... SONY

But when I think about it.... There's far more interest in Nintendo (never thought about it).

 

[Pandaxclone2]

The only alarm this rings to me is if we end up going for a very long time between updates since the last known kernel/equivalent thereof exploit (Not saying there's one now, I certainly haven't been keeping up with the Switch hacking scene; but I'm giving it as a hypothetical scenario), therefore preventing people from downgrading to that firmware.

But who knows? The 3DS was like that for the longest time and now we've figured out how to directly install bootstrap to the latest 3DS firmware using nothing more than an NDS flashcart and a magnet of all things, so I'm curious to see where this development takes the Switch hacking scene and hopeful it doesn't outright stop it in its tracks.

 

[mariogamer]

The only alarm this rings to me is if we end up going for a very long time between updates since the last known kernel/equivalent thereof exploit (Not saying there's one now, I certainly haven't been keeping up with the Switch hacking scene; but I'm giving it as a hypothetical scenario), therefore preventing people from downgrading to that firmware.

But who knows? The 3DS was like that for the longest time and now we've figured out how to directly install bootstrap to the latest 3DS firmware using nothing more than an NDS flashcart and a magnet of all things, so I'm curious to see where this development takes the Switch hacking scene and hopeful it doesn't outright stop it in its tracks.

3ds didn't had proper downgrade protection until 11.4 (even here smealum has arm9 and arm11 kernel exploits)

 

[Pandaxclone2]

3ds didn't had proper downgrade protection until 11.4 (even here smealum has arm9 and arm11 kernel exploits)

Which is fair but the last known kernel exploitable firmware was 9.0-9.2. I'm not saying that other kernel exploits weren't possible but that's quite a gap between then and 11.4 when we finally figured out Bootstrap. Luckily we had downgrading measures since around 10.3-10.4 until then IIRC but that's unlikely to be the case here for the Switch.

 

[Deleted User]

i think the switch will be like the PS3 you will need to be on the right firmware if there is no exploits for higher firmwares so people save your zelda you never know where the next banner bomb comes

 

[duffmmann]

Nintendo put a bit more potection in this device than I had anticipated. Can't say I really blame them, they've been hacked to shreds with the Wii, 3DS, and Wii U (and even the Gamecube and DSi have been exploited to the extents that those hardware can be).

 

[Ryccardo]

3ds didn't had proper downgrade protection until 11.4 (even here smealum has arm9 and arm11 kernel exploits)

There's no functional difference between 3DS and NX downgrade protection (assuming most people intending to downgrade don't have a full nand backup - the blocking of this method is actually the difference)
3DS has kernel downgrade protection implemented in software since day one, just that in the 9.x and 10.x days Nintendo didn't raise the minimum version for a long time, the fact it wasn't implemented in hardware didn't matter

(And drawing a parallel with sighax, if we manage to make something the bootrom agrees with, any further check on the fuses can be patched out)

 

[mariogamer]

i think the switch will be like the PS3 you will need to be on the right firmware if there is no exploits for higher firmwares so people save your zelda you never know where the next banner bomb comes

I don't think you read any single post of this thread....

There's no functional difference between 3DS and NX downgrade protection (assuming most people intending to downgrade don't have a full nand backup - the blocking of this method is actually the difference)
3DS has kernel downgrade protection implemented in software since day one, just that in the 9.x and 10.x days Nintendo didn't raise the minimum version for a long time, the fact it wasn't implemented in hardware didn't matter

(And drawing a parallel with sighax, if we manage to make something the bootrom agrees with, any further check on the fuses can be patched out)

Thank for correcting me. But it was still unpproper.

I'm not sure if nintendo will make the same mistake tho. (For bootloader)

 

[Ryccardo]

I'm not sure if nintendo will make the same mistake tho. (For bootloader)

AFAIK the bootrom was made by Nvidia, so no chance in hell

 

[lisreal2401]

At the very least it will make software hacks a lot more difficult. At least if they can keep usermode hacks in check. You can't bypass efuses without some hardware fuckery.