Hacking Switch Cartridge - Reverse Engineering

[spotanjo3]

What's the point ? If there is no Switch emulator or Switch is hack then there is no way to test the dump so called rom or iso.

 

[Drakia]

What's the point ? If there is no Switch emulator or Switch is hack then there is no way to test the dump so called rom or iso.

Same reason we had 3ds dumps before flash cards/cfw, WiiU dumps before sig patches, and currently have ps4 dumps with no way to play them, because eventually we will be able to use them.

 

[TheCyberQuake]

What's the point ? If there is no Switch emulator or Switch is hack then there is no way to test the dump so called rom or iso.

3ds had dumps before they were of any use. Understanding the cart (and thus being able to dump it) is the first part of getting it to run again.

 

[AyanamiRei0]

What's the point ? If there is no Switch emulator or Switch is hack then there is no way to test the dump so called rom or iso.

Just a proof of concept really just to see if rom dumping is possible at this time.

 

[Plushie]

Question: You say it looks like a normal NAND chip. Doesn't Nintendo normally use ROM with a small flash memory for saving? With Switch Cartridges being read-only and can't save to the card, wouldn't it be more logical for them to just be using simple ROMs?

 

[Dark-Sider]

.3ds roms were online way before anyone made an emulator or working flash cart, dumping is easier then getting them to run again.

If by copying you just meant dumping it, then I'm inclined to agree. I always think of "cloning" a cart when someone talks about copying (creating a duplicate that actually can be run on the console)

Question: You say it looks like a normal NAND chip. Doesn't Nintendo normally use ROM with a small flash memory for saving? With Switch Cartridges being read-only and can't save to the card, wouldn't it be more logical for them to just be using simple ROMs?

He meant it looks like a chip that has the same TSOP layout as common NAND chips. However this is just a way of packaging custom ICs. https://en.wikipedia.org/wiki/Thin_Small_Outline_Package You can't tell what the chips actually does just by looking at it (if it has no / unknown markings)

 

[Deleted User]

What's the point ? If there is no Switch emulator or Switch is hack then there is no way to test the dump so called rom or iso.

Knowledge is power.

 

[Duo8]

I don't think this is the case, but I guess time will tell. Adding CPU-Protection and stuff really adds up on production costs when you make millions of them.

Impossible? No, definitely not.
Unlikely? Yes.

Anyways right now I'm probably going to design a PCB for the switch where I can solder a bunch of wires on to debug anything thats happening on there, sounds like the most flexible solution on getting to know the cartridge a bit better

That's what the Vita did IIRC. These chips have a controller and they just use that.
The Vita also used the COB packaging like botw cart.

 

[Arck]

#prayforflashcard

 

[dubbz82]

What's the point ? If there is no Switch emulator or Switch is hack then there is no way to test the dump so called rom or iso.

1. It would be a Rom as its dumped from a cartridge.
2. Because we can?
3. Kinda hard to develop any sort of flash cart/Rom loader without understanding how the carts work in the first place, no? Also pretty hard for anyone that might be working on a loader (either hardware or software) to know if its actually working without having some means of testing it.

 

[spotanjo3]

1. It would be a Rom as its dumped from a cartridge.
2. Because we can?
3. Kinda hard to develop any sort of flash cart/Rom loader without understanding how the carts work in the first place, no?

You don't have to explain again. Please check my "like" before you answer my question. Anyway, I just click "like" on those two people that already answered my question, thanks anyway. That's why I didn't look at it again until now because of red mark appear on the bell icon and I thought it is something else. Let it go, ok ?

 

[xile6]

What's the point ? If there is no Switch emulator or Switch is hack then there is no way to test the dump so called rom or iso.

And you sir happen to be an enduser.

To the hacking scene dumps are use to dig through and find data.
You get a few dumps and compare what they have in common to each other. This is how you got about getting encryption keys, that would later be use to fully open the games and you have a way into the system.

Samw as sky3ds they spoof a real 3ds cart and thats how they were able to run 3ds game on unmodified firmware

 

[Mega-Mew]

Good and interesting job, good luck for the next step.

 

[DarthDub]

Good luck!

 

[Conn0r]

Wait, it's not rom? Could we connect wires to it and reflash a new image to it?

 

[xile6]

Wait, it's not rom? Could we connect wires to it and reflash a new image to it?

probably lock down with codes, but i see where your trying to go.

 

[spotanjo3]

And you sir happen to be an enduser.

To the hacking scene dumps are use to dig through and find data.
You get a few dumps and compare what they have in common to each other. This is how you got about getting encryption keys, that would later be use to fully open the games and you have a way into the system.

Samw as sky3ds they spoof a real 3ds cart and thats how they were able to run 3ds game on unmodified firmware

LOL

 

[SilverWah]

I'll keep a close eye on this thread. It might get interesting.

 

[Red1Reaper]

Interesting.

 

[Roamin64]

I'm curious to know what is the background of the OP ? I highly doubt if you are asking for donations that you can rival with all the chinese that make a living by copying other's work, that have tons of resources and pcb manufactures in their backyard. I don't know Smiba , and I've never heard of you, but anything is possible. But if high profile people in the scene aren't asking for any donations, I doubt you'll get anywhere. Anyone with enough skills will not be asking himself how to probe the cart while it's in the device , but would simply build a custom pcb that would replace the cartridge in the slot , or simply directly solder to the cartridge slot inside the switch , connect it to a FPGA , logic analyzer and a bunch of other tools and then figure out what each pin really does with man in the middle attacks and other methods.

I'm not trying to bash on Smiba at all , I wish you all the success in the world , hell all I want from this console is piracy. But you simply don't sound like you'll be the one cracking this whole stuff.

Just push the current exploits even further , and once you get kernel access , you won't even need to understand how the cartridge works , you'll just be able to use the console to rip the cartridge.

Still , I wish you good luck in your endeavor.