1. Adran_Marit

    OP Adran_Marit Walküre's Hacker
    Member

    Joined:
    Oct 3, 2015
    Messages:
    2,886
    Country:
    Australia
    This is an advanced tutorial.Follow this guide at your own risk. I am not responsible if you mess up your switch even more. This Tutorial has only been tested on a RCM Switch

    The idea of this tutorial is to fix PikaBrick ergo PikaFix, however it can be used for any broken Prodinfo bricks.
    This fix *** WILL NOT*** allow you to go online.
    The provided files have already had Incognito pre-applied to them.
    This will wipe your previous user partition.


    Requirements

    To follow this tutorial you will need a few things:
    Your bricked consoles biskeys - Obtain with lockpick_rcm
    Your bricked RMC vulnerable switch
    A computer/laptop
    PikaFix Pack from xbins or the mirror links (Mirror 1, Mirror 2, Mirror 3)
    My custom exosphere.bin file
    HacDiskMount (Method 1+Method 2)
    NXNandManager (Method 2)
    Hekate Nyx
    Sept
    Etcher
    Atmosphere
    TegraExplorer


    This tutorial is split into two methods, with the booting phase the same for both. Please follow your preferred method and following the booting section of the guide. I have written this guide as I was following the provided steps. I will try to update the tutorial to make it more streamlined it the coming weeks.



    • A few things before you start
      • Make a rawnand and boot0/1 backup, just in case, please? It's how you got into this mess in the first place.
      • Please read the guide carefully and if you have any questions ask them in the thread...


      • Nand Repair Method 1: HacDiskMount

        • Extract the contents of the PikaFix Pack archive to your desktop
        • Place the sept folder and hekate bootloader folder and the contents of the "to sd" folder in the PikaFix archive onto the root of your microSD card
        • Inject lockpick_rcm and run it to generate your prod.keys file
        • Place your switch into RCM and inject the hekate bin file
        • Navigate to Tools > USB Tools
        • Select "SD Card"
        • Open your mounted SD card and copy your prod.keys files from your sd card to your desktop
        • Eject your microsd card in windows
        • select "eMMC RAW GPP" (sysNand) - Set read only to off
        • Run HacDiskMount as an Administrator
        • Open your eMMC from physical drives
        • Open your prod.keys
        1. Double click Prodinfo
        2. Enter your biskeys
        3. Test them
        4. Save them
        5. Restore Prodinfo from the Prodinfo.bin file in Nand files on your desktop from the PikaFix files you extracted
        • Repeat steps 1-5 for ProdInfoF, Safe, and System Partitions
        • Double click on each of the BCPKG2 files and restore them from the provided files
        • Double click on system, install the driver and mount the partition to a drive letter
        • Navigate to the save folder and delete everything EXCEPT 8000000000000120
        • Unmount the drive
        • Close HacDiskMount and open Etcher
        • Unmount "eMMC RAW GPP" and Mount "BOOT 0" - you may need to unplug the switch from the usb and replug it to continue
          DO NOT CLICK FORMAT - Just close the popup box(s)
        • Choose the boot0.bin file from the Nand files on your desktop
        • Choose your mounted boot0 drive
        • Flash it
        • Repeat for Boot1
        • Reboot to RCM
        • Launch tegra explorer.bin
        • Navigate to the "_FWGEN" folder and run the systemRestore.te script and follow the on screen prompts
        • Reboot back to RCM and relaunch tegra explorer
        • Navigate back to the "_FWGEN" folder and this time run the systemwipe.te script and follow the on screen instructions
        • Reboot back to rcm
        • Proceed to boot section of guide

      • Nand Repair Method 2: NXNandManger + HacDiskMount

        • Extract the contents of the PikaFix Pack archive to your desktop
        • Place the sept folder and hekate bootloader folder and the contents of the "to sd" folder in the PikaFix archive onto the root of your microSD card
        • Inject lockpick_rcm and run it to generate your prod.keys file
        • Place your switch into RCM and inject the hekate bin file
        • Navigate to Tools > USB Tools
        • Select "SD Card"
        • Open your mounted SD card and copy your prod.keys files from your sd card to your desktop
        • Eject your microsd card in windows
        • select "eMMC RAW GPP" (sysNand) - Set read only to off
        • Open NXNand Manager
        • Press Ctrl+D or press File > Open Drive
        • Choose your nand
        • Press Ctrl+K or Click Options > Configure Keyset
        • Choose your prod.keys you copied to your desktop
        • Press Save
        • You will notice it will say Bad Crypto and Keyset Needed, this is normal.
        1. Click Prodinfo then click the following Icon View attachment 235857
        2. Choose Prodinfo.bin from the files you extracted
        3. Press yes on the restore prompt
        4. Close the transfer box
        • Repeat Steps 1 - 4 for the ProdInfoF, Safe and System Partitions
        • Do the same restore process for the BPKG2 partitions
        • Close NXNandManager
        • Run HacDiskMount as an Administrator
        • Open your mounted drive
        • Double click on system, install the driver and mount the partition to a drive letter
        • Navigate to the save folder and delete everything EXCEPT 8000000000000120
        • Unmount the drive
        • Close HacDiskMount and open Etcher
        • Unmount "eMMC RAW GPP" and Mount "BOOT 0" - you may need to unplug the switch from the usb and replug it to continue
          DO NOT CLICK FORMAT - Just close the popup box(s)
        • Choose the boot0.bin file from the Nand files on your desktop
        • Choose your mounted boot0 drive
        • Flash it
        • Repeat for Boot1
        • Reboot to RCM
        • Launch tegra explorer.bin
        • Navigate to the "_FWGEN" folder and run the systemRestore.te script and follow the on screen prompts
        • Reboot back to RCM and relaunch tegra explorer
        • Navigate back to the "_FWGEN" folder and this time run the systemwipe.te script and follow the on screen instructions
        • Reboot back to rcm
        • Proceed to boot section of guide

      • Nand Repair Method 3: ProdInfo_Gen + HacDiskMount

        THIS METHOD IS UNDER CONSTUCTION


    • Booting

      • Remount the microSD Car]d with hekate
      • Copy my modified exosphere.bin to your atmosphere folder on your microSD card
      • For launching with Hekate add the following line to your hekate_ipl.ini
      'secmon=atmosphere/exosphere.bin'​

      [config]
      autoboot=0
      autoboot_list=0
      bootwait=3
      verification=2
      backlight=100
      autohosoff=1
      autonogc=1
      {-- Custom Firmwares --}
      [HekAtmosphere]
      fss0=atmosphere/fusee-secondary.bin
      kip1patch=nosigchk
      atmosphere=1
      secmon=atmosphere/exosphere.bin
      • For launching with Fusee-primary add the following lines to atmosphere/config/BCT.ini

        [stage2]
        exosphere = atmosphere/exosphere.bin
      BCT0
      [stage1]
      stage2_path = atmosphere/fusee-secondary.bin
      stage2_mtc_path = atmosphere/fusee-mtc.bin
      stage2_addr = 0xF0000000
      stage2_entrypoint = 0xF0000000
      [stage2]
      exosphere = atmosphere/exosphere.bin
      • Unmount your microSD card, and proceed to launch with your now working switch


    Credits
    SciresM and the ReSwitched team for Atmosphere
    PabloZaiden for their deviceid exosphere builder
    Rajkosto for HacDiskMount
    Eliboa for NXNandManager
    SuchMemeManySkill for eMMC Hacc Gen and TegraExplorer
    CTCaer for Hekate
    Shchmue for Lockpick_RCM
    ScandalUK for Incognito_RCM
    Anyone else who helped out on these projects
    Linuxares for help with Method 2

    Finally I would like to have a massive thanks to
    Anonymous who donated their nand to me for experimenting with and saying it can be used publicly for this fix
     
    Last edited by Adran_Marit, Dec 15, 2020
    hausa51, WiiEJECT, Sword87 and 16 others like this.
  2. Adran_Marit

    OP Adran_Marit Walküre's Hacker
    Member

    Joined:
    Oct 3, 2015
    Messages:
    2,886
    Country:
    Australia
    Reserved
     
  3. 119880114

    119880114 Member
    Newcomer

    Joined:
    Aug 12, 2015
    Messages:
    15
    Country:
    Switzerland
    how can download PikaFix Pack from xbins
    search file is not found
    can you upload file to other side (MEGA,google)
    thx
     
  4. Adran_Marit

    OP Adran_Marit Walküre's Hacker
    Member

    Joined:
    Oct 3, 2015
    Messages:
    2,886
    Country:
    Australia
    Download autoxbins and navigate to the listed directory to download. Autoxbins will be marked as a virus but this is a false positive but is fine
     
    Last edited by Adran_Marit, Nov 30, 2020
    Modificatorul and Subtle Demise like this.
  5. 119880114

    119880114 Member
    Newcomer

    Joined:
    Aug 12, 2015
    Messages:
    15
    Country:
    Switzerland
    thx you reply
    ok I see file size(2.8G) and download speed is 6kb/s is impossible
     
  6. Adran_Marit

    OP Adran_Marit Walküre's Hacker
    Member

    Joined:
    Oct 3, 2015
    Messages:
    2,886
    Country:
    Australia
    Due to the nature of the pack been a Gray area at best I'm not willing to link it here
     
  7. chronoss

    chronoss GBAtemp Addict
    Member

    Joined:
    May 26, 2015
    Messages:
    2,376
    Country:
    Congo, Republic of the
    I have autox-xbins but i dont see the directory to download your pack, it's my first time to use this application :(
     
  8. Adran_Marit

    OP Adran_Marit Walküre's Hacker
    Member

    Joined:
    Oct 3, 2015
    Messages:
    2,886
    Country:
    Australia
    connect using xbins then navigate to the directory I listed next to the pack name in requirements, or use the new mirror link
     
    Subtle Demise likes this.
  9. chronoss

    chronoss GBAtemp Addict
    Member

    Joined:
    May 26, 2015
    Messages:
    2,376
    Country:
    Congo, Republic of the
    Where is the liste ?

    Capture.PNG
     
  10. Adran_Marit

    OP Adran_Marit Walküre's Hacker
    Member

    Joined:
    Oct 3, 2015
    Messages:
    2,886
    Country:
    Australia
    It hasn't fully loaded, when fully loaded it will look like this
     

    Attached Files:

    chronoss likes this.
  11. linuxares

    linuxares I'm not a generous god!
    Moderator

    Joined:
    Aug 5, 2007
    Messages:
    8,223
    Country:
    Sweden
    It say you're banned for 7 days.
     
    Subtle Demise and chronoss like this.
  12. Adran_Marit

    OP Adran_Marit Walküre's Hacker
    Member

    Joined:
    Oct 3, 2015
    Messages:
    2,886
    Country:
    Australia
    That's an oof, thankfully one mirror is now up
     
  13. chronoss

    chronoss GBAtemp Addict
    Member

    Joined:
    May 26, 2015
    Messages:
    2,376
    Country:
    Congo, Republic of the
    OK

    It's my first time to use this and i'm already banned, pfffff
     
    Subtle Demise likes this.
  14. linuxares

    linuxares I'm not a generous god!
    Moderator

    Joined:
    Aug 5, 2007
    Messages:
    8,223
    Country:
    Sweden
    do you use a VPN? Might be why.
     
    chronoss likes this.
  15. chronoss

    chronoss GBAtemp Addict
    Member

    Joined:
    May 26, 2015
    Messages:
    2,376
    Country:
    Congo, Republic of the
    Nothing
     
  16. linuxares

    linuxares I'm not a generous god!
    Moderator

    Joined:
    Aug 5, 2007
    Messages:
    8,223
    Country:
    Sweden
    Okey, well. Someone probably will fix a mirror so you can get it via there. Because you never get to the IRC server. If auto-xbins doesn't go to the IRC server, and get you permission to connect. It won't work sadly. It say "something about drones" so your said IP must be in a blacklist.

    @iriez do you happen to know the error he get?
     
    Subtle Demise likes this.
  17. linuxares

    linuxares I'm not a generous god!
    Moderator

    Joined:
    Aug 5, 2007
    Messages:
    8,223
    Country:
    Sweden
    There is a mirror in OP now
     
    Subtle Demise and chronoss like this.
  18. kickmeh

    kickmeh Advanced Member
    Newcomer

    Joined:
    Jun 16, 2020
    Messages:
    53
    Country:
    Switzerland
    yes i have 2 console with soft brick
    first case biskey still blue, user n system partitions still good, but wont boot (no error code splash) failed booting ofw or cfw autorcm off
    second case biskey red, error code 0x234c02, also cannot boot ofw or cfw

    i ll try with ur tool, later give a feedback, thanks
     
  19. Adran_Marit

    OP Adran_Marit Walküre's Hacker
    Member

    Joined:
    Oct 3, 2015
    Messages:
    2,886
    Country:
    Australia
    Any updates? I feel like it should work for console 1, not sure on console 2
     
    kickmeh likes this.
  20. Tamalulu

    Tamalulu Member
    Newcomer

    Joined:
    Jun 8, 2020
    Messages:
    33
    Country:
    France
Draft saved Draft deleted
Loading...

Hide similar threads Similar threads with keywords - Unbricking, (PikaFix), ProdInfo