Tutorial  Updated

Switch Unbricking Guide - ProdInfo Fix (PikaFix)

This is an advanced tutorial.Follow this guide at your own risk. I am not responsible if you mess up your switch even more. This Tutorial has only been tested on a RCM Switch. This has not been tested on switch lite, oled or redbox mariko units with chips

The idea of this tutorial is to fix PikaBrick ergo PikaFix, however it can be used for any broken Prodinfo bricks.
This fix *** WILL NOT*** allow you to go online.
The provided files have already had Incognito pre-applied to them.
**METHOD 1 IS THE EASIEST**
Methods 2 and 3 will wipe your previous user partition.
Methods 2 and 3 are now deprecated



Requirements

To follow this tutorial you will need a few things:
ALL METHODS

Your bricked consoles biskeys - Obtain with lockpick_rcm
Your bricked RMC vulnerable switch
A computer/laptop
HacDiskMount or NXNandManager
Hekate Nyx
Atmosphere

Method 1
Prodinfo_Gen
Donor Prodinfo File (or use your own donor)

Methods 2 and 3 - DEPRECATED
PikaFix Pack from xbins or the mirror links (Mirror 1, Mirror 2, Mirror 3)
xbins file location - /SWITCH/PC based software/Utilities/pikabricker repair pack
My custom exosphere.bin file
NXNandManager (Method 2)
Etcher
TegraExplorer

This tutorial has three methods. Method 1 is recommended as Methods 2 and 3 are no longer updated.
Please follow your preferred method and following the appropriate booting section of the guide. I have written this guide as I was following the provided steps.

Before You Start


A few things before you start
  • Make a rawnand and boot0/1 backup, just in case, please? It's how you got into this mess in the first place.
  • Please read the guide carefully and if you have any questions ask them in the thread...

Repair Method 1DEPRECATED


  1. Repair Method 1: ProdInfo_Gen + HacDiskMount OR NXNANDMANAGER

    • Place the donor_prodinfo.bin on your microSD card in the switch folder (SD:/switch/donor_prodinfo.bin)
    • Put your switch in RCM
    • Inject prodinfo_gen.bin
    • Choose 'Build PRODINFO file from donor
    • Reboot to RCM
    • Inject the latest hekate (make sure you have all the hekate files on your microSD card)
    • Press Tools
    • Press USB Tools
    • Press SD Card
    • On your pc copy "generated_prodinfo_from_donor.bin" in the switch folder your desktop
    • Eject your microSD Card
    • Turn 'Read Only' to off
    • Press eMMC RAW GPP
    • On your PC open your Nand Manager of choice, either HacDiskMount or NXNandManager, I'll be using the latter
    • Configure your keys from the prod.keys you got from your bricked console
    • Open physical drive and choose your switch's emmc
    • Highlight prodinfo
    • press restore
    • choose the bin you copied to your dekstop
    • resave your keyset
    • Close
    • boot atmosphere

  2. Method 2Method 3


    1. Nand Repair Method 2: NXNandManger + HacDiskMount


      • Extract the contents of the PikaFix Pack archive to your desktop
      • Place the sept folder and hekate bootloader folder and the contents of the "to sd" folder in the PikaFix archive onto the root of your microSD card
      • Inject lockpick_rcm and run it to generate your prod.keys file
      • Place your switch into RCM and inject the hekate bin file
      • Navigate to Tools > USB Tools
      • Select "SD Card"
      • Open your mounted SD card and copy your prod.keys files from your sd card to your desktop
      • Eject your microsd card in windows
      • select "eMMC RAW GPP" (sysNand) - Set read only to off
      • Open NXNand Manager
      • Press Ctrl+D or press File > Open Drive
      • Choose your nand
      • Press Ctrl+K or Click Options > Configure Keyset
      • Choose your prod.keys you copied to your desktop
      • Press Save
      • You will notice it will say Bad Crypto and Keyset Needed, this is normal.
      1. Click Prodinfo then click the following Icon View attachment 235857
      2. Choose Prodinfo.bin from the files you extracted
      3. Press yes on the restore prompt
      4. Close the transfer box
      • Repeat Steps 1 - 4 for the ProdInfoF, Safe and System Partitions
      • Do the same restore process for the BPKG2 partitions
      • Close NXNandManager
      • Run HacDiskMount as an Administrator
      • Open your mounted drive
      • Double click on system, install the driver and mount the partition to a drive letter
      • Navigate to the save folder and delete everything EXCEPT 8000000000000120
      • Unmount the drive
      • Close HacDiskMount and open Etcher
      • Unmount "eMMC RAW GPP" and Mount "BOOT 0" - you may need to unplug the switch from the usb and replug it to continue
        DO NOT CLICK FORMAT - Just close the popup box(s)
      • Choose the boot0.bin file from the Nand files on your desktop
      • Choose your mounted boot0 drive
      • Flash it
      • Repeat for Boot1
      • Reboot to RCM
      • Launch tegra explorer.bin
      • Navigate to the "_FWGEN" folder and run the systemRestore.te script and follow the on screen prompts
      • Reboot back to RCM and relaunch tegra explorer
      • Navigate back to the "_FWGEN" folder and this time run the systemwipe.te script and follow the on screen instructions
      • Reboot back to rcm
      • Proceed to boot section of guide

    2. Nand Repair Method 3: HacDiskMount


      • Extract the contents of the PikaFix Pack archive to your desktop
      • Place the sept folder and hekate bootloader folder and the contents of the "to sd" folder in the PikaFix archive onto the root of your microSD card
      • Inject lockpick_rcm and run it to generate your prod.keys file
      • Place your switch into RCM and inject the hekate bin file
      • Navigate to Tools > USB Tools
      • Select "SD Card"
      • Open your mounted SD card and copy your prod.keys files from your sd card to your desktop
      • Eject your microsd card in windows
      • select "eMMC RAW GPP" (sysNand) - Set read only to off
      • Run HacDiskMount as an Administrator
      • Open your eMMC from physical drives
      • Open your prod.keys
      1. Double click Prodinfo
      2. Enter your biskeys
      3. Test them
      4. Save them
      5. Restore Prodinfo from the Prodinfo.bin file in Nand files on your desktop from the PikaFix files you extracted
      • Repeat steps 1-5 for ProdInfoF, Safe, and System Partitions
      • Double click on each of the BCPKG2 files and restore them from the provided files
      • Double click on system, install the driver and mount the partition to a drive letter
      • Navigate to the save folder and delete everything EXCEPT 8000000000000120
      • Unmount the drive
      • Close HacDiskMount and open Etcher
      • Unmount "eMMC RAW GPP" and Mount "BOOT 0" - you may need to unplug the switch from the usb and replug it to continue
        DO NOT CLICK FORMAT - Just close the popup box(s)
      • Choose the boot0.bin file from the Nand files on your desktop
      • Choose your mounted boot0 drive
      • Flash it
      • Repeat for Boot1
      • Reboot to RCM
      • Launch tegra explorer.bin
      • Navigate to the "_FWGEN" folder and run the systemRestore.te script and follow the on screen prompts
      • Reboot back to RCM and relaunch tegra explorer
      • Navigate back to the "_FWGEN" folder and this time run the systemwipe.te script and follow the on screen instructions
      • Reboot back to rcm
      • Proceed to boot section of guide



Booting Method 1

Download latest atmosphere and launch fusee.bin

Booting method 2 and 3


    • Remount the microSD Card with hekate
    • Copy my modified exosphere.bin to your atmosphere folder on your microSD card
    • For launching with Hekate add the following line to your hekate_ipl.ini
    'secmon=atmosphere/exosphere.bin'​

    [config]​
    autoboot=0​
    autoboot_list=0​
    bootwait=3​
    verification=2​
    backlight=100​
    autohosoff=1​
    autonogc=1​
    {-- Custom Firmwares --}​
    [HekAtmosphere]​
    fss0=atmosphere/package3​
    kip1patch=nosigchk​
    atmosphere=1​
    secmon=atmosphere/exosphere.bin​

    • For launching with Fusee-primary add the following lines to atmosphere/config/BCT.ini (UPDATE FOR NEW RELEASE)

      [stage2]
      exosphere = atmosphere/exosphere.bin
    BCT0​
    [stage1]​
    stage2_path = atmosphere/fusee-secondary.bin​
    stage2_mtc_path = atmosphere/fusee-mtc.bin​
    stage2_addr = 0xF0000000​
    stage2_entrypoint = 0xF0000000​
    [stage2]​
    exosphere = atmosphere/exosphere.bin​


  • Unmount your microSD card, and proceed to launch with your now working switch
Credits
SciresM and the ReSwitched team for Atmosphere
PabloZaiden for their deviceid exosphere builder
Rajkosto for HacDiskMount
Eliboa for NXNandManager
SuchMemeManySkill for eMMC Hacc Gen and TegraExplorer
CTCaer for Hekate
Shchmue for Lockpick_RCM
ScandalUK for Incognito_RCM
Anyone else who helped out on these projects
Linuxares for help with Method 2

Finally I would like to have a massive thanks to
Anonymous who donated their nand to me for experimenting with and saying it can be used publicly for this fix
 
Last edited by Adran_Marit,

Adran_Marit

Walküre's Hacker
OP
Member
Joined
Oct 3, 2015
Messages
3,781
Trophies
1
Location
42*South
XP
4,550
Country
Australia
Hey, just curious, why do you need a custom exosphere.bin? The way I rebuilt my nand I am able to use normal unmodified OS and normal Atmosphere just fine.

--------------------- MERGED ---------------------------





someone I know tried to fix a patched switch with a sx core, but the sx core doesn't allow for tsec keys to be dumped so it wasn't possible to get it working.

A normal unmodded atmosphere or Horizon OS will boot if your console prodinfo is intact. A few years back there was a bricker that corrupted that section of your nand and without a backup, it rendered your switch useless unless you could restore a working prodinfo file. You could do this with someone else's prodinfo, and resign it with your keys (Done in the tutorial) however, it still wouldn't boot as there was a mismatch in the deviceID, the custom exosphere in this tutorial has been modified so that with the donated prodinfo, both deviceID's match and the console will boot.

They don't need the tsec keys, they just need to be able to launch Hekate and then lockpick_rcm to get their console biskeys. As I said it may work on a chipped console but I am not sure and take no responsibility.

In theory, it should be able to work on them, but if you have a chipped console you really really really should have a full nand backup.
 

guyman70718

Well-Known Member
Member
Joined
May 31, 2017
Messages
168
Trophies
0
Age
24
XP
507
Country
United States
A normal unmodded atmosphere or Horizon OS will boot if your console prodinfo is intact. A few years back there was a bricker that corrupted that section of your nand and without a backup, it rendered your switch useless unless you could restore a working prodinfo file. You could do this with someone else's prodinfo, and resign it with your keys (Done in the tutorial) however, it still wouldn't boot as there was a mismatch in the deviceID, the custom exosphere in this tutorial has been modified so that with the donated prodinfo, both deviceID's match and the console will boot.

They don't need the tsec keys, they just need to be able to launch Hekate and then lockpick_rcm to get their console biskeys. As I said it may work on a chipped console but I am not sure and take no responsibility.

In theory, it should be able to work on them, but if you have a chipped console you really really really should have a full nand backup.
oh, i used prodinfogen to generate a new prodinfo from scratch so that's why I don't need custom exosphere. I can dm you something to add to the post to add about prodinfogen, which I see is blank in your post now, but just a note prodinfogen breaks the cart slot, unless your custom exosphere fixes it?
 

Adran_Marit

Walküre's Hacker
OP
Member
Joined
Oct 3, 2015
Messages
3,781
Trophies
1
Location
42*South
XP
4,550
Country
Australia
oh, i used prodinfogen to generate a new prodinfo from scratch so that's why I don't need custom exosphere. I can dm you something to add to the post to add about prodinfogen, which I see is blank in your post now, but just a note prodinfogen breaks the cart slot, unless your custom exosphere fixes it?

Ahhh yeah from scratch is a minimal, this is meant to restore as much functionality as possible, also the prodinfogen has recently been updated so a donor prodinfo will have the gamecard working - I still need to test - only having 2 days a week off doesn't leave much spare time so I'll update it soon, but if you wanna dm me something feel free :)
 

dytri

Active Member
Newcomer
Joined
Apr 24, 2020
Messages
38
Trophies
0
Age
40
XP
101
Country
United States
Did you try restoring anyone else nand backup at some point?

What format is your sd card?

Did your biskeys match your nand?

As I said message me on discord it's going to be a quicker reply

If I did reformat my SD, it would always be set to Fat32.
Sadly and stupidly enough, I didnt even make a NAND backup way back when I homebrew my switch nor did I ever restore to another already existing Nand backup that a different person made.
As for the BISH keys, when I did use HacDiskMount... every key would work besides the keys for Prodinfo.
Looking further into it, I found out my prodinfo was tamper with so it was corrupted (Im not even sure how, given I never miss with it besides just trying to sync the crypo keys when trying to downgrade).. but stumbling upon this guide, I figure It would correct that by making a different one entirely.
Sadly that didnt seem to work. I'll try to contact you on your discord if I must, but I'm not sure what else I can possibly do.
 
Last edited by dytri,

Adran_Marit

Walküre's Hacker
OP
Member
Joined
Oct 3, 2015
Messages
3,781
Trophies
1
Location
42*South
XP
4,550
Country
Australia
If I did reformat my SD, it would always be set to Fat32.
Sadly and stupidly enough, I didnt even make a NAND backup way back when I homebrew my switch nor did I ever restore to another already existing Nand backup that a different person made.
As for the BISH keys, when I did use HacDiskMount... every key would work besides the keys for Prodinfo.
Looking further into it, I found out my prodinfo was tamper with so it was corrupted (Im sure, given I never miss with it besides just trying to sync the crypo keys when trying to downgrade).. but stumbling upon this guide, I figure It would correct that by making a different one entirely.
Sadly that didnt seem to work. I'll try to contact you on your discord if I must, but I'm not sure what else I can possibly do.

You can try following THESE steps to getting your biskeys, and they may work, not sure entirely though. Depending on the section it's failing, it may work it may not.
 

Amberlightin

New Member
Newbie
Joined
Jan 12, 2021
Messages
3
Trophies
0
Age
33
XP
36
Country
Russia
I got a problem. I carefully follow the step in guide and before i get to flash BOOT0 and BOOT1 with BalenaEtcher everything was fine but when i try to flash from file in archive boot0/1 Etcher gave me error on step with verification and so i can't flash boot0/1. Is the any way to flash boot0/1 without Etcher or how i can fix this problem? By the way restoring boot0/1 from backup works fine. Read only in Hekate is off. Thx for replying.
 

Adran_Marit

Walküre's Hacker
OP
Member
Joined
Oct 3, 2015
Messages
3,781
Trophies
1
Location
42*South
XP
4,550
Country
Australia
I got a problem. I carefully follow the step in guide and before i get to flash BOOT0 and BOOT1 with BalenaEtcher everything was fine but when i try to flash from file in archive boot0/1 Etcher gave me error on step with verification and so i can't flash boot0/1. Is the any way to flash boot0/1 without Etcher or how i can fix this problem? By the way restoring boot0/1 from backup works fine. Read only in Hekate is off. Thx for replying.

I've never had this issue before, did you extract the boot files from the archive? And there is, I however, am not sure the s method I'm thinking of would work, I'll test some stuff later and update the first post
 

Amberlightin

New Member
Newbie
Joined
Jan 12, 2021
Messages
3
Trophies
0
Age
33
XP
36
Country
Russia
I've never had this issue before, did you extract the boot files from the archive? And there is, I however, am not sure the s method I'm thinking of would work, I'll test some stuff later and update the first post
Yeah. I download boot from your archive. Well I was able flash this boot by using memloader and hekate 4.7 but in the end it didn't work for my console. Even Nintendo boot logo didnt show up.

By the way. If I have my own, original prodinfo, prodinfof and all keys can I just borrow some working backup change prodinfo and etc and just restore this backup using hekate restore?
 
Last edited by Amberlightin,

Adran_Marit

Walküre's Hacker
OP
Member
Joined
Oct 3, 2015
Messages
3,781
Trophies
1
Location
42*South
XP
4,550
Country
Australia
Yeah. I download boot from your archive. Well I was able flash this boot by using memloader and hekate 4.7 but in the end it didn't work for my console. Even Nintendo boot logo didnt show up.

By the way. If I have my own, original prodinfo, prodinfof and all keys can I just borrow some working backup change prodinfo and etc and just restore this backup using hekate restore?

If you have your original prodinfo and it isn't bricked, you can restore that, then just use emmchacgen to make firmware files and flash those - provided its an rcm vunerable switch
 

Amberlightin

New Member
Newbie
Joined
Jan 12, 2021
Messages
3
Trophies
0
Age
33
XP
36
Country
Russia
If you have your original prodinfo and it isn't bricked, you can restore that, then just use emmchacgen to make firmware files and flash those - provided its an rcm vunerable switch
Is the any way to check bricked my prodinfo or not?
Originally my eMMC enable read only mode after error in restoring original backup process. Then my HDD died and i lost any backup files from original emmc but i still can restore prodinfo and proninfof from old eMMC.
 
Last edited by Amberlightin,

Adran_Marit

Walküre's Hacker
OP
Member
Joined
Oct 3, 2015
Messages
3,781
Trophies
1
Location
42*South
XP
4,550
Country
Australia
Is the any way to check bricked my prodinfo or not?
Originally my eMMC enable read only mode after error in restoring original backup process. Then my HDD died and i lost any backup files from original emmc but i still can restore prodinfo and proninfof from old eMMC.

if it restores and the console boots with new firmware its not bricked
 

chronoss

Well-Known Member
Member
Joined
May 26, 2015
Messages
3,007
Trophies
1
XP
4,892
Country
Congo, Republic of the
Hello !

I use this methode when i got a bricked switch, it work well with Atmo 0.14.4, i use this tuto. Now, i update my switch to lastest firmware and it don't work, i can boot into sysnand with a payload but nothing on cfw (black screen). To use my switch again, i use a new prodinfo genereted by Prodfingo_gen and with this, no need deviceid_exosphere.bin and now, i can use my Nintendo Switch with the last fw without problem, see here for more info about my road to victory :)

@Adran_Marit : i think, u need to update your guide :)
 

Adran_Marit

Walküre's Hacker
OP
Member
Joined
Oct 3, 2015
Messages
3,781
Trophies
1
Location
42*South
XP
4,550
Country
Australia
Hello !

I use this methode when i got a bricked switch, it work well with Atmo 0.14.4, i use this tuto. Now, i update my switch to lastest firmware and it don't work, i can boot into sysnand with a payload but nothing on cfw (black screen). To use my switch again, i use a new prodinfo genereted by Prodfingo_gen and with this, no need deviceid_exosphere.bin and now, i can use my Nintendo Switch with the last fw without problem, see here for more info about my road to victory :)

@Adran_Marit : i think, u need to update your guide :)

This used the exact same method in the tutorial listed, both methods I listed tested and worked for me, from a bricked device. I need to add a prodinfo_gen section but I haven't had time lately. Did you also use a from scratch prodinfo or from a donor? as the ones I use are from donor.

Edit: Additionally the custom exosphere I linked is only needed if you use the donor I've provided, as they match.
 
Last edited by Adran_Marit,
  • Like
Reactions: chronoss

chronoss

Well-Known Member
Member
Joined
May 26, 2015
Messages
3,007
Trophies
1
XP
4,892
Country
Congo, Republic of the
This used the exact same method in the tutorial listed, both methods I listed tested and worked for me, from a bricked device. I need to add a prodinfo_gen section but I haven't had time lately. Did you also use a from scratch prodinfo or from a donor? as the ones I use are from donor.

Edit: Additionally the custom exosphere I linked is only needed if you use the donor I've provided, as they match.
With prodinfo_gen, i use a scratched prodfinfo, no donor
 

de9ed

Well-Known Member
Member
Joined
Oct 22, 2020
Messages
278
Trophies
0
Age
30
XP
919
Country
Canada
I have followed from a-z on the unbricking progress, I have placed atmosphere 0.17.1 and hekate 5.5.3 with the modified exosphere.bin and hekate_ipl.ini. I am still getting black screen after trying to boot hekAtmosphere.

I had to use Tegraexplorer 2.0.2 instead of the latest one for the system cleanup and restore. I will try the guide again tonight to see if it makes any difference.

Do i need to create EmuMMC or can i use SysMMC ?
 
Last edited by de9ed,

chronoss

Well-Known Member
Member
Joined
May 26, 2015
Messages
3,007
Trophies
1
XP
4,892
Country
Congo, Republic of the
I have followed from a-z on the unbricking progress, I have placed atmosphere 0.17.1 and hekate 5.5.3 with the modified exosphere.bin and hekate_ipl.ini. I am still getting black screen after trying to boot hekAtmosphere.
Black screen afther the splash screen of atmosphere or when u launch atmo with Hekate ?
 

de9ed

Well-Known Member
Member
Joined
Oct 22, 2020
Messages
278
Trophies
0
Age
30
XP
919
Country
Canada
Black screen afther the splash screen of atmosphere or when u launch atmo with Hekate ?

black screen after splash screen of atmosphere launched through hekate. i don't even get the Nintendo logo or the joycon logo anymore
 

chronoss

Well-Known Member
Member
Joined
May 26, 2015
Messages
3,007
Trophies
1
XP
4,892
Country
Congo, Republic of the
black screen after splash screen of atmosphere launched through hekate. i don't even get the Nintendo logo or the joycon logo anymore
The same problem with me when u update my switch, try to use prodinfo_gen.
Try this mini guide to create a new prodinfo scratched, no need device_exophere.bin with this :
  • Make sure you have a /switch/prod.keys file on your microSD card with, at least, valid master keys in it.
  • Launch prodinfo_gen.bin using your favorite payload injector or chainloader.
  • You should find /switch/generated_prodinfo_from_scratch.bin or /switch/generated_prodinfo_from_donor.bin depending on what you selected.
  • You can now write that PRODINFO to your NAND using a tool such as HacDiskMount (it is recommended to make a backup of the current PRODINFO first).
 
  • Like
Reactions: de9ed

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    SylverReZ @ SylverReZ: Also nice. Never really watched Fallout on Prime, but sounds like a good show. +1