This is an advanced tutorial.Follow this guide at your own risk. I am not responsible if you mess up your switch even more. This Tutorial has only been tested on a RCM Switch. This has not been tested on switch lite, oled or redbox mariko units with chips

The idea of this tutorial is to fix PikaBrick ergo PikaFix, however it can be used for any broken Prodinfo bricks.
This fix *** WILL NOT*** allow you to go online.
The provided files have already had Incognito pre-applied to them.
**METHOD 1 IS THE EASIEST**
Methods 2 and 3 will wipe your previous user partition.
Methods 2 and 3 are now deprecated

Requirements

To follow this tutorial you will need a few things:
ALL METHODS
Your bricked consoles biskeys - Obtain with lockpick_rcm
Your bricked RMC vulnerable switch
A computer/laptop
HacDiskMount or NXNandManager
Hekate Nyx
Atmosphere

Method 1
Prodinfo_Gen
Donor Prodinfo File (or use your own donor)

Methods 2 and 3 - DEPRECATED

Spoiler

PikaFix Pack from xbins or the mirror links (Mirror 1, Mirror 2, Mirror 3)

xbins file location - /SWITCH/PC based software/Utilities/pikabricker repair pack

My custom exosphere.bin file
NXNandManager (Method 2)
Etcher
TegraExplorer

This tutorial has three methods. Method 1 is recommended as Methods 2 and 3 are no longer updated.
Please follow your preferred method and following the appropriate booting section of the guide. I have written this guide as I was following the provided steps.

Before You Start

A few things before you start

• Make a rawnand and boot0/1 backup, just in case, please? It's how you got into this mess in the first place.
• Please read the guide carefully and if you have any questions ask them in the thread...

Repair Method 1DEPRECATED

1. 
   
   Repair Method 1: ProdInfo_Gen + HacDiskMount OR NXNANDMANAGER
   
   
   • Place the donor_prodinfo.bin on your microSD card in the switch folder (SD:/switch/donor_prodinfo.bin)
   • Put your switch in RCM
   • Inject prodinfo_gen.bin
   • Choose 'Build PRODINFO file from donor
   • Reboot to RCM
   • Inject the latest hekate (make sure you have all the hekate files on your microSD card)
   • Press Tools
   • Press USB Tools
   • Press SD Card
   • On your pc copy "generated_prodinfo_from_donor.bin" in the switch folder your desktop
   • Eject your microSD Card
   • Turn 'Read Only' to off
   • Press eMMC RAW GPP
   • On your PC open your Nand Manager of choice, either HacDiskMount or NXNandManager, I'll be using the latter
   • Configure your keys from the prod.keys you got from your bricked console
   • Open physical drive and choose your switch's emmc
   • Highlight prodinfo
   • press restore
   • choose the bin you copied to your dekstop
   • resave your keyset
   • Close
   • boot atmosphere
2. 
   

   Method 2Method 3

   1. 
      
      Nand Repair Method 2: NXNandManger + HacDiskMount
      
      
      
      • Extract the contents of the PikaFix Pack archive to your desktop
      • Place the sept folder and hekate bootloader folder and the contents of the "to sd" folder in the PikaFix archive onto the root of your microSD card
      • Inject lockpick_rcm and run it to generate your prod.keys file
      • Place your switch into RCM and inject the hekate bin file
      • Navigate to Tools > USB Tools
      • Select "SD Card"
      • Open your mounted SD card and copy your prod.keys files from your sd card to your desktop
      • Eject your microsd card in windows
      • select "eMMC RAW GPP" (sysNand) - Set read only to off
      • Open NXNand Manager
      • Press Ctrl+D or press File > Open Drive
      • Choose your nand
      • Press Ctrl+K or Click Options > Configure Keyset
      • Choose your prod.keys you copied to your desktop
      • Press Save
      • You will notice it will say Bad Crypto and Keyset Needed, this is normal.
      1. Click Prodinfo then click the following Icon View attachment 235857
      2. Choose Prodinfo.bin from the files you extracted
      3. Press yes on the restore prompt
      4. Close the transfer box
      • Repeat Steps 1 - 4 for the ProdInfoF, Safe and System Partitions
      • Do the same restore process for the BPKG2 partitions
      • Close NXNandManager
      • Run HacDiskMount as an Administrator
      • Open your mounted drive
      • Double click on system, install the driver and mount the partition to a drive letter
      • Navigate to the save folder and delete everything EXCEPT 8000000000000120
      • Unmount the drive
      • Close HacDiskMount and open Etcher
      • Unmount "eMMC RAW GPP" and Mount "BOOT 0" - you may need to unplug the switch from the usb and replug it to continue
        
        DO NOT CLICK FORMAT - Just close the popup box(s)
      • Choose the boot0.bin file from the Nand files on your desktop
      • Choose your mounted boot0 drive
      • Flash it
      • Repeat for Boot1
      • Reboot to RCM
      • Launch tegra explorer.bin
      • Navigate to the "_FWGEN" folder and run the systemRestore.te script and follow the on screen prompts
      • Reboot back to RCM and relaunch tegra explorer
      • Navigate back to the "_FWGEN" folder and this time run the systemwipe.te script and follow the on screen instructions
      • Reboot back to rcm
      • Proceed to boot section of guide
   2. 
      
      Nand Repair Method 3: HacDiskMount
      
      
      
      • Extract the contents of the PikaFix Pack archive to your desktop
      • Place the sept folder and hekate bootloader folder and the contents of the "to sd" folder in the PikaFix archive onto the root of your microSD card
      • Inject lockpick_rcm and run it to generate your prod.keys file
      • Place your switch into RCM and inject the hekate bin file
      • Navigate to Tools > USB Tools
      • Select "SD Card"
      • Open your mounted SD card and copy your prod.keys files from your sd card to your desktop
      • Eject your microsd card in windows
      • select "eMMC RAW GPP" (sysNand) - Set read only to off
      • Run HacDiskMount as an Administrator
      • Open your eMMC from physical drives
      • Open your prod.keys
      1. Double click Prodinfo
      2. Enter your biskeys
      3. Test them
      4. Save them
      5. Restore Prodinfo from the Prodinfo.bin file in Nand files on your desktop from the PikaFix files you extracted
      • Repeat steps 1-5 for ProdInfoF, Safe, and System Partitions
      • Double click on each of the BCPKG2 files and restore them from the provided files
      • Double click on system, install the driver and mount the partition to a drive letter
      • Navigate to the save folder and delete everything EXCEPT 8000000000000120
      • Unmount the drive
      • Close HacDiskMount and open Etcher
      • Unmount "eMMC RAW GPP" and Mount "BOOT 0" - you may need to unplug the switch from the usb and replug it to continue
        
        DO NOT CLICK FORMAT - Just close the popup box(s)
      • Choose the boot0.bin file from the Nand files on your desktop
      • Choose your mounted boot0 drive
      • Flash it
      • Repeat for Boot1
      • Reboot to RCM
      • Launch tegra explorer.bin
      • Navigate to the "_FWGEN" folder and run the systemRestore.te script and follow the on screen prompts
      • Reboot back to RCM and relaunch tegra explorer
      • Navigate back to the "_FWGEN" folder and this time run the systemwipe.te script and follow the on screen instructions
      • Reboot back to rcm
      • Proceed to boot section of guide
   
   

Booting Method 1

Download latest atmosphere and launch fusee.bin

Booting method 2 and 3

1. 
   
   Spoiler

   • Remount the microSD Card with hekate
   • Copy my modified exosphere.bin to your atmosphere folder on your microSD card
   • For launching with Hekate add the following line to your hekate_ipl.ini

   ​

   'secmon=atmosphere/exosphere.bin'​

   
   

   ​

   Spoiler

   ​

   [config]​

   autoboot=0​

   autoboot_list=0​

   bootwait=3​

   verification=2​

   backlight=100​

   autohosoff=1​

   autonogc=1​

   {-- Custom Firmwares --}​

   [HekAtmosphere]​

   fss0=atmosphere/package3​

   kip1patch=nosigchk​

   atmosphere=1​

   secmon=atmosphere/exosphere.bin​

   ​

   
   

   • For launching with Fusee-primary add the following lines to atmosphere/config/BCT.ini (UPDATE FOR NEW RELEASE)
     
     [stage2]
     exosphere = atmosphere/exosphere.bin

   Spoiler

   BCT0​

   [stage1]​

   stage2_path = atmosphere/fusee-secondary.bin​

   stage2_mtc_path = atmosphere/fusee-mtc.bin​

   stage2_addr = 0xF0000000​

   stage2_entrypoint = 0xF0000000​

   [stage2]​

   exosphere = atmosphere/exosphere.bin​

   ​
   
   

• Unmount your microSD card, and proceed to launch with your now working switch

Credits
SciresM and the ReSwitched team for Atmosphere
PabloZaiden for their deviceid exosphere builder
Rajkosto for HacDiskMount
Eliboa for NXNandManager
SuchMemeManySkill for eMMC Hacc Gen and TegraExplorer
CTCaer for Hekate
Shchmue for Lockpick_RCM
ScandalUK for Incognito_RCM
Anyone else who helped out on these projects
Linuxares for help with Method 2

Finally I would like to have a massive thanks to
Anonymous who donated their nand to me for experimenting with and saying it can be used publicly for this fix

 

[zorusgb]

That is true, however since the switch fails to read the emmc board I have little hope the mmcblkNX will either. Hence the exploe.te dongle which won't.

In your opinion, how important is to have the original boot partitions for restoring full functionality?

 

[Adran_Marit]

That is true, however since the switch fails to read the emmc board I have little hope the mmcblkNX will either. Hence the exploe.te dongle which won't.

In your opinion, how important is to have the original boot partitions for restoring full functionality?

ehhhhhh maybe like 50/50 at best.

Biggest thing is prodinfo imo... though I don't know enough about boot0/1 and what they contain to say fully

 

[zorusgb]

So finally the explitee low voltage emmc adapter arrived and its not good news right away. I'm testing the process on a second hand original emmc board and while the soldering went surprisingly smooth the chip is not recognized by the OS. I know the spare board is good as I also ordered an mmcblkNX adapter and that one reads it just fine. Tested all connections for continuity and all check out. Anyone knows how those boards behave normally? The light on mine blinks few times and goes off; not sure if this is a symptom of a problem with it or this is how it behaves when it doesn't detect anything. I also tried connecting a regular SD card to it, but still nothing.

 

[Ragna666]

ehhhhhh maybe like 50/50 at best.

Biggest thing is prodinfo imo... though I don't know enough about boot0/1 and what they contain to say fully

Hi.

i have a switch with no nand backup and i don't have the original emmc, just a replacement one.

with your tutorial now i have access to system and safe partition with the original console prod.keys, but i can't access the user partition without using my other switch prod.keys.

the switch is not booting right now and somehow the hekate not recognizing the touch panel.



do you know any method to save it?

UPDATE:
i used the second method.
i needed to use a user partition dump too, i decrypted with the working switch keys and re encrypted with the faulty switch keys.
idk why but it's not worked without this.

but i have a new problem, some games not starting, i tried to update sigpatches and other things too but it not works.
can u help me out with that?

here's some games that not start:
pokémon legends: arceus
castlevania advance collection
carrion
diablo 2 resurrected
...etc

bloodstained 1-2 and shantae and the pirates curse is working.

 

[ArturoTucan]

I left my switch at a repair shop so they could fix the usb port, I decided not to fix it with them due to their high quotation and when I tried to fix it months later I noticed the eMMC module was missing along with some screws, I bought the replacement parts from ali thinking it would be a simple repair but I haven't had luck with any guides.

Im getting Device ID: KEYSET NEEDED and FW ver. BAD CRYPTO! when loading my prod.keys and my generated nand in NxNandManager, Did I do something wrong?

 

[Imancol]

The metod 1 restore online?

 

[linuxares]

The metod 1 restore online?

Nope, no method does that.

 

[Adran_Marit]

I left my switch at a repair shop so they could fix the usb port, I decided not to fix it with them due to their high quotation and when I tried to fix it months later I noticed the eMMC module was missing along with some screws, I bought the replacement parts from ali thinking it would be a simple repair but I haven't had luck with any guides.

Im getting Device ID: KEYSET NEEDED and FW ver. BAD CRYPTO! when loading my prod.keys and my generated nand in NxNandManager, Did I do something wrong?
View attachment 335642

Do you have your original backups and keys, if so flash them then resign using your keys

 

[ArturoTucan]

Do you have your original backups and keys, if so flash them then resign using your keys

No, sadly I never tried to jailbreak my switch before mine got bricked. Does that mean my switch is gone for good?

 

[Adran_Marit]

No, sadly I never tried to jailbreak my switch before mine got bricked. Does that mean my switch is gone for good?

no, first thing first though would be to generate the keys you can using lockpick_rcm, make a backup of the nand as it is then work on partitioning and flashing teh switch files back to it using deprecated method 3. then following method 1 with prodinfo gen.
But your keys need to be valid. that is a must

 

[ArturoTucan]

Hey, thank you for replying. How do I know my keys are valid? Everytime I generate them with lockpick I get error parsing keys.dat is that expected? Im also getting errors on keyblobs 0-5, Also I got an error last time I tried to backup the entire RAW eMMC GPP. I would assume my emmc is bad but the benchmarking worked well.

no, first thing first though would be to generate the keys you can using lockpick_rcm, make a backup of the nand as it is then work on partitioning and flashing teh switch files back to it using deprecated method 3. then following method 1 with prodinfo gen.
But your keys need to be valid. that is a must

 

[Adran_Marit]

Hey, thank you for replying. How do I know my keys are valid? Everytime I generate them with lockpick I get error parsing keys.dat is that expected? Im also getting errors on keyblobs 0-5, Also I got an error last time I tried to backup the entire RAW eMMC GPP. I would assume my emmc is bad but the benchmarking worked well.

Honestly I'm not sure how to check other than trying to decrypt the nand backup. If lockpick_rcm is still giving you issues getting the backup done then I would suggest asking in the thread for that for help there before continuing if that makes sense?

 

[ArturoTucan]

Makes sense! I think I'm narrowing my search, searching through the forum I found that keyblobs are not needed to restore the eMMC. I used lockpick and generated a prod.keys file then backed up my eMMC GPT and used HacDiskMount and both are saying my Primary and Backup GPT are both valid but not the same, weird. But I'm back to NxNandManager and used debug mode and found that:
PRODINFO GOOD CRYPTO
SYSTEM BAD CRYPTO
PRODINFOF GOOD CRYPTO
SAFE GOOD CRYPTO
USER GOOD CRYPTO
NxStorage::setKeys(keys.dat) BAD crypto

So my keys might be ok but maybe the data on that partition is not.

Honestly I'm not sure how to check other than trying to decrypt the nand backup. If lockpick_rcm is still giving you issues getting the backup done then I would suggest asking in the thread for that for help there before continuing if that makes sense?

 

[Adran_Marit]

Makes sense! I think I'm narrowing my search, searching through the forum I found that keyblobs are not needed to restore the eMMC. I used lockpick and generated a prod.keys file then backed up my eMMC GPT and used HacDiskMount and both are saying my Primary and Backup GPT are both valid but not the same, weird. But I'm back to NxNandManager and used debug mode and found that:
PRODINFO GOOD CRYPTO
SYSTEM BAD CRYPTO
PRODINFOF GOOD CRYPTO
SAFE GOOD CRYPTO
USER GOOD CRYPTO
NxStorage::setKeys(keys.dat) BAD crypto

So my keys might be ok but maybe the data on that partition is not.

Looks like system needs to be regenerated/signed.

make sure you have a backup of it in the current state

Use hacdiskmount open the nand (make sure you can write to the emmc) load the keys for system, it should say bad CRYPTO. Save the key, then check it again and it should match. Then try booting

 

[ArturoTucan]

Looks like system needs to be regenerated/signed.

Tried this but it won't let me save if my keys are invalid.
Starting to lose hope, nothing is working. Next I tried to restore from HacDiskMount I get Data error (cyclic redundancy check) . In the switch I see
Deivce: eMMC GPP Status: Error SDMMC Write
Is there a way by any chance to use emuMMC only?

 

[Adran_Marit]

Tried this but it won't let me save if my keys are invalid.
Starting to lose hope, nothing is working. Next I tried to restore from HacDiskMount I get Data error (cyclic redundancy check) . In the switch I see
Deivce: eMMC GPP Status: Error SDMMC Write
Is there a way by any chance to use emuMMC only?


View attachment 336594

Not sure sorry, maybe you got a faulty chip, can't hurt to try it though

 

[ArturoTucan]

Not sure sorry, maybe you got a faulty chip, can't hurt to try it though

I will try ordering a new one, its like 10$ so its worth the risk

 

[ClementNerma]

Hi, when I try to generate the PRODINFO from donor, I get the following error:

Dumping keys...
Unable to derive master keys for prod.
Master keys... done in 1869 us
Keygen part done in 2545 us

Couldn't set master_key_00

Done in 4136 us

Do you know why this happens and how to solve this problem?

I'm using a Switch Lite with an SX Lite chip (if this helps).

 

[Adran_Marit]

Hi, when I try to generate the PRODINFO from donor, I get the following error:

Dumping keys...
Unable to derive master keys for prod.
Master keys... done in 1869 us
Keygen part done in 2545 us

Couldn't set master_key_00

Done in 4136 us

Do you know why this happens and how to solve this problem?

I'm using a Switch Lite with an SX Lite chip (if this helps).

I haven't done a donor dump in a while. Have you ran lockpick_rcm on your lite first before trying to dump the donor?

 

[ClementNerma]

No I downloaded it from the thread I linked. From the tutorial:

(With the donor_prodinfo.bin file being provided)