Whoops, forgot that I made this a group, but guess what, I have things to actually show for it now.
In reading up on the Fusee Gelee exploit, I did learn quite a bit about how RCM works. And then the code for the Switch bootloader actually leaked. Great. Even more information.
I've been looking through some sources, and it looks like RCM needs to just confirm the signature of a payload before it runs it. So I thought, hey, maybe it's cryptographically possible to sign a binary using these things?
I actually found a key used for signing NVIDIA assets that actually verified with the bootloader public key. Butttt, I haven't been able to test it with the bootloader itself. I don't have a way to send a payload to that since I don't have access to the RCM tools. I think I would need an Nvidia account for that.
Anyways, if anyone can find a way to push a payload to the Switch RCM the way NVIDIA intends for a payload to be sent, let me know. I need to test these signed versions of hekate. Provided they don't actually work, and I don't expect them to, at least this will be a potential entryway into the Switch.
TegraRCMsmash isn't going to work for this as the whole point of it is to smash the stack, not actually deliver the payload normally.
In reading up on the Fusee Gelee exploit, I did learn quite a bit about how RCM works. And then the code for the Switch bootloader actually leaked. Great. Even more information.
I've been looking through some sources, and it looks like RCM needs to just confirm the signature of a payload before it runs it. So I thought, hey, maybe it's cryptographically possible to sign a binary using these things?
I actually found a key used for signing NVIDIA assets that actually verified with the bootloader public key. Butttt, I haven't been able to test it with the bootloader itself. I don't have a way to send a payload to that since I don't have access to the RCM tools. I think I would need an Nvidia account for that.
Anyways, if anyone can find a way to push a payload to the Switch RCM the way NVIDIA intends for a payload to be sent, let me know. I need to test these signed versions of hekate. Provided they don't actually work, and I don't expect them to, at least this will be a potential entryway into the Switch.
TegraRCMsmash isn't going to work for this as the whole point of it is to smash the stack, not actually deliver the payload normally.
. I hope u stuck wit it and made progress on this.... it can be done. Where there is a will...there is a way.
