The Switch Flashcart Thread (Mig Switch etc.)

[Deleted member 413168]

OOB Reads?

Out of bound.

 

[ccfman2004]

Out of bound.

That's what I thought But I wanted to verify as I do not like acronyms. Too many have the same acronym but are completely different.

Obviously, trimmed ROMs would throw out of bounds errors.

Is there a possibility that Nintendo can see that XCI itself doesn't contain the certificate as it's separate? I also wonder if there is more inside a legit cart than just the ROM image.

 

[Inaki]

That's what I thought But I wanted to verify as I do not like acronyms. Too many have the same acronym but are completely different.

Obviously, trimmed ROMs would throw out of bounds errors.

Is there a possibility that Nintendo can see that XCI itself doesn't contain the certificate as it's separate? I also wonder if there is more inside a legit cart than just the ROM image.

Well, in a correct implementation, trimmer ROMs should still return valid padding ( 00s ? or whatever the padding is ) data when reads beyond the trimmed point are done. Being a trimmed ROM doesn' mean the MiG Flash shouldn't behave as if the ROM was a verbatim copy...

 

[ccfman2004]

Considering that the homebrew "sphaira" can easily detect if the current ROM loaded in the MIG Flash is trimmed or not, there is no reason to believe that Nintendo can't do the same.

 

[Locutus73]

OOB Reads?

outside of the boundaries

Post automatically merged: Jun 23, 2025

Considering that the homebrew "sphaira" can easily detect if the current ROM loaded in the MIG Flash is trimmed or not, there is no reason to believe that Nintendo can't do the same.

I mean, you can detect MIG "just" using nxdumptool too... try to produce an untrimmed dump of a 1.2.0 MIG...

Post automatically merged: Jun 23, 2025

Considering that the homebrew "sphaira" can easily detect if the current ROM loaded in the MIG Flash is trimmed or not, there is no reason to believe that Nintendo can't do the same.

That was in 1.1.9, now, with 1.2.0, it correctly reports all MIG as trimmed, regardless of the used XCI... which is worrying to me!

 

[Deleted member 413168]

That's what I thought But I wanted to verify as I do not like acronyms. Too many have the same acronym but are completely different.

Obviously, trimmed ROMs would throw out of bounds errors.

Is there a possibility that Nintendo can see that XCI itself doesn't contain the certificate as it's separate? I also wonder if there is more inside a legit cart than just the ROM image.

You don't need to wonder, everything is on here https://switchbrew.org/wiki/XCI.

 

[ccfman2004]

You don't need to wonder, everything is on here https://switchbrew.org/wiki/XCI.

What I meant was maybe there is stuff inside the chip that we don't know about yet that dumpers aren't able to properly dump. Something like a fake challenge where the MIG reports TRUE when it's always FALSE or should not be responded to. I know this is a gross oversimplification.

Post automatically merged: Jun 23, 2025

That was in 1.1.9, now, with 1.2.0, it correctly reports all MIG as trimmed, regardless of the used XCI... which is worrying to me

Why would it report trimmed, even on a full dump? That makes no sense. Shouldn't it always repot untrimmed?

 

[Locutus73]

What I meant was maybe there is stuff inside the chip that we don't know about yet that dumpers aren't able to properly dump. Something like a fake challenge where the MIG reports TRUE when it's always FALSE or should not be responded to. I know this is a gross oversimplification.

Post automatically merged: Jun 23, 2025

Why would it report trimmed, even on a full dump? That makes no sense. Shouldn't it always repot untrimmed?

Because it reports trimmed when the cart fails with specific OOB reads. With 1.2.0 MIG tries to fake a correct response when the Switch does that and they partially succeeds, in fact it seems to confuse the actual Switch 2... but this new implementation fails when you try to read a large quantity of OOB data like sphaira and nxdumptool do.

 

[ccfman2004]

Because it reports trimmed when the cart fails with specific OOB reads. With 1.2.0 MIG tries to fake a correct response when the Switch does that and they partially succeeds, in fact it seems to confuse the actual Switch 2... but this new implementation fails when you try to read a large quantity of OOB data like sphaira and nxdumptool do.

Shouldn't a FULL untrimmed dump be reported as full and not trimmed. What is the expected response on a real cart?

 

[Orekul]

outside of the boundaries

Post automatically merged: Jun 23, 2025

I mean, you can detect MIG "just" using nxdumptool too... try to produce an untrimmed dump of a 1.2.0 MIG...

Post automatically merged: Jun 23, 2025

That was in 1.1.9, now, with 1.2.0, it correctly reports all MIG as trimmed, regardless of the used XCI... which is worrying to me!

I have a feeling the 1.2.0 was rushed out to placate, it was a little quick for my liking. Maybe in time or new cart design.

Shouldn't a FULL untrimmed dump be reported as full and not trimmed. What is the expected response on a real cart?

The untrimmed dumps come in 2,4,8,16 and 32gb. The exact size of the flash memory in the official carts, it's like an image including all blank unused areas. I imagine that this will stop reading at the end of the data, whereas a mig possibly leaks something that can be read in the additional storage the SD card has or from one of the other files.

 

[Ygolonac]

Just bought one of these ( just to have it / potentially use it with Switch 2 if I feel like getting banned) I already have a banned Switch V1 with atmosphere... didn't realize this would be such a pain in the ass to use as you need to find .bin and initial data files apparently.
I'm guessing outside big games, most people using it for piracy are just downloading pre-made MIG game comps. Updating games / DLC on a stock console seems like it's not possible either. Better than nothing I suppose.

 

[Locutus73]

Just bought one of these ( just to have it / potentially use it with Switch 2 if I feel like getting banned) I already have a banned Switch V1 with atmosphere... didn't realize this would be such a pain in the ass to use as you need to find .bin and initial data files apparently.

They’re easy to find: they’re in your original cart.

Post automatically merged: Jun 24, 2025

Updating games / DLC on a stock console seems like it's not possible either. Better than nothing I suppose.

Just insert the cart (either the original you dumped or the MIG) and update online, they (should) behave the same.

But I’d be cautious until the OOB reading issue isn’t further investigated.

 

[FR0ZN]

They’re easy to find: they’re in your original cart.

Post automatically merged: Jun 24, 2025

Just insert the cart (either the original you dumped or the MIG) and update online, they (should) behave the same.

But I’d be cautious until the OOB reading issue isn’t further investigated.

I wouldn't worry too much about that oob issue, just use untrimmed ROMs and you'll be fine there.
The bigger issue is the sector access speed measurement that was introduced in a recent FS version.
If MIG can't fix that via software, then you can be 100% sure that you will always be flagged for ban.

 

[Locutus73]

I wouldn't worry too much about that oob issue, just use untrimmed ROMs and you'll be fine there.
The bigger issue is the sector access speed measurement that was introduced in a recent FS version.
If MIG can't fix that via software, then you can be 100% sure that you will always be flagged for ban.

It has been proved with different experiments you can replicate that using untrimmed dumps worked until firmware 1.1.9 (well except N was able to detect the MIG on S2)… with 1.2.0 they tried to implement OOB reads regardless of the completeness of the dump. And unfortunately their attempt can be detected, so with 1.2.0 OOB reads can unveil the MIG regardless of using an untrimmed or trimmed dump.

Regarding the FS speed, is that a conjecture or is it a proven thing?
I mean when dumping my OG carts and testing the MIG I noticed that first party games can be read quicker than the flash cart, but my third party games (Cave Shmups) are equivalent in speed to a MIG. So testing speed seems unreliable to me unless using a proper per game database.

 

[eviltwins]

Hi, i still dont have a mig but just curious , can you use multilpe sd cards or just one for your backups ? if multiple do you have to put in the update file to each one or just the first one?
thanks

 

[FR0ZN]

Regarding the FS speed, is that a conjecture or is it a proven thing?
I mean when dumping my OG carts and testing the MIG I noticed that first party games can be read quicker than the flash cart, but my third party games (Cave Shmups) are equivalent in speed to a MIG. So testing speed seems unreliable to me unless using a proper per game database.

Nintendo knows the speeds of the flash chips they use for game cartridge production.
There are probably only a handfull of possibilities, but if the MIG executes anything slower or faster (micro SD card is also a factor), then it's easy sailing for Nintendo.
The code is implemented amd the results are probably already part of their captured telemetry.
It's MIGs turn now to do countermeassures, from a user POV there is nothing you can do.

 

[Locutus73]

Nintendo knows the speeds of the flash chips they use for game cartridge production.
There are probably only a handfull of possibilities, but if the MIG executes anything slower or faster (micro SD card is also a factor), then it's easy sailing for Nintendo.
The code is implemented amd the results are probably already part of their captured telemetry.
It's MIGs turn now to do countermeassures, from a user POV there is nothing you can do.

I see, I mean, we can only speculate what Nintendo uses for effectively flagging MIGs (maybe speed isn't so accurate, I'm thinking to temperature variations, to give a ban)... but OOB reads are a speculation such as speeds. We only know that 1.1.9 were detected by Switch 2, 1.2.0 seems to not be detected. And we know 1.2.0 altered OOB reads, but we don't know if that's the only change and if that's the culrpit.

Regardless, one thing we know for sure is that currently there's a proven methodology for infallibly detecting MIG through OOB reads... now, whether N is using that or not, if I can detect MIG, I have to assume N isn't stupider than me, therefore currently I don't trust inserting any MIG in any of my Switches (1 or 2).

 

[Orekul]

This sounds a lot like the old 360 drive firmware days, next thing we will have stealth firmware for the mig

 

[SecureBoot]

Stupid question, but the MIG is still undetectable on Switch 1 right?

 

[Ygolonac]

They’re easy to find: they’re in your original cart.

Post automatically merged: Jun 24, 2025

Just insert the cart (either the original you dumped or the MIG) and update online, they (should) behave the same.

But I’d be cautious until the OOB reading issue isn’t further investigated.

I mean sure if you are using as intended. Nintendo seems to be banning people for using their backups so they can't update games though, at least on switch 2.
You could go rent / resell used games and back then up, but that is pretty scummy. I'm talking for straight up piracy, the MiG is fairly inconvenient, which helps it's legality I suppose.