[Tool] Fusée Gelée Launcher for MacOS

Discussion in 'Switch - Exploits, Custom Firmwares & Soft Mods' started by OkazakiTheOtaku, Apr 26, 2018.

  1. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no thanks, I don't want a custom title

    Member
    7
    Jul 20, 2016
    Japan
    127.0.0.1
    Fusée Gelée Launcher for MacOS
    (Last Updated September 28, 2018)

    This is a simple fork of the original fusee-launcher.

    It contains *no payloads*. You must download and place the payloads in the "Payloads" directory.

    Note: Payload-specific launchers have been removed for now. If demand is there, I will bring them back. I just do not see a point to them with one unified GUI.

    Dependencies:

    - Python 3
    - libusb
    - pyusb
    - tkinter

    1. Install brew via https://brew.sh
    2. Install Python 3 and libusb: brew install python libusb
    3. Install pyusb: python3 -mpip install pyusb
    4. Install tkinter: python3 -mpip install tkinter
    --note-- tkinter is installed on most Python3 installations by default

    Usage:

    0. Install everything in the above Dependencies area
    1. Look at the top of this repository page
    2. Click the green button that says "Clone or download"
    3. Download ZIP
    4. Find where the ZIP downloaded and extract it
    5. In the folder that was extracted, place your Fusée payloads in the payloads folder.
    4. Enter RCM mode on the Switch (this will not be covered here)
    5. While in RCM mode, connect the Switch to a USB port on the computer (using a hub will likely not work!)
    6. Doubleclick on macOS launch.command
    7. Use the arrow buttons in the window that opens to find your payloads.
    8. Press Run.

    Troubleshooting
    Recieving this error? usb.core.NoBackendError: No backend available
    Run the command: brew link --overwrite libusb

    If you are recieving issues and wish for help, please open a GitHub issue or let me know on the GBATemp thread.

    Include the following information:

    1. MacOS Version String (e.g., 10.14.x). Just giving me the name of the release ("High Sierra") does not help as much.
    2. Mac hardware. Include the model and year, so I know what ports and interfaces you are using.

    Credit

    - ReSwitched
    - Ktemkin
    - SciresM
    - @gbazone on GBATemp and his OS X tutorial
    - @trainboy2019 on GitHub for making the tkinter GUI and submitting a pull request
    - @Ickerday on GitHub for code cleanup, general improvements, and submitting a pull request
    - If I forgot anyone else I'm sorry - I love you too, don't worry! Let me know and I'll credit you here.
     
    Last edited by OkazakiTheOtaku, Sep 28, 2018
    metaljay, gbazone, sorabora and 19 others like this.
  2. jjbredesen

    jjbredesen Developer

    Member
    13
    GBAtemp Patron
    jjbredesen is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Feb 16, 2018
    Norway
    Hyrule
    Great job! Simplifying the process for end users is a must right now and scripts are a good place to start! I would simplify the language a bit though: not everyone understands what "cd" does or what a repository is etc. like we do

    Anyways keep it up!
     
  3. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no thanks, I don't want a custom title

    Member
    7
    Jul 20, 2016
    Japan
    127.0.0.1
    Thank you! I did some last-minute debugging before making the GBATemp post and I'm gonna get to bed right now, but I plan on writing a Usage info with simpler language tomorrow.
    Thanks for the feedback :D
     
    jjbredesen likes this.
  4. snoofly

    snoofly GBAtemp Advanced Fan

    Member
    6
    Aug 18, 2015
    United States
    Nice. I think I'll borrow my sons Macbook and try this out later today with the reboot to rcm nsp.
     
  5. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no thanks, I don't want a custom title

    Member
    7
    Jul 20, 2016
    Japan
    127.0.0.1
    There was a bug with a non-terminated double quote in the macOS launch.command file. This has now been fixed, and git pushed. I have also updated the usage guide to use a method that is more user friendly and does not require Xcode Command Line Tools.
     
  6. TheGreek Boy

    TheGreek Boy GBAtemp Maniac

    Member
    5
    Jan 9, 2016
    Greece
    Behind you.
    its possibly to run fusee gelee on windows 7 (without vmware)?
     
  7. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no thanks, I don't want a custom title

    Member
    7
    Jul 20, 2016
    Japan
    127.0.0.1
    Not at the moment. You either need VMware running Linux or a cold boot of Linux or macOS.
     
  8. TheGreek Boy

    TheGreek Boy GBAtemp Maniac

    Member
    5
    Jan 9, 2016
    Greece
    Behind you.
    why? i mean python is available for windows
     
  9. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no thanks, I don't want a custom title

    Member
    7
    Jul 20, 2016
    Japan
    127.0.0.1
    Some other dependencies are not, though. In addition from what I've gathered Windows interfaces with USB devices in a way that makes this not work.
     
  10. TheGreek Boy

    TheGreek Boy GBAtemp Maniac

    Member
    5
    Jan 9, 2016
    Greece
    Behind you.
    also when i connect my switch to pc (running windows 7) using a usb c to a cable my pc won't recognise the switch. is that normal?
     
  11. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no thanks, I don't want a custom title

    Member
    7
    Jul 20, 2016
    Japan
    127.0.0.1
    I only use Windows as a hobby, not as a main PC, so I'm not sure. That question would be better suited to a Windows tool thread.
     
  12. StageProps

    StageProps Member

    Newcomer
    2
    Mar 29, 2018
    United States
    This is awesome! The way the scene has exploded over the last few days can probably make things even more daunting for people who are only kind of keeping track of things or who have no experience using the command line. This will be very useful as more payloads start to trickle out!
     
  13. sarkwalvein

    sarkwalvein There's hope for a Xenosaga port.

    Member
    17
    GBAtemp Patron
    sarkwalvein is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Jun 29, 2007
    Germany
    Niedersachsen
    It is related to how Windows manages the USB, as far as I know.
    It has to be implemented in a different way, and it is still not there.

    You can find some info in the writings from ktemkin (somewhere) and in the python script itself.
    Both the macOS and Linux backend implementations are different, macOS is straightforward, while the Linux one needs some very hacky workaround.

    Let me check and quote the relevant parts of the code itself...

    macOS Backend, very straightforward:
    Code:
    class MacOSBackend(HaxBackend):
        """
        Simple vulnerability trigger for macOS: we simply ask libusb to issue
        the broken control request, and it'll do it for us. :)
        We also support platforms with a hacked libusb.
        """
    
        BACKEND_NAME = "macOS"
        SUPPORTED_SYSTEMS = ['Darwin', 'libusbhax', 'macos']
    
        def trigger_vulnerability(self, length):
    
            # Triggering the vulnerability is simplest on macOS; we simply issue the control request as-is.
            return self.dev.ctrl_transfer(self.STANDARD_REQUEST_DEVICE_TO_HOST_TO_ENDPOINT, self.GET_STATUS, 0, 0, length)
    
    Linux Backend:
    Code:
    class LinuxBackend(HaxBackend):
    
        """
        More complex vulnerability trigger for Linux: we can't go through libusb,
        as it limits control requests to a single page size, the limitation expressed
        by the usbfs. More realistically, the usbfs seems fine with it, and we just
        need to work around libusb.
        """
    
        BACKEND_NAME = "Linux"
        SUPPORTED_SYSTEMS = ['Linux', 'linux']
        SUPPORTED_USB_CONTROLLERS = ['pci/drivers/xhci_hcd', 'platform/drivers/dwc_otg']
    
    # (a really long block of code follows and has been snipped)
    And somewhere below in the code, you will find a comment stating that the windows backend still has to be implemented:
    Code:
    # FIXME: Implement a Windows backend that talks to a patched version of libusbK
    #        so we can inject WdfUsbTargetDeviceSendControlTransferSynchronously to
    #        trigger the exploit.
    
    If you ran this script in a windows machine it will fail in the create_appropriate_backend method:
    Code:
    class HaxBackend:
        """
        Base class for backends for the TegraRCM vuln.
        """
        # (portion of code snipped)
    
        @classmethod
        def create_appropriate_backend(cls, usb_device):
            """ Creates a backend object appropriate for the current OS. """
    
            # Search for a supportive backend, and try to create one.
            for subclass in cls.__subclasses__():
                if subclass.supported():
                    return subclass(usb_device)
    
            # ... if we couldn't, bail out.
            raise IOError("No backend to trigger the vulnerability-- it's likely we don't support your OS!")
    As you can see in the code, it will go through the defined subclasses trying to find one that supports the Windows OS, it will not find one because no one was defined, and then will raise an error, that will later result in the "It doesn't look like we support your OS, currently. Sorry about that!" message (line 309 of the script).

    I hope that answers your question of "why it won't run on windows?"
     
    kombos, OkazakiTheOtaku and Draxzelex like this.
  14. Damon_girl

    Damon_girl GBAtemp Advanced Fan

    Member
    4
    Oct 27, 2015
    United States
    Damn, I'd use this if I knew how to enter RCM mode on the Switch. I think it requires shorting of certain pins and I'm not skilled enough to do that. Guess it's back to waiting until a more user-friendly interface is out.
     
  15. sarkwalvein

    sarkwalvein There's hope for a Xenosaga port.

    Member
    17
    GBAtemp Patron
    sarkwalvein is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Jun 29, 2007
    Germany
    Niedersachsen
    Look for one of the many threads offering the 3d printing "pin shorting" accessory for less than $10.
    I think someone posted an ebay link of someone that could do the job in the USA for $2 or so.

    PS: You can also check the very generous offer of this user here https://gbatemp.net/threads/nintendo-switch-rcm-jigs.502091/
    He is proposing to do mostly all of the work and send it to you, practically for free (just postage cost).
     
    Last edited by sarkwalvein, Apr 26, 2018
    OkazakiTheOtaku likes this.
  16. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no thanks, I don't want a custom title

    Member
    7
    Jul 20, 2016
    Japan
    127.0.0.1
    It's really not that hard. I just stripped a Cat5 ethernet cable and bridged two pins in the joycon. Takes 10 minutes to test.
     
  17. gbazone

    gbazone GBAtemp Regular

    Member
    3
    Jun 6, 2014
    Just wanted to say nice work! And thank you for the credit. It's a shame we can't launch Switch Linux from OSX yet.
     
    OkazakiTheOtaku likes this.
  18. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no thanks, I don't want a custom title

    Member
    7
    Jul 20, 2016
    Japan
    127.0.0.1
    Thanks! It's funny you mention that, actually as I'm working on porting SoulCipher's shofel2_linux to be a easy to use tool on Mac right now.
     
    gbazone likes this.
  19. Centergaming

    Centergaming GBAtemp Advanced Fan

    Member
    4
    Apr 17, 2016
    United States
    Tested this on my macos high sierra 10.13.2 and it cannot detect TegraRCM. I made sure I installed the dependancies properly. Have to say, great job so far!
     
  20. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no thanks, I don't want a custom title

    Member
    7
    Jul 20, 2016
    Japan
    127.0.0.1
    Are you using a MacBook with a USB-C port and a C to C cable? Or are you using a USB-C to USB-A cable on an older Mac?
     
Loading...