[Tool] Fusée Gelée Launcher for MacOS

Discussion in 'Switch - Exploits, Custom Firmwares & Soft Mods' started by OkazakiTheOtaku, Apr 26, 2018.

  1. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no one likes me, not even me

    Member
    5
    Jul 20, 2016
    United States
    ~/
    Fusée Gelée Launcher for MacOS
    This is a simple launcher for the ReSwitched team's fusee-launcher.

    It contains no payloads. You must download and place the payloads in the "Payloads" directory.

    Updated on April 26 to not require Xcode Command Line tools.

    Dependencies:
    (All of these can be installed using ihaveamac's guide here.)
    • Python 3
    • libusb
    • pyusb
    Usage
    1. Navigate to my repository here
    2. Click the green button that says "Clone or download"
    3. Download ZIP
    4. Find where the ZIP file downloaded and extract it.
    5. In the folder that was extracted place your Fusée payloads in the "Payload" folder.
    6. Enter RCM mode on the Switch (this will not be covered here)
    7. While in RCM mode, connect the Switch to a USB port on the computer (using a hub will likely not work!)
    8. Run one of the .command files by double-clicking on them.
    9. If using macOS launch.command, the script will list the available payloads (make sure they're in the Payloads folder).
    10. Type the name of the payload, including the .bin
    Notes
    - I'm doing my best to learn scripting and programming. I know this isn't the most professional thing in the world and can be improved. I just made something for myself to use and figured it would work well for others, too. My work pales in comparison to that which I'm building off of.
    - The FuseDump .command is for use with FuseDump by Móricz Gergő.

    Credit
    • The entire ReSwitched team, of course
    • SciresM in particular, whom I really look up to as a programmer and as a person
    • @gbazone on GBATemp and his OS X tutorial
    • If I forgot anyone else I'm sorry - I love you too, don't worry! Let me know and I'll credit you here.
    Download: Here
     
    Last edited by OkazakiTheOtaku, Apr 26, 2018
  2. jjbredesen

    jjbredesen Developer

    Member
    6
    GBAtemp Patron
    jjbredesen is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Feb 16, 2018
    Norway
    Hyrule
    Great job! Simplifying the process for end users is a must right now and scripts are a good place to start! I would simplify the language a bit though: not everyone understands what "cd" does or what a repository is etc. like we do

    Anyways keep it up!
     
    Seathasky and OkazakiTheOtaku like this.
  3. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no one likes me, not even me

    Member
    5
    Jul 20, 2016
    United States
    ~/
    Thank you! I did some last-minute debugging before making the GBATemp post and I'm gonna get to bed right now, but I plan on writing a Usage info with simpler language tomorrow.
    Thanks for the feedback :D
     
    jjbredesen likes this.
  4. snoofly

    snoofly GBAtemp Fan

    Member
    3
    Aug 18, 2015
    United States
    Nice. I think I'll borrow my sons Macbook and try this out later today with the reboot to rcm nsp.
     
  5. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no one likes me, not even me

    Member
    5
    Jul 20, 2016
    United States
    ~/
    There was a bug with a non-terminated double quote in the macOS launch.command file. This has now been fixed, and git pushed. I have also updated the usage guide to use a method that is more user friendly and does not require Xcode Command Line Tools.
     
  6. TheGreek Boy

    TheGreek Boy GBAtemp Maniac

    Member
    4
    Jan 9, 2016
    Greece
    Behind you.
    its possibly to run fusee gelee on windows 7 (without vmware)?
     
  7. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no one likes me, not even me

    Member
    5
    Jul 20, 2016
    United States
    ~/
    Not at the moment. You either need VMware running Linux or a cold boot of Linux or macOS.
     
  8. TheGreek Boy

    TheGreek Boy GBAtemp Maniac

    Member
    4
    Jan 9, 2016
    Greece
    Behind you.
    why? i mean python is available for windows
     
  9. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no one likes me, not even me

    Member
    5
    Jul 20, 2016
    United States
    ~/
    Some other dependencies are not, though. In addition from what I've gathered Windows interfaces with USB devices in a way that makes this not work.
     
  10. TheGreek Boy

    TheGreek Boy GBAtemp Maniac

    Member
    4
    Jan 9, 2016
    Greece
    Behind you.
    also when i connect my switch to pc (running windows 7) using a usb c to a cable my pc won't recognise the switch. is that normal?
     
  11. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no one likes me, not even me

    Member
    5
    Jul 20, 2016
    United States
    ~/
    I only use Windows as a hobby, not as a main PC, so I'm not sure. That question would be better suited to a Windows tool thread.
     
  12. StageProps

    StageProps Newbie

    Newcomer
    1
    Mar 29, 2018
    United States
    This is awesome! The way the scene has exploded over the last few days can probably make things even more daunting for people who are only kind of keeping track of things or who have no experience using the command line. This will be very useful as more payloads start to trickle out!
     
  13. sarkwalvein

    sarkwalvein There's hope for a Xenosaga port.

    Member
    16
    GBAtemp Patron
    sarkwalvein is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Jun 29, 2007
    Germany
    Niedersachsen
    It is related to how Windows manages the USB, as far as I know.
    It has to be implemented in a different way, and it is still not there.

    You can find some info in the writings from ktemkin (somewhere) and in the python script itself.
    Both the macOS and Linux backend implementations are different, macOS is straightforward, while the Linux one needs some very hacky workaround.

    Let me check and quote the relevant parts of the code itself...

    macOS Backend, very straightforward:
    Code:
    class MacOSBackend(HaxBackend):
        """
        Simple vulnerability trigger for macOS: we simply ask libusb to issue
        the broken control request, and it'll do it for us. :)
        We also support platforms with a hacked libusb.
        """
    
        BACKEND_NAME = "macOS"
        SUPPORTED_SYSTEMS = ['Darwin', 'libusbhax', 'macos']
    
        def trigger_vulnerability(self, length):
    
            # Triggering the vulnerability is simplest on macOS; we simply issue the control request as-is.
            return self.dev.ctrl_transfer(self.STANDARD_REQUEST_DEVICE_TO_HOST_TO_ENDPOINT, self.GET_STATUS, 0, 0, length)
    
    Linux Backend:
    Code:
    class LinuxBackend(HaxBackend):
    
        """
        More complex vulnerability trigger for Linux: we can't go through libusb,
        as it limits control requests to a single page size, the limitation expressed
        by the usbfs. More realistically, the usbfs seems fine with it, and we just
        need to work around libusb.
        """
    
        BACKEND_NAME = "Linux"
        SUPPORTED_SYSTEMS = ['Linux', 'linux']
        SUPPORTED_USB_CONTROLLERS = ['pci/drivers/xhci_hcd', 'platform/drivers/dwc_otg']
    
    # (a really long block of code follows and has been snipped)
    And somewhere below in the code, you will find a comment stating that the windows backend still has to be implemented:
    Code:
    # FIXME: Implement a Windows backend that talks to a patched version of libusbK
    #        so we can inject WdfUsbTargetDeviceSendControlTransferSynchronously to
    #        trigger the exploit.
    
    If you ran this script in a windows machine it will fail in the create_appropriate_backend method:
    Code:
    class HaxBackend:
        """
        Base class for backends for the TegraRCM vuln.
        """
        # (portion of code snipped)
    
        @classmethod
        def create_appropriate_backend(cls, usb_device):
            """ Creates a backend object appropriate for the current OS. """
    
            # Search for a supportive backend, and try to create one.
            for subclass in cls.__subclasses__():
                if subclass.supported():
                    return subclass(usb_device)
    
            # ... if we couldn't, bail out.
            raise IOError("No backend to trigger the vulnerability-- it's likely we don't support your OS!")
    As you can see in the code, it will go through the defined subclasses trying to find one that supports the Windows OS, it will not find one because no one was defined, and then will raise an error, that will later result in the "It doesn't look like we support your OS, currently. Sorry about that!" message (line 309 of the script).

    I hope that answers your question of "why it won't run on windows?"
     
    kombos, OkazakiTheOtaku and Draxzelex like this.
  14. Damon_girl

    Damon_girl GBAtemp Advanced Fan

    Member
    3
    Oct 27, 2015
    United States
    Damn, I'd use this if I knew how to enter RCM mode on the Switch. I think it requires shorting of certain pins and I'm not skilled enough to do that. Guess it's back to waiting until a more user-friendly interface is out.
     
  15. sarkwalvein

    sarkwalvein There's hope for a Xenosaga port.

    Member
    16
    GBAtemp Patron
    sarkwalvein is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Jun 29, 2007
    Germany
    Niedersachsen
    Look for one of the many threads offering the 3d printing "pin shorting" accessory for less than $10.
    I think someone posted an ebay link of someone that could do the job in the USA for $2 or so.

    PS: You can also check the very generous offer of this user here https://gbatemp.net/threads/nintendo-switch-rcm-jigs.502091/
    He is proposing to do mostly all of the work and send it to you, practically for free (just postage cost).
     
    Last edited by sarkwalvein, Apr 26, 2018
    OkazakiTheOtaku likes this.
  16. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no one likes me, not even me

    Member
    5
    Jul 20, 2016
    United States
    ~/
    It's really not that hard. I just stripped a Cat5 ethernet cable and bridged two pins in the joycon. Takes 10 minutes to test.
     
  17. gbazone

    gbazone GBAtemp Regular

    Member
    2
    Jun 6, 2014
    Just wanted to say nice work! And thank you for the credit. It's a shame we can't launch Switch Linux from OSX yet.
     
    OkazakiTheOtaku likes this.
  18. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no one likes me, not even me

    Member
    5
    Jul 20, 2016
    United States
    ~/
    Thanks! It's funny you mention that, actually as I'm working on porting SoulCipher's shofel2_linux to be a easy to use tool on Mac right now.
     
    gbazone likes this.
  19. Centergaming

    Centergaming GBAtemp Regular

    Member
    1
    Apr 17, 2016
    United States
    Tested this on my macos high sierra 10.13.2 and it cannot detect TegraRCM. I made sure I installed the dependancies properly. Have to say, great job so far!
     
  20. OkazakiTheOtaku
    OP

    OkazakiTheOtaku no one likes me, not even me

    Member
    5
    Jul 20, 2016
    United States
    ~/
    Are you using a MacBook with a USB-C port and a C to C cable? Or are you using a USB-C to USB-A cable on an older Mac?
     
Loading...
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice