When will Switch 2 games be dumpable?

[Dausone]

I don't think this is accurate. If it were, we'd likely already see XCI files from Switch 2 games. It would also mean that Nintendo didn't implement any type of full disk encryption. My understanding is that the card reader handles the full disk encryption on the cart and the Switch handles the decryption of the game (XCI) files.

You can read up on Lotus2 and how it is structured if you want to learn more. But basically there is a security chip in every cart that when called, will generate a random password, this password is checked by the system. Think of it as a two-step verification process similar to google authenticator. This is different than the basic encryption and decryption of files, which is handled by the system itself and is independent of the cart or data.

What we know with certainty is that Nintendo does not implement any security handshake between the cart and the system S1 and S2 (when playing S1 games). The system thinks that the cart is legit and gives it a green light to play. MigFlash is just a loader not a decryption device. The reason why we do not see any XCI files from S2 games is that most likely, we do not know enough about the file protocol that Nintendo is using for the cart (Lotus3) and or files themselves (which may be organized differently than previous .XCI). Simply there is a lot we don't know.

 

[l7777]

You can read up on Lotus2 and how it is structured if you want to learn more. But basically there is a security chip in every cart that when called, will generate a random password, this password is checked by the system. Think of it as a two-step verification process similar to google authenticator. This is different than the basic encryption and decryption of files, which is handled by the system itself and is independent of the cart or data.

What we know with certainty is that Nintendo does not implement any security handshake between the cart and the system S1 and S2 (when playing S1 games). The system thinks that the cart is legit and gives it a green light to play. MigFlash is just a loader not a decryption device. The reason why we do not see any XCI files from S2 games is that most likely, we do not know enough about the file protocol that Nintendo is using for the cart (Lotus3) and or files themselves (which may be organized differently than previous .XCI). Simply there is a lot we don't know.

I'll look into it but I will theorize what I expect to find based on your description.

The cartridges use challenge-response authentication.
After successful authentication they return their unique decryption key.
This key is either used by the OS or the reader to unlock the disk encryption and access the file system.

Why do I still expect to find a form of FDE you might ask. Without it the entire security scheme falls on its face. Attackers would simply go around the security chip gate keeper by disassembling the cartridge and access the storage IC(s) directly. The only way to prevent this is encryption at rest. Unfortunately for Nintendo the challenge-response authentication of the original Switch was leaked allowing the creation of the Mig Flash and file dumper. There will be no file dumps of Switch 2 games until either HOS is compromised or the card reader is compromised. The only dumps that can exist right now are the fore mentioned raw dumps where someone accesses the storage directly and gets what I expect to be encrypted data.

 

[hippy dave]

Give me a few hours.

ETA WEN?

 

[Jayro]

I'll look into it but I will theorize what I expect to find based on your description.

The cartridges use challenge-response authentication.
After successful authentication they return their unique decryption key.
This key is either used by the OS or the reader to unlock the disk encryption and access the file system.

Why do I still expect to find a form of FDE you might ask. Without it the entire security scheme falls on its face. Attackers would simply go around the security chip gate keeper by disassembling the cartridge and access the storage IC(s) directly. The only way to prevent this is encryption at rest. Unfortunately for Nintendo the challenge-response authentication of the original Switch was leaked allowing the creation of the Mig Flash and file dumper. There will be no file dumps of Switch 2 games until either HOS is compromised or the card reader is compromised. The only dumps that can exist right now are the fore mentioned raw dumps where someone accesses the storage directly and gets what I expect to be encrypted data.

This seems like it could be a pretty easy thing to defeat just using a listening and logging device between the cartridge and the cart slot. Should be able to intercept everything between the two without bricking anything.

 

[l7777]

This seems like it could be a pretty easy thing to defeat just using a listening and logging device between the cartridge and the cart slot. Should be able to intercept everything between the two without bricking anything.

That would by like getting the raw encrypted data from the cartridge storage. It likely isn't decrypted in any way until it is on the reader or Switch circuitry. Even then sniffing communications is a very well known security vulnerability with a multitude of potential mitigations.

 

[Dausone]

I'll look into it but I will theorize what I expect to find based on your description.

The cartridges use challenge-response authentication.
After successful authentication they return their unique decryption key.
This key is either used by the OS or the reader to unlock the disk encryption and access the file system.

Why do I still expect to find a form of FDE you might ask. Without it the entire security scheme falls on its face. Attackers would simply go around the security chip gate keeper by disassembling the cartridge and access the storage IC(s) directly. The only way to prevent this is encryption at rest. Unfortunately for Nintendo the challenge-response authentication of the original Switch was leaked allowing the creation of the Mig Flash and file dumper. There will be no file dumps of Switch 2 games until either HOS is compromised or the card reader is compromised. The only dumps that can exist right now are the fore mentioned raw dumps where someone accesses the storage directly and gets what I expect to be encrypted data.

You have to look at all of the instances of a game as they are all handled differently and a deeper understanding of signatures. Switch has two different type of signatures, NPDM executable and ticket/content (NCA Headers). To be clear sigpatches do not fake signatures they just tell the system to skip verification.

MigFlash is simple. It works by tricking the system into thinking it is a legit cart. The switch is extremely lenient on cart based game validation but is very strict on e-games and digital files in general being read from SD card.

Post automatically merged: Jul 17, 2025

This seems like it could be a pretty easy thing to defeat just using a listening and logging device between the cartridge and the cart slot. Should be able to intercept everything between the two without bricking anything.

It is not even being checked by Switch 1 or 2 (for S1 games so far as we know). So there is nothing to defeat.

 

[ChibiMofo]

already dumped in private circles

Congrats on being the biggest liar on GBAT! Assuming they are aware you are using their PC to post this, your parents must be so proud of you!

 

[Dausone]

That would by like getting the raw encrypted data from the cartridge storage. It likely isn't decrypted in any way until it is on the reader or Switch circuitry. Even then sniffing communications is a very well known security vulnerability with a multitude of potential mitigations.

Correct. And to further point out and clarify, what was leaked was the fact that the cart has an authentication generator on board. One can easily create an authenticator like this but to clone one is impossible. Sig-patches do not work as a stand-in for the authentication process, they bypass it entirely.

 

[TPMJB]

I am incredibly disappointed that "Two more weeks" is not an option.

 

[MidTV]

Ryujinx can't run Switch 2 games it's a Switch 1 emulator

If the project was still maintained and not discontinued, Switch 2 support is technically possible, because the Switch 2 and Switch are like the New 3DS and 3DS when it comes to firmware. I highly doubt that a switch emulator would play a switch 2 game however.

 

[ihaveahax]

because the Switch 2 and Switch are like the New 3DS and 3DS when it comes to firmware

Not really. New 3DS was more like an enhanced version of the same hardware. Switch 2 has a different GPU (hence the need for a compatibility layer for Switch 1 games), and likely has plenty of other changes across the OS.

 

[FernandoRocker]

If the project was still maintained and not discontinued, Switch 2 support is technically possible, because the Switch 2 and Switch are like the New 3DS and 3DS when it comes to firmware. I highly doubt that a switch emulator would play a switch 2 game however.

That's not true at all.

 

[MidTV]

That's not true at all.

Not saying it is 100% true, just throwing s**t out there.

 

[twatsandwich]

Not saying it is 100% true, just throwing s**t out there.

But it's 0% true.

Why do so many people here talk on things they have zero context or clue on?

 

[hippy dave]

But it's 0% true.

Why do so many people here talk on things they have zero context or clue on?

I'm 30% sure it's because they're actually AI ninja bots sent by Nintendo to derail any discussion of hacking

 

[subcon959]

I'm 30% sure it's because they're actually AI ninja bots sent by Nintendo to derail any discussion of hacking

I'm 20% sure Nintendo would never do anything like that.

 

[TheStonedModder]

Give me a few hours.

This aged well

 

[SecureBoot]

But it's 0% true.

Why do so many people here talk on things they have zero context or clue on?

Dunning-Kruger effect

 

[CosasLocas]

I'm 20% sure Nintendo would never do anything like that.

I'm 10% sure that the other 90% is unsure

 

[M7L7NK7]

This aged well

A few million hours is still a few