Hacking RELEASE Yasdu - Yet Another Switch Dumping Utility

[DacoTaco]

let me just copy pasta from my reddit thread for a sec....


http://github.com/DacoTaco/YASDU
( gbatemp, your link detection is a bit...flawed. i shouldn't be able to post a link, yet here it is. )

tl;dr : i wanted to dump NAND & keys but SD was to small. other options dumped wrong and didn't provide a hash to check if it was ok. i made my own and NAND, boot0,boot1 and TSEC fw dumping are complete and working perfectly (and provide hashes), however YASDU is not complete, and if you can help with the key dumping or accessing TSEC from linux, please do!

Long Version
ok, so. YASDU. ive been wanting to get my hands dirty with the switch and linux for a while now and ive finally found a bit of time to play around.

as any normal person i wanted to dump my NAND and keys but the NAND flashing needs a big SD card to dump to, which i dont have. so i started looking around and found httpnand but it dumped the nand & boot0 incorrectly so i made my own tool in python (hoozah, my first python script xD)

it was at first only intended to be a personal script for nand dumping as it doesn't bring anything new to the scene, but i though, why not add the tsec fw in there together with the keys so they could be dumped from linux and throw it online for everyone to hopefully learn as i have learned from naehrwert's code?
though i never got the key dumping to work, i put it online none the less hoping somebody could help.
the current problem is that i can't seem to access the TSEC or clock registers needed to either reset & start the Falcon cpu or the system freezes trying to access them (both through opening /dev/mem or devmem2 ).
if anyone could help or tell me the actual interface in linux to access TSEC , that would be great!
(i saw tsec code was in the linux build from f0f but i didn't find it when running it besides some read only stuff :/ )

so here you go, YASDU.
if you would like to see any functionality additions to this script/application or want to help improve it, feel free to poke me.


Current functions/tools in YASDU :

• D.a.n (decrypted access of nand) : a tool to access encrypted nand partitions like they are normal partitions using FUSE in linux. can work with dumps or the actual nand in linux on the switch
  
  
• R.n.d (Random Nand Decryptor) : a tool to decrypt encrypted partition dumps
  
  
• NandFileServer : python based webserver that allows the downloading/dumping of Nand & its partitions. future planned to allow browsing and dumping of certain files of the nand using D.a.n
  

enjoy!

 

[masterspike52]

YASDU is spelled YUSDU in the long version

 

[Deathscreton]

YASDU is spelled YUSDU in the long version

literally unusable /s

Thanks for the tool m8! All contributions are amazing. I wish I had more code knowledge (not really, if I did, I'd study more. lol)

 

[DacoTaco]

literally unusable /s

totally useless. worst app 2018. /s

personally i dont see it as a contribution as its done before, somewhat. in my head i have many things i wanna do with it but from a technical standpoint i have no idea how to reach those ideas

 

[ploggy]

totally useless. worst app 2018. /s

personally i dont see it as a contribution as its done before, somewhat. in my head i have many things i wanna do with it but from a technical standpoint i have no idea how to reach those ideas

Your name sounds familiar? Wii scene?

 

[NANASHI89]

Will this work on the HBL?

Sent from my SM-T280 using Tapatalk

 

[Tommy084]

I dumped my tsecfw.inl (is that what you need?) from this distro,
https://gbatemp.net/threads/tutorial-how-to-dump-switch-nand-using-linux.502201/
Just type in nand_dump in the terminal
I didt manage to dump tsec if i clone the script from github on the other distros.
Hope it helps.
Thanks for your work

 

[Madridi]

Your name sounds familiar? Wii scene?

Priiloader

 

[ploggy]

Priiloader

Ohhhhh.. that's right, thanks

 

[VashTS]

good to see you again Daco

 

[DacoTaco]

I dumped my tsecfw.inl (is that what you need?) from this distro,
https://gbatemp.net/threads/tutorial-how-to-dump-switch-nand-using-linux.502201/
Just type in nand_dump in the terminal
I didt manage to dump tsec if i clone the script from github on the other distros.
Hope it helps.
Thanks for your work

ye ok, maybe i should rename the tsecfw filename to make it more obvious.
all you need for this is python and your root password of your switch (probably 'alarm')

EDIT : there, renamed it

good to see you again Daco

haha, thanks. im not back yet though. again, nothing fancy so far. and no ban on gbatemp yet either :V

 

[Tommy084]

Edited
Sorry—-

 

[ScarletDreamz]

@DacoTaco The DacoTaco that made Priiloader? Wow never tough i would see another app from you! Great to see you here!

 

[DacoTaco]

Python and the script is allready installed with the v3.
Bash sudo
Pass: alarm
Nand_dump and it starts
It wil save to root

yes, -TO SD-

this is a network dumping tool XD

 

[DacoTaco]

in the past few week or so ive been working on a few tools to help me with the decryption of the NAND. again i have no idea if they will ever be of use to anyone, but you can have them none the less all for the price of FREE :o xD

both are using the source i found and helped me understand things from ihaveamac's switchfs & tpw_rules' example code

these are 2 tools, currently only allowing decryption & reading. no encryption/writing

• D.a.n (decrypted access of nand) : a tool to access encrypted nand partitions like they are normal partitions using FUSE in linux. can work with dumps or the actual nand in linux on the switch. currently only allows reading, as i haven't tested writing yet and im kinda scared to do it too.
  
  
• R.n.d (Random Nand Decryptor) : a windows/Linux tool to decrypt encrypted partition dumps ( windows executable available ). a decrypted partition can be mounted (linux, or windows after being made into a VHD) ,accessed, edited or whatever

everything can be found @ https://github.com/DacoTaco/YASDU

enjoy and feedback is welcome

(also, can a mod move this to a better subforum like the tools subforum? i think it fits there beter, dont you think?)

 

[Astoria]

Thanks a lot for this. I don't know why there aren't more fuse utilities for Switch NAND.

 

[DacoTaco]

2 years later self bump.

after few years , i've been playing around with the encryption some more and ive added writing/encrypting support to d.a.n. (without having to read a full sector and decrypt it) and allowed it to read the partitions from a NAND dump/emunand directly.
ive tested this using a NAND dump , EMUNAND dump and EMUNAND directly.
basically, the switch's filesystem is just a regular FAT filesystem now and its your playground now on linux.

i know this is probably not going to be used by anyone and that other tools like hacdiskmount and ninfs exist, but meh *shrug*
next step would be to do the mounting of the decrypted partitions in code

 

[Draxzelex]

Don't worry, somebody probably found it useful

 

[DacoTaco]

Don't worry, somebody probably found it useful

doubtful.
but in case they do : everything is done in app now.
all you have to do is start dan and it'll mount the nand to a directory you give it.
after that you can browse the filesystem like any usb drive or whatever.
and yes, it can write to it if you start it in read-write mode (by default its read-only)

see here

 

[Draxzelex]

doubtful.
but in case they do : everything is done in app now.
all you have to do is start dan and it'll mount the nand to a directory you give it.
after that you can browse the filesystem like any usb drive or whatever.
and yes, it can write to it if you start it in read-write mode (by default its read-only)

see here

You'd be surprised. There are a lot of save managers available but when I was helping a user, only one of them worked on firmware 1.0 and they were so happy. But the only reason that happened was because someone made that app so kudos to developers like you who make programs even if there are alternatives because you never know.