Hacking Atmosphere-NX - Custom Firmware in development by SciresM

[mariogamer]

Well 1.0 was supposed to have coldboot very soon, I guess that's probably why no one even cares talking about a warmboot exploit when we are talking about FW 1.0...

I don't think is that any warmboot above FW1.0 will be released in the day atmosphere is released, but we never know...

Heh, even 1.0 is long term.

 

[guily6669]

Well SciresM as far as I know always said Coldboot was coming soon for FW1.0... And at first he also stated that FW1.0 would most likely load atmosphere emunand before the others, but that's probably not valid anymore since the RCM exploit works everywhere and was leaked shortly after, but I guess the coldboot for FW1.0 coming soon is still valid, no idea.

 

[Bumblecito]

Guys please refer them as coldboot exploit and warmboot exploit to not misunderstand it, I'm noob :'v

 

[mariogamer]

Well SciresM as far as I know always said Coldboot was coming soon for FW1.0... And at first he also stated that FW1.0 would most likely load atmosphere emunand before the others, but that's probably not valid anymore since the RCM exploit works everywhere and was leaked shortly after, but I guess the coldboot for FW1.0 coming soon is still valid, no idea.

Well this is the last message that explains everything well from sciresm:

Lemme be very clear:
On up to 4.1.0, we have a means of triggering full privileges code execution through softwarehax. This softwarehax requires user interaction. All of our current hax does.

Because the Switch uses ASLR, static exploits (not attacking scripting engines) are extremely unlikely to ever arise once you go down to OS-level exploitation. There's a flaw that allows for a "partial" ASLR defeat on < 3.0.2, but it's extremely difficult to use -- there's currently a $200 bounty from qlutoo and I for anyone being able to trigger a non-scripting engine aslr defeating exploit (e.g. via a savegame), and frankly I don't expect anyone to claim it any time soon. It's extremely difficult. I think in the long term, maybe 1.0.0 could get a solution where you turn it on and it boots into softwarehax. There's a theoretical vector that is almost impossible to use and also has no accompanying savegame exploit on < 3.0.2. Higher than that, your odds of getting what you'd call "coldboothax" are best summarized as followed:
"You're fucked."
I would genuinely maintain approximately zero hope.

 

[guily6669]

Guys please refer them as coldboot exploit and warmboot exploit to not misunderstand it, I'm noob :'v

Nothing is there to misunderstand... CFW\emunand has nothing to do with coldboot\warmboot exploit, they are separated things. To have a CFW we need a entry point which is the exploit (tethered\untethered, warmboot\coldboot)...

If I remember well Coldboot publicly known can be achieved up to 3.01 if I even remember well and above it up only warmboot is known up to 4.1, however only FW1.0 was said to get coldboot very soon, the others have no ETA, might never be completely leaked or might even never be exploited, but at least we know they exist and above 4.1 nothing is known and might never have anything other than using the crap jig'n payload 4 ever .

Well this is the last message that explains everything well from sciresm:

Yep, but there were other messages from him and Kate...

1 of them said the FW1.0 would have coldboot soon (not soon as in releasing with atmosphere though if I understood well, but can't remember ).

 

[M7L7NK7]

What I don't get is if jamais vu is exclusive to 1.0.0 why hasn't it been released? I'd understand if it could be used for mariko

 

[mariogamer]

What I don't get is if jamais vu is exclusive to 1.0.0 why hasn't it been released? I'd understand if it could be used for mariko

How to do it and a detailed write up was done. An implementation is missing and any good dev. could do it.

 

[guily6669]

The exploit for FW1.0 nop, its exclusive for the first ever released console with FW 1.0 only (no idea why it still didnt show up working )...

The warmboot exploit for up to 4.1 (including it) is the one being hold down for mariko as they are hopping it will come with FW that still support it and it might be the only way to hack it as RCM tethered exploit is kaput in them.

 

[Lacius]

What I don't get is if jamais vu is exclusive to 1.0.0 why hasn't it been released? I'd understand if it could be used for mariko

The write up for jamais vu was released a long time ago. It's up to someone else to implement it.

 

[mariogamer]

The exploit for FW1.0 nop, its exclusive for the first ever released console with FW 1.0 only (no idea why it still didnt show up working )...

The warmboot exploit for up to 4.1 (including it) is the one being hold down for mariko as they are hopping it will come with FW4.1 and it might be the only way to hack it as RCM tethered exploit is kaput in them.

No it won't come with 4.x. They know mariko comes with 5.x because of someconfiguration added for it.
5.x didn't patch deja vu completely throught software, part of it is in the bootrom.

 

[guily6669]

Edited thanks for correction

The write up for jamais vu was released a long time ago. It's up to someone else to implement it.

Maybe the exploit is better to be implemented in a emunand CFW environment?

 

[Bumblecito]

The warmboot exploit for up to 4.1 (including it) is the one being hold down for mariko as they are hopping it will come with FW that still support it and it might be the only way to hack it as RCM tethered exploit is kaput in them.

But this is what Kate leaked to Nintendo, right?

 

[mariogamer]

But this is what Kate leaked to Nintendo, right?

Not to nintendo.

And it was already known if I remember.

 

[Draxzelex]

But this is what Kate leaked to Nintendo, right?

Kate leaked to Nvidia (who then most likely disclosed it to Nintendo) the current RCM exploit, Fusee Gelee sometime in late winter/early spring, maybe February but I can't really remember the exact time. The warmboot exploits have not been disclosed to Nintendo otherwise they would have been released already as that gives Nintendo all the info they need to patch it and exploits are generally released after they have been fixed.

 

[M7L7NK7]

The write up for jamais vu was released a long time ago. It's up to someone else to implement it.

Got a link?

 

[Draxzelex]

Got a link?

https://www.reddit.com/r/SwitchHack...is_vu_a_100_trustzone_code_execution_exploit/

 

[aerios169]

MAybe in a couple of years my grandson will install for me atmosphere with emunand :V, seeening the progress it will take along

 

[guily6669]

Is that supposed to be a joke? If you check their discord there's something being done almost every day. Those things take a huge work as its not just changing a few lines of code on the Nintendo FW, its like having a full custom OS written almost from scratch (I think SciresM said he actually started doing some work before any hack was known or maybe it was even before the Switch release, can't even remember lol, but he is a 3DS veteran).

 

[M7L7NK7]

How to do it and a detailed write up was done. An implementation is missing and any good dev. could do it.

The write up for jamais vu was released a long time ago. It's up to someone else to implement it.

https://www.reddit.com/r/SwitchHack...is_vu_a_100_trustzone_code_execution_exploit/

Tempted to make a bounty or something

 

[guily6669]

10$ for the person that make it work, oh wait, I don't even have a Switch FW1.0, therefore 0$ 4 who release it working ...

Now if someone would release a full working coldboot exploit for 3.01 then I would pay 10$ right away as I'm on 3.02 and since they share the same e-fuses, in theory I can go back to 3.01.

But I would be 99% happy with a hassle-free warmboot method of launching into emunand, if they made it work like GW emunand, would be 4 me just as good as coldboot with just like 2 or 3 touches on the screen and bam booting to atmosphere, I will keep dreaming and can only stop dreaming in the day something like that comes out