Hacking Question Bought a switch after I couldn't repair it... 100% confirmed now that the NAND is messed up...

[TheUnknownOne]

So, a customer brought me a switch that would not power on, at all. There are 0 shorts on the main board but just for the hell of it I replaced the M92T36 chip just in case. No go.

Customer offered to sell it to me for $25USD so I said sure, considering it's in mint condition. So I bought it.

Turns out, it's patched but the very weird thing is that if I plug it into my pc and hit power, TegraRCM will say RCM OK! without needing to short out the rail or anything. However unfortunately it looks like this unit is in fact patched as it returns a 0x0000 and not 0x7000.

So, just for the hell of it I decided to see what would happen if I swap the nand board out with one from various other dead switch mainboards that I have and I can actually get the Nintendo logo to show up. Obviously it won't boot past that but what I find weird is how the hell is this switch going into AutoRCM if it's patched? The other NAND when I put it on is not doing this RCM thing.

Any help would be highly appreciated.

If it helps, I do have a 100% clean BOOT0/BOOT1 backup from an unpatched switch that I no longer have.

 

[M7L7NK7]

Could be a dead mmc

 

[TheUnknownOne]

Could be a dead mmc

Wouldn't it just not do anything then?

 

[DocKlokMan]

Wouldn't it just not do anything then?

No, if you disconnect the eMMC from a Switch it goes into RCM. That's it's normal behavior.

 

[TheUnknownOne]

No, if you disconnect the eMMC from a Switch it goes into RCM. That's it's normal behavior.

Perhaps we're misunderstanding each other.

With the messed up nand it just goes straight to RCM

If I take a nand from another board I know it's not going to work but it doesn't go into RCM unless I use the jig.

I was told to take an unpatched switch, plug the nand in and boot hekate and try to turn off autorcm and then restore boot0 and boot1 since I have clean ones already.

It may be possible someone stuck this nand board in an unpatched before and turned on autorcm apparently. So I will be borrowing another customers unpatched switch soon to see if I can get it going using that.

 

[DocKlokMan]

Perhaps we're misunderstanding each other.

With the messed up nand it just goes straight to RCM

If I take a nand from another board I know it's not going to work but it doesn't go into RCM unless I use the jig.

I was told to take an unpatched switch, plug the nand in and boot hekate and try to turn off autorcm and then restore boot0 and boot1 since I have clean ones already.

It may be possible someone stuck this nand board in an unpatched before and turned on autorcm apparently. So I will be borrowing another customers unpatched switch soon to see if I can get it going using that.

I mean that the patched Switch's eMMC doesn't have autoRCM (you can't do that) but more likely it's 100% dead to the point where the Switch doesn't even see that it's there, thus the Switch boots to RCM as if it wasn't, as it's designed to do.

 

[Draxzelex]

So, a customer brought me a switch that would not power on, at all. There are 0 shorts on the main board but just for the hell of it I replaced the M92T36 chip just in case. No go.

Customer offered to sell it to me for $25USD so I said sure, considering it's in mint condition. So I bought it.

Turns out, it's patched but the very weird thing is that if I plug it into my pc and hit power, TegraRCM will say RCM OK! without needing to short out the rail or anything. However unfortunately it looks like this unit is in fact patched as it returns a 0x0000 and not 0x7000.

So, just for the hell of it I decided to see what would happen if I swap the nand board out with one from various other dead switch mainboards that I have and I can actually get the Nintendo logo to show up. Obviously it won't boot past that but what I find weird is how the hell is this switch going into AutoRCM if it's patched? The other NAND when I put it on is not doing this RCM thing.

Any help would be highly appreciated.

If it helps, I do have a 100% clean BOOT0/BOOT1 backup from an unpatched switch that I no longer have.

Its also possible they used some outdated homebrew applications that enable AutoRCM on patched units.