Description
Lockpick_RCM is a bare metal Nintendo Switch payload that derives encryption keys for use in Switch file handling software like hactool, hactoolnet/LibHac, ChoiDujour, etc. without booting Horizon OS.

Source: https://github.com/shchmue/Lockpick_RCM
Payload: https://github.com/shchmue/Lockpick_RCM/releases

Due to changes imposed by firmware 7.0.0, Lockpick homebrew can no longer derive the latest keys. In the boot-time environment however, there are fewer limitations. That means the new keys are finally easy to dump!

Usage

• Launch Lockpick_RCM.bin using your favorite payload injector or chainload from Hekate by placing it in /bootloader/payloads
• Upon completion, keys will be saved to /switch/prod.keys on SD
• If the console has Firmware 7.x, the /sept/ folder from Atmosphère or Kosmos release zip containing both sept-primary.bin and sept-secondary.enc must be present on SD or else only keyblob master key derivation is possible (ie. up to master_key_05 only)

Big thanks to CTCaer
For Hekate and all the advice while developing this!

Known Issues

• Chainloading from SX will hang immediately due to quirks in their hwinit code, please launch payload directly

 

[Adran_Marit]

I have a full NAND backup, but I've never been able to get the keys, and it sounds like the only way I can is to flash my modchip (which I don't want to do!).

If lockpick_rcm wont launch from hekate (through the sx boot) then you need spacecraft which means flashing the chip so best of luck

p.s sx is also considered dead unless they release an update which I doubt

 

[shchmue]

Big release, no more Sept requirement, now dumps all latest keys for both dev and prod regardless of SD or NAND contents on Erista

https://github.com/shchmue/Lockpick_RCM/releases/tag/v1.9.4

 

[RealYoti]

Big release

Key generation line is missing.

 

[shchmue]

Key generation line is missing.

yea i removed it since it’s not relevant anymore, all dumps result in latest keys

 

[theskid]

tried running fom hekate and sx os
getting error
unable to run keygen?
please help

 

[Hayato213]

tried running fom hekate and sx os
getting error
unable to run keygen?
please help

You need to load from Hekate not SX OS bootloader menu. I believe it doesn't work with SX OS Pro Dongle either.

 

[theskid]

You need to load from Hekate not SX OS bootloader menu. I believe it doesn't work with SX OS Pro Dongle either.

okay i only have sx os dongle ,but im loading hekate from that via sx os load payloads
as i have atmosphere running from emunand on higher firmware,but still want to use sx os for xci support
but still using dongle
is there any other way i can do this?
i can try booting staight to hekate via a custom boot.dat see if that works(so not going through sx)(but just using dongle)

yes that method worked booting straight into hekate but still using sx os dongle to get there

 

[Hayato213]

okay i only have sx os dongle ,but im loading hekate from that via custom boot.dat
as i have atmosphere running from emunand on higher firmware
but still using dongle
is there any other way i can do this?

If chain loading from SX OS bootloader menu into hekate loading lockpick_RCM doesn't work, then you would have to use another injection method like RCM loader one, NS Atmosphere or PC.

 

[shchmue]

firmware 13.0.0 comes with new keys, dump them with the new Lockpick_RCM

https://github.com/shchmue/Lockpick_RCM/releases/tag/v1.9.5

 

[pcwizard7]

firmware 13.0.0 comes with new keys, dump them with the new Lockpick_RCM

https://github.com/shchmue/Lockpick_RCM/releases/tag/v1.9.5

Nice Work

 

[shchmue]

Lockpick_RCM v1.9.6 fixes reboot to hekate, which pairs nicely with hekate 5.6.1's new boot to Lockpick feature (Console Info -> Lockpick)!
https://t.co/GvnOkWWP7b?amp=1
https://github.com/shchmue/Lockpick_RCM/releases/tag/v1.9.6

 

[pinsen24]

dumping key from sysnand resulting with this. any idea?

sx core mariko. boot with hekate through sx gear. then launch payload via launch menu.

 

[BaamAlex]

View attachment 277749
dumping key from sysnand resulting with this. any idea?

sx core mariko. boot with hekate through sx gear. then launch payload via launch menu.

Chainloading doesn't work. You have to boot the payload directly.

 

[pinsen24]

Chainloading doesn't work. You have to boot the payload directly.

does booting payload.bin with sx gear consider as chainloading?

 

[pcwizard7]

does booting payload.bin with sx gear consider as chainloading?

yes, going to have to put lockpick_rcm payload temporary

 

[BaamAlex]

does booting payload.bin with sx gear consider as chainloading?

That's why i wrote it...

 

[pinsen24]

yes, going to have to put lockpick_rcm payload temporary

got the same result tho. i renamed lockpick_rcm to payload.bin and boot then try to dump keys again but still got the same result. am i missing something.... ☹

 

[Kallrkyle]

As far i remember from the TX days, there was some talk about that rcm version of Lockpick wasen't compatible with the Mariko Switch, and ppl was adviced to use Lockpick.nro

 

[pcwizard7]

you should get the following files as result

Partitalkeys.txt
prod
titlekeys.txt

The errors you see are markio specific are due to the nand being encrypted. But unless you're a dev you don't need this data, but you're still getting your masterkeys in prod.

 

[BaamAlex]

As far i remember from the TX days, there was some talk about that rcm version of Lockpick wasen't compatible with the Mariko Switch, and ppl was adviced to use Lockpick.nro

Lockpick.nro is not compatible with fw 7.0.0+