Description
Lockpick_RCM is a bare metal Nintendo Switch payload that derives encryption keys for use in Switch file handling software like hactool, hactoolnet/LibHac, ChoiDujour, etc. without booting Horizon OS.

Source: https://github.com/shchmue/Lockpick_RCM
Payload: https://github.com/shchmue/Lockpick_RCM/releases

Due to changes imposed by firmware 7.0.0, Lockpick homebrew can no longer derive the latest keys. In the boot-time environment however, there are fewer limitations. That means the new keys are finally easy to dump!

Usage

• Launch Lockpick_RCM.bin using your favorite payload injector or chainload from Hekate by placing it in /bootloader/payloads
• Upon completion, keys will be saved to /switch/prod.keys on SD
• If the console has Firmware 7.x, the /sept/ folder from Atmosphère or Kosmos release zip containing both sept-primary.bin and sept-secondary.enc must be present on SD or else only keyblob master key derivation is possible (ie. up to master_key_05 only)

Big thanks to CTCaer
For Hekate and all the advice while developing this!

Known Issues

• Chainloading from SX will hang immediately due to quirks in their hwinit code, please launch payload directly

 

[Slluxx]

Great to see this confirmation.

By the way, is there any "easy method to follow" in order to update those files?
https://github.com/Slluxx/Picklock_RCM/blob/main/source/keys/crypto.h
https://github.com/Slluxx/Picklock_RCM/blob/main/source/keys/key_sources.inl

Deriving the keys from your console is tricky. I am not going to talk about that though because I don't think its smart to do if we don't want a billion lockpick forks, all doing the same thing. I also hope that the people who do know keep it to themselves for the same reason (at least for now).

 

[oresterosso]

@Sluxx Then we will have a new version 1.9.11 for the firmware 16.0.3?

 

[linuxares]

@Sluxx Then we will have a new version 1.9.11 for the firmware 16.0.3?

Not all firmwares include new keys. I don't think 16.0.3 have any.

 

[oresterosso]

Not all firmwares include new keys. I don't think 16.0.3 have any.

So why didn't GitHub state that it works with firmware 16.0.3?

 

[linuxares]

Because it runs in RCM mode. Not firmware.

 

[oresterosso]

Because it runs in RCM mode. Not firmware.

But this is confusing! if it works in RCM mode and not in firmware mode then it doesn't make sense to add in GitHub that "Works with firmware 16.0.2"

 

[Slluxx]

But this is confusing! if it works in RCM mode and not in firmware mode then it doesn't make sense to add in GitHub that "Works with firmware 16.0.2"

Because i had not yet access to 16.0.3 nor had i the time to check the keys. Also, it does make sense because it means that it works at least until 16.0.2. Nothing prevented you from just testing the payload on your switch. These questions/statements in here are killing me sometimes.

 

[linuxares]

Because i had not yet access to 16.0.3 nor had i the time to check the keys. Also, it does make sense because it means that it works at least until 16.0.2. Nothing prevented you from just testing the payload on your switch. These questions/statements in here are killing me sometimes.

Wut you don't hack Nintendo getting their firmwares before everyone else? /s

 

[oresterosso]

Because i had not yet access to 16.0.3 nor had i the time to check the keys. Also, it does make sense because it means that it works at least until 16.0.2. Nothing prevented you from just testing the payload on your switch. These questions/statements in here are killing me sometimes.

I'm not creating controversy, actually I thank you for taking over the project by putting you firsthand .
I'm simply trying to figure out the future of picklock.
Now that you have answered my question by explaining the reasons in detail, everything is clearer.

 

[mrdude]

I heard rumbling of Nintendo doing something "anti-lockpick".

And where exactly did you hear this? Did a friend of a friends cousin let it slip or did you read it from some dark place on the internet? Or do you have a mate that works in the inner circles in the NSW security team? Or is it just specultaion? which I imagine it is.

TBH I am sure that no matter what the case may be, files will still be decrypted and keys will still find their way on to the internet and patches will still be made, so don't worry too much about it as you are worrying over nothing.

 

[ShadowOne333]

Deriving the keys from your console is tricky. I am not going to talk about that though because I don't think its smart to do if we don't want a billion lockpick forks, all doing the same thing. I also hope that the people who do know keep it to themselves for the same reason (at least for now).

Not to be harsh or anything, but keeping information from the public can be counterproductive in a bad way for the community. It's better to have the information on how to do it and how to update them when a new firmware releases to the community, and they can do the back-lifting. That way Nintendo wouldn't even know when or where to attack, since the information once out is permanent and will forever be accessible. After that, I'm sure a couple creators will jump in and centralize it, but with all the info still public.
One clear example to this is the signature patches, which I'm sure mrdude can abide for. He basically had to do a lot of the research to figure out how the sigpatches were being made in order to generate them after the GitHub repository from iTotalJustice got nuked by DMCA (sounds familiar, doesn't it?).

After that, mrdude worked on both an in-console software and PC software that could both auto-generate the patches based on the newest Atmosphere version and firmware version too. Possibly something similar would be the best option to tackle here just so Nintendo can fuck off once and for all with the keys stuff.

 

[Slluxx]

Not to be harsh or anything, but keeping information from the public can be counterproductive in a bad way for the community. It's better to have the information on how to do it and how to update them when a new firmware releases to the community can do the back-lifting. That way Nintendo wouldn't even know when or where to attack, since the information once out is permanent and will forever be accessible. After that, I'm sure a couple creators will jump in and centralize it, but with all the info still public.
One clear example to this is the signature patches, which I'm sure mrdude can abide for. He basically had to do a lot of the research to figure out how the sigpatches were being made in order to generate them after the GitHub repository from iTotalJustice got nuked by DMCA (sounds familiar, doesn't it?).

After that, mrdude worked on both an in-console software and PC software that could both auto-generate the patches based on the newest Atmosphere version and firmware version too. Possibly something similar would be the best option to tackle here just so Nintendo can fuck off once and for all with the keys stuff.

I see where you are coming from and thought about that too but i still disagree. I don't mind letting anyone know how they can their hands on the keys themselves or even getting something to work that can auto generate the keys. However for the scene as a whole i think its better to not inflate it with a ton of forks that are all maintained by different people with different skillsets and for different amounts of timespans. That will create even more confusion than there already is.

i will happily share everything i have after the next firmware update.

That way Nintendo wouldn't even know when or where to attack, since the information once out is permanent and will forever be accessible.

The information will not be lost, even if they are behind the DMCA strikes and will strike my repo too. If they do, i can still tell the world. Its not like i want to take this to my grave. The people skilled enough to work on something like lockpick already know how the key stuff work anyway.

I don't want to discuss this any further either. The next firmware update will come probably rather sooner than later and then everyone gets their answers.

 

[mrdude]

I see where you are coming from and thought about that too but i still disagree. I don't mind letting anyone know how they can their hands on the keys themselves or even getting something to work that can auto generate the keys. However for the scene as a whole i think its better to not inflate it with a ton of forks that are all maintained by different people with different skillsets and for different amounts of timespans. That will create even more confusion than there already is.

i will happily share everything i have after the next firmware update.


The information will not be lost, even if they are behind the DMCA strikes and will strike my repo too. If they do, i can still tell the world. Its not like i want to take this to my grave. The people skilled enough to work on something like lockpick already know how the key stuff work anyway.

I don't want to discuss this any further either. The next firmware update will come probably rather sooner than later and then everyone gets their answers.

I know where to get the keys from a certain git and use those to update lockpic_rmc, but I don't know where certain devs get the keys from, do you? If so I wouldn't mind learning about that.

 

[Adran_Marit]

I see where you are coming from and thought about that too but i still disagree. I don't mind letting anyone know how they can their hands on the keys themselves or even getting something to work that can auto generate the keys. However for the scene as a whole i think its better to not inflate it with a ton of forks that are all maintained by different people with different skillsets and for different amounts of timespans. That will create even more confusion than there already is.

i will happily share everything i have after the next firmware update.


The information will not be lost, even if they are behind the DMCA strikes and will strike my repo too. If they do, i can still tell the world. Its not like i want to take this to my grave. The people skilled enough to work on something like lockpick already know how the key stuff work anyway.

I don't want to discuss this any further either. The next firmware update will come probably rather sooner than later and then everyone gets their answers.

from my understanding there is a way to autogen the keys but it way above my head

Post automatically merged: May 16, 2023

I know where to get the keys from Atmosphere git and use those to update lockpic_rmc, but I don't know where Atmosphere devs get the keys from, do you? If so I wouldn't mind learning about that.

something something, mkek sources in trustzone and that's about all I know

 

[caitsith2]

And it seems github just got a DMCA notice for Picklock_RCM and all of its forks. I know this because I recently forked this to see when it would inevitably happen.

Hi CaitSith2,

GitHub Trust & Safety is contacting you because we've received a DMCA takedown notice regarding the following content:

https://github.com/CaitSith2/Picklock_RCM

You can see the DMCA takedown notice that we received here, which includes the complainant's requested changes to your repository:

https://github.zendesk.com/attachments/token/2Qmq3lV9vLgjkZ50kozhqRcjJ/?name=2023-05-18-nintendo.rtf

 

[giovany86]

And it seems github just got a DMCA notice for Picklock_RCM and all of its forks. I know this because I recently forked this to see when it would inevitably happen.

Instantly re-upped it to Archive.org under a temp account. Guess we're up for a mouse & cat game again.

 

[Slluxx]

Yep, got a DMCA notice but im going to fight it.
EDIT: The dmca counter notice is out.

 

[mrdude]

Yep, got a DMCA notice but im going to fight it

I still think as soon as ninty update the firmware and certain CFW is released, you'll see a bin file and keys available - even if every github page in the world is removed from public view. PS you can make a new git and make it non public and it won't get DMCA'd.

 

[Slluxx]

I still think as soon as ninty update the firmware and certain CFW is released, you'll see a bin file and keys available - even if every github page in the world is removed from public view. PS you can make a new git and make it non public and it won't get DMCA'd.

Yeah, i have a private mirror repo that i will use in case.

 

[SylverReZ]

Yeah, i have a private mirror repo that i will use in case.

I've made archives of the URL.