Homebrew Discussion Possibility of completely rebuilding nand any time soon?

[gamesquest1]

Just wondering if anyone has any idea how far away we are (or if it will ever be possible) to completely rebuild a nand from nothing

basically I got hold of another broken switch and unfortunately it seems the original owner decided to try replace the batter and for some reason removed the emmc module and lost it

, I'm wondering if there is any technical reasoning why it wouldn't be possible to rebuild a donor nand for the system to restore it back to life with zero backups etc, I'm assuming it will probably be possible soon enough but just wondered if there is anything I'm overlooking

I'm guessing there may be some issue with console specific certs or something, but assuming we could use donor files from another switch, I'm also assuming I should be able to read out the fuse values to figure out what FW the system should be running

I just hate swing things that would otherwise function, completely dead over something that *should* be fixable

 

[Deleted-442439]

I am not completely sure about the specifics of the crypto, but my understanding is that console specific stuff is only required for OFW, Fusee Gelee can patch out the checks (needs to be repeated on every boot) so without the emmc you could still boot with emunand from a SD card.

As for reconstructing a emmc to function normally the console specific stuff is apparently stored on the NAND itself so without it I don't think you can extract the necessary information from anywhere else on the system.

Someone with the right knowledge could give a better answer, but the above is at least the way I have understood it.

 

[RHOPKINS13]

Pretty sure the nand contents are encrypted with a different key for each console. Without any way of getting that key, you don't have any chance at rebuilding that nand.

It may be possible in the future though. Maybe you can dump whatever key is needed while in RCM mode, or maybe with emunand you can boot a decrypted nand from SD. Or maybe they come up with something like CTRTransfer for Switch.

While plausible, I think you're going to be waiting a long time before any of these solutions are released. But I could be wrong, I would ask in the ReSwitched Discord about Atmosphere's emunand capabilities.

 

[gamesquest1]

I am not completely sure about the specifics of the crypto, but my understanding is that console specific stuff is only required for OFW, Fusee Gelee can patch out the checks (needs to be repeated on every boot) so without the emmc you could still boot with emunand from a SD card.

As for reconstructing a emmc to function normally the console specific stuff is apparently stored on the NAND itself so without it I don't think you can extract the necessary information from anywhere else on the system.

Someone with the right knowledge could give a better answer, but the above is at least the way I have understood it.

yeah I know the nand would be console uniquely encrypted, but those keys will be derived from the CPU I assume, so I assume it would be possible to dump those via RCM and then use them to encrypt the rebuilt image similar to how it was done on the 3ds

Pretty sure the nand contents are encrypted with a different key for each console. Without any way of getting that key, you don't have any chance at rebuilding that nand.

It may be possible in the future though. Maybe you can dump whatever key is needed while in RCM mode, or maybe with emunand you can boot a decrypted nand from SD. Or maybe they come up with something like CTRTransfer for Switch.

While plausible, I think you're going to be waiting a long time before any of these solutions are released. But I could be wrong, I would ask in the ReSwitched Discord about Atmosphere's emunand capabilities.

yeah I realise this is probably the most weird and less likely to be tackled for a while, but figured it might be worth spitballing to see if I'm overlooking something critical that would make it not possible​

 

[Deleted-442439]

yeah I know the nand would be console uniquely encrypted, but those keys will be derived from the CPU I assume, so I assume it would be possible to dump those via RCM and then use them to encrypt the rebuilt image similar to how it was done on the 3ds

yeah I realise this is probably the most weird and less likely to be tackled for a while, but rigured it might be worth spitballing to see if I'm overlooking something critical ​

I believe those keys are the BIS keys used to decrypt a backup.They can be derived with a payload made by @rajkosto , perhaps they can be used to encrypt someone else's backup?

Download: https://switchtools.sshnuke.net/

 

[gamesquest1]

I believe those keys are the BIS keys used to decrypt a backup.They can be derived with a payload made by @rajkosto , perhaps they can be used to encrypt someone else's backup?

Download: https://switchtools.sshnuke.net/

yeah I was thinking of giving something like that a shot(although I'm guessing it may be similar to the 3DS where stuff needs to be fixed before it will be accepted by the host system), but just got to swap the battery over to another switch as it doesn't charge in RCM mode, fingers crossed its not just a totally dead system .....although it does solve the problem of me wanting to revive it

 

[Deleted-442439]

yeah I was thinking of giving something like that a shot(although I'm guessing it may be similar to the 3DS where stuff needs to be fixed before it will be accepted by the host system), but just got to swap the battery over to another switch as it doesn't charge in RCM mode, fingers crossed its not just a totally dead system .....although it does solve the problem of me wanting to revive it

Yeah I presume not all the binaries would just work out of the box, but with a few tweaks (presumably a few other bytes that would need to be configured for the host unit) I don't see why it would not work.

I do think it would be a very tedious process though.

 

[rajkosto]

savedata is device specific and not reverse engineered so dont know which bytes need to be recalculated with new device's key if you are transplating it...
without system savedata you just get a black screen after (Nintendo) logo

other than that, normal system operation requires PRODINFO, which is ALL device specific data only creatable by nintendo

 

[Reecey]

I’m not sure if I’m correct here but can you not buy a complete eMMC module and plug it in I thought you could? Try ebay GQ I’m sure they sell them. Yes eBay have loads put in Nintendo switch eMMC there’s loads for sale. Is that what you want? Not sure?

 

[rajkosto]

the module isnt the problem, the missing data is.

 

[linuxares]

https://www.aliexpress.com/item/EMM...dule-repair-parts-For-Switch/32871062224.html - I don't know if this will help you on your quest. I guess you have to wait for a CFW before doing anything. A donor will probably do nothing if the encryptions aren't correct.

 

[gamesquest1]

ok, well thanks for the input, seems there may be something else wrong with the system, idk if its a broken charge IC as it doesn't seem to be detected by windows, but it does seem to be warming up like its on, might be why the original owner was trying to change the battery not realising the charge IC was broken

just wondering if people know if the charge IC being broken would also mean it would not interface via USB, I'm assuming so but idk, kinda means its on the back, back, back burner for now

 

[SimonMKWii]

All Switch crypto is symmetrical, so technically it should be possible.

 

[NO_ob]

Pretty sure the nand contents are encrypted with a different key for each console. Without any way of getting that key, you don't have any chance at rebuilding that nand.

It may be possible in the future though. Maybe you can dump whatever key is needed while in RCM mode, or maybe with emunand you can boot a decrypted nand from SD. Or maybe they come up with something like CTRTransfer for Switch.

While plausible, I think you're going to be waiting a long time before any of these solutions are released. But I could be wrong, I would ask in the ReSwitched Discord about Atmosphere's emunand capabilities.

you can already dump the keys if you look at the tutorial for getting exefs on lower fws you dump the keys i'm pretty sure you can decrypt all partitions with these

 

[Prince ofhell]

you can already dump the keys if you look at the tutorial for getting exefs on lower fws you dump the keys i'm pretty sure you can decrypt all partitions with these

the prodinfo is the big problem it's the key for every thing if you rebuild the system and the user and the safe and the prodinfo is still faulty the switch will be stuck on the logo so you need a way to rebuild the prodinfo and prodinfof

tell now you don't have a way to rebuild a wii u nand if the key's are lost ... i guess you should forget about that switch .... i have a smiler switch with a prodinfo damaged tell now no answer for how to rebuild the prodinfo partition

 

[Prince ofhell]

if you got the keys for the fuse.bin and the tsec_keys.bin so buck up of those 2 is 50% of the work
buckup the prodinfo and prodinfof is the other 50% of work

so to rebuild any cfw you will need a fuse.bin and the tsec_keys.bin ... prodinfo and prodinfof.bin this 4 fils can do the magic work

 

[Prince ofhell]

system nand partition NAND structure

https://switchbrew.org/wiki/Flash_Filesystem

 

[linuxares]

Trying to repair the prodinfo is something some hackers have tried to figure out. So far, no luck. I still think there must be an algoritm how they're made. That they match hardware etc inside the Switch. Is the TSEC the one that confirms the prodkeys are correct? What is deciding prodinfo are valid keys or not?

 

[Prince ofhell]

its the fuse key and the tesc key that unlock the bis 0 key encrypt for the prodinfo and prodinfof thats what i know