Hacking [RCM Payload] Hekate - CTCaer mod

[tecfreak]

I can distribute the coreboot file even though it has this blob inside.

You can do everything you want, but it doesn't mean that this wouldn't be a copyright violation. That is why no one shares this blob and why everyone tells you to extract it yourself.

 

[CTCaer]

You can do everything you want, but it doesn't mean that this wouldn't be a copyright violation. That is why no one shares this blob and why everyone tells you to extract it yourself.

i know what you are saying, but well, it works a little differently with Google and many other manufacturers and android rom components.

https://developers.google.com/android/images
Look down below.

You will see 2 licenses for the distribution images:
https://creativecommons.org/licenses/by/3.0/
https://www.apache.org/licenses/LICENSE-2.0

These basically allow you, via the already given consent of Google to distribute these files, even though they include proprietary blobs and drivers.
That's why sites like XDA developers still exist.

Another big example is Windows.
It's legal to share the installation image and parts of it. Copy paste, Dvd, iso whatever. BUT you can't share the license.


With console software though it's another thing.
Because there's encryption in play and the manufacturer does not allow you to acquire them normally, they abide on copyright and distribution laws for each region.


EDIT:
Btw the above does not mean that I will also distribute it, if I decide to use it for hekate.
I'm just making conversation here.

 

[Sury1943]

I got a question about the restoration of a backup. I made a full back up of my NAND, using a Fat32 formatted SD Card.
Because my switch in on ofw 4.1.0 and there is no support for exFAT in the OFW or CFW.
How do i restore my NAND now ?

Joining the NAND parts into one file is no problem at all and needed cause according to the information provided, Hekate dus not support restoring from multiple parts.
However, this results in a file exceeding the single file limitation of Fat32.
So does Hekate support exFat regardless if the switch itself has the update or is it dependent on the ofw having the exFat update ?

 

[tecfreak]

So does Hekate support exFat regardless if the switch itself has the update or is it dependent on the ofw having the exFat update ?

This question has been answered 1000 times. YES, it supports exFAT no matter if your FW does it or not.
Next time, read the OP! It's everything there!

 

[Sury1943]

This question has been answered 1000 times. YES, it supports exFAT no matter if your FW does it or not.
Next time, read the OP! It's everything there!

Sorry, i apparently read over that part, thank you for the fast reply.

 

[MarkDaPirate]

Sorry if this has been answered before but I haven't been able to find an answer.

Is it safe to boot into hakate and then go online?

I have just got my switch and wanted to check rcm with a jig worked (it does) so I got it into rcm mode sent the payload bin and then rebooted after seeing it booted fine.

Am I now safe to go online with out a ban?

Cheers for any help

 

[Draxzelex]

Sorry if this has been answered before but I haven't been able to find an answer.

Is it safe to boot into hakate and then go online?

I have just got my switch and wanted to check rcm with a jig worked (it does) so I got it into rcm mode sent the payload bin and then rebooted after seeing it booted fine.

Am I now safe to go online with out a ban?

Cheers for any help

Nobody has been banned for only using Hekate but that doesn't mean its safe, it just means nobody has been banned yet. CTCaer is not held responsible for any bans that you may incur while using his work.

 

[MarkDaPirate]

Thanks, I'll risk it then

 

[Draxzelex]

@CTCaer I've got a burning question in my head. I know you consider writing to the eMMC dangerous but this is more in relation to something else. The eMMC works like an SD card and when people restore their NAND to it, it reduces the number of write cycles it has left. My question is it is possible to reach that limit in the console's lifetime or do you have to restore an exceedingly abnormal number of times to reach that limit? I'm asking because many people will be restoring their NAND backups made before backups in order to avoid being banned and I would like to know how effective it will be in the long-term (outside of the obvious risk that your writing directly to the eMMC).

 

[hippy dave]

Restoring a complete backup only writes to each memory location once. Unless you were doing so daily I don't think the impact on its lifetime would be significant.

 

[CTCaer]

@CTCaer I've got a burning question in my head. I know you consider writing to the eMMC dangerous but this is more in relation to something else. The eMMC works like an SD card and when people restore their NAND to it, it reduces the number of write cycles it has left. My question is it is possible to reach that limit in the console's lifetime or do you have to restore an exceedingly abnormal number of times to reach that limit? I'm asking because many people will be restoring their NAND backups made before backups in order to avoid being banned and I would like to know how effective it will be in the long-term (outside of the obvious risk that your writing directly to the eMMC).

You have to restore an abnormal number of times.
Normally eMMC life performance is around 2000-5000 writes per cell. I don't know exactly though. Manufactures tend to keep these figures a secret or using strange year expectancy calculations.

Depends on NAND chip type (the actual storage chip inside the eMMC), quality (binning) and manufacturers algorithms.
Samsung are the best currently. So the above number should be higher (still not sure though).

On the other hand, replacements are quite cheap. Around 10 dollars. And you can just restore the backup to a new one.

In the end, it's not a good idea to play often with a full write all the time. And a user must always keep this in mind.

 

[fOmey]

I'm just wondering if we select "launch stock" option will this prevent fuses being burnt if we have upgraded using the unofficial method? Excuse my ignorance, I've been out of the switch hacking loop for a minute.

 

[Chrushev]

Is there a difference between installing AutoRCM via this, versus using SX OS 1.3 Auto RCM install?

 

[Minikea]

i don't know, maybe I'll play with this sometime. Still though, I have more important things to do (booting linux through hekate is a pain in the ass).

Honnestly, I've tested Linux on Switch with ShofEL2 and it was fun to work with but in the end it's just useless (for me).
Maybe it's more friendly for dev to work in a linux env but for end user the homebrew are far more easier to play with.
And i suspect that if you want to boot linux on switch you'll have to bypass the limit of loader size or at least exploit the A57 core and not the BPMP. I trust you: that would be a pain in the ass.

 

[CTCaer]

I'm just wondering if we select "launch stock" option will this prevent fuses being burnt if we have upgraded using the unofficial method? Excuse my ignorance, I've been out of the switch hacking loop for a minute.

All options in Launch firmware bypass efuses and lock them to prevent burning them.

Is there a difference between installing AutoRCM via this, versus using SX OS 1.3 Auto RCM install?

Yes. They corrupt different parts. So they are incompatible. Always uninstall AutoRCM with the same payload used to install it.

Honnestly, I've tested Linux on Switch with ShofEL2 and it was fun to work with but in the end it's just useless (for me).
Maybe it's more friendly for dev to work in a linux env but for end user the homebrew are far more easier to play with.
And i suspect that if you want to boot linux on switch you'll have to bypass the limit of loader size or at least exploit the A57 core and not the BPMP. I trust you: that would be a pain in the ass.

Well the CBFS serving is solved. The problem is that it stucks on tz firmware for some reason. One step before uboot.

 

[Chrushev]

Yes. They corrupt different parts. So they are incompatible. Always uninstall AutoRCM with the same payload used to install it.

Is there a reason why we use different approaches? What makes one better than the other? Why not use a universal one? Reminds me of this https://xkcd.com/927/

 

[CTCaer]

Is there a reason why we use different approaches? What makes one better than the other? Why not use a universal one? Reminds me of this https://xkcd.com/927/

Ask tx.

AutoRCM from hekate (it is called AutoRCM v2) and Bricmii were the first.
Hekate and Brickmii, XOR one byte in each BCT with a specific or random value each.
Afaik, Brickmii can unbrick any option. At least it's what seems to do judging by its code.

But in the end, all of them do the same job.

The public key is still the same for all switches, so even if you mess this up, you can still restore it.

EDIT:
Btw, hekate does not use Brickmii's AutoRCM, because of size constraints.
We are still a bootloader with countless features and not just a tool. So everything has to fit in 123KiB.
But it would be good to have a similar unbrick option though.

 

[Minikea]

It's possible to clear logs while in hekate, without booting the system?
I noticed sys-ftpd is not working if we boot with the clear logs option.

[CFW + FTP + Clear Log]
kip1=modules/sys-ftpd.kip
kip1=modules/newfirm/loader.kip
kip1=modules/newfirm/sm.kip
kip1=modules/nx-dreport.kip

My full ini file:

{------------ Stock -----------}
[Stock]
[Stock + Clear Log]
kip1=modules/nx-dreport.kip
{ }

{------ Custom Firmwares ------}
{IP: 192.168.1.10 / Port: 5000}
{ }
[CFW + FTP]
kip1=modules/sys-ftpd.kip
kip1=modules/newfirm/loader.kip
kip1=modules/newfirm/sm.kip
[CFW + FTP + Clear Log]
kip1=modules/sys-ftpd.kip
kip1=modules/newfirm/loader.kip
kip1=modules/newfirm/sm.kip
kip1=modules/nx-dreport.kip
{ }

{--------- LayeredFS ----------}
{IP: 192.168.1.10 / Port: 5000}
{ }
[LayeredFS + FTP]
kip1=modules/sys-ftpd.kip
kip1=modules/newfirm/loader.kip
kip1=modules/newfirm/sm.kip
kip1=modules/newfirm/fs_mitm.kip
atmosphere=1
[LayeredFS + FTP + Clear Log]
kip1=modules/sys-ftpd.kip
kip1=modules/nx-dreport.kip
kip1=modules/newfirm/loader.kip
kip1=modules/newfirm/sm.kip
kip1=modules/newfirm/fs_mitm.kip
atmosphere=1
{ }

with the last SDFILE release, the

[CFW + FTP + Clear Log]
kip1=modules/sys-ftpd.kip
kip1=modules/newfirm/loader.kip
kip1=modules/newfirm/sm.kip
kip1=modules/nx-dreport.kip
{ }

works with my 3.0.0 switch

 

[triple-sevenz]

I bought a second switch just for cfw and homebrew and stuff. How do I know if it is a new one with the RCM vulnerability patched?

 

[tecfreak]

I bought a second switch just for cfw and homebrew and stuff. How do I know if it is a new one with the RCM vulnerability patched?

Check the serial number.
https://gbatemp.net/threads/switch-informations-by-serial-number.481215/