Hacking Switch Cartridge - Reverse Engineering

Status
Not open for further replies.

spotanjo3

Well-Known Member
Member
Joined
Nov 6, 2002
Messages
11,145
Trophies
3
XP
6,211
Country
United States
What's the point ? If there is no Switch emulator or Switch is hack then there is no way to test the dump so called rom or iso.
 

Drakia

Well-Known Member
Member
Joined
Mar 15, 2008
Messages
1,644
Trophies
2
Age
36
XP
2,596
Country
Canada
What's the point ? If there is no Switch emulator or Switch is hack then there is no way to test the dump so called rom or iso.
Same reason we had 3ds dumps before flash cards/cfw, WiiU dumps before sig patches, and currently have ps4 dumps with no way to play them, because eventually we will be able to use them.
 

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,432
Country
United States
What's the point ? If there is no Switch emulator or Switch is hack then there is no way to test the dump so called rom or iso.
3ds had dumps before they were of any use. Understanding the cart (and thus being able to dump it) is the first part of getting it to run again.
 

Plushie

Well-Known Member
Newcomer
Joined
Feb 12, 2017
Messages
48
Trophies
0
Age
32
XP
103
Country
Belgium
Question: You say it looks like a normal NAND chip. Doesn't Nintendo normally use ROM with a small flash memory for saving? With Switch Cartridges being read-only and can't save to the card, wouldn't it be more logical for them to just be using simple ROMs?
 

Dark-Sider

Active Member
Newcomer
Joined
Jul 17, 2009
Messages
27
Trophies
0
XP
184
Country
Gambia, The
.3ds roms were online way before anyone made an emulator or working flash cart, dumping is easier then getting them to run again.
If by copying you just meant dumping it, then I'm inclined to agree. I always think of "cloning" a cart when someone talks about copying (creating a duplicate that actually can be run on the console)

Question: You say it looks like a normal NAND chip. Doesn't Nintendo normally use ROM with a small flash memory for saving? With Switch Cartridges being read-only and can't save to the card, wouldn't it be more logical for them to just be using simple ROMs?
He meant it looks like a chip that has the same TSOP layout as common NAND chips. However this is just a way of packaging custom ICs. https://en.wikipedia.org/wiki/Thin_Small_Outline_Package You can't tell what the chips actually does just by looking at it (if it has no / unknown markings)
 

Duo8

Well-Known Member
Member
Joined
Jul 16, 2013
Messages
3,613
Trophies
2
XP
3,024
Country
Vietnam
I don't think this is the case, but I guess time will tell. Adding CPU-Protection and stuff really adds up on production costs when you make millions of them.

Impossible? No, definitely not.
Unlikely? Yes.

Anyways right now I'm probably going to design a PCB for the switch where I can solder a bunch of wires on to debug anything thats happening on there, sounds like the most flexible solution on getting to know the cartridge a bit better
That's what the Vita did IIRC. These chips have a controller and they just use that.
The Vita also used the COB packaging like botw cart.
 

dubbz82

Well-Known Member
Member
Joined
Feb 2, 2014
Messages
1,572
Trophies
0
Age
41
XP
1,215
Country
United States
What's the point ? If there is no Switch emulator or Switch is hack then there is no way to test the dump so called rom or iso.


1. It would be a Rom as its dumped from a cartridge.
2. Because we can?
3. Kinda hard to develop any sort of flash cart/Rom loader without understanding how the carts work in the first place, no? Also pretty hard for anyone that might be working on a loader (either hardware or software) to know if its actually working without having some means of testing it.
 
Last edited by dubbz82,
  • Like
Reactions: TheCyberQuake

spotanjo3

Well-Known Member
Member
Joined
Nov 6, 2002
Messages
11,145
Trophies
3
XP
6,211
Country
United States
1. It would be a Rom as its dumped from a cartridge.
2. Because we can?
3. Kinda hard to develop any sort of flash cart/Rom loader without understanding how the carts work in the first place, no?

You don't have to explain again. Please check my "like" before you answer my question. :) Anyway, I just click "like" on those two people that already answered my question, thanks anyway. That's why I didn't look at it again until now because of red mark appear on the bell icon and I thought it is something else. Let it go, ok ?
 

xile6

Well-Known Member
Member
Joined
Jan 15, 2006
Messages
1,219
Trophies
0
XP
720
Country
United States
What's the point ? If there is no Switch emulator or Switch is hack then there is no way to test the dump so called rom or iso.
And you sir happen to be an enduser.

To the hacking scene dumps are use to dig through and find data.
You get a few dumps and compare what they have in common to each other. This is how you got about getting encryption keys, that would later be use to fully open the games and you have a way into the system.

Samw as sky3ds they spoof a real 3ds cart and thats how they were able to run 3ds game on unmodified firmware
 
  • Like
Reactions: DarthDub

Conn0r

Well-Known Member
Member
Joined
Jan 10, 2016
Messages
355
Trophies
0
Age
27
XP
718
Country
United States
Wait, it's not rom? Could we connect wires to it and reflash a new image to it?
 

spotanjo3

Well-Known Member
Member
Joined
Nov 6, 2002
Messages
11,145
Trophies
3
XP
6,211
Country
United States
And you sir happen to be an enduser.

To the hacking scene dumps are use to dig through and find data.
You get a few dumps and compare what they have in common to each other. This is how you got about getting encryption keys, that would later be use to fully open the games and you have a way into the system.

Samw as sky3ds they spoof a real 3ds cart and thats how they were able to run 3ds game on unmodified firmware

LOL
 

Roamin64

Well-Known Member
Member
Joined
May 24, 2007
Messages
280
Trophies
1
Age
43
XP
2,488
Country
Canada
I'm curious to know what is the background of the OP ? I highly doubt if you are asking for donations that you can rival with all the chinese that make a living by copying other's work, that have tons of resources and pcb manufactures in their backyard. I don't know Smiba , and I've never heard of you, but anything is possible. But if high profile people in the scene aren't asking for any donations, I doubt you'll get anywhere. Anyone with enough skills will not be asking himself how to probe the cart while it's in the device , but would simply build a custom pcb that would replace the cartridge in the slot , or simply directly solder to the cartridge slot inside the switch , connect it to a FPGA , logic analyzer and a bunch of other tools and then figure out what each pin really does with man in the middle attacks and other methods.

I'm not trying to bash on Smiba at all , I wish you all the success in the world , hell all I want from this console is piracy. But you simply don't sound like you'll be the one cracking this whole stuff.

Just push the current exploits even further , and once you get kernel access , you won't even need to understand how the cartridge works , you'll just be able to use the console to rip the cartridge.

Still , I wish you good luck in your endeavor.
 
Status
Not open for further replies.

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    BakerMan @ BakerMan: it looks like a little kids' game, and bunny (welcome btw) is looking for an uncensor patch