Switch Unbricking Guide - ProdInfo Fix (PikaFix)

zorusgb · Dec 10, 2021

zorusgb said:
I'm trying to fix my unpatched switch after it just wouldn't wake up one day (never modded before). It looks like dead emmc. So I got a blank emmc and followed all 3 methods and read all the discussions. Everything seem to go well until the very last step (method 3), system wipe through tegra explorer where I get: User failed to mount!
The switch goes to black screen splash screen when I try to launch Atmosphere and have to hold the power down to turn it off.
I noticed that the pikafix pack doesn't contain USER image and the guides mention nothing about that partition. Is this on purpose or am I missing something? The new emmc has a user partition, but that only because I used gptrestore when it was blank.

It doesn't look like I have a functional USER partition; when I mount it in HacDiskMount windows is not seeing it. That king of explains the above. I either need a donor user.bin (or nand dump) or a tool to format it. Any ideas how to do that? The other partitions show as a FAT32, but I think this is because HacDiskMount translates it in a format Windows can operate with.

Adran_Marit · Dec 10, 2021

zorusgb said:
I'm trying to fix my unpatched switch after it just wouldn't wake up one day (never modded before). It looks like dead emmc. So I got a blank emmc and followed all 3 methods and read all the discussions. Everything seem to go well until the very last step (method 3), system wipe through tegra explorer where I get: User failed to mount!
The switch goes to black screen splash screen when I try to launch Atmosphere and have to hold the power down to turn it off.
I noticed that the pikafix pack doesn't contain USER image and the guides mention nothing about that partition. Is this on purpose or am I missing something? The new emmc has a user partition, but that only because I used gptrestore when it was blank.

In your case you would likely need to flash an entire rawnand image to your nand then apply the pikafix. The other likely thing is the partition data may be out of alignment.

I suggest you follow THIS GUIDE first, to build all the partitions you need, then proceed with method 1 of pikafix.

If you are still having trouble, please feel free to message or reply here and I'm happy to help when I can

zorusgb · Dec 10, 2021

Adran_Marit said:
In your case you would likely need to flash an entire rawnand image to your nand then apply the pikafix. The other likely thing is the partition data may be out of alignment.

I suggest you follow THIS GUIDE first, to build all the partitions you need, then proceed with method 1 of pikafix.

If you are still having trouble, please feel free to message or reply here and I'm happy to help when I can

Thanks Adrian. I tried the guide you suggested; identical to your guide the restore script runs fine, but it doesn't seem to rectify the issue with the USER partition. Since I cant do a emmc dump I used the SYSTEM folder generated from OFW 12.0.2 (I have 15 burned fuses) through EmmcHaccGen using my keys. I guess you're omitting the USER.bin in your PikaFix pack because of the sheer size of a mostly empty file. I tried looking for a donor dump on the net, but no luck; does such thing even exist? Here is my emmc table if it can provide any clues what might be the problem.

Adran_Marit · Dec 11, 2021

zorusgb said:
Thanks Adrian. I tried the guide you suggested; identical to your guide the restore script runs fine, but it doesn't seem to rectify the issue with the USER partition. Since I cant do a emmc dump I used the SYSTEM folder generated from OFW 12.0.2 (I have 15 burned fuses) through EmmcHaccGen using my keys. I guess you're omitting the USER.bin in your PikaFix pack because of the sheer size of a mostly empty file. I tried looking for a donor dump on the net, but no luck; does such thing even exist? Here is my emmc table if it can provide any clues what might be the problem.

I'm not sure I feel like the offset is wrong, does the user partition mount at all if you try it ?

zorusgb · Dec 11, 2021

Adran_Marit said:
I'm not sure I feel like the offset is wrong, does the user partition mount at all if you try it ?

As far as I can tell the offsets are OK; I found a reference of a "proper" partition table and the two match perfectly. One issue I noticed is that I cant encrypt/decrypt USER, I get Fail! Entropy:....Either because USER is messed up or my keys are bad.
BIS Keys 0-2 work fine though. If I'm not mistaken BIS Key 2 and 3 are supposed to be identical (they are for me) and if 2 works for SYSTEM, then it's not the keys. So back to the donor issue to fix the messed up USER. Did I stumble on a taboo request and that's why your pack doesn't contain a USER.bin?
I also tried following ewabc886 NAND rebuilding guide, but he also starts with a donor. I figure if PRODINFO can be anonymized, then USER should be no problem too (besides the size). Anyone knows if USER.bin donor can be found?

zorusgb · Dec 11, 2021

zorusgb said:
As far as I can tell the offsets are OK; I found a reference of a "proper" partition table and the two match perfectly. One issue I noticed is that I cant encrypt/decrypt USER, I get Fail! Entropy:....Either because USER is messed up or my keys are bad.
BIS Keys 0-2 work fine though. If I'm not mistaken BIS Key 2 and 3 are supposed to be identical (they are for me) and if 2 works for SYSTEM, then it's not the keys. So back to the donor issue to fix the messed up USER. Did I stumble on a taboo request and that's why your pack doesn't contain a USER.bin?
I also tried following ewabc886 NAND rebuilding guide, but he also starts with a donor. I figure if PRODINFO can be anonymized, then USER should be no problem too (besides the size). Anyone knows if USER.bin donor can be found?

I think I finally managed to sort out the USER partition issue. I found a rawnand dump in the Unbrick_Your_Switch pack by mattytrog (much appreciated Matt!). Mounted the archive in HacDiskMount and extracted the USER partition using null keys. I then flashed it to my emmc using my keys and it worked; the partition mounts fine and the keys check out. The FWGEN scripts both completed w/o error too.

Now I need to figure out why I'm getting black screen after the Atmosphere splash screen. I used FW 12.0.2 for the nand rebuild which is the minimal for my fuse count (15), so it should work in theory, but I', new to the HB scene so it could be many other things. Any suggestions are welcome.

zorusgb · Dec 12, 2021

zorusgb said:
I think I finally managed to sort out the USER partition issue. I found a rawnand dump in the Unbrick_Your_Switch pack by mattytrog (much appreciated Matt!). Mounted the archive in HacDiskMount and extracted the USER partition using null keys. I then flashed it to my emmc using my keys and it worked; the partition mounts fine and the keys check out. The FWGEN scripts both completed w/o error too.

Now I need to figure out why I'm getting black screen after the Atmosphere splash screen. I used FW 12.0.2 for the nand rebuild which is the minimal for my fuse count (15), so it should work in theory, but I', new to the HB scene so it could be many other things. Any suggestions are welcome.

If it helps, this is the message I get with newer versions of Atmosphere (pic). Older versions just end up with black screen, no message. There are some reports of this happening to other Switches, but none of the solutions seem to work.

Adran_Marit · Dec 12, 2021

zorusgb said:
If it helps, this is the message I get with newer versions of Atmosphere (pic). Older versions just end up with black screen, no message. There are some reports of this happening to other Switches, but none of the solutions seem to work.

okay cool we getting somewhere

A few questions

1) When following matty's tutorial did you resign the partitions with your keys?
2)You followed the previously linked tutorial for generating the firmware files?
3) since you got the user partition fixed did you follow this tutorial to generate a prod info (Method 1) and flash it?
4) Do you have a gamecard inserted?

zorusgb · Dec 13, 2021

Adran_Marit said:
okay cool we getting somewhere

A few questions

1) When following matty's tutorial did you resign the partitions with your keys?
2)You followed the previously linked tutorial for generating the firmware files?
3) since you got the user partition fixed did you follow this tutorial to generate a prod info (Method 1) and flash it?
4) Do you have a gamecard inserted?

To quickly answer your questions:
1: I didn't follow his tutorial, just borrowed the USER part that was missing in the PikaFix. But yes, all entropies eventually passed.
2: Not just, but also repeated them from scratch. I'll explain in a new post.
3: As above in 2 (BTW, there is an error in the guide I believe)
4: Nope

umby24 · Dec 13, 2021

Came to add; I'm in the same boat. eMMC chip died one day. Followed the rebuild your nand from scratch guides, and I get as far as having a nintendo switch logo appear, and then Atmosphere crashes. I've retried and retried many times now over the last 3 days;

Of interest to me is on the error screen, the general purpose registers from X0 -> X28 have no value at all.
Error code of 2162-0002 (0x4a2).
I've tried firmwares 13.1.0, 12.0.2, and the pikafix pack whatever that's on.

Adran_Marit · Dec 13, 2021

umby24 said:
Came to add; I'm in the same boat. eMMC chip died one day. Followed the rebuild your nand from scratch guides, and I get as far as having a nintendo switch logo appear, and then Atmosphere crashes. I've retried and retried many times now over the last 3 days;

Of interest to me is on the error screen, the general purpose registers from X0 -> X28 have no value at all.
Error code of 2162-0002 (0x4a2).
I've tried firmwares 13.1.0, 12.0.2, and the pikafix pack whatever that's on.

Try method 1 in this post then try booting atmosphere again and let me know

zorusgb said:
To quickly answer your questions:
1: I didn't follow his tutorial, just borrowed the USER part that was missing in the PikaFix. But yes, all entropies eventually passed.
2: Not just, but also repeated them from scratch. I'll explain in a new post.
3: As above in 2 (BTW, there is an error in the guide I believe)
4: Nope

1) Entropies passing is good
2) Okay if all the firmware flashed properly that is also good.
3) If there is an error in this guide for flashing the prodinfo which is the guide I was referring to, please message me what you think it is. I'm sorry should have made that a bit clearer
4) Okay

As above, please try method 1 in this guide and let me know

Thanks

zorusgb · Dec 13, 2021

zorusgb said:
To quickly answer your questions:
1: I didn't follow his tutorial, just borrowed the USER part that was missing in the PikaFix. But yes, all entropies eventually passed.
2: Not just, but also repeated them from scratch. I'll explain in a new post.
3: As above in 2 (BTW, there is an error in the guide I believe)
4: Nope

I shouldn't have called it error, it's an omission at most; let me explain.

First I started making sure PRODINFO is generated properly. This is probably where I was making the first mistake. What I didn't realize is that prodinfo_gen needs not only the donor prodinfo file, but also the keys dump. That's probably obvious and explained in the tool usage page, but got past a noob like me. The ewabc886 guide mentions this step; what's missing is that the keys dump needs to be renamed to donor. Perhaps for prodinfo from scratch it doesn't matter, but it did in my case as I wanted to follow the donor path in order to be able to use game cartridges. I was getting "can't parse keys file" error (which I dismissed the first time); the error went away after renaming the keys file to donor. I don't know if this makes any difference, but it's an observation I thought I should share.

Uploaded the now supposedly correct prodinfo, but still black screen after splash. Repeated all 3 guides for good measure (plus the ewabc886 one) and still no luck.

However, while playing with prodinfo_gen I noticed that the donor prodinfo was being identified as 10.2.0 and I was using 12.0.2 which is the lowest available for my fuse count. I went back and re-did the FW part in ewabc866 guide but using OFW 10.2.0 instead. Lo and behold, it booted this time!

Now, new issue

. The moment I insert a game cartridge the console crashes. I'll post a screenshot tonight. Made some progress though, so can't comlain.

umby24 · Dec 13, 2021

Adran_Marit said:
Try method 1 in this post then try booting atmosphere again and let me know

1) Entropies passing is good
2) Okay if all the firmware flashed properly that is also good.
3) If there is an error in this guide for flashing the prodinfo which is the guide I was referring to, please message me what you think it is. I'm sorry should have made that a bit clearer
4) Okay

As above, please try method 1 in this guide and let me know

Thanks

WOMG it booted!
Redownloaded your donor prodinfo, followed the steps and boom, booted right away!
I could hug you
Thank you

zorusgb · Dec 14, 2021

umby24 said:
WOMG it booted!
Redownloaded your donor prodinfo, followed the steps and boom, booted right away!
I could hug you
Thank you

Nicely done umby24, congrats. Are you able to use game cartridges? I get this as soon as I put one in:

zorusgb · Dec 14, 2021

zorusgb said:
Nicely done umby24, congrats. Are you able to use game cartridges? I get this as soon as I put one in:

Never mind, updated to 12.0.2 through daybreak and its all good. I suspect it was a mismatch between the FW revision and the card reader fuses. Men so much reading and learning to get to this point

Long story short, although it wasn't the goal of this guide it is possible to completely rebuild a switch emmc with just the tools and files that are readily available on the web.

Shoutout to Adrian, ewabc866, mattytrog and the countless others that made any of this possible.

Now to the next phase: try to recover the data of the busted emmc board; hundreds of hours of saves on that bastard

Adran_Marit · Dec 14, 2021

zorusgb said:
Never mind, updated to 12.0.2 through daybreak and its all good. I suspect it was a mismatch between the FW revision and the card reader fuses. Men so much reading and learning to get to this point

Long story short, although it wasn't the goal of this guide it is possible to completely rebuild a switch emmc with just the tools and files that are readily available on the web.

Shoutout to Adrian, ewabc866, mattytrog and the countless others that made any of this possible.

Now to the next phase: try to recover the data of the busted emmc board; hundreds of hours of saves on that bastard

Nice, pro tip. Make a complete nand backup at this point. Makes it easier for recovery now.

Good luck i suspect you'll need an external emmc reader at least

zorusgb · Dec 14, 2021

Oh, I did that right away; learned that lesson the hard way.
I ordered both dongles, mmcblkNX and exploit.te; also got an used emmc module from ebay to practice on.
With the dead bugging method I won't have access to Boot0 and Boot1; is there system specific information or is it Prodinfo the important one?
Unless the emmc chip itself is dead I should be able to access everything but the boot partitions. My ultimate goal is to recover the system to stock if it's even possible with a substitute emmc board.

umby24 · Dec 14, 2021

zorusgb said:
Nicely done umby24, congrats. Are you able to use game cartridges? I get this as soon as I put one in:

It appears during one of my teardowns of the system I broke the daughterboard or its ribbon cable or something, as the touch screen, card reader, and headphone jack are non-functional, so I can't test, sorry!

Adran_Marit · Dec 15, 2021

zorusgb said:
Oh, I did that right away; learned that lesson the hard way.
I ordered both dongles, mmcblkNX and exploit.te; also got an used emmc module from ebay to practice on.
With the dead bugging method I won't have access to Boot0 and Boot1; is there system specific information or is it Prodinfo the important one?
Unless the emmc chip itself is dead I should be able to access everything but the boot partitions. My ultimate goal is to recover the system to stock if it's even possible with a substitute emmc board.

mmcblknx will allow you access to boot partitions
as well as prodinfo and all the other ones

Possibly.

umby24 said:
It appears during one of my teardowns of the system I broke the daughterboard or its ribbon cable or something, as the touch screen, card reader, and headphone jack are non-functional, so I can't test, sorry!

oof

zorusgb · Dec 15, 2021

Wow, you did a number on that one, eh

.

Well-Known Member

Attachments

Walküre's Hacker

Well-Known Member

Attachments

Walküre's Hacker

Well-Known Member

Attachments

Well-Known Member

Well-Known Member

Attachments

Walküre's Hacker

Well-Known Member

New Member

Walküre's Hacker

Well-Known Member

New Member

Well-Known Member

Attachments

Well-Known Member

Walküre's Hacker

Well-Known Member

New Member

Walküre's Hacker

Well-Known Member

Similar threads

Popular threads in this forum