​

Just over a week ago, team Xecuter announced that they are working on a soon-to-be-revealed modchip for the Nintendo Switch. This was big news because modchip devices are usually used to circumvent anti-piracy measures on many digital platforms, but mainly gaming systems, and to see one already in the works for a machine that is only 10 months old is very rare.

Since then the team have been quiet, no one knows what the device will look like, how it will work, or when they can get their hands on one - but GBAtemp can exclusively reveal today that there will be BOTH a solder AND solderless option of team Xecuter's Nintendo Switch modchip.

Here is a direct quote from team Xecuter:

For now, I can tell you there is a solder and solderless version. We have quite a lot in the works, you will have more info soon.

The difference in pricing should be interesting in the two versions of the device, but at least you can now rest safely, knowing that the team will be providing options for whatever the Xecuter Switch modchip turns out to be.

Stay tuned to GBAtemp for more info in the upcoming weeks.

 

[Onibi]

The bootrom vuln is in the USB RCM part of the bootrom. You can trigger it with the right hardware.
For the glitching, you don't really need USB. Glitching exploits a way to skip the RSA sig check so it will run any bootloader you put on eMMC.

You don't need the 'bootrom keys' to communicate with USB. If you put the Switch into USB RCM mode, it will tell you its UID. Is that not USB comms then and there?

Hey, interresting, thank you, where you got the information from?

About the glitching - I though so. Probably harder to pull off then the other way. I mean, I would be happy with a clamp-on eMMC programmer and a chip that could glitch in (even better also calculate ) the signature ...

But if there is a neat way to trigger the RCM, coolio, even better That should allow you to permanently flash a new bootrom as well thou, no? You think this is what's going on in the video and what TX is gonna do? That would be nice to have solution A neat little cable to just plug in

--------------------- MERGED ---------------------------

If you don't believe me read what Nvidia themselves say about the matter: https://http.download.nvidia.com/tegra-public-appnotes/tegra-boot-flow.html

• If no valid bootloader could be found, enters USB recovery mode (RCM).

Just read this - that would be too easy ... ^__^

 

[brickmii82]

It feels like both the PS3 and Xbox360 prepared these folks to hack this thing. Xbox had the efuses and PS3 had the recovery mode lol

 

[Onibi]

You don't need the 'bootrom keys' to communicate with USB. If you put the Switch into USB RCM mode, it will tell you its UID. Is that not USB comms then and there?

https://http.download.nvidia.com/tegra-public-appnotes/tegra-boot-flow.html

• The Tegra SoC supports various security modes. Some of these modes require the BCT, bootloader, and/or RCM protocol messages to be encrypted and/or signed with a potentially device-specific key.

I assume you need a key, but that it is either flawed or can be leaked? I mean, I don't think they left that open.

 

[RedHunter]

"But on top of that, because of Stargate large success, they also dropped their price by US$10!"

Yeah ahah best part of that email. Glad to know their not selling too well, those gateway scammers doesn't deserve any more money.

 

[mariogamer]

What is that video exactly.

https://http.download.nvidia.com/tegra-public-appnotes/tegra-boot-flow.html

• The Tegra SoC supports various security modes. Some of these modes require the BCT, bootloader, and/or RCM protocol messages to be encrypted and/or signed with a potentially device-specific key.

I assume you need a key, but that it is either flawed or can be leaked? I mean, I don't think they left that open.

We would need a privatekwey from Nintendo, yeah.