Hardware What's the whole eFuses thing?

  • Thread starter Deleted User
  • Start date
  • Views 8,838
  • Replies 22
D

Deleted User

Guest
OP
I mean, I get that it prevents us from downgrading, but when/if we get the ability to dissect the update to the point where we can see all individual files, couldn't we just modify the amount of eFuses that's been coded to the amount of the most recent firmware from which we could downgrade? Then flash the image to the Switch. That would allow us to use an earlier firmware just be modifying the amount of required eFuses.

I mean, I highly doubt Nintendo hardcoded all the firmware versions beforehand, because that wouldn't be very intelligent.
 

Xzi

Time to fly, 621
Member
Joined
Dec 26, 2013
Messages
17,716
Trophies
3
Location
The Lands Between
Website
gbatemp.net
XP
8,462
Country
United States
You can't unburn efuses, so it's a matter of whether or not CFW can be updated without burning more. If not, then sysfirm and customfirm would have to be the same version, and it wouldn't be possible to do CFW/backups past 3.0.0.
 
  • Like
Reactions: BIFFTAZ
D

Deleted User

Guest
OP
You can't unburn efuses, so it's a matter of whether or not CFW can be updated without burning more. If not, then sysfirm and customfirm would have to be the same version, and it wouldn't be possible to do CFW/backups past 3.0.0.
I'm not saying unburn efuses, I'm saying do a frankenfirm sort of thing.
 
D

Deleted User

Guest
OP
But unless you can boot directly into that it wouldn't work, since sysfirm wouldn't match the number of burnt efuses set from that firmware.
Sorry if I am not understanding what your saying, but that's why I said you would dissect the FW image to the point where you could modify the number of required efuses and the flash it back
 

Xzi

Time to fly, 621
Member
Joined
Dec 26, 2013
Messages
17,716
Trophies
3
Location
The Lands Between
Website
gbatemp.net
XP
8,462
Country
United States
Sorry if I am not understanding what your saying, but that's why I said you would dissect the FW image to the point where you could modify the number of required efuses and the flash it back
Yeah, assuming that's possible. It might not be, however. The whole system of efuses seems pretty rigid.
 

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,432
Country
United States
In theory from what I understand, if we had a way to make an updated emuNAND without burning efuses, and a way to boot into emuNAND without rebooting the system, you technically wouldn't need to dissect anything because AFAIK efuse check only occurs during the boot process. I could be wrong so someone can say so if I am.
 

evandixon

PMD Researcher
Developer
Joined
May 29, 2009
Messages
1,725
Trophies
0
Website
projectpokemon.org
XP
2,313
Country
United States
AFAIK, the efuses are checked pretty early in the boot process. To bypass them, there'd need to be hax at or earlier than that point in the boot process. Depending on how early they're checked, we may need something like sighax, and I don't know if a bug affecting the 3DS bootrom would also affect the Switch bootrom.
 

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,432
Country
United States
AFAIK, the efuses are checked pretty early in the boot process. To bypass them, there'd need to be hax at or earlier than that point in the boot process. Depending on how early they're checked, we may need something like sighax, and I don't know if a bug affecting the 3DS bootrom would also affect the Switch bootrom.
If you are able to create an updated emuNAND without burning efuses, after the system boots (and thus is past the efuse check) all you would need to do is boot into emuNAND without completely rebooting the system, at least from my understanding. Kinda like how we used to boot into CFW emuNAND from HBL with the 3ds. How viable that actually is, we can't say for sure yet.
 

Xzi

Time to fly, 621
Member
Joined
Dec 26, 2013
Messages
17,716
Trophies
3
Location
The Lands Between
Website
gbatemp.net
XP
8,462
Country
United States
Sorry, not very cluey on this but what happens if all the eFuses are burned? Does the console brick?
There are way more efuses than there will be updates for the console's lifetime. However, if more (or less probably too) efuses are burnt than the system is expecting, it won't boot.
 
Last edited by Xzi,
  • Like
Reactions: Kourin

Pippin666

SSF43DE Master
Member
Joined
Mar 30, 2009
Messages
2,098
Trophies
1
Age
42
Location
Montreal, Qc
Website
www.tetesrasees.com
XP
1,849
Country
Canada
Seems almost none of you little-brainer have any idea of what efuses really are. But so you guys can understand better, here is a simpliest explaination, you will need to go much much much deeper than a simple firmware image to then change any efuses value thinking it then could be reflash on a console. Poor boys, I cannot not wait for all the Switch brick thread in a couple of years.

Pip'
 
  • Like
Reactions: Masterwin

The9thBit

Well-Known Member
Newcomer
Joined
Mar 25, 2015
Messages
93
Trophies
0
XP
388
Country
United States
I'm extremely late here, and also not at all an expert, but I don't think it's completely impossible.

If a low enough level exploit is found for a given fw version, then, hypothetically, we could have an updated emuNAND. SysNAND would boot properly using the real eFuse count. From sysNAND, we could load emuNAND and pass it a fake eFuse count that it would use to boot properly. For the sake of example, we'll say this count comes from a file called Fuses.bin.

The trouble comes in updating emuNAND, as it would still try to burn eFuses. If we could redirect the commands that would normally burn eFuses to an emulation layer that simply writes those changes to Fuses.bin, then we could update emuNAND without it actually burning any fuses. SysNAND still boots happily with the real eFuse count, emuNAND boots happily with Fuses.bin.

This is probably a lot easier said than done. The commands to burn eFuses are probably baked in to the kernel (or maybe even lower than that), so we'd have to be able to run code at an extremely low level in order to redirect eFuse burns. Worse yet, Nintendo could potentially change their code in a way that bypasses the emulation layer. Since the system panics when booting with an invalid eFuse count, this could mean that updating emuNAND could actually brick the system.

On the bright side, since there is a physical limit to how many times Nintendo can burn more fuses, they have to be careful about choosing which updates to burn them in. It's unlikely that Nintendo would continuously try to patch eFuse circumvention, as they simply can't afford to be burning fuses in every update, and changing the procedure in every update does them no good if they only actually use that procedure in a fraction of the updates.

Again, this is all hypothetical and quite far out there. Many things need to happen before any of this can take place, such as near hardware level code execution, analysis of how the eFuses are burnt, and analysis of the update procedure, not to mention that there is probably a notworthy amount of encryption that needs to be broken along the way.

TL;DR emuNAND and/or eFuse bypassing is pretty far away, but it's definitely not impossible.

EDIT: I should add that this is ONLY for having a low firm sysNAND and updated emuNAND. This kind of exploit would not allow for downgrading. In fact, downgrading is probably not possible without modifying the firmware and/or certain parts of boot code.
 
Last edited by The9thBit,

rickycoe123

Well-Known Member
Member
Joined
Jun 23, 2014
Messages
449
Trophies
0
Age
33
XP
688
Country
If you know your mobile phones, some Samsungs do this. When you flash CFW, you trip KNOX, which is done by burning the efuse on the board. Therefore voiding warranty. However, you can boot and use the device perfectly fine.
 

linuxares

The inadequate, autocratic beast!
Global Moderator
Joined
Aug 5, 2007
Messages
13,138
Trophies
2
XP
17,848
Country
Sweden
If you know your mobile phones, some Samsungs do this. When you flash CFW, you trip KNOX, which is done by burning the efuse on the board. Therefore voiding warranty. However, you can boot and use the device perfectly fine.
That's not the same thing. An Xbox 360 is a better example. It uses efuses, yet we got alternative launchers. Because a hardware "chip" interupts the process and links it to the alternative dashboard. KNOX is just a security thing, the phone will work fine and that's exactly what it's suppose to do. There were/are bypassers for KNOX when it was software, hench they got efuses now days.
 

SoslanVanWieren

Banned!
Banned
Joined
Feb 6, 2017
Messages
1,809
Trophies
0
XP
847
Country
Australia
You can't unburn efuses, so it's a matter of whether or not CFW can be updated without burning more. If not, then sysfirm and customfirm would have to be the same version, and it wouldn't be possible to do CFW/backups past 3.0.0.
you could solder new fuses on there but they are really small so it would be hard.
 

cybrian

Well-Known Member
Member
Joined
Sep 14, 2009
Messages
111
Trophies
1
XP
549
Country
United States
you could solder new fuses on there but they are really small so it would be hard.
No you can’t. The fuses are INSIDE THE CPU. And the CPU also has serial information burned into it, so even if you somehow could swap it you’d (worst case) brick the rest of the Switch, or (best case) lose all of your data.
 

DarkenSX

Well-Known Member
Member
Joined
Mar 28, 2009
Messages
109
Trophies
0
Age
38
Location
Earth
XP
445
Country
United States
Does the switch check the efuses prior to or during loading of the bootloader if its during there are two theoretical solutions 1. (Hardest) dump and create a modded bootloader that ignores efuse values assuming theres not some type of pre bootloader check or fuses for just the bootloader. 2. (Even Harder if possible) make some kind of loader the normal bootloader boots into (thinking its the switch os but is not) that will load os xxx and always report efuse values as xxx.. did ps3 use efuses or just xbox 360 as ps3 did have the e3 flasher i wonder....i remember seeing tegra flashing software for flashing tegra chips for various tegra based mobile devices that didnt touch efuses (think of it kinda like Samsungs odin but a little different and by nvidia lol.) i think nvidia used it to factory refurbish devices or something (IDK what it was used for really) i wonder if a modifed version could be made to work for the switch
 
Last edited by DarkenSX,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    LeoTCK @ LeoTCK: hmm