Hacking Why Nintendo can't rely on Pin 10 reading

[kombos]

Is it definitely floating on the switch? There may well be a pull up resistor on board. Additionally, if that pin is occasionally driven high and the Switch is unable to do so, then that can be detected.

Staff have spoken ! ;-)

--------------------- MERGED ---------------------------

I'm not sure I get how this can be true - if the early boot sequence can tell that the Tegra's Home button is being held (i.e. pin 10 is shorted to ground) to trigger recovery mode, why couldn't Horizon read the status of the Tegra's Home button and know immediately that you've modded your joycon?

Because there is a image "floating" around which is ultimate proof you're wrong :}}}}}}}

 

[Kubas_inko]

Let´s just hope that they do find some way to find and ban people with modded consoles.

Any particular reason why?

 

[aykay55]

Bans due to false positives would cause a bad image to the company.

*coff*Miiverse*coff*

 

[Deathscreton]

I'm not sure I get how this can be true - if the early boot sequence can tell that the Tegra's Home button is being held (i.e. pin 10 is shorted to ground) to trigger recovery mode, why couldn't Horizon read the status of the Tegra's Home button and know immediately that you've modded your joycon?

I'm sure they can tell. But they're not going to take the risk that a joycon is actually modded and not just giving off a value that could be incorrect. They'd rather play the safe side and not ban a bunch of people who are showing grounded pins for extended amounts of time. Its, here's that word again, unreliable.

 

[kombos]

I'm sure they can tell. But they're not going to take the risk that a joycon is actually modded and not just giving off a value that could be incorrect. They'd rather play the safe side and not ban a bunch of people who are showing grounded pins for extended amounts of time. Its, here's that word again, unreliable.

Nintendo Risk Manager have spoken. Sometime on warez or criminal sites there are undercover agents doing everything to cheat on legit users, lure them and then sentence :}}}
I no wonder that Nintendo have their agents snitching here. Just don't use permanent joycon mods and you're safe.

 

[Deathscreton]

Nintendo Risk Manager have spoken. Sometime on warez or criminal sites there are undercover agents doing everything to cheat on legit users, lure them and then sentence :}}}
I no wonder that Nintendo have their agents snitching here. Just don't use permanent joycon mods and you're safe.

Kombos, you've been ignoring everything I've been saying without a proper retort. Now you're beyond being petty. Seriously, go somewhere. Jesus man.

 

[kombos]

Kombos, you've been ignoring everything I've been saying without a proper retort. Now you're beyond being petty. Seriously, go somewhere. Jesus man.

Sure I did. Because everything you're saying is bollox. Indeed, I don't know you & I don't know who you are - one thing I know you have no knowledge yourself and only thing you're good at is telling us what other said and in pasting one image as an ultimate proof on everything. You don't even read posts just talking nonsense. No proof for anything other than image - your holy grail. Thats ok, I get used to that. But who let you talk what kind of risk Nintendo gonna take or not ? That's silly. Are you risk consultant ? They do what they want actually as they don't care what's your or mine opinion. There is other side - I know how to mitigate risk. Whatever "staff" says I still recommend everyone not to use permanent joycon mods. Trigger hidden button when needed and release - hence you are sure yourself that you're safe.

 

[Deathscreton]

Sure I did. Because everything you're saying is bollox. Indeed, I don't know you & I don't know who you are - one thing I know you have no knowledge yourself and only thing you're good at is telling us what other said and in pasting one image as an ultimate proof on everything. You don't even read posts just talking nonsense. No proof for anything other than image - your holy grail. Thats ok, I get used to that. But who let you talk what kind of risk Nintendo gonna take or not ? That's silly. Are you risk consultant ? They do what they want actually as they don't care what's your or mine opinion. There is other side - I know how to mitigate risk. Whatever "staff" says I still recommend everyone not to use permanent joycon mods. Trigger hidden button when needed and release - hence you are sure yourself that you're safe.

Wow. So you're one of those people. Alright, suit yourself man. I'm not gonna bust a fucking vein explaining why you're full of it. So have fun misguiding people.

 

[kombos]

Wow. So you're one of those people. Alright, suit yourself man. I'm not gonna bust a fucking vein explaining why you're full of it. So have fun misguiding people.

The only person misguiding users here is you. I bet you work for Nintendo, hence you know that much about what risk they're going to take.

 

[andijames]

Staff have spoken ! ;-)

--------------------- MERGED ---------------------------



Because there is a image "floating" around which is ultimate proof you're wrong :}}}}}}}

Your code is erroring here. Too many brackets. Banned.

In all seriousness stop flapping. They will ban cheaters for sure..

We haven't even got CFW hero so it's all Conjecture! FFS relax

 

[TheCyberQuake]

I'm not sure I get how this can be true - if the early boot sequence can tell that the Tegra's Home button is being held (i.e. pin 10 is shorted to ground) to trigger recovery mode, why couldn't Horizon read the status of the Tegra's Home button and know immediately that you've modded your joycon?

The pins can work differently at boot from after HOS loading

 

[smf]

Because there is a image "floating" around which is ultimate proof you're wrong :}}}}}}}

The image is factually wrong. Floating io pins normally read high unless you ground them.

The volume and power inputs are also left floating until you press the respective buttons, which connects them to ground & the switch doesn't randomly think you're pressing those.

The pins can work differently at boot from after HOS loading

They are magic?

 

[TheCyberQuake]

The image is factually wrong. Floating io pins normally read high unless you ground them.

The volume and power inputs are also left floating until you press the respective buttons, which connects them to ground & the switch doesn't randomly think you're pressing those.



They are magic?

Sorry, bad wording, I meant might, not can

 

[GuardHouse]

but what if i play through a vpn
what if i play at a library so they don't know where i am
what if i pay jimmy from down the street to set up my network so im invisible /s

you're retarded

 

[Deathscreton]

you're retarded

did you not see the "/s" at the end?

 

[GuardHouse]

did you not see the "/s" at the end?

no

 

[Deathscreton]

no

Dick.

 

[JustBrandonT]

Pins in an unknown or undesired state is floating when the impedance is HIGH.. A resistor pulling it up. If you short out the pin, it will always be LOW.. Not only that but you trigger the recovery mode with the switch buttons.. If the pin was by default configured always high.. and all of a sudden it's always low and the user entered recovery mode (requires manual user input), then obviously something is wrong. By shorting the pin, you're pulling it to ground when by default it is high due to a high pull.

Floating pin is one that can SOMETIMES be high or low.. but if it's always low due to pull down then it ain't floating anymore.. Most hardware developers pull high for default state (on state)..

So either disable that joycon and force the user to send it for repairs or ban the user.

 

[TerraPhantm]

The image is factually wrong. Floating io pins normally read high unless you ground them.

The volume and power inputs are also left floating until you press the respective buttons, which connects them to ground & the switch doesn't randomly think you're pressing those.

Pins in an unknown or undesired state is floating when the impedance is HIGH.. A resistor pulling it up. If you short out the pin, it will always be LOW.. Not only that but you trigger the recovery mode with the switch buttons.. If the pin was by default configured always high.. and all of a sudden it's always low and the user entered recovery mode (requires manual user input), then obviously something is wrong. By shorting the pin, you're pulling it to ground when by default it is high due to a high pull.

Floating pin is one that can SOMETIMES be high or low.. but if it's always low due to pull down then it ain't floating anymore.. Most hardware developers pull high for default state (on state)..

So either disable that joycon and force the user to send it for repairs or ban the user.

So for whatever it's worth, I just checked with my meter - a 10kΩ pull-down resistor and the pin is at 1.800v as soon as the switch is powered on.

 

[aut0mat3d]

yet hundreds of people believe them. Probably because they do something useful for the community.

This is so offending and rude i can not withstand to reply.

I am always helpful - and i want to do something for the Community. Guess what?
I do not want to have other users going in trouble following your wrong thoughts!
Stop flaming and please please do not believe anybody - only believe your own and proof ererything twize - regardless what a Dev is telling you in discord
If you had some verry rudimentary understanding how logic signals and/or serial communication/handshake works you must had started thinking after my first reply in this thread.

So i want to attemp to describe some verry basic stuff:

10 minutes ago i opened up my right joycon to measure out the connnector port and to do some measurements of the logic levels. I searched for a legit Pinout of the Joycon port to attach my oscilloscope...
Doing that i found the following page:
https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering
Here you can find a verry well made documentation, some logic traces and a commented Pinout - also Testpoints described.

Below another 10 cents from me - my last try to make you familiar with verry verry basics of electrical engineering and digital signals:
Digital signals are done with (typically) FET transistors switching a signal line to GND or VCC (tied to GND is a Low level, tied to VCC is a High level) - verry verry rudimentary explained.
So... on the Switch side we do have 0V for Low, 1.8V for high if the SOC has to read the pin state.
To read the State of a Pin the SOC do have to compare the voltage level of the corresponding Pin for being smaller or higher than a certain treshhold level (typically 0.3V on 3.3V logic)
Each input pin has a verry high input impedance (not much current flowing when you apply a source). So: If you want to read a pin state with no pullup or pulldown resistors you would "see" sporadic lows and highs - i.e. a "floating Pin" - This is from EMV (the attached PCB Trace or Wire is acting like a Antenna....
To avoid that (also on unused Pins you ALWAYS want to have defined states!
So the ordinary/regullary way is to activate the built in PullUP resistors as a minimum. I am programming here on Atmel uCs - here we do have about 50K (50 Kiloohm) to VCC - so the Trace/Wire attached on the Pin does have a defined state.
If you want to have a 0 level on that Pin you need to tie it to GND with will lead to some amount of current flowing. - defined pin states - Voi'la!

As far as i know, Pin 10 has to be grounded for having Access to Tegra USB recovery.
A custom method described at many places here in the forum is to short pins 9 and 10.
Pin 9 is unknown, but seems to be driven to ground by the Joycon uC - If you want to do something for the community, please do some measurement and reverse engineer that - would appreciate that a lot.
Pin 10 is for Flow Control (Serial Communication Switch>Joycon) according to dekuNukem: "Joy-Con will only send data to console when this line is HIGH"
Pins 1,2,7 are GND.

So:
If you are shorting Pins 9 and 10 with your switch in normal working state(OS booted) you probably risk damaging your SOC. Why?:
If the Findings of dekuNukem are right (and i am willed to trust him!) the SOC ties that pin to VCC for communication via Serial, the Joycon drives Pin 9 to GND...
If you shorten a Pin in High State (configured as Output) you will draw a lot of current which (if there is no protection circuit) result in a burnt transistor inside the SOC/uC.

If you want to be on the safe Side, please please do the following:
Use a temporary bridge or solder in a Switch - always with a resistor in Series to avoid damage
Use a Resistor, do not short Pins - 200 Ohm would be a good value to start (did not tried that)
Short Pins 1 and 10, not Pins 9 and 10

Detecting a Pin10 permanent tied to GND would be absolutely no problem for Nintendo.
There is a near zero chance that this Pin will be grounded in any way by a fault. - if for some reason pins gets bended or the UART of the Joycon dies with grounding that pin - this would be one of a million.
So: No problem to ban that user - tell him to send in the defective device, look what has happened and unban him if he did nothing wrong.
If i were Nintendo i would definitely do bans according to shorted pins as this is the only chance to make piracy/homebrew a little less comfortable.
I would not wonder if we are facing exactly that behaviour on the next softwares for the Switch:
At verry early System Start the corresponding IO will be configured as input (with pullup resistor enabled), check for being tied to GND, System Message that you have to send in your console.....

Job done, i did something really useful for the Community!
Sorry for the grammatical errors and misspelling - English is not my native language.