4 ms·
There is an easy workaround developed by the Switch homebrew community, simply upgrade from within a custom firmware (such as Atmosphere-NX) and run a tool call
by hd4 6y ago
There is an easy workaround developed by the Switch homebrew community, simply upgrade from within a custom firmware (such as Atmosphere-NX) and run a tool called ChoiDuJourNX which bypasses the fuse-burning.
If you're careful you can keep a backup trail going all the way back to your original device firmware and restore/downgrade it using the Hekate system tool. It has already been pointed out that there isn't much reason to do this, AFAIK the main reason people either held out on older firmwares or kept up a backup trail to them was in order to take advantage of possible firmware-version-specific exploits, the gold standard being a coldboot exploit.
- rekoil 6y agoAnd for those who stayed on the 4.1.0 fuseset (or certain versions below that) there are warmboot exploits available. So those who are able to "normally" boot those firmwares do not need to use AutoRCM (or an RCM-"jig") to access RCM anymore.
- hd4 6y agoWhile this is true, I was essentially saying that you don't have to remain on an older firmware as long as you're careful about how you move around between versions. I'm on 10.0 but I could go back to 3.1.0 anytime, and then move somewhere in between those versions if we got a coldboot exploit for example (which according to notable members of the Switch homebrew community is not likely).
- rekoil 6y agoYeah, sure, you can ignore the fuses, but only if you assist the boot process using a jig and an injected payload. The stock Horizon kernel from FW 10.3 won't boot if your fuseset is for 3.1.0, unless you inject a chainloader which fakes the fuseset or removes the check. Edit: I see what you were referring to, I was unspecific in my comment, updated it!
- roblabla 6y agoThe reason this "easy workaround" works at all is that there is a BootROM exploit that trivially allows running arbitrary code in the BootROM. This allows us to run our own bootloader instead of Nintendo's, bypassing their fuse burning logic. Had Nvidia not fucked up their USB implementation (along with other part of their platform), this would have been harder to bypass. [0]: https://www.reddit.com/r/SwitchHacks/comments/7rq0cu/jamais_vu_a_100_trustzone_code_execution_exploit/ https://www.reddit.com/r/SwitchHacks/comments/7rq0cu/jamais_...
- artsyca 6y agoI don't want to sound like I'm pontificating or defecating on the corporacy at everyone's favorite hardware company but it strikes me that these sorts of lapses are cultural and stem from this tedious emphasis everyone places on having "relaxed working environments"[0] Does it surprise you that the product of this culture also has relaxed security characteristics? [0] https://www.nvidia.com/en-us/about-nvidia/culture-at-nvidia/ https://www.nvidia.com/en-us/about-nvidia/culture-at-nvidia/
- monsieurbanana 6y agoThank you for making me laugh in these trying times.
- artsyca 6y agoI gotta keep it real for you sir banana, the only way to have a legit conversation on this platform is to have an equal number of up and downvotes.
- nemothekid 6y agoAh yes, compared to every other company that has never had an exploit ever.
- heavenlyblue 6y agoDoes anyone even like Nvidia?