4 ms·

And this reveals the real reason Nintendo came after Switch emulators - to buy some extra time before Switch 2 gets properly emulated.

jsheard 2y ago
The hard part of emulating the Switch 2 probably isn't going to be the actual emulation, but breaking the security so that the games and firmware can be extracted and decrypted. Nintendo pretty much nailed their software security with the Switch 1 but were undone by catastrophic hardware bugs, so we'll have to see how well they learned their lesson on the hardware front next time. Microsoft and Sony have demonstrated that hardware security can be more or less perfected, neither of their systems have been compromised via hardware attacks for several generations now.
- farseer 2y ago
  Microsoft and Sony have successfully prevented their systems from being jtaged or mod-chipped. Not sure you can prevent dumping the actual game binary on the internet. That has lots of software and hardware attack vectors and only needs to be done once by a professional enthusiast.
  - jsheard 2y ago
    The game binaries are encrypted, sure you can image the Blurays and put them online but they won't do anyone much good without access to the keys buried in the firmware, which are also a moving target since they can be rotated via mandatory firmware updates if they get compromised. In the case of the Switch, you also have to contend with the proprietary carts requiring a crypto handshake before they'll let you even read the encrypted game data.
    - gcr 2y ago
      What on earth do you mean? How does a physical blu-ray’s encryption keys get rotated? Do you mean that the protection on the firmware gets refreshed with updates, but the secret it protects always stays the same?
      - jsheard 2y ago
        I mean the keys can be rotated for future game releases, so extracting the keys from firmware X doesn't allow you to decrypt all new physical games in perpetuity, because past a certain point they'll start using a key that only exists in firmware Y onwards. Key rotation was moot in the case of the Switch 1 since the early models were so thoroughly broken that Nintendo couldn't do anything to stop the new keys from being extracted every time, but it worked for Sony and Microsoft whose systems generally only get one-off software exploits that can be closed forever via firmware updates.
  - downrightmike 2y ago
    MSFT largely did this by building the xbox platform basically on a local hyper-v system that they can control and not have to worry about hardware.
- kregasaurusrex 2y ago
  The main hardware security bugs[0] were very low hanging fruit associated with taking over the boot chain at ring 0- it's more likely that Nintendo themselves were in a rush to get the product on the market after the perceived failure of the Wii U. Even with a secure software stack, people found a way to defeat the Xbox 360 hardware[1] by physically drilling into a chip that enforced a software lock, and George Hotz became known for his work in finding ECDSA flaws in the PS3. Companies can design these locks to last for a few years of a console's lifespan, but I think people now are determined enough to dive into these difficult problems that they're unlikely to be secured forever. [0] https://www.gamesindustry.biz/unpatchable-hardware-exploit-leaves-nintendo-facing-security-nightmare https://www.gamesindustry.biz/unpatchable-hardware-exploit-l... [1] https://gbatemp.net/threads/scanned-drilling-template-16d4s-in-a4-page-form.621339/ https://gbatemp.net/threads/scanned-drilling-template-16d4s-...
  - jsheard 2y ago
    There's a reason why you have to go back to the 360 and PS3 for those examples, Sony and Microsoft stepped up their hardware security dramatically after that generation. Neither the PS4, PS5, Xbox One or Xbox Series systems have ever been compromised via hardware attacks, and those earlier ones are over a decade old now. The Xboxes have held up extremely well on the software front as well, and although the Playstation software isn't so robust (they use FreeBSD and routinely get owned by upstream CVEs) their secure boot has never been broken, which limits how much you can do with a software jailbreak. PS3 jailbreaks had continuity where you could upgrade an exploitable firmware to a non-exploitable one while retaining a backdoor, but the PS4s secure boot put an end to that.
    - pjmlp 2y ago
      Also a note that the XBox security CPU, Pluton is a requirement for more recent PC hardware architecture designs. And for Rust fans, its firmware has been rewriten.
    - deleted 2y ago
      [deleted]
    - 2y ago
- akira2501 2y ago
  > can be more or less perfected When it comes to video games. That's not much of a demonstration in the grand scheme of things.
- Gigachad 2y ago
  The modern versions of the switch with those catastrophic bugs patched are still hackable though through mod chips. It's too hard for the casual user to install, but it's plenty accessible for a hacker who just wants to dump ROMs and reverse engineer the OS. Even if the software is absolutely bulletproof, you can hack almost everything by modifying the hardware. Cutting the power of the CPU for a tiny amount of time for example can cause it to glitch in a way that bypasses the security checks. This is accessible enough for at least one person to get in and dump games.
  - mmaniac 2y ago
    Modchips on newer Switches use fault injections (clock/voltage glitching) but there exist mitigations for those. The Xbox One is confirmed to use them. I encourage you to watch this video where Microsoft describes the security design of the Xbox One, which so far has been almost bulletproof. https://www.youtube.com/watch?v=U7VwtOrwceo https://www.youtube.com/watch?v=U7VwtOrwceo
    - Gigachad 2y ago
      Incredible video. The engineering effort that goes in to this stuff is unreal. I’d be mad about this, but I’ve got a Steam Deck which is fully unrestricted. I guess the trade off is not being able to play competitive online due to the lack of cheating prevention.
moralestapia 2y ago
[flagged]
- cholantesh 2y ago
  If only anyone been able to establish this as a credible defense in court.
  - moralestapia 2y ago
    "This is my IP" is an absolutely valid defense in court. There have been tens of thousands of trials with IP infringement at its core. https://en.wikipedia.org/wiki/List_of_copyright_case_law https://en.wikipedia.org/wiki/List_of_copyright_case_law https://en.wikipedia.org/wiki/List_of_patent_case_law https://en.wikipedia.org/wiki/List_of_patent_case_law https://en.wikipedia.org/wiki/List_of_trademark_case_law https://en.wikipedia.org/wiki/List_of_trademark_case_law https://en.wikipedia.org/wiki/List_of_United_States_patent_law_cases https://en.wikipedia.org/wiki/List_of_United_States_patent_l... https://en.wikipedia.org/wiki/List_of_United_States_Supreme_Court_copyright_case_law https://en.wikipedia.org/wiki/List_of_United_States_Supreme_... https://en.wikipedia.org/wiki/List_of_United_States_Supreme_Court_patent_case_law https://en.wikipedia.org/wiki/List_of_United_States_Supreme_... https://en.wikipedia.org/wiki/List_of_United_States_Supreme_Court_trademark_case_law https://en.wikipedia.org/wiki/List_of_United_States_Supreme_... Did you not know this?
    - cholantesh 2y ago
      Are you aware of a case where the practice of emulation has ever been found, in court, to be a case of IP infringement? Because that's actually the pertinent claim here, not that IP infringement is a real thing that exists.
      - moralestapia 2y ago
        [flagged]
    - deleted 2y ago
      [deleted]
ashconnor 2y ago
Mig Switch should work then.
hbn 2y ago
There's also the fact that their games keep leaking a week or 2 head of release, so people can play them earlier and with better performance by downloading the leaked game and playing on an emulator. I think Nintendo has a case to make that Switch emulation is costing them real money.
- ronsor 2y ago
  Sounds like Nintendo's problem. They should step up their security to prevent leaks. As for people choosing an emulator over buying a Switch: too bad, that's how competition works.

jsheard 2y ago

The hard part of emulating the Switch 2 probably isn't going to be the actual emulation, but breaking the security so that the games and firmware can be extracted and decrypted. Nintendo pretty much nailed their software security with the Switch 1 but were undone by catastrophic hardware bugs, so we'll have to see how well they learned their lesson on the hardware front next time. Microsoft and Sony have demonstrated that hardware security can be more or less perfected, neither of their systems have been compromised via hardware attacks for several generations now.

farseer 2y ago
Microsoft and Sony have successfully prevented their systems from being jtaged or mod-chipped. Not sure you can prevent dumping the actual game binary on the internet. That has lots of software and hardware attack vectors and only needs to be done once by a professional enthusiast.
- jsheard 2y ago
  The game binaries are encrypted, sure you can image the Blurays and put them online but they won't do anyone much good without access to the keys buried in the firmware, which are also a moving target since they can be rotated via mandatory firmware updates if they get compromised. In the case of the Switch, you also have to contend with the proprietary carts requiring a crypto handshake before they'll let you even read the encrypted game data.
  - gcr 2y ago
    What on earth do you mean? How does a physical blu-ray’s encryption keys get rotated? Do you mean that the protection on the firmware gets refreshed with updates, but the secret it protects always stays the same?
    - jsheard 2y ago
      I mean the keys can be rotated for future game releases, so extracting the keys from firmware X doesn't allow you to decrypt all new physical games in perpetuity, because past a certain point they'll start using a key that only exists in firmware Y onwards. Key rotation was moot in the case of the Switch 1 since the early models were so thoroughly broken that Nintendo couldn't do anything to stop the new keys from being extracted every time, but it worked for Sony and Microsoft whose systems generally only get one-off software exploits that can be closed forever via firmware updates.
- downrightmike 2y ago
  MSFT largely did this by building the xbox platform basically on a local hyper-v system that they can control and not have to worry about hardware.
kregasaurusrex 2y ago
The main hardware security bugs[0] were very low hanging fruit associated with taking over the boot chain at ring 0- it's more likely that Nintendo themselves were in a rush to get the product on the market after the perceived failure of the Wii U. Even with a secure software stack, people found a way to defeat the Xbox 360 hardware[1] by physically drilling into a chip that enforced a software lock, and George Hotz became known for his work in finding ECDSA flaws in the PS3. Companies can design these locks to last for a few years of a console's lifespan, but I think people now are determined enough to dive into these difficult problems that they're unlikely to be secured forever. [0] https://www.gamesindustry.biz/unpatchable-hardware-exploit-leaves-nintendo-facing-security-nightmare https://www.gamesindustry.biz/unpatchable-hardware-exploit-l... [1] https://gbatemp.net/threads/scanned-drilling-template-16d4s-in-a4-page-form.621339/ https://gbatemp.net/threads/scanned-drilling-template-16d4s-...
- jsheard 2y ago
  There's a reason why you have to go back to the 360 and PS3 for those examples, Sony and Microsoft stepped up their hardware security dramatically after that generation. Neither the PS4, PS5, Xbox One or Xbox Series systems have ever been compromised via hardware attacks, and those earlier ones are over a decade old now. The Xboxes have held up extremely well on the software front as well, and although the Playstation software isn't so robust (they use FreeBSD and routinely get owned by upstream CVEs) their secure boot has never been broken, which limits how much you can do with a software jailbreak. PS3 jailbreaks had continuity where you could upgrade an exploitable firmware to a non-exploitable one while retaining a backdoor, but the PS4s secure boot put an end to that.
  - pjmlp 2y ago
    Also a note that the XBox security CPU, Pluton is a requirement for more recent PC hardware architecture designs. And for Rust fans, its firmware has been rewriten.
  - deleted 2y ago
    [deleted]
  - 2y ago
akira2501 2y ago
> can be more or less perfected When it comes to video games. That's not much of a demonstration in the grand scheme of things.
Gigachad 2y ago
The modern versions of the switch with those catastrophic bugs patched are still hackable though through mod chips. It's too hard for the casual user to install, but it's plenty accessible for a hacker who just wants to dump ROMs and reverse engineer the OS. Even if the software is absolutely bulletproof, you can hack almost everything by modifying the hardware. Cutting the power of the CPU for a tiny amount of time for example can cause it to glitch in a way that bypasses the security checks. This is accessible enough for at least one person to get in and dump games.
- mmaniac 2y ago
  Modchips on newer Switches use fault injections (clock/voltage glitching) but there exist mitigations for those. The Xbox One is confirmed to use them. I encourage you to watch this video where Microsoft describes the security design of the Xbox One, which so far has been almost bulletproof. https://www.youtube.com/watch?v=U7VwtOrwceo https://www.youtube.com/watch?v=U7VwtOrwceo
  - Gigachad 2y ago
    Incredible video. The engineering effort that goes in to this stuff is unreal. I’d be mad about this, but I’ve got a Steam Deck which is fully unrestricted. I guess the trade off is not being able to play competitive online due to the lack of cheating prevention.

moralestapia 2y ago

[flagged]

cholantesh 2y ago
If only anyone been able to establish this as a credible defense in court.
- moralestapia 2y ago
  "This is my IP" is an absolutely valid defense in court. There have been tens of thousands of trials with IP infringement at its core. https://en.wikipedia.org/wiki/List_of_copyright_case_law https://en.wikipedia.org/wiki/List_of_copyright_case_law https://en.wikipedia.org/wiki/List_of_patent_case_law https://en.wikipedia.org/wiki/List_of_patent_case_law https://en.wikipedia.org/wiki/List_of_trademark_case_law https://en.wikipedia.org/wiki/List_of_trademark_case_law https://en.wikipedia.org/wiki/List_of_United_States_patent_law_cases https://en.wikipedia.org/wiki/List_of_United_States_patent_l... https://en.wikipedia.org/wiki/List_of_United_States_Supreme_Court_copyright_case_law https://en.wikipedia.org/wiki/List_of_United_States_Supreme_... https://en.wikipedia.org/wiki/List_of_United_States_Supreme_Court_patent_case_law https://en.wikipedia.org/wiki/List_of_United_States_Supreme_... https://en.wikipedia.org/wiki/List_of_United_States_Supreme_Court_trademark_case_law https://en.wikipedia.org/wiki/List_of_United_States_Supreme_... Did you not know this?
  - cholantesh 2y ago
    Are you aware of a case where the practice of emulation has ever been found, in court, to be a case of IP infringement? Because that's actually the pertinent claim here, not that IP infringement is a real thing that exists.
    - moralestapia 2y ago
      [flagged]
  - deleted 2y ago
    [deleted]

ashconnor 2y ago

Mig Switch should work then.

hbn 2y ago

There's also the fact that their games keep leaking a week or 2 head of release, so people can play them earlier and with better performance by downloading the leaked game and playing on an emulator. I think Nintendo has a case to make that Switch emulation is costing them real money.

ronsor 2y ago
Sounds like Nintendo's problem. They should step up their security to prevent leaks. As for people choosing an emulator over buying a Switch: too bad, that's how competition works.