From WikiTemp, the GBAtemp wiki
(updates, some fixes, new tables, etc.)
(List of Switch's Exploits: added links)
(13 intermediate revisions by the same user not shown)
Line 1: Line 1:
 
{{NXNav}}__NOTOC__{{Newpagepreload|Template:P/Switch Homebrew}}
 
{{NXNav}}__NOTOC__{{Newpagepreload|Template:P/Switch Homebrew}}
  
*Draft page* please help improving and fixing missing information.
+
*Draft page* please help improving and fixing missing information.
  
 
==List of Switch's Exploits==
 
==List of Switch's Exploits==
 
{| class="prettytable sortable" style="width:100%"
 
{| class="prettytable sortable" style="width:100%"
! style="width:25%" | Name
+
! style="width:10%" | Name
! class="unsortable" | Compatible firmwares
+
! style="width:10%" | Compatible firmware versions
! style="width:20%" | Author(s)
+
! class="unsortable" style="width:20%" | Author(s)
! style="width:20%" | Fixed
+
! style="width:8%" | Link
 +
! style="width:8%" | Status
 
|-
 
|-
| ?
+
| Jamais vu
| 1.x 3.0x?
+
| 1.0.0
|
+
| ReSwitched Team (SciresM, and Motezazer)
 +
| [https://gbatemp.net/threads/494712/ Thread], [https://www.reddit.com/r/SwitchHacks/comments/7rq0cu/jamais_vu_a_100_trustzone_code_execution_exploit/ reddit]
 
| Fixed
 
| Fixed
 
|-
 
|-
| Fusée Gelée
+
| PegaSwitch
| v1.x - v5.1
+
| 1.0.0 - 3.0.0
| Independently discovered by ReSwitchTeam (Kate Temkin), fail0verflow (shuffle2).
+
| ReSwitched Team (SciresM, and more)
| Fixed, june2018
+
| [https://pegaswitch.com/ website], [https://github.com/ReSwitched/PegaSwitch Sources]
 +
| Fixed
 
|-
 
|-
| Déjà Vue (unreleased)
+
| Nereba
| 1.x - 4.1
+
| 1.0.0 - 3.0.0
 +
| ReSwitched Team (Stuckpixel)
 +
| [https://gbatemp.net/threads/536409/ Unofficial Thread], [https://github.com/pixel-stuck/nereba/ Sources]
 +
| Fixed
 +
|-
 +
| Déjà Vu
 +
| 1.0.0 - 4.1.0
 
| SciresM
 
| SciresM
|
+
| [https://gbatemp.net/threads/496799/ Unofficial Thread], [https://gbatemp.net/threads/537361/ Unofficial Thread], [https://github.com/liuervehc/caffeine github for 3.0.0]
 +
| Fixed
 +
|-
 +
| Fusée Gelée
 +
| 1.0.0 - 5.1.0
 +
| Independently discovered by ReSwitched Team (Kate Temkin), fail0verflow (shuffle2).
 +
| [https://gbatemp.net/threads/496838/ Unofficial Thread]
 +
| Fixed, june2018
 
|}
 
|}
  
 +
==Jamais vu==
 +
Jamais vu exploit a warmboot vulnerability in the TrustZone to allow code execution.
  
 +
==PegaSwitch==
 +
PegaSwitch exploit a vulnerability in the Internet navigator WebKit module. PegaSwitch does not allow homebrew launching.
  
 +
PegaSwitch is triggered by using a computer's program serving as DNS server.
  
==?==
+
==Nereba==
A software triggered exploit on early firmware, allowing unsigned code execution (homebrew).
+
released in April 2019, this exploit is compatible with old firmwares 1.0.0 to 3.0.0 only.
  
 +
It's exploiting a warm boot RAM access vulnerability which allows the console to reboot from OFW to any Fusée Gelée payloads using the web applet.
 +
 +
 +
==Déjà vu==
 +
 +
Déjà vu was an old known but unreleased exploit. It has finally been released in April 2019.
 +
 +
Compatible firmwares from 1.0.0 up to 4.1.0. The vulnerability was only partially fixed in 6.0.0. The vulnerability was kept secret as long as it wasn't fully fixed in eventuality that it could be useful later to exploit units with patched known exploits.
 +
 +
Nintendo definitely [https://twitter.com/SciresM/status/1117955638863130624 fixed that vulnerability] in 2019 with firmware 8.x
  
  
 
==Fusée gelée==
 
==Fusée gelée==
 +
(en: Frozen Space Rocket)
 +
 +
 
Fusée gélée exploit a vulnerability in the Recovery mode of the Nintendo Switch, allowing early code execution on the console. The Recovery mode is launched before Horizon OS, the switch's operating system (the user interface).
 
Fusée gélée exploit a vulnerability in the Recovery mode of the Nintendo Switch, allowing early code execution on the console. The Recovery mode is launched before Horizon OS, the switch's operating system (the user interface).
  
Grahical representation of the launch sequence:
+
A ''simplified'' graphical representation of the launch sequence:
  Power ON > Boot mode > Boot loader > Horizon OS
+
  Cold boot > Recovery mode > Boot loader > Horizon OS
 +
This might not be the exact launch sequence, but it's good enough to get a quick understanding of what happens before the main console's interface is displayed.
  
  
Fusée Gelée runs in the Boot mode step and allows code execution before the Boot loader.
+
Fusée Gelée runs in the Recovery mode step and allows code execution before the Boot loader.
 
It can be used to either:
 
It can be used to either:
 
* Run standalone applications (key dumpers, display console information, etc.),
 
* Run standalone applications (key dumpers, display console information, etc.),
Line 50: Line 85:
 
'''Q.''' Why use Fusée gelée to boot an official firmware?
 
'''Q.''' Why use Fusée gelée to boot an official firmware?
  
'''A.''' The official Nintendo's bootloader is responsible for checking and burning eFuse. eFuses are burned when upgrading the firmware to prevent you to downgrade your console.
+
'''A.''' The official Nintendo's bootloader is responsible for checking and burning [https://switchbrew.org/wiki/Fuses#Anti-downgrade eFuse]. eFuses are burned when upgrading the firmware to prevent you to downgrade your console.
 
Horizon checks how many eFuses has been burned, if it doesn't match the expected eFuse number the OS will refuse to launch.
 
Horizon checks how many eFuses has been burned, if it doesn't match the expected eFuse number the OS will refuse to launch.
 
Bypassing the official bootloader prevents eFuse burning when booting a higher (official or patched) firmware version, allowing the user to return to the lowest installed fused firmware (eMMC restoration or firmware downgrade).
 
Bypassing the official bootloader prevents eFuse burning when booting a higher (official or patched) firmware version, allowing the user to return to the lowest installed fused firmware (eMMC restoration or firmware downgrade).
Line 63: Line 98:
 
* The internal memory is corrupted or the entire eMMC board is missing ;
 
* The internal memory is corrupted or the entire eMMC board is missing ;
 
* The bootloader program is corrupted ;
 
* The bootloader program is corrupted ;
* A specific key combination is pressed on boot.
+
* A specific key combination is pressed on cold boot : with the console fully shutdown, keep pressed both Vol+ while bridging right joycon's pin 10 with Ground (with pin1, 7 or 9) and switch on the console.
 
+
Console power OFF : keep pressed both Vol+ and power buttons while shorting pin 1 and pin 10 on the right joycon connector.
+
  
 
Entering this recovery mode (RCM) puts the console on a black screen, where the console waits for USB sent signed commands for secure communication. Fusée gelée uses a vulnerability in the command verification process to send non signed data and execute unsigned code.
 
Entering this recovery mode (RCM) puts the console on a black screen, where the console waits for USB sent signed commands for secure communication. Fusée gelée uses a vulnerability in the command verification process to send non signed data and execute unsigned code.
Line 73: Line 106:
  
 
====Maintenance mode====
 
====Maintenance mode====
There is another menu called ''Recovery Mode'', also known as Maintenance Mode. It has an onscreen menu to update or format the console and delete user preferences. A different pressed buttons combination is used to boot into this menu.
+
There is another menu called ''Recovery Mode'', also known as Maintenance Mode. The maintenance mode is part of the Horizon OS, and can be launched after RCM, for example, after choosing which firmware to launch from Hekate in RCM.
 +
 
 +
It has an onscreen menu to update the console, format and delete user preferences, or just exit and launch Horizon OS. Additionally, entering this menu automatically clears temporarily downloaded files, such as a complete or partial system update.
  
Console power OFF : keep pressed Vol+ and Vol-, press and release Power button.
+
A different pressed buttons combination is used to boot into this menu.
  
 +
Console power OFF : keep pressed Vol+ and Vol-, press and release Power button
 +
or
 +
Just after selecting Launch Firmware from RCM's custom bootloader : keep pressed Vol+ and Vol-
 
Accessing this Maintenance mode screen has the effect of deleting temporary downloaded update files and stop displaying the update nag on Horizon OS.
 
Accessing this Maintenance mode screen has the effect of deleting temporary downloaded update files and stop displaying the update nag on Horizon OS.
 
 
'''Q.''' Is this menu part of the Bootloader code or triggered before it? Can it be accessed if using AutoRCM?
 
 
'''A.''' ...
 
  
  
Line 88: Line 121:
 
Safe mode is used to boot Horizon OS using a slightly different firmware. You can see this mode like booting into Windows' safe mode on your computer to disable drivers and network configuration to resolve conflicts.
 
Safe mode is used to boot Horizon OS using a slightly different firmware. You can see this mode like booting into Windows' safe mode on your computer to disable drivers and network configuration to resolve conflicts.
  
There is no reason to use this mode for homebrew or fusée Gelée. For more information, read switchbrew's boot modes page.
+
There is no reason to use this mode for homebrew or Fusée Gelée. For more information, read switchbrew's boot modes page.
  
  
Line 96: Line 129:
 
When the console is in RCM, waiting for USB data reception, you can use a payload launcher to send a non signed payload binaries (program) to the Switch.
 
When the console is in RCM, waiting for USB data reception, you can use a payload launcher to send a non signed payload binaries (program) to the Switch.
  
There are different payload launchers program (on computers, android Phones or standalone dongles), and different payload binaries which can be sent to the console.
+
There are different payload launchers program (on computers, Phones or standalone dongles), and different payload binaries which can be sent to the console.
  
  
Line 104: Line 137:
 
* Run the payload Launcher and select the payload to send to the console, or let the dongle do it automatically.
 
* Run the payload Launcher and select the payload to send to the console, or let the dongle do it automatically.
  
 
+
A list of Fusée Gelée Code launchers, dongles and payloads are available [[List of Switch payloads|here]]
List of Launchers, Dongle and Payloads here (add link to lists here)
+
 
+
< include Switch_FuseeGelee_launchers >
+
currently listed here.
+
 
+
====Payload Loaders (programs)====
+
{| class="prettytable sortable" style="width:100%"
+
! style="width:25%" | Name
+
! style="width:20%" | System
+
! style="width:20%" | description
+
! style="width:20%" | Author
+
! style="width:20%" | Link
+
! style="width:20%" | sources
+
|-
+
| [[Fusée Launcher]]
+
| Python
+
| Proof-of-concept code loader for Fusée Gelée exploit. Works on Windows, Linux, macOS and FreeBSD.
+
| Kate Temkin, Qyriad
+
|
+
| [https://github.com/Cease-and-DeSwitch/fusee-launcher github]
+
|-
+
| [[TegraRcmSmash]]
+
| Windows
+
| A Windows code loader for Fusée Gelée exploit.
+
| [[User:rajkosto|rajkosto]]
+
| [https://switchtools.sshnuke.net/ download]
+
| [https://github.com/rajkosto/TegraRcmSmash Github]
+
|-
+
| [[NXLauncher]]
+
| Android
+
| An Android code loader for Fusée Gelée exploit.
+
|
+
|
+
| [https://github.com/DavidBuchanan314/NXLoader/ Github]
+
|}
+
 
+
====Payload Loaders (Dongle)====
+
{| class="prettytable sortable" style="width:100%"
+
! style="width:25%" | Name
+
! style="width:20%" | System
+
! style="width:20%" | description
+
! style="width:20%" | Author
+
! style="width:20%" | Link
+
! style="width:20%" | sources
+
|-
+
| SX
+
| Dongle
+
| -
+
| A dongle to launch a payload for Fusée Gelée exploit.
+
|
+
|
+
|-
+
| Other open source/retail dongle name here
+
| Dongle
+
| -
+
| A dongle to launch a payload for Fusée Gelée exploit.
+
|
+
|
+
|}
+
 
+
====Payload (binaries)====
+
{| class="prettytable sortable" style="width:100%"
+
! style="width:25%" | Name
+
! style="width:20%" | description
+
! style="width:20%" | Author
+
! style="width:20%" | Link
+
! style="width:20%" | sources
+
|-
+
| Fusée Gelée sample payload
+
| A sample payload binary to use with Fusée Launcher.
+
| Kate Temkin
+
| [http://misc.ktemkin.com/fusee.bin Download]
+
| [https://github.com/Cease-and-DeSwitch/fusee-launcher github]
+
|-
+
| [[ShofEL2]]
+
| A Linux booter.
+
| fail0verflow (shuffle2)
+
| [https://fail0verflow.com/blog/2018/shofel2/ info], no binary download?
+
| [https://github.com/fail0verflow/shofel2 github]
+
|-
+
| [[SX OS]]
+
| A bootloader and Firmware Patcher (CFW) allowing homebrew launching from Horizon OS. Requires a License to unlock backup loader features.
+
| Team Xecuter
+
| https://team-xecuter.com/
+
| closedsource
+
|-
+
| [[Hekate]]
+
| A multi-tool payload. Serves as SD binary payload loader?, a bootloader and Firmware Patcher (CFW) allowing homebrew launching from Horizon OS. Contains multiple tools such as NAND backup/restore.
+
| Nwert ?
+
|
+
|
+
|-
+
| [[Lakka (Switch)|Lakka]]
+
| A Linux booter, used to boot Lakka, a Linux distribution specialized in emulators.
+
|
+
|
+
|
+
|-
+
| [[fusedump]]
+
| An eFuse dumper. (deprecated)
+
| moriczgergo
+
| [https://github.com/moriczgergo/fusedump/releases Download]
+
| [https://github.com/moriczgergo/fusedump github]
+
|-
+
| [[moonflower]]
+
| An eFuse and GPIO dumper for the Switch. Based on Fusedump.
+
| moriczgergo
+
| [https://github.com/moriczgergo/moonflower/releases Download]
+
| [https://github.com/moriczgergo/moonflower github]
+
|-
+
| [[GRAnimated payload]]
+
| A customized fusée Gelée binary modded by GRAnimated.
+
| GRAnimated
+
| [https://github.com/GRAnimated/FG-CustomPayload/raw/master/fusee/out/fusee.bin download]
+
| [https://github.com/GRAnimated/FG-CustomPayload/ github]
+
|-
+
| [[BiskeyDump]]
+
| A Switch key dumper.
+
| rajkosto
+
| [https://switchtools.sshnuke.net/ Download]
+
| [https://github.com/rajkosto/biskeydump guthub]
+
|-
+
| [[Lakka (Switch)|Lakka]]
+
| A Linux booter, used to boot Lakka, a Linux distribution specialized in emulators.
+
|
+
|
+
|
+
|}
+
 
+
 
+
 
+
 
+
 
+
temporary list on the forum until wiki page is created.
+
https://gbatemp.net/threads/fusee-gelee-all-the-payloads.502028/
+
 
+
 
+
 
+
==déjà vu==
+
unreleased exploit up to 4.1 ?
+

Revision as of 10:35, 29 April 2019

*Draft page* please help improving and fixing missing information.

List of Switch's Exploits

Name Compatible firmware versions Author(s) Link Status
Jamais vu 1.0.0 ReSwitched Team (SciresM, and Motezazer) Thread, reddit Fixed
PegaSwitch 1.0.0 - 3.0.0 ReSwitched Team (SciresM, and more) website, Sources Fixed
Nereba 1.0.0 - 3.0.0 ReSwitched Team (Stuckpixel) Unofficial Thread, Sources Fixed
Déjà Vu 1.0.0 - 4.1.0 SciresM Unofficial Thread, Unofficial Thread, github for 3.0.0 Fixed
Fusée Gelée 1.0.0 - 5.1.0 Independently discovered by ReSwitched Team (Kate Temkin), fail0verflow (shuffle2). Unofficial Thread Fixed, june2018

Jamais vu

Jamais vu exploit a warmboot vulnerability in the TrustZone to allow code execution.

PegaSwitch

PegaSwitch exploit a vulnerability in the Internet navigator WebKit module. PegaSwitch does not allow homebrew launching.

PegaSwitch is triggered by using a computer's program serving as DNS server.

Nereba

released in April 2019, this exploit is compatible with old firmwares 1.0.0 to 3.0.0 only.

It's exploiting a warm boot RAM access vulnerability which allows the console to reboot from OFW to any Fusée Gelée payloads using the web applet.


Déjà vu

Déjà vu was an old known but unreleased exploit. It has finally been released in April 2019.

Compatible firmwares from 1.0.0 up to 4.1.0. The vulnerability was only partially fixed in 6.0.0. The vulnerability was kept secret as long as it wasn't fully fixed in eventuality that it could be useful later to exploit units with patched known exploits.

Nintendo definitely fixed that vulnerability in 2019 with firmware 8.x


Fusée gelée

(en: Frozen Space Rocket)


Fusée gélée exploit a vulnerability in the Recovery mode of the Nintendo Switch, allowing early code execution on the console. The Recovery mode is launched before Horizon OS, the switch's operating system (the user interface).

A simplified graphical representation of the launch sequence:

Cold boot > Recovery mode > Boot loader > Horizon OS

This might not be the exact launch sequence, but it's good enough to get a quick understanding of what happens before the main console's interface is displayed.


Fusée Gelée runs in the Recovery mode step and allows code execution before the Boot loader. It can be used to either:

  • Run standalone applications (key dumpers, display console information, etc.),
  • Replace the bootloader and allows launching of custom OS running on native tegra chipset (Linux, Lakka, etc.)
  • Act as a bootloader and launches Horizon OS, stock (OFW) or with temporary memory patches (CFW),


Q. Why use Fusée gelée to boot an official firmware?

A. The official Nintendo's bootloader is responsible for checking and burning eFuse. eFuses are burned when upgrading the firmware to prevent you to downgrade your console. Horizon checks how many eFuses has been burned, if it doesn't match the expected eFuse number the OS will refuse to launch. Bypassing the official bootloader prevents eFuse burning when booting a higher (official or patched) firmware version, allowing the user to return to the lowest installed fused firmware (eMMC restoration or firmware downgrade).


Boot modes

There are different Boot Modes the console can access: Normal launch, Recovery mode, Maintenance mode, Safe mode. Fusée gelée uses the Recovery Mode, commonly called "RCM".

Recovery mode

The console enters this Recovery mode for three different reasons:

  • The internal memory is corrupted or the entire eMMC board is missing ;
  • The bootloader program is corrupted ;
  • A specific key combination is pressed on cold boot : with the console fully shutdown, keep pressed both Vol+ while bridging right joycon's pin 10 with Ground (with pin1, 7 or 9) and switch on the console.

Entering this recovery mode (RCM) puts the console on a black screen, where the console waits for USB sent signed commands for secure communication. Fusée gelée uses a vulnerability in the command verification process to send non signed data and execute unsigned code.

This vulnerability has been fixed on consoles sold after june 2018.


Maintenance mode

There is another menu called Recovery Mode, also known as Maintenance Mode. The maintenance mode is part of the Horizon OS, and can be launched after RCM, for example, after choosing which firmware to launch from Hekate in RCM.

It has an onscreen menu to update the console, format and delete user preferences, or just exit and launch Horizon OS. Additionally, entering this menu automatically clears temporarily downloaded files, such as a complete or partial system update.

A different pressed buttons combination is used to boot into this menu.

Console power OFF : keep pressed Vol+ and Vol-, press and release Power button
or
Just after selecting Launch Firmware from RCM's custom bootloader : keep pressed Vol+ and Vol-

Accessing this Maintenance mode screen has the effect of deleting temporary downloaded update files and stop displaying the update nag on Horizon OS.


Safe mode

Safe mode is used to boot Horizon OS using a slightly different firmware. You can see this mode like booting into Windows' safe mode on your computer to disable drivers and network configuration to resolve conflicts.

There is no reason to use this mode for homebrew or Fusée Gelée. For more information, read switchbrew's boot modes page.


Usage

When the console is in RCM, waiting for USB data reception, you can use a payload launcher to send a non signed payload binaries (program) to the Switch.

There are different payload launchers program (on computers, Phones or standalone dongles), and different payload binaries which can be sent to the console.


  • Fully shutdown the console (not in sleep mode)
  • Launch RCM (shortcut joycon pin10 with any GND pin, press Vol+ and power button)
  • Plug your Nintendo Switch through USB OTG compatible device (computer, phone or dongle)
  • Run the payload Launcher and select the payload to send to the console, or let the dongle do it automatically.

A list of Fusée Gelée Code launchers, dongles and payloads are available here