List of Switch exploits

Template:P/Switch Homebrew

• Draft page* please help improving and fixing missing information.

List of Switch's Exploits

Name	Compatible firmwares	Author(s)	Fixed
?	1.x 3.0x?		Fixed
Fusée Gelée	v1.x - v5.1	Independently discovered by ReSwitchTeam (Kate Temkin), fail0verflow (shuffle2).	Fixed, june2018
Déjà Vue (unreleased)	1.x - 4.1	SciresM

?

A software triggered exploit on early firmware, allowing unsigned code execution (homebrew).

Fusée gelée

Fusée gélée exploit a vulnerability in the Recovery mode of the Nintendo Switch, allowing early code execution on the console. The Recovery mode is launched before Horizon OS, the switch's operating system (the user interface).

Grahical representation of the launch sequence:

Power ON > Boot mode > Boot loader > Horizon OS

Fusée Gelée runs in the Boot mode step and allows code execution before the Boot loader. It can be used to either:

• Run standalone applications (key dumpers, display console information, etc.),
• Replace the bootloader and allows launching of custom OS running on native tegra chipset (Linux, Lakka, etc.)
• Act as a bootloader and launches Horizon OS, stock (OFW) or with temporary memory patches (CFW),

Q. Why use Fusée gelée to boot an official firmware?

A. The official Nintendo's bootloader is responsible for checking and burning eFuse. eFuses are burned when upgrading the firmware to prevent you to downgrade your console. Horizon checks how many eFuses has been burned, if it doesn't match the expected eFuse number the OS will refuse to launch. Bypassing the official bootloader prevents eFuse burning when booting a higher (official or patched) firmware version, allowing the user to return to the lowest installed fused firmware (eMMC restoration or firmware downgrade).

Boot modes

There are different Boot Modes the console can access: Normal launch, Recovery mode, Maintenance mode, Safe mode. Fusée gelée uses the Recovery Mode, commonly called "RCM".

Recovery mode

The console enters this Recovery mode for three different reasons:

• The internal memory is corrupted or the entire eMMC board is missing ;
• The bootloader program is corrupted ;
• A specific key combination is pressed on boot.

Console power OFF : keep pressed both Vol+ and power buttons while shorting pin 1 and pin 10 on the right joycon connector.

Entering this recovery mode (RCM) puts the console on a black screen, where the console waits for USB sent signed commands for secure communication. Fusée gelée uses a vulnerability in the command verification process to send non signed data and execute unsigned code.

This vulnerability has been fixed on consoles sold after june 2018.

Maintenance mode

There is another menu called Recovery Mode, also known as Maintenance Mode. It has an onscreen menu to update or format the console and delete user preferences. A different pressed buttons combination is used to boot into this menu.

Console power OFF : keep pressed Vol+ and Vol-, press and release Power button.

Accessing this Maintenance mode screen has the effect of deleting temporary downloaded update files and stop displaying the update nag on Horizon OS.

Q. Is this menu part of the Bootloader code or triggered before it? Can it be accessed if using AutoRCM?

A. ...

Safe mode

Safe mode is used to boot Horizon OS using a slightly different firmware. You can see this mode like booting into Windows' safe mode on your computer to disable drivers and network configuration to resolve conflicts.

There is no reason to use this mode for homebrew or fusée Gelée. For more information, read switchbrew's boot modes page.

Usage

When the console is in RCM, waiting for USB data reception, you can use a payload launcher to send a non signed payload binaries (program) to the Switch.

There are different payload launchers program (on computers, android Phones or standalone dongles), and different payload binaries which can be sent to the console.

• Fully shutdown the console (not in sleep mode)
• Launch RCM (shortcut joycon pin10 with any GND pin, press Vol+ and power button)
• Plug your Nintendo Switch through USB OTG compatible device (computer, phone or dongle)
• Run the payload Launcher and select the payload to send to the console, or let the dongle do it automatically.

List of Fusée Gelée Code launchers, dongles and payloads

Switch payload injector

déjà vu

unreleased exploit up to 4.1 ?