Firmware 10.0.0 adds preliminary support for a new hardware model: "nx-abcd".
3 of the 5 new DRAM profiles are for this new hardware type and there's evidence of a secondary display of sorts being added exclusively on this model.
( ͡° ͜ʖ ͡°)
It seems some misinterpretations are floating around regarding the next Switch model. Since I was asked to clarify, here's what we know so far about it:
1) A new retail model is definitely being worked on for release. There have been references to it since firmware 10.0.0;
PSA: SX OS contains brick code. How do I know this? Take a guess... :/
Anyway, the concept is the same that was used by Gateway for the 3DS: your eMMC will be locked with a specific password. Sadly, in my case, the password was generated from random garbage on the stack. :(
After stumbling upon this tweet, we were able to use this bug to dump the Gateway/TX modchip's firmware. It's important to remember that this is the exact same issue that led to fusee-gelee/shofel2, but on a different USB stack, meaning this might be even more widespread.
Hello enjoy CVE-2020-15808
for STMicroelectronics, no response to patch it. CDC USB class is vulnerable for buffer overflow via req->wLength pointer and allows to read up to 65KB of memory by crafting special USB descriptor message. Impacted entire series.
Very proud of my 2nd successful glitch attack against a real-life target after about 2 years of learning from scratch.
sha512sum mariko_bootrom.bin 6c02c0d488311c60b7d626cf2cf55d759e1264ef57d166c8e4a630f380cfbbf930b52d69d06b47feecb3a1c2daefdcf20c71b8356bc6f11748cbe51521b23bbb
I'm seeing a lot of confusion around the flashcart thing which is understandable given how (likely deliberately) vague they are being on what it can or can't do. I'll try to cover here a few facts known about the Gamecard ecosystem in general that may provide some answers. (1/20)
Now that the first Mariko based Switch has finally been announced, I believe it's a good time to provide some insight on what has been going on inside the Switch's HOS regarding new hardware.
So, TX's OS is up....
Main file ("boot.dat") has a small header (0x100) and the body is AES-128-CTR encrypted with:
KEY: 47E6BFB05965ABCD00E2EE4DDF540261
CTR: 8E4C7889CBAE4A3D64797DDA84BDB086
Decrypted file has another payload to "deobfuscate" the "OS"...
Sneak peak of TX's enterprise-ready filesystem layer totally developed from scratch!
But why does it look so familiar?
"embeddedfs:/titles/%016lx/exefs/main.npdm" 🤔
It's finally here! The story of how
@SciresM
and myself broken the Nvidia's TSEC with the help of many friends along the way.
I hope you have as much fun reading our work as we did writting about it! Enjoy!
We finally lost (the original) nvhax:
This was the original exploit chain
@qlutoo
,
@SciresM
and I used to create gmmuhax. May it rest in peace...
I'll be publishing a writeup for this one in due time.
And yes, there are still other bugs. ;)
"Flashcart" TLDR in 5 bullet points:
1) Lotus3 must have been decapped. This is necessary to obtain certain secret hardware keys used for communications and to decrypt gamecard certificates;
While the DRM imposed by the modchip was already bypassed months ago, the modchip's firmware remained impossible to dump without glitching.
And yes, I do realize Gateway's modchip being affected by this particular bug is irony at it's finest. Top quality meme material even.
Bear with me, this is going to be a long thread...
First of all, suing TX? I don't think we care enough for that.
On the other hand, calling them out was more than necessary. I've seen many people bashing those who claimed they would steal/use public code.
It's still unclear how the output signal will be generated (new dock?), but the evidence suggests the dp2hdmi chip lives *inside* the new display and not in an external PCB.
Considering the information we've extracted and observed, we speculate this new dp2hdmi chip is designed for upscaling HDMI output to 4K. This is further corroborated by changes in the HDCP DRM ("nvhost_tsec" firmware inside "nvservices") and by looking at RTD2173 as example.
As for the brick code, I was wrong. Not only it is more destructive than I originally thought (it tries to corrupt boot partitions too), but it's also deployed on *multiple* stages across the boot chain. It is also way more likely to be triggered on accident than expected.
( ͡° ͜ʖ ͡°)
FWIW the repo contains source code of critical software (bootrom included) tailored for Android running in Tegra platforms up to T124 (before Switch).
All this was already RE'd on the T210/Switch, but it has never before seen names, debug symbols and amusing comments.
"FOR SECURITY REASONS, THIS FILE SHOULD BE DISTRIBUTED ONLY IN BINARY FORM."
That's...really not how this works. Oh, NVidia...
(thanks
@balika011
for link)
Stay tuned for a writeup/paper from
@SciresM
and I, to be published soon, detailing the whole process involved in taking over this obscure secure processor and all the fun we've had working with many of our friends to accomplish this feat!
It's finally here! Honestly, and I think I can safely speak for
@SciresM
here, we were kinda expecting a better name... Other than that, it's exactly what we thought it would be (minus the 64GB storage; we had our suspicions, but it's not something observable in firmware).
5) The SoC is still Mariko/T214/T210B01/TegraX1+;
6) DRAM is now being produced with 10nm process, but no new sizes or types can be observed. This means "Aula" will keep the usual 4GB LPDDR4X.
3) "Aula" will feature an improved display of some sort and it bundles a dp2hdmi chip from Realtek (likely RTD2173 or from the same family). Communication with this chip is done by the "nvservices" system module using new ioctls for sending/getting panel messages via DPAUX;
Ok so, considering that:
a) Nvidia has moved away from Falcon for good, replacing it with a RISC-V based solution ("Peregrine");
b) Nintendo no longer uses the TSEC for secure boot on new Switch units;
I actually bricked my console again (for science!) and was able to unlock the eMMC with the "WANNA PLAY? :)" password, but I don't recommend anyone to try this unless you are really sure on what you're doing.
Sorry for missing my own ETA on the browserhax + nvhax release. I wasn't counting on spending the last days dealing with food poisoning.
The exploit will, obviously, be released during this week (there isn't that much left to justify another delay).
Anyway, browserhax + nvhax for < 6.2.0 will be released later this week (along with the writeup) so people with ipatched units can play around a bit in userland. It's not much, but hopefully will lead to more people researching other attack vectors in the latest firmwares.
2) The next model's codename is "Aula" (for comparison, the Lite model is called "Hoag") and its form factor is codenamed nx-abcd (for comparison, the Lite is nx-abcc);
Jokes aside:
- LayeredFS support - Public code;
- eShop NSP support - Using DevMenu... Seriously?
- Battery desync fix - Available in
@CTCaer
's hekate fork;
- Hide OSX temp files - A real improvement;
- Removed eMMC password lock - Is this a joke?
Please, keep up the hard work.
Just added DRAM training into Atmosphère for a faster boot time and future... stuff.
Many thanks to
@CTCaer
's awesome Minerva project which helped squash bugs and improve my code base (originated from RE'd code and
Peter De Schrijver's patches)!
This should prevent a lot of headaches for anyone looking into TX's OS:
This script further decrypts the "data" file you get from
@naehrwert
's script. I missed a few CTRs, but I'll update the gist asap.
Documented the TSEC Keygen and SecureBoot payloads on the wiki:
Still need to write down relevant methods, but this should give a nice overview of the TSEC SecureBoot process.
While the patchers were updated to fix several issues with FS, the KIPS were updated solely to fix a very funny issue.
Turns out, all hardcoded file paths in version 2.9 were using "atmosphere" as root directory. Version 2.9.1 renamed everything to "sxos".
Retweeting for visibility.
It's important we get ninupdates up and running before 6.x drops. Yes, 6.0.0 is real and is getting very close to an official release.
Finally, there's absolutely no evidence of an actual "Pro" version. At least not in the sense that it would be based off of the Tegra X2 or have massive performance and/or memory improvements.
REMINDER: Switch homebrew will be firmware 3.0.0 only for quite a while. Future hacks belong to an uncertain future and homebrew development will begin and be maintained on firmware 3.0.0 for as long as necessary.
In case you missed it, you can relive
@yifanlu
and
@DaveeFTW
's "Viva la Vita Vida" talk here (raw stream):
TLDR: Someone in Sony's HQ is now hunting down the cat that mashed the A key on the F00D development team's keyboard.
As you've probably seen already, the CDN "leaked" 6.0.0 a couple days ago and we were able to start tearing it apart.
It seems people are confused over some of the publicly shared details on the update, so I'll try to give a more technical view about it in this thread.
I think this deserves attention. Folks over at have been finding hilarious vulns and documenting the inner workings of the long forgotten iQue Player console!
Details on deja vu and TSEC carveout access blacklisting are now public.
The TSEC stuff was an expected mitigation after it's full compromise, but deja vu...
R.I.P. 2017-2019
And finally:
"The Secret of Monkey Hax: Chapter 1"
99c6cedf71e56852b656a1122f45bdde238ba037f84355052073ab3aa7a1340b
The important lesson here is that I suck at boasting hashes.
Since people have been asking, I've updated the unpack script for all versions except 1.1 (can't find it):
I've also cleaned up and uploaded a script I've been using to decompress the KIP files and the inner NSO files:
All this will be discussed in a future write-up by
@naehrwert
and myself, but in the mean time, if you are that eager to disprove us, feel free to run their "data_80000000.bin" payload using something like hekate. Reboot your console and enjoy the brick magic!
Interesting fact: Tegra systems are code-named after Marvel characters. TK1 was "Logan", TX1 was "Erista" and now T214 SoC's name "Mariko" comes from Mariko Yashida, Wolverine's lover. Whether this symbolizes Nvidia and Nintendo's scorching "romance" remains to be seen. ;)
Since the modchip uses a GD32, this was hardly unexpected as those are straight up clones of STM32. Nonetheless, I believe this demonstrates how this bug may be affecting way more devices than we thought.
Sad day as we finally have confirmation that one of the most useful bugs in the déjà-vu exploit chain was reported for a bounty by
@daeken
.
The nvservices transfer memory leak was originally found by
@qlutoo
and I back in June 2017 and it was part of the nvhax chain.
I'm releasing the WebKit code execution RCE I spoke of yesterday targetting PS4 6.20 firmware. Gadgets and potentially the code execution strategy will need to be adjusted for lower firmwares. Have fun :)
On a more serious note, AFAICT the SX OS brick code has indeed been stubbed. The "WANNA PLAY :)" password is still generated and the code is still there, but now instead of trying to lock the eMMC it will just get stuck on a loop.
Updated scripts for SX OS v1.4:
Things to note:
- fs.mitm KIP has been renamed to "y so salty" (LMAO);
- Patchers have been updated for NCA stuff;
- TX NSO has been replaced with a loader that grabs the actual thing.
By mistake I posted the wrong hash (HOVI_KEK_KEY_PRD for 6.2.0) and
@shchmue
quickly noticed it... :P
So, let's try this again:
sha_256(HOVI_ENC_KEY_PRD for 6.2.0): b7ac0d53f675ec20844fb693d69208f00f28ae546b5e658763c7f747a440c874
Due to this, it was uncertain if keys in future updates could be extracted or not... Until now.
Third time's the charm. I found a critical design flaw a few weeks ago and after a short brainstorm session with
@SciresM
, we were able to obliterate the TSEC's crypto scheme forever.
The "Loader" is the meat of the "OS", but it's nothing more than:
- An old build of nx-hbmenu;
- Atmosphère's loader code.
Backup loading is mostly achieved by parsing and decrypting XCI files and feeding them directly to the FS sysmodule (which has signature checks disabled).
Even the code for talking to their license server uses an open-source crypto library so, yes, there are multiple license violations here. However, none of us expected differently, to be honest.
I like to think 9.2.0 update, while serving it's technical purpose, is also symbolic as it adds 33 (March 3) to a system resource limit. Coincidentally, Atmosphère's release ends in 3, as the Switch celebrates it's 3rd anniversary. Thank you Nintendo for this awesome console! :)
However, it is completely possible that future hardware would now force you to verify older gamecards online to assert its legitimacy, for example. (20/20)
Already saw the real codename being dropped on a popular forum (albeit in an indirect, enigmatic way) so this probably won't stay a secret for too long.
Fun fact: Nintendo themselves leaked the name over a year ago by adding it to a single file in the retail Switch firmware.
I'm not in the business of leaking this kind of thing (sorry), but for my future self's ability to prove I know what I'm talking about: ed099f81f8ffcf020b5eb0b93db313ee603155d5826e623c178a9e7b8367cd7d
After stripping down all the obfuscation we can now say for sure that the SX OS is made of:
- Custom bootloader to display their main menu;
- Set of kernel + INI1/KIP1 patches to disable signature checking;
- Modified KIP1 Loader.
A number of mistakes in Loader paired with the re-use of all DRM payloads and overall changes in code style, strongly suggest this is not the work of the same programmers (which could explain the sudden jump from 3.0.5 to 3.1.0 with so minimal changes).
Once again, big shout out to
@qlutoo
,
@shuffle2
,
@SciresM
and
@elmirorac
for all the work involved and also to the nouveau/envytools' people for the amazing work in documenting the Falcon and other obscure controllers over the years!
It seems my tweets from yesterday confused some people. I don't blame you. Me failing at basic english ("until" instead of "while", smh) *and* posting the wrong hash didn't help at all, but what can I say? I was too excited and tired to even notice. :P