|
|
Nintendo DS News is a News and downloads site for All Nintendo Handhelds and Consoles including the Gameboy, NES, N64, Snes, Gamecube, Wii, WiiU, NDS, 3DS, GBA and Snes, We have all the latest emulators, hack, homebrew, commercial games and all the downloads on this site, the latest homebrew and releases, Part of the
DCEmu Homebrew & Gaming Network.
THE LATEST NEWS BELOW
|
May 5th, 2018, 11:16 Posted By: wraggster
More Switch news:
Nintendo 'scene' is on fire today, and @fail0verflow has decided to release their GITHub Repo pages to the public for viewing, most are still 'work-in-progress' and no official tweet has been announced yet by the team, but they do say to 'stay tuned' to after April 25th. 
f0f GITHUB links:
So from the looks of it, soon we will have full disclosure after their 90-day window closes in the next few days, so Stay Tuned!
via http://www.maxconsole.com/threads/te...go-live.46868/
To read more of the post and Download, click here!
 Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
 |
|
|
|
May 5th, 2018, 11:14 Posted By: wraggster
Heres a major new exploit for the Nintendo Switch:
@fail0verflow decided to have the 'last word' in the on-going 'scene drama', by releasing things 48 hours early, and at same time taking one more 'dig/poke' at the other teams, saying they 'found this bootrom bug first', but at same time saying others found it also!
Choosing whether to release an exploit or not is a difficult choice. Given our experiences with past consoles, we’ve been wary of releasing vulnerability details or exploits for fear of them being used primarily for piracy rather than homebrew. That said, the¹ Tegra bootrom bug is so obvious that multiple people have independently discovered it by now; at best, a release by other homebrew teams is inevitable, while at worst, a certain piracy modchip team might make the first move. 90 days ago, we begun the responsible disclosure process with Google, as Tegra chips are often used in Android devices. The disclosure deadline has now lapsed. The bug will be made public sooner or later, likely sooner, so we might as well release now along with our Linux boot chain and kernel tree, to make it very clear that we do this for fun and homebrew, and nothing else.
… is what we were planning to say, but then someone published the 0day bug two days before our 90-day disclosure window was set to expire on April 25th. Oh well. Yes, this is the same bug that is exploited by fusée gelée, and that was just leaked by some other group (but we found it first).
This is going to be a bit rough since we didn’t have the blogpost/repos ready (procrastinators as we are), but without further ado, here’s the scoop.
What’s this all about anyway?
The Tegra X1 (also known as Tegra210) SoC inside the Nintendo Switch contains an exploitable bug that allow taking control over early execution, bypassing all signature checks. This bug is in the RCM mode, which is a USB-based rescue mode intended for initial flashing of Tegra devices and recovery of bricked devices. Normally, RCM mode only allows signed images to be loaded, but thanks to the bug, arbitrary code execution is possible.
This means that in order to gain code execution on the Switch you need to do two completely independent things:
- Enter RCM mode
- Execute the USB-based exploit
Each can be accomplished in several independent ways. Note that this is what iPhone users would call a “tethered jailbreak”, in that it needs to be performed on every boot via USB.
Entering RCM mode
On the Switch, RCM mode can be entered in multiple ways:
- From prior kernel-mode code execution on the system, e.g. using a WebKit exploit and kernel exploit as an entry points
- If the eMMC is removed, the Tegra will enter RCM mode on boot
- If you hold the Volume Up, Home, and Power buttons on the Switch (not joy-cons) at the same time.
Note that the Joy-Con home button won’t work here. You may be wondering about the secret home button on the Nintendo switch itself. As it turns out, what Tegra calls the Home button is actually connected to Pin 10 (the rearmost pin) on the right hand side Joy-Con connector. You can just use a simple piece of wire to bridge it to e.g. a screw on the rail (easiest), or pins 10 and 7 (or 1) together (10 and 9 won’t work). You can also 3D print a little jig to do this easily, using the innards of a Micro USB connector (which has the same pin pitch as Joy-Con connectors), or use a disemboweled Joy-Con as a donor for the connector. The latter is also useful, because the Joy-Con rails are UARTs and we use the right hand joy-con port as the console for coreboot, u-boot, and Linux.
Executing the USB-based exploit
The USB exploit requires a USB host. The exploit also requires using very long control transfers, which unfortunately some OSes are not happy with. You can either use vanilla Linux on a PC with an xHCI controller (USB 3.0, or any USB port on most recent systems), or a PC with an EHCI (USB 2.0) controller and this kernel patch.
This could conceivably also be executed from an Android phone (at least those with xHCI controllers), although porting the exploit to Android is left as an exercise to the reader. Bonus points for doing it from another Tegra device. Like another Switch.
Linux on Switch boot chain
Our boot chain is 99% open source, based on the Pixel C boot chain (because who wants to use Nvidia’s messy L4T kernel fork and proprietary bootloaders?). It looks like this:
BootROM Exploit → coreboot loader → coreboot → ARM trusted firmware → coreboot → u-boot → Linux
The only closed-source component, which is optional, is the Tegra210 DDR4 memory training code. For unknown reasons, this is released as a binary blob for the Pixel C, which gets copied into memory and jumped into. This blob can be obtained from the Pixel C factory image as follows:
Code:
./build/util/cbfstool/cbfstool bootloader-dragon-google_smaug.7900.97.0.img extract -n fallback/tegra_mtc -f tegra_mtc.bin
Make sure you get a tegra_mtc.bin with this SHA256:
edb32e3f9ed15b55e780e8a01ef927a3b8a1f25b34a6f95467 041d8953777d21
Although this blob contains hardcoded tables and a “do everything” entrypoint for the Pixel C, it is possible to jump in one level deeper into the call tree and pass in custom tables, which is what our patched coreboot does to configure DDR4 on the Switch. Without this blob, the stack will still work, but the memory will run at ~200Mhz, which needless to say rather cripples performance.
The boot process looks like this:
- The Tegra starts up the Boot ROM on the BPMP (arm7) core, and enters RCM mode.
- The host-based USB exploit code puts a small (~2.5K) loader (cbfs.bin) into SRAM memory, using an RCM command.
- The exploit is triggered, causing the ROM to jump into cbfs.bin.
- The host code then goes into CBFS server mode, dynamically serving coreboot.rom via the USB RCM pipe to the Tegra.
- cbfs.bin uses this CBFS server to request the first 28KiB of coreboot, which is the coreboot bootblock, into SRAM, then jumps into it.
- The coreboot bootblock initializes basic peripherals, then loads the romstage into SRAM using the CBFS service from USB and jumps to it.
- The coreboot romstage initializes SDRAM (at the basic fixed boot speed) and other peripherals.
- The romstage then downloads the entire coreboot ROM into SDRAM (still using the Boot ROM RCM mode USB routines) and switches to RAM-backed CBFS.
- The romstage now loads the ramstage (from the RAM CBFS), starts up the CCPLEX (Cortex-A57), and shuts down the BPMP.
- Now on the CCPLEX (at EL3), the coreboot ramstage performs the rest of the basic system initialization, including DDR4 training if the MTC blob is available.
- The ramstage now jumps into ARM Trusted Firmware, which initializes the TrustZone implementation. This is required to provide certain OS services.
- ARM Trusted Firmware returns to the coreboot ramstage, now running in EL2 mode.
- The ramstage loads and jumps to its final payload, U-Boot.
- U-Boot starts, initializes some more hardware, and, by default, goes into USB download mode, with its own USB driver.
- Using imx_usb_loader on the PC side, you can load arbitrary U-Boot payloads, such as a Linux kernel and its initramfs, and run them.
The code
Have a look at our Git repositories:
Sorry, we don’t have a guide for the Average User to use this, nor should they, most likely, since a lot of things are very rough around the edges. If you’re serious about developing, you should be able to figure things out yourself or ask questions on IRC.
The Git history is quite ugly, as we haven’t had a chance to clean things up yet. Please do not stare too hard.
Coming soon
Proper write-up on the exploit, stories of porting Linux (yes, there’s more to it than a panel driver ;-) ), upstreaming status, how batshit insane DDR4 is, and more. Probably, anyway. We’re pretty bad at writing blogposts.
¹ There are actually many Boot ROM bugs, several of which have been found by multiple people.
Linux on the Nintendo Switch
OFFICIAL SITE: --> https://fail0verflow.com/blog/2018/shofel2/
via http://www.maxconsole.com/threads/te...exploit.46871/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 11:10 Posted By: wraggster
Heres an awesome release for the Nintendo DSI:
Yesterday, was a crazy day for 'Nintendo' with all the ongoing Switch drama and releases, but yesterday also saw another 'coldboot exploit' released, this time by famous GBA emulator author no$cash which is designed for installation our now classic retro DSi handhelds, and you can now check out today's updated version attached below with improvements from yesterday's first release:
Version v0.6: added write-protect flag to the .tmd file (avoiding Data Management to delete it).
- It's gaining control with full SCFG_EXT access rights immediately after power-up (before even starting the launcher).
- Installation requires a working DSiware exploit with SD/MMC access, or a hardmod.
- The exploit works with all retail DSi models, regardless of region and firmware version.
- Once when installed, it will start the file 'bootcode.dsi' from SD card (if present).
- Or, otherwise, it will resume booting nintendo's launcher (with disturbing healthsafety and bootmusic disabled, and removed RSA, whitelist and region checks).
CAUTION: This is still in mostly untested beta stage.
Currently, this should be used only if you have an eMMC backup & an installed hardmod - so you can unbrick if something goes wrong. Further how-to-use info is shown in the .dsi file's installer menu.
Note: The background GIF's are showing Herzogin Cecilie. I've also considered Principessa Jolanda for actual launch failures, and the Skyluck for intentionally grounded vessels. But then, the photo with the half sunken ship's figurehead nearly kissing the waves is so strong that I've chosen that one.
OFFICIAL SITE: --> https://problemkaputt.de/gba.htm
FORUM SUPPORT THREAD: --> http://4dsdev.kuribo64.net/thread.php?id=171
via http://www.maxconsole.com/threads/un...ndo-dsi.46865/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 11:07 Posted By: wraggster
Some Switch news from BigBlueBox:
The 100th Warez Release like their previous 50th Release is special in two ways, one it mentions how big 'N' is changing their games to make it easier to do DMCA takedowns on sites that host the dumps, and also at the same time they released a set of useful KeyBlobs.
BigBlueBox --- Proudly Presents: The Snack World: Trejarers Gold
Wow, its Game 100 release time, and boy did we pick one this XCI is different than all the others so far how can that be you wonder.
Well let's begin first we have a new Partition on the Cart previously its was Update.Normal.Secure this one is Update.Logo.Normal.Secure this new Partition Logo contains a Plaintext Logo so guessing this means they want to go after people hosting and file a copyright claim.
Secondly, the Normal Partition is Completely Blank still there but Blank, assuming this is the force the new ASIC, so no displaying on <4.x Firms. So that sums up this strange XCI. Switch tools will need to update to support.
Now onto the 100th release present, we are still astounded we are the only Scene group dumping though, I guess it made this release come faster and it's not the last boring Master Key, so enjoy these: (keys removed, please see below)
Thanks Level 5 for this different ROM, please release in English. Here's to the next 100 releases. Enjoy as Always!
As always unlike other sites, we post the real shit, so here you go, have fun, but first a quote from SwitchBrew on what a KeyBlob is:
There are 32 keyblobs written to NAND at factory, with each keyblob encrypted with a console-unique key derived from the console's SBK, the console's tsec key, and a constant specific to each keyblob. Despite being encrypted with console unique keys, though, the decrypted keyblob contents are shared for all consoles.
more info http://www.maxconsole.com/threads/bi...release.46886/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 11:06 Posted By: wraggster
More Nintendo Switch Hacking news:
It is easy to dump a 'binary', but then how do you study it, normally you use a program like IDA PRO, but then its still hard, but when scene developers like @SciresM releases IDC scripts, then it makes it a ton easier, you can start almost right away, studying the flow of coding!
SciresM said:For anyone who's interested in REing the Nintendo Switch's "Loader" sysmodule, here are my IDCs (which I used to reimplement the module the past week): https://gist.github.com/SciresM/5f43...17dd3e43e656d0 (1.0.0, 3.0.0, and 5.0.0).
Note, as usual, if you just wanna know how it works, see Stratosphère
NEWS SOURCE: @SciresM (via) Twitter
via http://www.maxconsole.com/threads/release-idcs-for-the-switch-loader-1-0-0-3-0-0-5-0-0-by-sciresm.46887/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 11:05 Posted By: wraggster
Some great news regarding Yuzu the Nintendo Switch Emulator:
The amazing emulator developer folks behond 'yuzu' which will be very first emulator on our PCs that can 'emulate' the Nintendo Switch, is making progress, since two weeks ago they reported the first 'indie' games booting up, now an actual Nintendo first-party game starts to work, of course still many long months maybe years before we see Super Mario Odyssey running in 4k on our high-end Desktop PCs.
OFFICIAL SITE: --> https://yuzu-emu.org/
NEWS SOURCE: @yuzuemu (via) Twitter
via http://www.maxconsole.com/threads/yuzu-boots-its-first-switch-exclusive-1-2-switch.46903/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 11:02 Posted By: wraggster
An old group has come back to release games for the Snes:
OLDSKOOL in the past released a ton of games, and now they just released 'Socks the Cat Rocks The Hill, unreleased SNES
Socks the Cat Rocks The Hill made history when a prototype was discovered, and then in form of Kickstarter last year it was released finally in brand-new SNES cartridge format, but in true spirit of real warez scene group, OLDSKOOL has now released the dump of it, along with two new 'intro/changers' for games Hind Strike and Creepy Bird, along with nice letter to the whole scene regarding recent and past drama that always seems to drag down the all spirit of just enjoying our consoles in ways official companies don't love!
download http://www.maxconsole.com/threads/ol...eleases.46904/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 11:00 Posted By: wraggster
Cpasjuste has posted a new homebrew release for the Switch:
Scene developer @Markus95 has used the nice work by @Cpasjuste to help him port over 'Streets of Rage' to the Switch to enjoy!
Markus95 said:Having finally updated my switch in 3.0.0 I decided to adapt my MOD Streets of Rage to the base developed for PS3 but also available on PSP, PS Vita and PS TV, so that it works on Switch. It understands for the moment only the mode EASY, the mode NORMAL and HARD will arrive soon, like the correction of some graphic bugs visible in this first release.
changelog - v0.2:
- Public release
- Addition of PS3 cutscenes
- Addition of PS3 internships
- Added the PS3 intro
- Addition of PS3 music
- Added visual effects not present in the PS3 version
- Adding the complete EASY mode
Installation:
- Decompress the SOR_Switch.rar archive
- Copy / paste the Openbor folder in sd: / switch / ...
The full version of MOD Streets of Rage is being tested and will be released soon, as well as a beta version of a new MOD being developed (preview in the video )
PS: I want to thank @Cpasjuste for his huge work without which these MODs could not be adapted on Switch.
via http://www.logic-sunrise.com/news-98...-rage-mod.html
via http://www.maxconsole.com/threads/sw...age-mod.46906/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 10:58 Posted By: wraggster
My eyes, heres yet another switch release:
GBATemp Forum Member @ksamj202 has been kind enough to setup two 'web-friendly' domains for accessing the Web Fusée Launcher released earlier this week be scene developer @altas44 on his GITHub, and it works great except only on Chromebooks and most Android phones, but not on Windows Chrome, but at least it gives you another option to launch the payloads via USB.
Instructions:
- Put the Switch in RCM, and connect it to your device.
- Select either the example payload, or upload one.
- Press 'Do the thing!'
- On the consent screen that appears, select 'APX' and hit confirm.
- If all goes well, the payload will launch!
Random stuff:
- This is pretty poorly tested. I just kind wrote it and whatever. I'm not responsible if anything goes wrong!
- This does NOT work on Windows due to a limitation in the Chrome implementation of WebUSB (and probably other reasons!)
- This does NOT currently work on any browser but Chrome, because they don't implement WebUSB.
- On Linux, you might get an access denied error! If you do, you can try creating a file at /etc/udev/rules.d/50-switch.rules
- With the following contents:
- SUBSYSTEM=="usb", ATTR{idVendor}=="0955", MODE="0664", GROUP="plugdev"
- This has been tested and appears to work on Linux, OSX, Android (unrooted) and Chromebooks. Your mileage may vary.
OFFICIAL SOURCE: --> https://github.com/atlas44/web-fusee-launcher
WEBFG SITES: --> https://fusee-gelee.firebaseapp.com/ (or) https://switch-fgw.firebaseapp.com/
via http://www.maxconsole.com/threads/sw...auncher.46907/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 10:55 Posted By: wraggster
More Switch News:
Scene developer @hexkyz recently updated the 'SwitchBrew Wiki', to document the 'TegraRCM' in full, and at the same time dropped a rather useless (but hilarious) 'unpatchable' bug. - That he found in the 'TSEC firmware' for v5.02 that not very useful but still its there:
Package1ldr loads a firmware blob into TSEC early on boot. This piece of code runs on the TSEC in Authenticated Mode and has the sole purpose of generating the per-console TSEC key (see Cryptosystem).
As a way to mitigate attacks, the TSEC firmware blob is split into 3 stages: Stage 0 which is unencrypted and unsigned, Stage 1 which is unencrypted but signed and Stage 2 which is encrypted and signed. Stage 0 loads a static pre-generated signature into the Falcon's CPU crypto registers, loads Stage 1 into the Falcon's CODE region and jumps to it. Execution will proceed into Stage 1 in Authenticated Mode if, and only if, the loaded signature matches the one Falcon calculates internally for Stage 1.
Among various things, Stage 1 will attempt to do a "backwards" security check by calculating a CMAC over Stage 0 and comparing it with a known hash stored in the TSEC firmware's key data (a small buffer stored after Stage 0's code). If the hashes don't match, execution aborts.
Stage 1 stores the calculated Stage 0's CMAC in the stack, but forgets to clear it. Since the stack is located in Falcon's DATA region, loading the TSEC firmware blob and dumping the DATA region afterwards (via MMIO) will reveal the calculated hash. This allows using Stage 1 as an oracle to generate a valid CMAC for arbitrary Stage 0 code. Replacing the CMAC in the TSEC firmware's key data region results in Stage 1 accepting any Stage 0 code, thus rendering this security measure useless.
Additionally, since signed Falcon code can't be revoked without an hardware revision, an attacker can always reuse the flawed Stage 1 code even if a fix is issued.
OFFICIAL SITE: --> http://switchbrew.org/index.php?titl...541&oldid=4515
NEWS SOURCE: @hexkyz (via) Twitter
via http://www.maxconsole.com/threads/switch-bug-found-in-v5-02-tsec-firmware-compromises-itself.46910/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 10:54 Posted By: wraggster
If your interested in Switch releases, heres another one:
Scene developer @DavidBuchanan314 has put together a nice android app, that can help launch those frozen rocket payloads coming out for the TegraX1 (coldboot) Recovery Mode Exploit, so you can now be more portable if you have an compatible phone handy!
Changelog v0.2:
- Fix APK signatures for installation on pre-7.0 devices.
- Various code quality improvements (thanks @langerhans )
NXLoader (ALPHA - EXPERIMENTAL)
My first Android app: Launch Fusée Gelée payloads from stock Android
Heavily based on Fusée Gelée and ShofEL2. fusee.bin is bundled as a default payload. This app is currently in "Alpha" state, it's my first Android app and there is some rather disgusting code (Potentially blocking tasks on the UI thread ). This will be improved soon™.
HOWTO:
- Launch the app.
- (Optional) go to the Config tab, and select a custom payload file.
- Plug in your Switch. (On my Nexus 5, I use a micro USB OTG cable, and an A-to-C cable)
- Put it into RCM mode. (Note: your switch will power on by itself when plugged in, be sure to hold VOL+).
- Grant permission to the app to access the USB device.
- Enjoy!
Note: The app does not need to be running in order to launch the payload. The phone can even be locked!
FAQ:
- Why use this over a web-based launcher?: No internet required, and can auto-launch even if your phone is locked. Plug and play!
- Can it load Linux?: soon™
- Will it brick my phone/switch?: Hopefully not, but I an certainly not responsible if it does!
- Does it need root?: Nope!
TODO:
- Refactor the code so it's less hacky
- Improve UI/UX
- Implement loader for fail0verflow's Linux
For anyone who wants to look at the exploit source, the magic happens here.
Does it work on your device? Report here
OFFICIAL SITE: --> https://github.com/DavidBuchanan314/NXLoader
via http://www.maxconsole.com/threads/nx...anan314.46912/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 10:53 Posted By: wraggster
Whats this another Switch release:
Currently, there is no way to access the Switch eMMC on the console itself, as its 'disabled' when using the 'fusée gelée' exploit, but thanks to scene developer @rajkosto, whom earlier released a payload called 'biskeydump', you can at least get your console unique BIS keys, and then using his latest release, HacDiskMount and a way to attach the eMMC removed from your Switch, or an NAND backup, you can now access it!
Allows to open Switch eMMC RawNand dumps (and physical devices) and lets you perform operations on the individual partitions within, such as dump/restore from file, or mount them as a drive letter in Windows (with transparent crypto performed provided you have your BIS keys).
Changes:
- 1.0.2.2 - Fix crypto not working correctly at all on CPUs without AES-NI
- 1.0.1.1 - Partial support for dumps on 4K physical sector drives
OFFICIAL SITE: --> https://switchtools.sshnuke.net/
via http://www.maxconsole.com/threads/sw...ajkosto.46894/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 10:52 Posted By: wraggster
The Switch releases keep on coming:
The original 'fusedump' by scene developer @moriczgergo has been scraped and now been replaced with moonflower which is much more stable payload for use with your frozen rocket experiments on your Nintendo Switch console, so check it out below:
moonflower (License/GPLv2)
A fuse and GPIO dumper for the Switch, to be used with fusée gelée.
NOTE: Your dump may contain sensitive info that you probably don't want to leak.
Usage
- Build moonflower.bin, or grab one from our releases.
- Run fusée gelée with moonflower.bin instead of fusee.bin.
Changes
This section is required by the original license of Atmosphere, GPLv2.
- This originates from ktemkin's fork of Atmosphere (branch: poc_nvidia).
- exosphere has been stripped out, only fusee remains.
- main.c has been modified to print the fuse and GPIO data.
- Makefile has been modified to only build moonflower.
- .gitignore has been modified to apply to the new directory structure.
- README.md has been modified.
- shutdown_using_pmic() (src/main.c) is from rajkosto's biskeydump.
Responsibility: Don't blame me if damage happens to your Switch. (There shouldn't be any damage tho'.)
Credits
- rajkosto, for helping me out with GPIO stuff, and for the PMC shutdown code.
- ktemkin, for making fusee gelee, and releasing a fusee payload POC.
- SciresM, for making Atmosphère.
- Everyone in the ReSwitched Discord. <3
OFFICIAL SITE: --> https://github.com/moriczgergo/moonflower
via http://www.maxconsole.com/threads/sw...czgergo.46895/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 10:50 Posted By: wraggster
Heres one of the major releases for the Nintendo Switch Scene:
Scene developer @SciresM is back finally with a much needed update to his 'HacTool' that now handles all the newly discovered 'Switch File Formats', and recently released Keys (not supplied with his package, but support is when you 'find them'), so enjoy!
Keydata can be baked in at compile-time, or loaded from an external key file. See README.md and KEYS.md for details. In addition, a secure boot key + TSEC key + boot0 file pair can be passed in with an external key file to derive all keys it is possible to know given the information one has.
New Features:
- Added support for NAX0 (Nintendo Aes Xts File(system), SD Card content)
- Added support for key derivation using EKS (keyblobs) and sbk/tsec key
- Support was added for pre-1.0.0 "NCA2" content.
Bugs fixed:
- BKTR did not support the non-single bucket case, affecting games with huge patches (Splatoon 2, maybe others)
- Too many small ones to count
The following Switch file formats are supported:
- NCA
- XCI
- HFS0
- PFS0
- RomFS
- NPDM
- Package1 (PK11)
- Package2 (PK21)
- INI1
- KIP1
- NAX0 (New)
Compilation is still annoying, so a pre-compiled build is provided for Windows users.
OFFICIAL SITE: --> https://github.com/SciresM/hactool/releases
via http://www.maxconsole.com/threads/sw...sciresm.46914/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 10:49 Posted By: wraggster
Yet another release for the Nintendo Switch:
For some reason since the 'Switch' scene exploded like a rocket last week, i never been so hungry, maybe because all I am posting recently is things like this release by scene developer @moriczgergo, whom has made a portable setup for those with a RPi handy!
Ingredients
- A Raspberry Pi Zero (any RPi works, but the Zero tends to run off of any power bank)
- A power bank (for powering the RPi)
- A non-powered USB hub (why?)
- A USB-A to C cable (don't get a no-brand one: it may not have a needed resistor, and it may wreck your Switch or your USB source)
- A USB-A to Micro cable (for RPi power)
- A USB Micro to USB-A Female cable (only for the RPi Zero: for plugging in the USB hub)
SD Setup
- Download a fusee-framboise image.
- Flash it to your RPi's SD card. (If you don't have a flasher software installed, I recommend Etcher.)
Cables!
- Plug the USB Micro to USB-A Female cable into the RPi. (only for RPi Zero)
- Plug in the USB hub into the USB-A Female cable.
- Plug in the USB-A to C cable into the USB hub.
- Plug in the USB-A to Micro cable into the USB hub, and into the RPi.
Usage
You should just be able to plug in your Switch, put it into RCM, and the payload should automatically launch.
Replacing the payload
To replace the payload, you have two methods: (both need sudo)
- Replace fusee.bin in /etc/fusee-launcher/ with another payload. (recommended)
- Copy another payload into /etc/fusee-launcher/, change modchipd.sh to point to it, and restart the fusee-launcher service, or reboot.
Networking
You can change the payload over the air. Here's how to do it: (your RPi needs wireless, and you'll need a mobile/normal hotspot to do this)
- Set a root password with "sudo passwd", and take note of it.
- Change your default pi user's password from "raspberry". (optional, recommended)
- Turn on SSH: it's in Interfacing Options of raspi-confiig.
- Configure your Pi to connect to your phone's network.
- Reboot to connect to it, run ifconfig, and take note of the settings.
- Set a static IP based on your ifconfig data.
- Take note of your static IP. (you should probably take note of it on your phone)
- Use an app that supports SFTP to connect to your RPi with the new root password. (iOS)
OFFICIAL SITE: -->https://github.com/moriczgergo/fusee-framboise
via http://www.maxconsole.com/threads/sw...lée-rig.46916/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 10:47 Posted By: wraggster
The Nintendo Switch releases keep on coming:
Scene developer @naehrwert has released the very first 'payload' for the Switch that does some very cool things, for one it replaces 'bootloader/package1', so it can load 'custom firmwares', but that only works on v2.0.0 or lower (for now), and second it can display all your console-unique fuses/key info, and in the tools section it can so far 'backup' your eMMC o the inserted FAT32-formatted SD Card, but it currently only does the main system-unique partitions found within 32gb NAND, it skips over your 'user/game' 26gb section, but still its useful enough to generate future 'emunand' setups and explore your eMMC and make changes with the current released tools, all at of course at your own risk, as well you could just brick something, but if you love living on the leading edge of the scene, try it!
- So it has come to this. Presenting 'hekate_ipl' (grab it here https://my.mixtape.moe/rugfcr ), our PoC bootloader/package1 replacement - run it with your favourite shofEL2/FG launcher. Example config here https://gist.github.com/nwert/9cff14...522d2cf7d53253 … (place it on the root of your SD card).
- you probably want to create a backup of your eMMC before trying out any shenanigans with patched kernels/etc., that's why we've included a dumper for you, currently it skips the USER partition, all other partitions take ~5mins to dump.
- oh and sleep mode is broken right now because configuring the MC config in PMC is hard and we're really good at procrastinating - we'll fix it sometime soon
- almost forgot, firmware launching is limited to 1.X and 2.X for now, support for later versions is being worked on
- sure, sometime later this week - just a bit hesitant bc the last source I've shared (hwinit) is now widely being used without zero attribution
- https://github.com/nwert/hekate - I'm outta here
The above is all the recent tweets by the author since this announcement set the Switch scene on fire yesterday, and now last tweet came earlier today and is finally a link to his 'magic dust' (source code) behind his amazing frozen rocket payload, and already people having started to fork it in as you can see in our latest post here.
NEWS SOURCE: @naehrwert (via) Twitter
via http://www.maxconsole.com/threads/switch-release-hekate_ipl-by-naehrwert-source-code-released.46915/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
|
May 5th, 2018, 10:45 Posted By: wraggster
Now heres a major release, a Custom Firmware for the Nintendo DSI, how awesome is that, heres the release details:
The Nintendo DSi scene was set on 'fire' again after long-time scene developer @no$cash dropped the world's first 'coldboot' exploit for now retro DSi handheld onto the world called 'ULaunch' and now scene developer @Robz8 has released the world' first DSi 'CFW'.
Here it is, the first DSi CFW!
Video by Alex S (with SRLoader installed) and Video by @Apache Thunder (When RocketLauncher was planned for a release. With WarioWare Touched (DSiWare version) installed.)
Robz8 said:With this CFW, you can run custom DSiWare, alongside region free and 3DS-exclusive DSiWare (WarioWare Touched), on your SD card, via NAND to SD redirection! You can also run blocked flashcards (such as R4 Ultra).
Full guide (from stock to HiyaCFW)
Credits
- @Apache Thunder, @nocash123, StuckPixel, @shutterbug2000, and @Gericom.
- @Drenn: .bmp loading code from GameYob, for custom splash screens.
- me: Logo graphic, and settings screen.
- WinterMute/devkitPro: For the majority of the base code like nds-bootloader which this loader uses.
FAQs
Q: Can I use a custom splash for HiyaCFW?
A: Yes you can, but only top splashes work for now. Place it at "sd:/hiya/" and name it splashtop.bmp. Make sure it's actually saved as a .bmp file, with the size of 256x192, with no color space info, and is 16-bit (A1 R5 G5 B5).
OFFICIAL SITE: --> https://github.com/Robz8/hiyaCFW/releases
OFFICIAL GUIDE: --> https://dsi.cfw.guide/
via http://www.maxconsole.com/threads/hi...dsi-cfw.46922/
To read more of the post and Download, click here!
Join In and Discuss Here
Submit News and Releases Here and Contact Us for Reviews and Advertising Here |
|
|
|
|
« prev
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
next » |
|
|
