Hacker News Reader

Comment by hd4 | Hacker News Reader

There is an easy workaround developed by the Switch homebrew community, simply upgrade from within a custom firmware (such as Atmosphere-NX) and run a tool called ChoiDuJourNX which bypasses the fuse-burning.

If you're careful you can keep a backup trail going all the way back to your original device firmware and restore/downgrade it using the Hekate system tool. It has already been pointed out that there isn't much reason to do this, AFAIK the main reason people either held out on older firmwares or kept up a backup trail to them was in order to take advantage of possible firmware-version-specific exploits, the gold standard being a coldboot exploit.

View on HN

The reason this "easy workaround" works at all is that there is a BootROM exploit that trivially allows running arbitrary code in the BootROM. This allows us to run our own bootloader instead of Nintendo's, bypassing their fuse burning logic. Had Nvidia not fucked up their USB implementation (along with other part of their platform), this would have been harder to bypass.

[0]: https://www.reddit.com/r/SwitchHacks/comments/7rq0cu/jamais_...

I don't want to sound like I'm pontificating or defecating on the corporacy at everyone's favorite hardware company but it strikes me that these sorts of lapses are cultural and stem from this tedious emphasis everyone places on having "relaxed working environments"[0]

Does it surprise you that the product of this culture also has relaxed security characteristics?

[0] https://www.nvidia.com/en-us/about-nvidia/culture-at-nvidia/

Thank you for making me laugh in these trying times.

I gotta keep it real for you sir banana, the only way to have a legit conversation on this platform is to have an equal number of up and downvotes.

Ah yes, compared to every other company that has never had an exploit ever.

Does anyone even like Nvidia?

"Fuck Nvidia" ---Linus Torvalds

And for those who stayed on the 4.1.0 fuseset (or certain versions below that) there are warmboot exploits available. So those who are able to "normally" boot those firmwares do not need to use AutoRCM (or an RCM-"jig") to access RCM anymore.

While this is true, I was essentially saying that you don't have to remain on an older firmware as long as you're careful about how you move around between versions. I'm on 10.0 but I could go back to 3.1.0 anytime, and then move somewhere in between those versions if we got a coldboot exploit for example (which according to notable members of the Switch homebrew community is not likely).

Yeah, sure, you can ignore the fuses, but only if you assist the boot process using a jig and an injected payload. The stock Horizon kernel from FW 10.3 won't boot if your fuseset is for 3.1.0, unless you inject a chainloader which fakes the fuseset or removes the check.

Edit: I see what you were referring to, I was unspecific in my comment, updated it!

Reply on news.ycombinator.com