Hacker News Reader

Comment by no_time | Hacker News Reader

Even Nintendo isn't petty enough to sink billions into R&D'ing a novel architecture to ruin the prospect of emulation for a couple a few hundred thousand people at most.

View on HN

The more likely avenue is they continue to use commodity hardware, but keep refining their security model to make it harder to dump and decrypt the games in the first place. They got really close to nailing it with the Switch, but were undone by the Tegra bootloader exploit completely and irrevocably breaking the root of trust on early batches, however beyond that one bug the systems security has held up extremely well. No firmware released in the last five years has been jailbroken without leveraging the bootloader exploit, which is desirable since only Switches sold in the first year or so of release are vulerable to the bootloader bug, and none of the versions with upgraded specs (die shrunk original model, OLED model, lite model) are vulnerable.

If they manage to avoid a repeat of the bootloader exploit next time, it's going to be an uphill struggle more akin to attacking the Playstation and Xbox.

> No firmware released in the last five years has been jailbroken without leveraging the bootloader exploit

It's worth noting that the desire to break these firmwares are much lower since the bootloader exploit exists. I'm sure people would be looking much harder otherwise.

That is true, but SciresM has exhaustively reverse engineered the latest Switch kernels from end to end and stated confidently that there's nothing there to exploit. It's a tiny microkernel so auditing the entire thing is actually feasible, nothing like the enormous potential attack surface of the Playstations FreeBSD kernel.

https://twitter.com/SciresM/status/1486787208333774848

"I don't expect another software hack to release ever for the switch." - the person with probably the deepest knowlege of the Switch OS outside of Nintendo

There is one other glitch recently discovered that affects all Switches; the Tegra X1 has no protections against voltage glitching attacks. Therefore, a mod chip (or RP2040) can cause a power drop at the right moment and bypass the signature check, and reboot and try again a few times if it didn’t work.

Most likely a Tegra X1 successor would (like modern security chips) have circuitry to detect such glitching and force an automatic reboot if it occurs.

Yeah, Microsoft got blindsided by voltage glitching on the 360 and they went on to implement a watchdog system in the XB1 which forces a reboot if it detects voltages, clocks or temperatures going out of sensible ranges. They also audited their first stage bootloader to ensure that even if you manage to sneak one glitch past the watchdog, the code is structured such that any single branch going the wrong way won't lead to a compromised state. The combination of those has successfully prevented any such attacks from happening again.

Voltage glitching is the kind of play you only get to make once unfortunately.

A I understand it, the PS3, Xbox 360, and PS4 have been broken by hackers. The Xbox opened its platform to unsigned code removing a big incentive for hackers to break the system. I’m expecting the PS5 to be hacked first.

The PS4 was hacked intermittently, which is what I meant by uphill struggle. The exploits are the "bottom up" variety starting in usermode and escalating up to patching the kernel, which can be fixed by firmware updates, so if you're not sitting on an old firmware you're out of luck. They've also never managed to escalate to the root of trust, which means you can't exploit vulnerable firmware X and then update to a pre-rooted non-vulnerable firmware Y like you could on the PS3 - you're stuck on firmware X and will eventually get locked out of newer game releases that need Y or newer.

Without the bootloader exploit the Switch would have been a similar story - firmwares up to 4.10 were hacked in much the same way the PS4 was hacked, but that has very limited usefulness. I don't think you could have decrypted Tears of the Kingdom using such an old firmware.

You can enable developer mode ($20) on the Xbox series S/X and install (UWP) emulators. The Xbox also has pluton on the die so it's a lot harder.

I've heard there are power glitching exploits (Picofly, Hwfly) for newer Switches including OLED.

i softmodded my ps4 to run pirate copies.

Stopped reading at ‘Nintendo isn’t petty enough.’

I guess you’re not involved with the fan gaming or fan content communities, whatsoever? :3

Nintendo is the textbook definition of petty with their copyright. It’s honestly brutal and disappointing. I much prefer SEGA’s strategy, even if they’re not perfect, either.

Trust me, they are ABSOLUTELY petty enough. They ruined a man’s life in part because he had the last name of “Bowser”. (Yes, I know the case is more complex, but there were bigger fish to fry and Gary was only tech support.)

The problem is, and why we’ll never see this, is because Nintendo is highly risk-averse after the Wii U, and unlike tacking a second monitor on (which is relatively cheap), building a custom architecture is expensive and raises major problems, like we saw with Sony grabbing IBM’s CELL architecture. It was amazingly powerful, but difficult to code for and rather expensive to use, which made adoption difficult for devs.

Though on the flip side, Nintendo would have much stronger first-party titles, which frankly sell most Switches anyway. I do still believe it’s unlikely due to cost though.

Oddly enough - a lot of PS3 games are running on PC pretty well, but there's no PS4 emulator despite the fact that the PS4 is x64 based.

PS3 games are running a lot better than they had been, that’s true. However the CPU needed is, last I checked, still rather beefy.

PS4 actually has some emulators as of last year. Originally it was just Spine, but now we have fpPS4, a more advanced open source Free Pascal-based emulator.

Wiki page summarizing the current state of PS4 emulation: https://emulation.gametechwiki.com/index.php/PlayStation_4_e...

ModernVintageGamer showing off fpPS4: https://www.youtube.com/watch?v=012PptHgl3s

> They ruined a man’s life in part because he had the last name of “Bowser”.

Doug Bowser could have said no to being CEO of NoA.

You'd think that. But Nintendo is incredibly petty when it comes to YouTube strikes and prosecution of people pirating 30 year old games.

Reply on news.ycombinator.com