shadACII schrieb:
Aber nur auf den ersten 2017 Switches und welche mit Firmware bis 4.0.
Alles danach braucht einen Modchip.
Da die Switch 2 Firmware auf der Originalen aufbaut und diese bis heute nicht geöffnet wurde, ist ein kurzfristiges CFW sehr unwahrscheinlich.
Yeah, no shit
Now for anyone interested as to why, sit back.
So, something to get out of the way is that to this day, outside of early firmwares, switch 1 has ZERO exploitable kernel bugs. Entry points sure, but none that get you anything close to an actual CFW. So then, how do people keep hacking it to this day? Because Nvidia royally screwed up.
The first switch models as you may recall were memed to the end of time because a paper clip could mod them. In actuality though, that entry point was intended and in fact is used by Nintendo and Nvidia when they service switch consoles. The Tegra X1 has a recovery mode which has the purpose of as the name implies, being used to recover or more commonly flash devices. Ideally, that would be its only use, but hackers discovered two things. Firstly, recovery mode never verifies how large the payload being sent is, leading to an overflow. And 2nd, memory is never cleared. The recovery mode (or RCM) exploit essentially allowed for full access to the system at the highest level, before any of Nintendo's code even started running, or even before the CPU started up. It all ran on the boot and power management processor inside the TX1. Nintendo caught wind of this around late 2017, and quickly patched it out with a new run of processors. Eventually, the revised TX1+ chip used a different USB stack entirely, so this was out of the table. RCM won't be repeated on switch 2.
The next method, and the most powerful one, is instead, voltage glitching. The idea is simple, cause a voltage drop across the CPU so that it skips instructions. With the correct timing, you can get it to skip something crucial, such as verifying signatures. This is important as signature checks are what allows software to be verified as legitimate, IE, by Nintendo. So, the modchip constantly halts the CPU, injects it's own boot code, and then as signature verification occurs, it causes a voltage drop. This skips the check, and let's the same chain of events that made RCM so powerful occur. I mention all that to say, that with T239, Nintendo and Nvidia went to great lengths in order to prevent both of these from happening.
As mentioned before, software hacks are very unlikely, especially since NS2 is using the exact same kernel and firmware as NS1. RCM is irrelevant as the bug doesn't even exist on T239. The next obvious avenue would be voltage glitching, but there are 2 big issues with this. The biggest of which and arguably the biggest roadblock, is something known as dual core lockstep. Essentially this means that the system is designed in a way where 2 processor cores will preform the exact same instructions, the results of those will then be sent off to a comparitor. It's job it to make sure the both instructions match, and if they don't, the chip knows something is wrong and locks everything out. For a modchip to bypass this, it would need to glitch everything at the exact same time with perfect timing to make sure no alarms are sounded anywhere. That alone would require a fairly complex modchip without high success rates, but the next step is that the boot and power management processor inside NS2 is entirely untrusted. No longer is it the highest level of execution, instead anything you even manage to do on BPMP is null and void because you won't be able to initialize the rest of the hardware, like for example, the CPU or GPU. You could maybe dump keys, but that wouldn't do much.
That leaves us with two other glitching avenues, NVRISCV, Nvidias custom security processor which is almost entirely undocumented. The other avenue, is trying to somehow glitch CCPLEX. CCPLEX is basically just the CPU cores, however anything of note there would get blocked by firmware updates in theory. Glitching NVRISCV would be beyond needle in a haystack, because its a piece of silicon designed to not be glitched and to be as big of a black box as possible. As much as I wish there was some kind of silver bullet to NS2's security, the true answer is that it is probably going to be something that makes the 360 hypervisor look like a joke in terms of security.
TL;DR: Warte nicht drauf. Für die OG Switch gibt es bis heute (!) nur einen Exploit für Firmware bis 4.0.
https://www.reddit.com/r/nintendo/s/jWHsEXh8qG
Ja ich weiß es gibt einen Userland Exploit, dieser bringt uns aktuell aber noch nichts.
Siehe hier:
). Was soll ich sagen, 2 Mediamarkt-Besuche später haben wir dann doch noch eine ergattert.
