News for hackers. Stuff that matters.

A comment on How the Nintendo Switch prevents downgrades by irreparably blowing its own fuses.

Re:How the Nintendo Switch prevents downgrades by irreparabl... by hd4 on Tuesday June 16, 2020 @03:29AM (#23536758)
There is an easy workaround developed by the Switch homebrew community, simply upgrade from within a custom firmware (such as Atmosphere-NX) and run a tool called ChoiDuJourNX which bypasses the fuse-burning.

If you're careful you can keep a backup trail going all the way back to your original device firmware and restore/downgrade it using the Hekate system tool. It has already been pointed out that there isn't much reason to do this, AFAIK the main reason people either held out on older firmwares or kept up a backup trail to them was in order to take advantage of possible firmware-version-specific exploits, the gold standard being a coldboot exploit.

[ Parent | on HN ]
Re:How the Nintendo Switch prevents downgrades by irreparabl... by roblabla on Tuesday June 16, 2020 @08:13AM (#23538182)
The reason this "easy workaround" works at all is that there is a BootROM exploit that trivially allows running arbitrary code in the BootROM. This allows us to run our own bootloader instead of Nintendo's, bypassing their fuse burning logic. Had Nvidia not fucked up their USB implementation (along with other part of their platform), this would have been harder to bypass.

[0]: https://www.reddit.com/r/SwitchHacks/comments/7rq0cu/jamais_...

[ Parent | on HN ]
Re:How the Nintendo Switch prevents downgrades by irreparabl... by artsyca on Tuesday June 16, 2020 @08:27AM (#23538293)
I don't want to sound like I'm pontificating or defecating on the corporacy at everyone's favorite hardware company but it strikes me that these sorts of lapses are cultural and stem from this tedious emphasis everyone places on having "relaxed working environments"[0]

Does it surprise you that the product of this culture also has relaxed security characteristics?

[0] https://www.nvidia.com/en-us/about-nvidia/culture-at-nvidia/

[ Parent | on HN ]
Re:How the Nintendo Switch prevents downgrades by irreparabl... by nemothekid on Tuesday June 16, 2020 @10:51AM (#23539780)
Ah yes, compared to every other company that has never had an exploit ever.
[ Parent | on HN ]
Re:How the Nintendo Switch prevents downgrades by irreparabl... by monsieurbanana on Tuesday June 16, 2020 @09:13AM (#23538740)
Thank you for making me laugh in these trying times.
[ Parent | on HN ]
Re:How the Nintendo Switch prevents downgrades by irreparabl... by artsyca on Tuesday June 16, 2020 @05:28PM (#23544417)
I gotta keep it real for you sir banana, the only way to have a legit conversation on this platform is to have an equal number of up and downvotes.
[ Parent | on HN ]
Re:How the Nintendo Switch prevents downgrades by irreparabl... by heavenlyblue on Tuesday June 16, 2020 @01:46PM (#23541905)
Does anyone even like Nvidia?
[ Parent | on HN ]
Re:How the Nintendo Switch prevents downgrades by irreparabl... by knolax on Tuesday June 16, 2020 @04:42PM (#23543833)
"Fuck Nvidia" ---Linus Torvalds
[ Parent | on HN ]
Re:How the Nintendo Switch prevents downgrades by irreparabl... by rekoil on Tuesday June 16, 2020 @06:10AM (#23537455)
And for those who stayed on the 4.1.0 fuseset (or certain versions below that) there are warmboot exploits available. So those who are able to "normally" boot those firmwares do not need to use AutoRCM (or an RCM-"jig") to access RCM anymore.
[ Parent | on HN ]
Re:How the Nintendo Switch prevents downgrades by irreparabl... by hd4 on Tuesday June 16, 2020 @07:17AM (#23537795)
While this is true, I was essentially saying that you don't have to remain on an older firmware as long as you're careful about how you move around between versions. I'm on 10.0 but I could go back to 3.1.0 anytime, and then move somewhere in between those versions if we got a coldboot exploit for example (which according to notable members of the Switch homebrew community is not likely).
[ Parent | on HN ]
Re:How the Nintendo Switch prevents downgrades by irreparabl... by rekoil on Tuesday June 16, 2020 @07:58AM (#23538094)
Yeah, sure, you can ignore the fuses, but only if you assist the boot process using a jig and an injected payload. The stock Horizon kernel from FW 10.3 won't boot if your fuseset is for 3.1.0, unless you inject a chainloader which fakes the fuseset or removes the check.

Edit: I see what you were referring to, I was unspecific in my comment, updated it!

[ Parent | on HN ]