pages bg right
Posted by Scene News on Jul 29, 2018

Team Xecuter versus the "unhackable" Switch

Dear fans, we hope you're all enjoying your weekend!

Recently, it has come to our attention there's a new revision of the Nintendo Switch in the wild which is incompatible with our SX Pro product. This isn't simply an incompatibility with SX Pro but rather appeared to be a fix of the infamous "USB RCM" exploit.

Naturally, we had to locate one of these new Switch units to get to the bottom of this. Our new Switch unit arrived to us at firmware version 5.1.0 and what we found out is the following (sorry, time to get a bit technical):

One of the IPATCH entries in the fuse set (entry #3) has been replaced with a new patch. The old patch patches the bootrom location 0x10fb3c with the value "00 20" (mov r0, #0 in thumb), and the new patch patches the bootrom location 0x10769a with the value "00 21" (mov r1, #0 in thumb). This new patch effectively zeroes out the upper-byte of the wLength field in the USB RCM endpoint 0 handling code.

Those who are paying attention probably wonder how we know the exact details of this IPATCH entry change, since we can't read out the fuses without our precious USB RCM exploit, right? It is a classic chicken and egg problem.

The answer is obvious: There is more than one coldboot bootrom exploit, and it is not just the warmboot one.

So don't fear: we will deliver a solution for these new "unhackable" switches in due time!

Thank you for attention.

— Team-Xecuter – Rocking the Switch in 2018 and beyond! —