Editing Nintendo Switch (Homebrew)


== Hardware ==
Powered primarily by its Tegra X1 SoC (system on a chip), the Nintendo Switch is a midrange gaming tablet and the most powerful handheld to date released by a dedicated gaming company. The SoC uses four ARMv8 ARM Cortex-A57 cores clocked at 1GHz in Horizon (docked or handheld), but with a maximum clock of 1.9GHz based on hardware limits.

=== Tegra X1 ===
While there are three major revisions to the Tegra X1, there are no performance differences employed by Nintendo in practice.

====== Erista (T210) | Nintendo Switch (2017 / 2019) ======
This is the only model of the Tegra X1 vulnerable to CVE-2018-6242 (PDF) ("fusee-gelee | ShofEL2").

The Tegra T210 is the original model of the processor, released in 2015 by Nvidia and used in the original 2017 model of the Nintendo Switch. This SoC is codenamed Erista, and has drastically higher power draw compared to the Tegra T214.

In mid-2019, Nintendo began shipping units with a modified bootrom IRAM patch (ipatch) written at the factory, effectively mitigating CVE-2018-6242, and largely patching out the main entrypoint for custom firmware access. These, alongside Mariko units, are commonly referred to as "patched units".

===== Mariko (T214) | Nintendo Switch 2019 / Switch Lite =====
This revision introduced in 2019 with the HAC-001(-01) and Nintendo Switch Lite (HDH-001). Every console manufactured after mid-2019 is a Mariko unit.

It uses nearly half of the wattage as the original console to run its games, thereby producing less heat and providing a longer battery life as a result.

Also known as the T210B01 revision, the T214 is capable of hitting higher clock frequencies without thermal throttling, and therefore can effectively serve as a more powerful SoC, if Nintendo ever chose to go this route.

The bootROM has undergone a full rewrite, so CVE-2018-6242 is no longer present in any capacity and cannot be reintroduced in any form. By definition, these are also patched units, but the community often explicitly refers to them as Mariko units to differentiate from patched Erista units.

== HorizonNX ==
HorizonNX (hereby referred to as HOS) is a heavy rewrite and reimagining of the Nintendo 3DS operating system of the same name. Synonymous system calls and design concepts are present and, given the timeframe the OS was developed in (early 2015 to early 2017), explains the method Nintendo used to push out a fully-functional OS this quickly.

=== Custom firmwares ===

===== AtmosphèreNX =====
AtmosphèreNX, (stylised as atmosphère), is the main custom firmware for Nintendo Switch, developed primarily by SciresM of the ReSwitched team. The name is a allusion; as Horizon names the operating system, the atmosphere rests just above it, referencing how atmosphère runs on top of HorizonNX.

===== ReiNX =====
A deprecated fork of atmosphère, ReiNX generally does not offer exclusive features over atmosphère itself, and has not been updated since May of 2020.

===== SXOS =====
A commercial fork of atmosphère, SXOS is primarily developed for game piracy groups on the Nintendo Switch.

SX OS is illegal to manufacture, purchase, or own in the US due to multiple violations of copyright law, specifically due to hardcoding Nintendo's firmware decryption keys in their software (in an attempt to avoid showing atmosphère branding during sept, and also due to failure to release source code, in violation of atmosphère's GPLv2 license, which requires derivative works to disclose its full source code to the public.

Similarly has not been updated in ages after a litigation attempt by Nintendo.

=== Exploits ===
Several writeups and conferences have been created in regard to the Switch console's reverse-engineering efforts.

==== Hardware ====
Hardware exploits exist either due to physical exploits with the console components, or within software burned into read-only/write-once portions of the console; e.g, the bootROM. Hardware exploits can never be patched out without physical access to the console (and by replacing said console's hardware).

===== Fusee Gelee =====
"Fusee gelee" translates to "frozen rocket" from French, referencing the coldboot nature of the exploit.

This is an unpatchable, tethered bootROM exploit, which takes advantage of the Switch console's boot and power management chip (BPMP), and is leveraged by copying a payload into executable portion of memory (jokingly referred to as a memecpy by members involved in its development).

There is approximately thirty to forty million consoles sold which are vulnerable to this, and these consoles will become a rarity as time passes on.

This exploit requires physical access to the console's USB-C port, injecting a custom payload after entering a compromised recovery mode (RCM). RCM is a factory mode intended for maintenance and repair of damaged consoles, or initial factory setup of devices. Fusee gelee effectively bypasses verification for signed payloads and allows an attacker to bypass every single technological protection measure present on the console at boottime with minimal external hardware.

Technical writeup presented to Nvidia (PDF)

Nintendo Homebrew's custom firmware guide - AtmosphèreNX

===== Jamais Vu =====
Jamais Vu

==== Software ====

===== General =====
The console's current version of its operating system does not seem to contain noteworthy bugs that can lead to homebrew or custom firmware. Previous versions of Horizon were vulnerable to a limited number of flaws, none of which enabled TrustZone access purely due to security issues from Nintendo's fault. Every known entrypoint (which grants full system access) is the result of a flaw originating with Nvidia.

34C3

== Trivia ==

* Nintendo Switch's BPMP is the ARM7TDMI, also known as the processor that powered the Game Boy Advance and Nintendo DS family.
* The Nintendo Switch name was finalised in 2014, two years before the console's name was revealed in October 2016.
* Nintendo was aware of the ramifications and the existence of an RCM-based exploit well before the console released in 2017, however, it's unclear which RCM-based exploit that they are referencing.
* The Nintendo Switch OS is a major rewrite of the Nintendo 3DS operating system of the same name.

== Troubleshooting ==

=== Software ===

* Nintendo Switch does not boot past Nintendo Switch logo! One of these things are likely busted: PRODINFO, your USER partition, your SYSTEM partition, your partition table is messed up. If you run atmosphere, a rogue sysmodule or corrupt microSD may also be to blame.
* Nintendo Switch does not boot past Nintendo logo! You may have corrupted one of the boot stage slots. Restore a BCPKG2 backup.

=== Hardware ===

* Nintendo Switch does not boot past Nintendo Switch logo, does not display on the dock, or does not charge! It is highly likely that the M92T36 chip has been blown out by overvoltage, or a physical short. Common causes are using an uncertified USB-A to USB-C cable to charge the unit, or using a third party dock. Third party AC adapters which don't utilise USB also can cause this. Your Switch will likely need to have the M92T36 replaced.
* Screen shows ink-like blotches that obstruct gameplay! Replace the screen. Duh.
* Nintendo Switch emits a grinding or sawing noise when pressed together! This is the fan scraping against the console's metal backplate. Please do not press the console together.
* Nintendo Switch turns off abruptly, even with remaining battery! The battery may be decalibrated. This can happen to any device with a battery. This occurs when the battery percentage is not synchronised with the physical amount of remaining power. This can be solved by charging the device for double the amount of time it normally takes to reach 100%, and draining it down to zero before fully charging it again. The battery is now calibrated.
* Nintendo Switch does not turn on! Is the unit in RCM? Is the unit fully charged? Have you a modchip installed? If so, check the FAQ of the RCMX86 install guide.
* Nintendo Switch does not enter RCM! 　All consoles can enter RCM, regardless of whether or not you're able to exploit RCM itself. If the console cannot enter RCM, it is never the fault of software. Instead, a dirty or defective bridging device ("jig"), a dirty or defective console-side slot, or torn ribbon cables will always be the culprit, if the user is following the correct steps to enter RCM (VOL+, Power, Home).