Editing Nintendo Switch (Homebrew) (section)

=== Hardware ===
Hardware exploits exist either due to physical exploits with the console components, or within software burned into read-only/write-once portions of the console; e.g, the bootROM. Hardware exploits can never be patched out without physical access to the console (and by replacing said console's hardware).

There is external hardware that can be used alongside fusee, including dongles such as the DragonInjector.
[[File:20200831 151501.jpg|thumb|A late-stage production of a DragonInjector.]]

====== DragonInjector ======
DragonInjector, or DI for short, was a small dongle for the Nintendo Switch designed to fit inside the card slot. On July 13, 2020, it was pursued by Nintendo primarily on a Canadian copyright infringement[https://wiki.halcove.com/files/CD.pdf].

===== Fusee Gelee =====
''Fusee gelee'' translates to "frozen rocket" from French, referencing the coldboot nature of the exploit.

This is an unpatchable, tethered bootROM exploit, which takes advantage of the Switch console's boot and power management chip (BPMP), and is leveraged by copying a payload into executable portion of memory (jokingly referred to as a memecpy by members involved in its development).

Approximately thirty to forty million consoles are vulnerable to this. These consoles will become a rarity as time passes on.

This exploit requires physical access to the console's USB-C port, injecting a custom payload after entering a compromised recovery mode (RCM). RCM is a factory mode intended for maintenance and repair of damaged consoles, or initial factory setup of devices. Fusee gelee effectively bypasses verification for signed payloads and allows an attacker to bypass every single technological protection measure present on the console at boottime with minimal external hardware.

[https://wiki.halcove.com/files/fusee_gelee_nvidia.pdf Technical writeup presented to Nvidia (PDF)]

[https://switchgui.de Nintendo Homebrew's custom firmware guide for Atmosphère]

Fusee-gelee can be leveraged into an untethered coldboot exploit by wiring a Trinket M0-based board with specialised software onto the USB lanes on the Switch mainboard. The Trinket will then be able to automatically inject a self-contained payload as soon as an APX device is detected.