Nintendo Switch (Homebrew)

The Nintendo Switch is home to a vast homebrew community which has propagated from before the console launch date in 2017. In this time, there have been major technical strives and discoveries that span many devices outside of the Nintendo console itself. One of the most in-depth reverse engineering projects within console hacking is the Atmosphère project, which reimplements Horizon(NX), the operating system of the console.

Atmosphère reimplements many aspects of the original system software as open source software; a step which allows for much more customisability than bytecode patches that are executed at runtime that merely modify existing system modules like most other custom firmwares.

Atmosphère, specifically, has not been on record to cause a single Nintendo network ban to date. This is corroborated by this spreadsheet, developer testing, and feedback from banned users, which invariably pinpoint a catalyst stemming from user error, where the user has partaken an action that is known to be bannable. Custom firmware is not equivalent to piracy; only the participation of the latter has been acted upon by Nintendo, historically.

Using custom firmware on the Nintendo Switch is considered safe, as long as certain actions are avoided. Contrary to popular rhetoric, Nintendo has shown a distinct tolerance to homebrew users and seems to actively allow their presence, as they are able to detect any console running a custom firmware. Nintendo chooses to ban only specific bad actors such as pirates and online cheaters. While this can change at any time, this behaviour has remained true to this day.

These actions, for the most part, are disruptive to Nintendo's online infrastructure or sales strategy, and are generally actions that go outside of the scope of legitimate custom firmware usage. These actions also setting a custom avatar, which have been the subject of controversy due to adult content being uploaded by CFW users in the past, and eShop financial fraud, which constitutes a Nintendo Account ban entirely, forfeiting any digital collections held by the account. However, Nintendo account integrity is not a concern for console bans stemming solely via CFW.

If you enjoy not being banned, follow these guidelines.

Shown to the right is a general community guideline post, further defining what is or isn't safe with the functionalities granted by custom firmware.

Contrary to popular rhetoric, Nintendo has not and cannot knowingly brick a console of any type due to the presence of unauthorised software. This has never happened in the past, despite any ignorant press and website reportings. However, they are fully within their rights to restrict the console from online functionality, and this is clearly defined in any end-user license agreement. In addition, Nintendo is not responsible for incompatibilities caused by a system update, such as Atmosphère and Hekate failing to boot after a package1loader update. This is due to the nature of homebrew and not indicative of ill action from Nintendo.

For example, I have primarily used custom firmware while online on every Switch unit I've had since 2019, without any issues following these guidelines. None of my consoles have been banned.

A guide for custom firmware installation can be found here.

My setup

Sysmodules

There are a few modules that change and enhance the functionality of the Switch. I consider them to be essential in basic usage of the console.

An example of SwitchPresence-Rewritten.

sys-ftpd-light - FTP server running at all times, allowing remote access to the microSD's files. Can be toggled on or off via controller inputs and starts alongside the console. Access to the FTP server can be restricted via user-defined credentials defined in a configuration file on the microSD card.

DVR-Patches - Technically a compatibility patch for Sys-DVR to run under almost all games, but has the side effect of allowing video recording under almost any title.

Tesla-Menu - Overlay menu allowing the use of cheats and advanced sysmodules in real-time, alongside currently running software. Overlays are distributed via .ovl files and installable in /switch.

Tesla Menu requires the nx-ovlloader to be installed alongside it.

sys-screenuploader - System module which uploads all screenshots taken by the Switch to a remote server in real time. This can be configured to be sent to a local folder on your PC, onto a Discord channel on Discord, or a self-hosted server with these software examples.

Mission Control - Allows most common third-party controllers, like the DualSense, to function natively within the Switch's OS via Bluetooth connection. The wired counterpart to this software is sys-con.

ReverseNX-RT - Allows the Nintendo Switch to run software in handheld or docked mode on-demand, regardless of the physical location of the console. This is useful to achieve higher graphical fidelity in handheld mode alongside sys-clk in handheld mode. This is best done using Mariko hardware, which is more power efficient.

SwitchPresence-Rewritten - Allows the Nintendo Switch to report the currently running title to Discord automagically, via a client running on a PC on the same network.

Homebrew Software

I use Homebrew Details 0.95[1] as my primary homebrew browser. I plan to patch it to allow touchscreen input, as this layout and design is unrivaled. Unfortunately, even compared to its 1.0 release.

The title I use to serve as the homebrew browser via title takeover is Rogue Bit - this way, I can simply launch Rogue Bit straight from the HOME Menu to get into a fully escalated homebrew launcher. Since it is a game based around hacking, it is a fitting icon.

Custom firmwares

Atmosphère

Atmosphère is the main custom firmware for Nintendo Switch, developed primarily by SciresM of the ReSwitched team. The name is a allusion; Atmosphère runs on top of Horizon, referencing how the atmosphere rests on top of the horizon. Its current release is 1.4.1.

ReiNX

A deprecated fork of Atmosphère, ReiNX generally does not offer exclusive features over Atmosphère itself, and has not been updated since May of 2020.

SXOS

A commercial fork of Atmosphère, SXOS is primarily developed for game piracy groups on the Nintendo Switch.

SX OS software and its modchips (which are bundled with SX OS) are illegal to manufacture, purchase, or own in the US due to multiple violations of copyright law, not limited to actions such as hardcoding Nintendo's firmware decryption keys in their software (in an attempt to avoid showing Atmosphère branding during sept, advertising and directly supporting piracy groups by supplying pirated software, and also due to failure to release source code, in violation of Atmosphère's GPLv2 license, which requires derivative works to disclose its full source code to the public.

Like ReiNX, SX OS has not been updated in years after a successful litigation attempt by Nintendo and the FBI, where the team was labelled as a piracy group due to directly supplementing piracy repositories within its custom firmware. Due to this, SX OS cannot even boot any recent HorizonNX releases.

Exploits

Several writeups and conferences have been created in regard to the Switch console's reverse-engineering efforts.

Hardware

Hardware exploits exist either due to physical exploits with the console components, or within software burned into read-only/write-once portions of the console; e.g, the bootROM. Hardware exploits can never be patched out without physical access to the console (and by replacing said console's hardware).

There is external hardware that can be used alongside fusee, including dongles such as the DragonInjector.

A late-stage production of a DragonInjector.

DragonInjector

DragonInjector, or DI for short, was a small dongle for the Nintendo Switch designed to fit inside the card slot. On July 13, 2020, it was pursued by Nintendo primarily on a Canadian copyright infringement[2].

Fusee Gelee

Fusee gelee translates to "frozen rocket" from French, referencing the coldboot nature of the exploit.

This is an unpatchable, tethered bootROM exploit, which takes advantage of the Switch console's boot and power management chip (BPMP), and is leveraged by copying a payload into executable portion of memory (jokingly referred to as a memecpy by members involved in its development).

Approximately thirty to forty million consoles are vulnerable to this. These consoles will become a rarity as time passes on.

This exploit requires physical access to the console's USB-C port, injecting a custom payload after entering a compromised recovery mode (RCM). RCM is a factory mode intended for maintenance and repair of damaged consoles, or initial factory setup of devices. Fusee gelee effectively bypasses verification for signed payloads and allows an attacker to bypass every single technological protection measure present on the console at boottime with minimal external hardware.

Technical writeup presented to Nvidia (PDF)

Nintendo Homebrew's custom firmware guide for Atmosphère

Fusee-gelee can be leveraged into an untethered coldboot exploit by wiring a Trinket M0-based board with specialised software onto the USB lanes on the Switch mainboard. The Trinket will then be able to automatically inject a self-contained payload as soon as an APX device is detected.

Software

General

The console's current version of its operating system does not seem to contain noteworthy bugs that can lead to homebrew or custom firmware. Previous versions of Horizon were vulnerable to a limited number of flaws, none of which enabled TrustZone access purely due to security issues from Nintendo's fault. Every known entrypoint (which grants full system access) is the result of a flaw originating with Nvidia. This includes hardware flaws that are initiated via software, such as...

Jamais Vu

Jamais Vu translates to "never seen". This is a warmboot TrustZone exploit for a prerelease version of Horizon. Namely, version 1.0, which became outdated on the day the Nintendo Switch launched. More information can be found on SciresM's announcement post.

Caffeine

A bootROM warmboot exploit implementation for the Nintendo Switch currently for consoles running 2.0 up to 4.1.0, based off of Deja Vu. This exploit was fixed in firmware 8.0.

34C3

My contributions

Restoring Balrog's iconic line

Intending to settle down after participating in the Nintendo 3DS homebrew community, I have ended up developing a small number of mods for the Nintendo Switch.

The largest one is the restoration of the Aeon Genesis translation of Cave Story to the official port of Cave Story+ on the Switch. As Cave Story was originally a Japanese exclusive game, a number of community translations of the game have appeared, before it was officially published by Nicalis in 2010. The Aeon Genesis translation is one of them. This was done to combine the improved visuals and extra modes of Cave Story+ with a different interpretation of the story and its characters. It was published on 10/20/2020 as a customary habit to have releases and actions historically linked to rare days on the Gregorian calendar. For example, 10/20/2020 was the last day in the current millennium to repeat the number 20 at least three times.

After developing this patch and witnessing how flexible Cave Story's scripting engine is, I plan to eventually create a simple game using it.

The Aeon Genesis translation patch for Cave Story+ is available to download.

Much easier on the eyes

I also have created a small number of mods for Super Smash Bros. Ultimate, a game with a heavy and well-known modding community. This Super Smash Bros. Melee-inspired Victory screen was created as a desire to rid the game of the personally distracting flash that occurs on freeze-frames of a victor's celebration animation. I eventually intend to privately research into what is needed to manipulate other UI assets in the game.

These themes were published. I kinda intended to just make them for myself.

I also help with maintaining this Nintendo Switch custom firmware setup guide.

Trivia

• Nintendo Switch's BPMP is the ARM7TDMI, also known as the processor that powered the Game Boy Advance and the hardware mapper of the Nintendo DS family.
• Nintendo was aware of the ramifications of an RCM-based exploit well before the console released in 2017, however, it's unclear which RCM-based exploit that they are referencing.
• The Nintendo Switch OS is a major rewrite of the Nintendo 3DS operating system of the same name.

First Usage Guides / Frequent Questions

What is Atmosphère?

Atmosphère is the custom firmware that you're using on your console. Custom firmware handles all of the invisible patches that you use once you boot into the main Switch menus; it's the software that makes modding your Switch "useful".

CFW has no visible menu, and there is no visible difference between a console simply using CFW and one using original firmware (OFW), unless you take advantage of the features in CFW to modify the appearance and functionality of your console.

What is Hekate?

Before the console turns on, there is (normally) invisible software that handles the startup of the console. This applies to most electronic devices. This invisible software software is called the bootloader, and it handles the preparation of the device. When you hacked the Switch, you also gave it a custom bootloader menu named Hekate ("heh-KAH-tay"). This software serves to add flexibility to how the Nintendo Switch starts up, and provides an interface for you to select different payloads/OSes to launch upon startup, including OSes like Android and Linux.

What is Horizon?

Horizon is the Switch's native OS. Atmosphère applies customisations to this OS, and fully replaces some parts of it behind the scenes, even if you can't see those replacements.

Software

• Nintendo Switch does not boot past Nintendo Switch logo! One of these things are likely busted: PRODINFO, your USER partition, your SYSTEM partition, your partition table is messed up. If you run Atmosphère, a rogue sysmodule or corrupt microSD may also be to blame.
• Nintendo Switch does not boot past Nintendo logo! You may have corrupted one of the boot stage slots. Restore a BCPKG2 backup.
• After injecting a payload and booting, an error about an unknown package1 version appears! Your homebrew software does not support the Horizon firmware you are trying to run. Update your homebrew, or wait for a new release.
• My homebrew software has a NOFAT error message! Your microSD is corrupt. Reformat it, or obtain a new card.

Hardware

• Nintendo Switch does not boot past Nintendo Switch logo, does not display on the dock, or does not charge! It is highly likely that the M92T36 chip has been blown out by overvoltage, or a physical short. Common causes are using an uncertified USB-A to USB-C cable to charge the unit, or using a third party dock. Third party AC adapters which don't utilise USB also can cause this. Your Switch will likely need to have the M92T36 replaced. A blown BQ24193 may also be the culprit.
• Screen shows ink-like blotches that obstruct gameplay! Replace the screen. Duh.
• Nintendo Switch emits a grinding or sawing noise when pressed together! This is the fan scraping against the console's metal backplate. Please do not press the console together.
• Nintendo Switch turns off abruptly, even with remaining battery! The battery may be decalibrated. This can happen to any device with a battery. This occurs when the battery percentage is not synchronised with the physical amount of remaining power. This can be solved by charging the device for double the amount of time it normally takes to reach 100%, and draining it down to zero before fully charging it again. The battery is now calibrated.
• Nintendo Switch does not turn on! Is the unit in RCM? Is the unit fully charged? Have you a modchip installed? If so, check the FAQ of the RCMX86 install guide.
• Nintendo Switch does not enter RCM! All consoles can enter RCM, regardless of whether or not you're able to exploit RCM itself. If the console cannot enter RCM, it is never the fault of software. Instead, a dirty or defective bridging device ("jig"), a dirty or defective console-side slot, or torn ribbon cables will always be the culprit, if the user is following the correct steps to enter RCM (VOL+, Power, Home).