Team Rebug showcases Nintendo Switch modchip
Hacker evilsperm of team rebug fame has been sharing a few screenshots and videos of a modchip for the Nintendo switch. The device will let you boot into RCM mode as well as run payloads without the use of an external dongle. This can be a more elegant solution for those of us willing to solder a few wires. This is not using a new hack, rather another way to leverage the Tegra exploit that was disclosed a while ago.
The hacker had been tweeting about his progress for a few months now, posting blueprints and other screenshots of the work in progress. The final result can be seen in the screenshot below. A tiny board that fits inside the Nintendo Switch (that’s the blue PCB with a handful of red wires).
It’s not sure if many users will want to open their switch to solder these wires, compared to the simple techniques that exist today leveraging the “shortcut” of the joycon, but it’s always nice to see some open hardware mods out there. In particular, this will let people send payloads and hack the Nintendo switch without the need for a computer, phone, or external dongle.
Evilsperm has not given a “preorder” date yet, but said an announcement on that topic will come soon.
@i8br @MaxConsoleTweet @qlutoo @naehrwert @hexkyz @frwololo Seeing Videos are just better, here you go 😛 Nintendo Switch Mod Chip 4 wire install (just showing off without auto rcm) 3 Clicks and its off to OZ 🙂
Huge thanx to everyone involved in the Switch Scene! pic.twitter.com/zWC3uEOwrT
— evilsperm (@Aboshi2011) July 17, 2018
Source: evilsperm
Is this for real? Seems a waste when a 10$ trinket M0 does the same thing and is already out and available. Fitted one myself.
This is technically less work and far more elegant. Uses less power, too. plenty of things do “the same thing” but most still offer different advantages and disadvantages
Less power ? Trinket turns off when when switch it’s turned off essentially a cold boot. Trinket goes to sleep after injecting the payload so uses very little power in standby essentially making this a cold boot solution it’s avail right now and flash files easily available.
This is less work than the trinket M0.
No it’s not less work, even uses the same wiring.
yet another paid chip… what happened the releasing atmosphere
Drama, drama and more drama. It’s probably MIA for awhile if not RIP. Also it would still need a jib to boot into RCM anyway.
there is free CFW for earlier firmwares, if you dont wanna pay 60$ to support modder then do it yourself.
Isn’t it typical to have a “paid” solution before a free solution comes available? PlayStation and Saturn both had modchips but they also had a “free” method (wether it be disk swapping or using readily available hardware that you may or may not own already), PlayStation 2 and Xbox both had modchips as well as free methods (again, using readily available hardware that you may or may not own already). PlayStation 3 had a dongle that cost money before CFW was released. Xbox 360 was a bit complicated due to the number of revisions the system went thru. All dependent on motherboard, DVD-ROM and Dashboard versions. Early systems were VERY easy and as long as you had a SATA connection on your computer, flashing DVD-ROM was free….later revisions required you to drill into it and risk breaking it. PSP used to require you to purchase certain games, until it became a matter of just flashing it for free. 3DS used to require you to buy an $80 GateWay card (2x the cost of a retail 3DS game), now it’s free. See a pattern here? MOST the time it cost money to play backups but eventually a free method comes along either just by running a program or by using something you may or may not already own.
Rebug has been working on and releasing CFW for the PS3 for free for going on a decade. This is the best solution for the Switch currently, and presumably will function like autoRCM and TX OS all in one, booting directly into cfw.
This isn’t a chip that boots you into its own custom firmware. It still needs a custom firmware like atmosphere, this just gives you another way to boot into it without needing to send payloads from a PC. It also says that it is using an early version of atmosphere.
What a stupid comment.
it looks easy to build enough. probably a simple AVR.
I have been a little behind on switch news, is it still the case that on each reboot you need to re load a cfw? And if so, while in an “unhacked” state, is it possible to go online? Or is it very much still traceable etc and likely to cause ban?
I wonder if someone will come up with a “duel nand” style solution so you can have the best of both worlds
Yes, in general, it still needs to be applied every reboot. There is “autoRCM” which forces your Switch to boot into RCM mode without shorting pins… But it still requires that you connect the USB port to some external device to send the payload.
As for you second question, it stands to reason that there is always a risk. Until the NAND is completely separate, logs or telling signs will remain from using unauthorized firmware, and as soon as you connect online you run the risk of that info being sent to Nintendo. In practice, it is hard to say if Nintendo is going to ban people in this situation, as it seems like most/everyone who has been banned so far went online while in the unauthorized firmware OR they have made some permanent change from within CFW (i.e. deleted logs, which is only possible if you have used unauthorized firmware – hence, insta-ban.) Simply running homebrew is far less likely to trigger red flags, but I could hardly say it’s “safe” either.
Thanks Cupcakes for these details,
I was wondering if a console with soldered pins could connect to the eshop. It appears so, as long as you run the OFW and didn’t mess too much with your data while using atmosphere.
Nintendo can still track your application history if you go online even after you load official firmware again. If you use homebrew, they could see it this way and still ban.
Thanks !
Well, so long online purchases…
I’m glad my switch backlog is waaaaay lighter than my VITA’s.
Ha, I forgot, VITA has no games. Silly me.
maybe someone adapt the code for arduino mini ( chip seems equvalent)
The chip these use is an ATSAMD21, an atmel variant of the arm cortex m0+, which is way more powerful than the pro mini’s which use the atmega328p. Not too sure what are the requirements for a microprocessor to be used to hack the switch but I am assuming full speed native hardware based usb host capability (or it may be possible to bit bang it) is necessary which the 328p lacks. It looks like the modchip puts the SOC into dfu mode and sends the firmware payload over usb.
Needs to have USB host function, if the mini does then it will work.
I’ve got a working product but different to the one in the photo