The "unpatchable" exploit that makes every current Nintendo Switch hackable


Recommended Posts

A newly published "exploit chain" for Nvidia Tegra X1-based systems seems to describe an apparently unpatchable method for running arbitrary code on all currently available Nintendo Switch consoles.  Hardware hacker Katherine Temkin and the hacking team at ReSwitched released an extensive outline of what they're calling the Fusée Gelée coldboot vulnerability earlier today, alongside a proof-of-concept payload that can be used on the Switch.

 

"Fusée Gelée isn't a perfect, 'holy grail' exploit—though in some cases it can be pretty damned close," Temkin writes in an accompanying FAQ.

 

The exploit, as outlined, makes use of a vulnerability inherent in the Tegra X1's USB recovery mode, circumventing the lock-out operations that would usually protect the chip's crucial bootROM. By sending a bad "length" argument to an improperly coded USB control procedure at the right point, the user can force the system to "request up to 65,535 bytes per control request." That data easily overflows a crucial direct memory access (DMA) buffer in the bootROM, in turn allowing data to be copied into the protected application stack and giving the attacker the ability to run arbitrary code.

 

On the Switch, the hardest part of the exploit seems to be forcing the system into USB recovery mode. To do this without opening the system requires shorting out a certain pin on the right Joy-Con connector (the bit on the side of the system where the Joy-Con clicks into place). The hacking team at Fail0verflow tweeted a picture of a small plug-in device that can apparently provide this short-out easily, and the team joked that a simple piece of wire from the hardware store can do so today. Temkin also tweeted a picture suggesting that simply exposing and bending the pin in question would also work.

 

 

 

 

 

Full article@ Ars Technica

Hopefully this doesn't kill software releases and sales à la NDS / PSP :/ Nintendo has been working on a new SoC for a few months now though; presumably because they were notified of the exploit, so if you want one of these exploit capable Switches buy one soon.

  • 3 weeks later...

I assume this has been blown wide open now? I'm seeing entire switch rom library dumps happening on private torrent sites. Not that I've looked into what's happening as this progresses much at the moment.

  • 2 weeks later...
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • You will soon have fewer reasons to open Control Panel in Windows 11 by Taras Buria Good news: more Control Panel bits are making their way to the Settings app, giving you fewer reasons to use the legacy UI that Microsoft buried deep inside its operating system. This time, the company is migrating certain clock-related settings, giving them a more modern look in the Settings app. The upgraded Settings app now lets you enable additional clocks in the notification center and adjust AM/PM indicators. These features work the same as they do in the legacy Control Panel: you can enable up to two additional clocks for two extra time zones and name them as you wish. Thanks to the redesign, the UI for setting up additional clocks supports dark and light themes, bigger UI elements, and improved accessibility. The same goes for the AM/PM indicators: you can customize them in Settings > Time & Language > Language & Region > Regional Format. Other Control Panel bits that recently made their way to the Settings app include some keyboard settings. Microsoft has not confirmed any of those changes yet, so stand by for announcements in future preview builds. Speaking of preview builds, this week, Microsoft released a new Canary build with improved context menus, taskbar changes, new accessibility features, and more. Check out the full release notes here.
    • Everything 1.4.1.1028 by Razvan Serea "Everything" is search engine that locates files and folders by filename instantly for Windows. Unlike Windows search "Everything" initially displays every file and folder on your computer (hence the name "Everything"). You type in a search filter to limit what files and folders are displayed. "Everything" only indexes file and folder names and generally takes a few seconds to build its database. A fresh install of Windows 10 (about 120,000 files) will take about 1 second to index. 1,000,000 files will take about 1 minute. "Everything" will run on Windows XP, Vista, Windows 7, Windows 8, Windows 10 and Windows 11. NTFS indexing requires the Everything service or running "Everything" as administrator. What is the Lite version of "Everything"? The Lite version of Everything is the same as the normal multilingual version of Everything, except it has some features removed: Removed ETP/FTP Server. Removed HTTP Server. Removed IPC. The Command line interface / ES will not work with the Lite version. The SDK will not work with the Lite version. Windows accessibility features and screen readers will not work with the Lite version. Everything 1.4.1.1028 changes: fixed a crash when getting help text from a context menu item that throws an exception. updated localization. "Everything" is Freeware. If you use "Everything" in a commercial environment and find it useful a donation would be appreciated. Download: Everything 1.4.1.1028 64-bit | Portable ~1.0 MB (Freeware) Download: Everything 1.4.1.1028 32-bit | Portable Download: Lite 32-bit | Lite 64-bit View: Everything Website | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • So you just don't like the statement? That's completely different than the statement not being true. And one doesn't have to be "full of hate" to acknowledge a cow is, in fact, a cow.
    • They are trying to pretend there is demand for this crap. That it's for special, wealthy, niche customers only right now. You know, the Apple marketing model.
    • Allow all task bar elements on all monitors, allow us to move around any taskbar element. When in Desktop mode, separate the icons in the system tray area only combine them when in touch mode.
  • Recent Achievements

    • Week One Done
      BlakeBringer earned a badge
      Week One Done
    • Week One Done
      Helen Shafer earned a badge
      Week One Done
    • First Post
      emptyother earned a badge
      First Post
    • Week One Done
      Crunchy6 earned a badge
      Week One Done
    • One Month Later
      KynanSEIT earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      669
    2. 2
      ATLien_0
      273
    3. 3
      Michael Scrip
      232
    4. 4
      Steven P.
      163
    5. 5
      +FloatingFatMan
      160
  • Tell a friend

    Love Neowin? Tell a friend!