Skip to main content
Notes by Peter Galonza(Пётр Галонза)
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  1. Hi, it’s my notes
  2. /
  3. Game consoles
  4. /
  5. Nintendo Switch

Nintendo Switch

  • RCM - Recovery Mode allows Nintendo to send the switch commands. GitHub
  • sysNand/sysMMC - system NAND, Nintendo Switch internal memory storage.
  • emuNAND/emuMMC - emulated NAND. emulating Nintendo Switch “internal memory storage” which contain OS and everything else into a MicroSD card.
  • amiibo - interactive figures and cards that work with your games.
  • Dongle - method to enter in RCM. (Do not need for Chip Mod)
  • ninfs - FUSE filesystem Python scripts. GitHub
  • nxdumptool - Generates XCI/NSP/HFS0/ExeFS/RomFS/Certificate/Ticket dumps gamecards and installed SD/eMMC titles. GitHub

Overlays

  • sys-clk - overclocking/underclocking system module. GitHub
  • Ultrahand-Overlay - fully craft-able overlay executor.GitHub
  • Uberhand-Overlay(fork Ultrahand-Overlay) - fully craft-able overlay executor. GitHub
  • SaltyNX - background process for file/code modification. GitHub
  • Status-Monitor-Overlay - Monitor many stats of hardware. GitHub
  • QuickNTP - Tesla plugin to sync time with NTP servers. GitHub
  • sys-ftpd - FTP server as a background service (sysmodule). GitHub
  • ReverseNX-RT - alternative version of ReverseNX that can switch between handheld and docked mode in Real Time. GitHub
  • sys-botbase - sys-module that allows users to remote control their switch via sockets as well as read and write to a games memory. GitHub

Tesla Overlay System

Allows to access a menu of various homebrew applications and plugins.

  • Tesla-Menu - overlay menu. GitHub
  • nx-ovlloader - sys-module, host process for loading overlay OVLs (NROs). GitHub, GitHub
  • libtesla - support library for Tesla overlays for develop. GitHub

Payload

Send command or binary file (the payload) to the Nintendo Switch in Recovery mode (RCM). Software writes on C/C++ for AArch64 Cortex A57 CPU SoC Tegra X1.

  • Lockpick_RCM - bare metal Nintendo Switch payload that derives encryption keys for use in Switch file handling software without booting HOS. GitLab, Codeberg, GitHub
  • TegraExplorer - payload-based file manager. GitHub
  • SX Gear/PRO - SX Gear is payload injector dongle for the Nintendo Switch.
  • NS-USBloader - Awoo Installer and GoldLeaf uploader of the NSPs, RCM payload injector. GitHub
  • ArgonNX-SE - GUI payload chainloader. GitHub

Homebrew

Unoffical software

  • JKSV - JK’s Save Manager Switch Edition. GitHub
  • nx-hbmenu - the Nintendo Switch Homebrew Menu. GitHub
  • sphaira - the Nintendo Switch Homebrew Menu. GitHub
  • hb-appstore - Homebrew App Store. GitHub
  • nx-hbloader - host process for loading Homebrew NROs. GitHub
  • 90DNS Tester - simple homebrew application to test DNS. GitHub
  • Goldleaf - multipurpose homebrew tool. GitHub
  • Linkalho - homebrew app that will link NNID accounts offline. GitHub
  • DBI - install NSP, NSZ, XCI and XCZ from various sources. GitHub
  • Awoo-Installer - install NSP, NSZ, XCI and XCZ. GitHub
  • Haku33 - perform a hard reset. GitHub
  • Goldleaf - multipurpose homebrew tool. GitHub
  • nso-icon-tool - allows you to create user icons like NSO. GitHub
  • switch-ezremote-client - File Manager application that allows you to connect the Switch to remote FTP, SMB, WebDAV servers to transfer and manage files. GitHub
  • PPSSPP - PSP emulator. Site
  • RetroArch - advanced features like shaders, netplay, rewinding, next-frame response times, runahead, machine translation, blind accessibility features, and more! Site
  • SimpleModManager - SimpleModManager is an homebrew app. GitHub
  • SimpleModDownloader - homebrew which downloads mods from gamebanana. GitHub
  • libnx - library for development Homebrew. GitHub
  • LayeredFS - homebrew virtual file system for replace games use TitleID.
  • nton - NRO to NSP forwarder. GitHub
  • switch-tools - SP forwarder creator. GitHub
  • Switch Homebrew Development - Gbatemp
  • nx.js - JavaScript runtime for homebrew applications GitHub

Firmware

  • Caffeine/Nereba - name of excploit and software vulnerability.

Official

Bootloader

  • Hekate - bootloader with GUI and many features. GitHub
  • hekate_boot_dat -create a SX boot.dat from hekateGitHub
  • ArgonNX-SE - GUI payload chainloader. GitHub

Custom

  • Evaron-AIO - sall-in-one build based on existing CFWS. GitHub
  • DeepSea - the new All-in-One CFW package. GitHub
  • Ultra - GitHub
  • NX-Venom - the ultimate bundle for overclocking. GitHub
  • Kefir - Bitbucket
  • Hats - pack containing the latest version of Hekate, Atmosphere and its Signature Patches. Telegram, Mediafire
  • Santa-Claus - Site
  • NeXT - another AIO Pack. Codeberg
  • 4IFIR - ultimate CFW for overlocking. GitHub
  • 5IFIR - like 4IFIR for semi-stock GitHub
  • Switch OC Suite - Overclocking suite. GitHub
  • GNX - Brazilian All-in-One CFW package. GitHub
  • ShallowSea - AIO CFW package for the. Codeberg
  • SX OS - Features like the XCI Loader require an SX OS license.
  • Arquivos-JNX - additional file. GitHub
  • Kefir Updater - update your CFW, sigpatches, cheat codes, firmwares and more. GitHub
  • AIO-Switch-Updater - update your CFW, cheat codes, firmwares and more. GitHub
  • AtmoPackUpdater - homebrew which update your CFW/Firmware/Homebrews/Sigpatches. GitHub
  • emuMMC - SDMMC driver replacement for Nintendo’s Filesystem Services. GitHub
  • sigmapatches

Atmosphere

  • Atmosphere - GitHub
  • ns-Atmosphere - custom atmosphere with including from fork changes and reverting controversial changes. GitHub
  • Kefirosphere - fork of Atmosphère. GitHub
  • KIP - Kernel Initial Processes

Build

  • Instruction
  • devkitPro - provider of homebrew toolchains for Nintendo
  • devkita64-atmosphere - devkita64-container with everything you need for build atmosphere locally and with CI. GitHub Packages

SigPatch

Signature patches, es/fs/ips/acid/loader-pathes. Digital signatures that allow unsigned code to run on the horizon operating system. Use sys-patch if problem with it.

Atmosphere > 1.7.0

  • Hekate use patches.ini file
  • Modified fusee use atmosphere/kip_patches/
  • FS-patches - File System patches, modifications to the file system required to execute custom, modified, or unsigned Nintendo Switch packages (NSPs), including homebrew NSPs and NRO forwarders.
  • ES-patches - Eticket Service patches, required to install fake tickets for running commercial(dumped/pirated) Nintendo Switch Packages (NSPs).
  • Loader-patches - required for running NRO forwarders and installed homebrews.
  • NIFM-ctest - patch for the connection test, allowing a local area network to function even without an internet connection.
  • SHA-256 hashes on FS patches - Gbatemp
  • How work Load patch - Gbatemp

IPS patch

IPS(International Patching System”)

Type Size Data
Header 5 Patch
Offset 3
Size 2
Data Size
Footer 3 EOF

RLE

Type Size Data
Header 5 Patch
Offset 3
Size 2
RLE Size 2
Data Size
Footer 3 EOF

IPS32

Type Size Data
Header 5 IPS32
Offset 3
Size 2
RLE Size 2
Data Size
Footer 4 EEOF

Logo and splash screen

devkitPro

  • devkitPro pacman - devkitPro provided tools and libraries are managed by the rather wonderful Arch Linux pacman. devkitpro
  • devkitPro container images - Dockerfiles, DockerHub
  • Problem with CI - you need to use a container to avoid http error 403. Issues

ModChip and HW

  • SX Core/SX Lite - glitch methods GitHublike PicoFly. GitHub
  • HWFLY - glitch methods like PicoFly. GitHub
  • Erista/Mariko - names of SoC(System on Chip) NVIDIA Tegra X1 revisions.
  • Fuses - physical component on the board, that can be physically burned away. It`s security mechanism which preventing downgrade OFW.
  • Glitching the Switch - CCC - YouTube, media.ccc.de, YouTube
  • fusee-nano - minimalist re-implementation of the Fusée Gelée exploit, designed to run on embedded Linux devices. GitHub
  • fusee-launcher - reference implementation launcher for the Fusée Gelée Tegra X1 bootROM exploit. GitHub
  • Fusée Gelée - name of excploit and hardware vulnerability. GitHub, SecurityLab
  • Glitch - is an activity in which a person finds and exploits flaws or glitches in programs and devices to achieve something that was not intended by the designers and developers. Habr
  • CVE-2020-15808
  • CVE-2018-6242

PicoFly

RP2040 microcontroller designed here at Raspberry Pi for load Hekate, enter in RCM, transfer payload via Glitch method.

  • Load payload.bin from root sd-card
  • Not needed transder payload from PC
  • Not needed boot.dat and boot.ini it`s for SX Gear
  • .uf2 - flashing when loading into the controller memory
  • .bin - flashing using picofly toolbox
  • Evaron-pfrp2040 - own picofly fork. GitHub
  • GitHub Source
  • GitHub Source
  • Glitching the CPU to make it fail a check, which allows booting from an unsigned payload that will then run higher level software.
  • UF2 - USB flashing format developed by Microsoft. GitHub

Cheat

  • EdiZon - using cheats. GitHub
  • EdiZon-SE - using cheats. GitHub
  • EdiZon-Overlay - EdiZon Overlay originally by WerWolv. GitHub
  • Breeze - game cheating tool designed to work with Atmosphere’s cheatVM. GitHub
  • NXCheatCode - database. GitHub

Overcloak

  • OC Switchcraft - Overclocking suite. Discord, GitHub
  • sys-clk - overclocking/underclocking system module and frontend. GitHub
  • FPSLocker - set custom FPS in games. GitHub, Patches
  • NX-60FPS-RES-GFX-Cheats - A database of 60FPS cheats, resolution cheats, and general graphics cheats. GitHub
  • FPSLocker-Warehouse - FPSLocker patches and methodology how to update them. GitHub
  • Horizon-OC - An open source overclocking tool forh consoles running Atmosphere custom firmware. GitHub

Ram configuration

Information from

Tier RAM ID Ram Clock (MHz) VDD2(Safe) VDDQ Common Timings Super-Tight (ST) Timings
GOD NEI/NEE 3100-3300 1175 mV 640 (3-3-2) 2-5-5-4-6 (4-4-4) 3-7-6-6-6
GOD WT : B 3000-3200 1175 mV 600 (4-4-5) 5-2-6-5-6 (6-6-7) 7-2-6-5-6
S AA-MGCL / MGCR 2933-3100 1175 mV 640 (4-4-5) 5-5-6-7-6 (4-4-8) 6-5-7-8-6
A MGCJ 2633-2733(3000 with 1250mv) 1175 mV 640 (3-2-4) 2-4-4-4-6 (4-3-8) 3-5-4-4-6
B NME 2500-2766 1175 mV 640 (2-2-1) 0-1-4-3-6 (3-3-4) 0-1-4-4-6
C WT : F 2633-2800 1175 mV 600 (4-4-2) 5-4-6-3-6 (5-5-4) 5-5-6-5-6
D AB-MGCL 2500 1175 mV 640 (4-4-4) 4-4-5-6-6 (4-4-8) 5-5-6-8-6

DNS

  • 90dns - NX DNS setup. GitLab

Mikrotik 

add address=127.0.0.1 regexp=".*\\.nintendo\\..*"
add address=127.0.0.1 regexp="^nintendo\\..*"

EMUMMC

emummc.txt

127.0.0.1 *nintendo*
127.0.0.1 receive-%.dg.srv.nintendo.net receive-%.er.srv.nintendo.net
127.0.0.1 *nintendo-europe.com
127.0.0.1 *nintendoswitch.*

Backup & Restore

DD backuo

eMMC/emuMMC with DD

  1. Enter to Hekate
  2. Go to Tools > USB-tools
  3. In USB MASS STORAGE press eMMC RAW GPP
  4. Run parted -l or fdisk -l and look disk device
  5. Execute dd command 
    dd if=/dev/sd<a-z> of=/<file name>.img bs=5M status=progress
  6. Do that for boot0 and boot1

DD restore

eMMC/emuMMC with DD

  1. Enter to Hekate
  2. Go to Tools > USB-tools
  3. Disable Read-Only mode
  4. In USB MASS STORAGE press eMMC RAW GPP
  5. Run parted -l or fdisk -l and look disk device
  6. Execute dd command 
    dd if=/<file name>.img of=/dev/sd<a-z> bs=5M status=progress

Games

Witcher 3 saves from PC

  1. Intall JKSV
  2. Create Backup of game save
  3. Enter to directory on computer C:\Users<user name>\Documents\The Witcher 3\gamesaves
  4. Connect SD Card to PC
  5. Go to /JKSV/// on SD-Card
  6. Copy saves
  7. Restore backup in JKSV

Install via DBI

  1. Edit configuration in SD-Card /switch/DBI/dbi.config 
    [Network sources]
<name>=ApacheHTTP|http://<ip or hostname>/Nintendo/Switch/
  2. Create Nginx configuration switch.conf 
    server {
    listen       80 default_server;

    charset UTF-8;
    location /Nintendo/Switch/ {
        root   /Nintendo/Switch;
        index  index.html index.htm;
        autoindex on;
    }
}
  3. Run Nginx use docker 
    docker run --rm --name nginx -p 8000:80 -v <games directiry>:/Nintendo/Switch:ro -v ./switch.conf:/etc/nginx/conf.d/default.conf:ro nginx:<version>
  4. Go to DBI homebrew and select created resource
  5. Choose game folder and install

SD-Card

Partition for emuMMC 

parted /dev/sd<>
unit MB
mkpart primary fat32 1M <end - 32768-1>M
mkpart primary fat32 <end - 32768>M <end>M

mkfs.fat /dev/sd<>1

Reverse engineering

gdoc_arrow_left_alt General Git gdoc_arrow_right_alt