Skip to main content
Notes by Peter Galonza(Пётр Галонза)
GitHub Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage

Nintendo Switch


  • RCM - Recovery Mode allows Nintendo to send the switch commands. GitHub
  • sysNand/sysMMC - system NAND, Nintendo Switch internal memory storage.
  • emuNAND/emuMMC - emulated NAND. emulating Nintendo Switch “internal memory storage” which contain OS and everything else into a MicroSD card.
  • amiibo - interactive figures and cards that work with your games.
  • Dongle - method to enter in RCM. (Do not need for Chip Mod)
  • ninfs - FUSE filesystem Python scripts. GitHub
  • nxdumptool - Generates XCI/NSP/HFS0/ExeFS/RomFS/Certificate/Ticket dumps gamecards and installed SD/eMMC titles. GitHub

Overlays

  • sys-clk - overclocking/underclocking system module. GitHub
  • Ultrahand-Overlay - fully craft-able overlay executor.GitHub
  • Uberhand-Overlay(fork Ultrahand-Overlay) - fully craft-able overlay executor. GitHub
  • SaltyNX - background process for file/code modification. GitHub
  • Status-Monitor-Overlay - Monitor many stats of hardware. GitHub
  • QuickNTP - Tesla plugin to sync time with NTP servers. GitHub
  • sys-ftpd - FTP server as a background service (sysmodule). GitHub
  • ReverseNX-RT - alternative version of ReverseNX that can switch between handheld and docked mode in Real Time. GitHub
  • sys-botbase - sys-module that allows users to remote control their switch via sockets as well as read and write to a games memory. GitHub

Tesla Overlay System

Allows to access a menu of various homebrew applications and plugins.

  • Tesla-Menu - overlay menu. GitHub
  • nx-ovlloader - sys-module, host process for loading overlay OVLs (NROs). GitHub, GitHub

  • libtesla - support library for Tesla overlays for develop. GitHub

Payload

Send command or binary file (the payload) to the Nintendo Switch in Recovery mode (RCM). Software writes on C/C++ for AArch64 Cortex A57 CPU SoC Tegra X1.

  • Lockpick_RCM - bare metal Nintendo Switch payload that derives encryption keys for use in Switch file handling software without booting HOS. GitLab, Codeberg, GitHub
  • TegraExplorer - payload-based file manager. GitHub
  • SX Gear/PRO - SX Gear is payload injector dongle for the Nintendo Switch.
  • NS-USBloader - Awoo Installer and GoldLeaf uploader of the NSPs, RCM payload injector. GitHub
  • ArgonNX-SE - GUI payload chainloader. GitHub

Homebrew

Unoffical software

  • JKSV - JK’s Save Manager Switch Edition. GitHub
  • nx-hbmenu - the Nintendo Switch Homebrew Menu. GitHub
  • hb-appstore - Homebrew App Store. GitHub
  • nx-hbloader - host process for loading Homebrew NROs. GitHub
  • 90DNS Tester - simple homebrew application to test DNS. GitHub
  • Goldleaf - multipurpose homebrew tool. GitHub
  • Linkalho - homebrew app that will link NNID accounts offline. GitHub
  • DBI - install NSP, NSZ, XCI and XCZ from various sources. GitHub
  • Awoo-Installer - install NSP, NSZ, XCI and XCZ. GitHub
  • Haku33 - perform a hard reset. GitHub
  • Goldleaf - multipurpose homebrew tool. GitHub
  • nso-icon-tool - allows you to create user icons like NSO. GitHub
  • switch-ezremote-client - File Manager application that allows you to connect the Switch to remote FTP, SMB, WebDAV servers to transfer and manage files. GitHub
  • PPSSPP - PSP emulator. Site
  • RetroArch - advanced features like shaders, netplay, rewinding, next-frame response times, runahead, machine translation, blind accessibility features, and more! Site
  • SimpleModManager - SimpleModManager is an homebrew app. GitHub
  • SimpleModDownloader - homebrew which downloads mods from gamebanana. GitHub

  • libnx - library for development Homebrew. GitHub
  • LayeredFS - homebrew virtual file system for replace games use TitleID.
  • nton - NRO to NSP forwarder. GitHub
  • switch-tools - SP forwarder creator. GitHub
  • Switch Homebrew Development - Gbatemp
  • nx.js - JavaScript runtime for homebrew applications GitHub

Firmware

  • Caffeine/Nereba - name of excploit and software vulnerability.

Official

Bootloader

  • Hekate - bootloader with GUI and many features. GitHub
  • hekate_boot_dat -create a SX boot.dat from hekateGitHub
  • ArgonNX-SE - GUI payload chainloader. GitHub

Custom

  • Evaron-AIO - sall-in-one build based on existing CFWS. GitHub
  • DeepSea - the new All-in-One CFW package. GitHub
  • Ultra - GitHub
  • NX-Venom - the ultimate bundle for overclocking. GitHub
  • Kefir - Bitbucket
  • Hats - pack containing the latest version of Hekate, Atmosphere and its Signature Patches. Telegram, Mediafire
  • Santa-Claus - Site
  • NeXT - another AIO Pack. Codeberg
  • 4IFIR - ultimate CFW for overlocking. GitHub
  • 5IFIR - like 4IFIR for semi-stock GitHub
  • Switch OC Suite - Overclocking suite. GitHub
  • GNX - Brazilian All-in-One CFW package. GitHub
  • ShallowSea - AIO CFW package for the. Codeberg
  • SX OS - Features like the XCI Loader require an SX OS license.
  • Arquivos-JNX - additional file. GitHub

  • Kefir Updater - update your CFW, sigpatches, cheat codes, firmwares and more. GitHub
  • AIO-Switch-Updater - update your CFW, cheat codes, firmwares and more. GitHub
  • AtmoPackUpdater - homebrew which update your CFW/Firmware/Homebrews/Sigpatches. GitHub
  • emuMMC - SDMMC driver replacement for Nintendo’s Filesystem Services. GitHub
  • sigmapatches

Atmosphere

  • Atmosphere - GitHub
  • ns-Atmosphere - custom atmosphere with including from fork changes and reverting controversial changes. GitHub
  • Kefirosphere - fork of Atmosphère. GitHub

  • KIP - Kernel Initial Processes

Build

  • Instruction
  • devkitPro - provider of homebrew toolchains for Nintendo
  • devkita64-atmosphere - devkita64-container with everything you need for build atmosphere locally and with CI. GitHub Packages

SigPatch

Signature patches, es/fs/ips/acid/loader-pathes. Digital signatures that allow unsigned code to run on the horizon operating system. Use sys-patch if problem with it.

Atmosphere > 1.7.0

  • Hekate use patches.ini file
  • Modified fusee use atmosphere/kip_patches/

  • FS-patches - File System patches, modifications to the file system required to execute custom, modified, or unsigned Nintendo Switch packages (NSPs), including homebrew NSPs and NRO forwarders.
  • ES-patches - Eticket Service patches, required to install fake tickets for running commercial(dumped/pirated) Nintendo Switch Packages (NSPs).
  • Loader-patches - required for running NRO forwarders and installed homebrews.
  • NIFM-ctest - patch for the connection test, allowing a local area network to function even without an internet connection.
  • SHA-256 hashes on FS patches - Gbatemp
  • How work Load patch - Gbatemp

IPS patch


IPS(International Patching System”)

TypeSizeData
Header5Patch
Offset3
Size2
DataSize
Footer3EOF

RLE

TypeSizeData
Header5Patch
Offset3
Size2
RLE Size2
DataSize
Footer3EOF

IPS32

TypeSizeData
Header5IPS32
Offset3
Size2
RLE Size2
DataSize
Footer4EEOF

Logo and splash screen


devkitPro

  • devkitPro pacman - devkitPro provided tools and libraries are managed by the rather wonderful Arch Linux pacman. devkitpro
  • devkitPro container images - Dockerfiles, DockerHub
  • Problem with CI - you need to use a container to avoid http error 403. Issues

ModChip and HW

  • SX Core/SX Lite - glitch methods GitHublike PicoFly. GitHub
  • HWFLY - glitch methods like PicoFly. GitHub
  • Erista/Mariko - names of SoC(System on Chip) NVIDIA Tegra X1 revisions.
  • Fuses - physical component on the board, that can be physically burned away. It`s security mechanism which preventing downgrade OFW.

  • Glitching the Switch - CCC - YouTube, media.ccc.de, YouTube
  • fusee-nano - minimalist re-implementation of the Fusée Gelée exploit, designed to run on embedded Linux devices. GitHub
  • fusee-launcher - reference implementation launcher for the Fusée Gelée Tegra X1 bootROM exploit. GitHub
  • Fusée Gelée - name of excploit and hardware vulnerability. GitHub, SecurityLab
  • Glitch - is an activity in which a person finds and exploits flaws or glitches in programs and devices to achieve something that was not intended by the designers and developers. Habr
  • CVE-2020-15808
  • CVE-2018-6242

PicoFly

RP2040 microcontroller designed here at Raspberry Pi for load Hekate, enter in RCM, transfer payload via Glitch method.

  • Load payload.bin from root sd-card
  • Not needed transder payload from PC
  • Not needed boot.dat and boot.ini it`s for SX Gear
  • .uf2 - flashing when loading into the controller memory
  • .bin - flashing using picofly toolbox

  • Evaron-pfrp2040 - own picofly fork. GitHub
  • GitHub Source
  • GitHub Source
  • Glitching the CPU to make it fail a check, which allows booting from an unsigned payload that will then run higher level software.
  • UF2 - USB flashing format developed by Microsoft. GitHub

Cheat

  • EdiZon - using cheats. GitHub
  • EdiZon-SE - using cheats. GitHub
  • EdiZon-Overlay - EdiZon Overlay originally by WerWolv. GitHub
  • Breeze - game cheating tool designed to work with Atmosphere’s cheatVM. GitHub
  • NXCheatCode - database. GitHub

Overcloak

  • OC Switchcraft - Overclocking suite. Discord, GitHub
  • sys-clk - overclocking/underclocking system module and frontend. GitHub
  • FPSLocker - set custom FPS in games. GitHub, Patches
  • NX-60FPS-RES-GFX-Cheats - A database of 60FPS cheats, resolution cheats, and general graphics cheats. GitHub
  • FPSLocker-Warehouse - FPSLocker patches and methodology how to update them. GitHub

DNS

Mikrotik

add address=127.0.0.1 regexp=".*\\.nintendo\\..*"
add address=127.0.0.1 regexp="^nintendo\\..*"

EMUMMC

emummc.txt

127.0.0.1 *nintendo*
127.0.0.1 receive-%.dg.srv.nintendo.net receive-%.er.srv.nintendo.net
127.0.0.1 *nintendo-europe.com
127.0.0.1 *nintendoswitch.*

Backup & Restore

DD backuo

eMMC/emuMMC with DD

  1. Enter to Hekate
  2. Go to Tools > USB-tools
  3. In USB MASS STORAGE press eMMC RAW GPP
  4. Run parted -l or fdisk -l and look disk device
  5. Execute dd command
    dd if=/dev/sd<a-z> of=/<file name>.img bs=5M status=progress
    
  6. Do that for boot0 and boot1

DD restore

eMMC/emuMMC with DD

  1. Enter to Hekate
  2. Go to Tools > USB-tools
  3. Disable Read-Only mode
  4. In USB MASS STORAGE press eMMC RAW GPP
  5. Run parted -l or fdisk -l and look disk device
  6. Execute dd command
    dd if=/<file name>.img of=/dev/sd<a-z> bs=5M status=progress
    

Games

Witcher 3 saves from PC

  1. Intall JKSV
  2. Create Backup of game save
  3. Enter to directory on computer C:\Users<user name>\Documents\The Witcher 3\gamesaves
  4. Connect SD Card to PC
  5. Go to /JKSV/// on SD-Card
  6. Copy saves
  7. Restore backup in JKSV

Install via DBI

  1. Edit configuration in SD-Card /switch/DBI/dbi.config
    [Network sources]
    <name>=ApacheHTTP|http://<ip or hostname>/Nintendo/Switch/
    
  2. Create Nginx configuration switch.conf
    server {
        listen       80 default_server;
    
        charset UTF-8;
        location /Nintendo/Switch/ {
            root   /Nintendo/Switch;
            index  index.html index.htm;
            autoindex on;
        }
    }
    
  3. Run Nginx use docker
    docker run --rm --name nginx -p 8000:80 -v <games directiry>:/Nintendo/Switch:ro -v ./switch.conf:/etc/nginx/conf.d/default.conf:ro nginx:<version>
    
  4. Go to DBI homebrew and select created resource
  5. Choose game folder and install

SD-Card

Partition for emuMMC

parted /dev/sd<>
unit MB
mkpart primary fat32 1M <end - 32768-1>M
mkpart primary fat32 <end - 32768>M <end>M

mkfs.fat /dev/sd<>1

Reverse engineering