Hackers Seem Close To Publicly Unlocking the Nintendo Switch (arstechnica.com) 91
Ars Technica reports that "hackers have been finding partial vulnerabilities in early versions of the [Nintendo] Switch firmware throughout 2017." They have discovered a Webkit flaw that allows for basic "user level" access to some portions of the underlying system and a service-level initialization flaw that gives hackers slightly more control over the Switch OS. "But the potential for running arbitary homebrew code on the Switch really started looking promising late last month, with a talk at the 34th Chaos Communication Congress (34C3) in Leipzig Germany," reports Ars. "In that talk, hackers Plutoo, Derrek, and Naehrwert outlined an intricate method for gaining kernel-level access and nearly full control of the Switch hardware." From the report: The full 45-minute talk is worth a watch for the technically inclined, it describes using the basic exploits discussed above as a wedge to dig deep into how the Switch works at the most basic level. At one point, the hackers sniff data coming through the Switch's memory bus to figure out the timing for an important security check. At another, they solder an FPGA onto the Switch's ARM chip and bit-bang their way to decoding the secret key that unlocks all of the Switch's encrypted system binaries. The team of Switch hackers even got an unexpected assist in its hacking efforts from chipmaker Nvidia. The "custom chip" inside the Switch is apparently so similar to an off-the-shelf Nvidia Tegra X1 that a $700 Jetson TX1 development kit let the hackers get significant insight into the Switch's innards. More than that, amid the thousand of pages of Nvidia's public documentation for the X1 is a section on how to "bypass the SMMU" (the System Memory Management Unit), which gave the hackers a viable method to copy and write a modified kernel to the Switch's system RAM. As Plutoo put it in the talk, "Nvidia backdoored themselves."
You shouldn't have to depend on hackers. (Score:1, Interesting)
Why doesn't Nintendo just allow people to use these computers as they see fit? Why must one always struggle for freedom from the Dear Leader?
Re:You shouldn't have to depend on hackers. (Score:5, Insightful)
Why doesn't Nintendo just allow people to use these computers as they see fit? Why must one always struggle for freedom from the Dear Leader?
Because in every single case where a gaming system has been hacked, that hack is used to play games the person didn't pay for.
Yes, there are many other reasons for unlocking the hardware and many other things you can do with a small portable computer like the switch, but the most widely used reason will be pirating games.
Re:You shouldn't have to depend on hackers. (Score:5, Insightful)
Actually, the biggest fear nintendo have is not piracy, but unlicensed games.
You have to pay a big, big fee to nintendo to manufacture games for it, but if the publishers could avoid it somehow...
Re: (Score:2)
They already won this battle, as you just can't manufacture a cartridge not approved by nintendo or create parallel game store.
Re: (Score:1)
Actually, that's not at all established.
Atari (d.b.a. Tengen) v. Nintendo [wikipedia.org] established that clean-room reverse engineering was totally OK, even though Atari didn't in that particular case.
Sega v. Accolade [wikipedia.org] established that you couldn't use technical details masquerading as a trademark as a backup strategy to promote a case from a copyright infringement suit you might lose into a trademark infringement suit you'll probably win.
And licensee enforcement is not DMCA-protected. Only copy control measures are. Thes
Re: (Score:1, Interesting)
You have a secondary problem where you get fake carts. The GBA and DS were both marred by this problem. You go looking for a specific game and you get something that looks the part only to notice that the plastic isn't quite right, the label is poor, and the PCB puts extra strain on the pins hastening the death of the slot and the developer gets not a single cent out of your purchase.
I'd argue that this is worse than piracy. These go after customers who wanted to give developers money and instead wound up f
Re: (Score:3)
Uhm, that *is* piracy in it's purest commercial form (with a bit of physical damage to the customer's hardware thrown in) . Going right back to the birth of the term in regards to Hollywood as a pirate distributor of East-coast media.
Re: (Score:2)
On the Wii, Mariocart became unplayable with all the people playing hacked versions and cheating.
This will happen again if the platform is opened.
If you want an open platform, buy a PC or microcontroller board. There are plenty of options.
Re: (Score:3)
That's like saying printer manufacturers should charge more for their printers and stop creating more and more ridiculous locks on the ink.
The ink/games is what brings in the money. Selling a printer/console is one sale. Selling ink/games for it is basically a way to keep the revenue flowing long, long after you are already locked in.
Re: (Score:2)
More importantly, it keeps the revenue flowing with basically no additional expenditure of effort or money by the console manufacturer. License fees are all pure profit.
Re: (Score:2)
Nintendo has historically HATED R their greatest success in their minds was the original Game Boy, because they were able to make money on that for 10+ years. There's a reason they've had to be dragged kicking and screaming to release a new generation console when their competitors did.
Re: (Score:1)
What do you mean Nintendo has had to be dragged kicking and screaming? Their home consoles are on a 5-year life cycle, and have been since they started. There are only minor variations to this life cycle. Due to the slow release of the NES at start, it is technically 6 years. The Wii due to its wild success lasted 6 years as well, but the WiiU didn't do well, so only lasted 4 years (averaging out with the Wii, still on a 5-year cycle). Nintendo isn't a reactionary company to their competitors, its quite the
Re: (Score:2)
It hasn't been a planned cycle; in each case they came out with a new system because they were pressured by their competitors releasing systems. When they don't have that pressure, see e.g. in the handheld market, they keep their systems going as long as possible, see e.g. game boy.
Re: (Score:2)
From a technical perspective and rational standpoint, that would seem the best course.
From a realistic business perspective, making cost of entry low, and then charging $60 per game works better. People are reluctant to say fork over 500 or 600 dollars in one go, but they will end up spending far more than that over the course of a few months if you hit them a chunk at a time.
Re: (Score:2)
We should demand an end to home and car financing. Interest is pure-profit.
Re: (Score:2)
Something has to be done; otherwise, we'll be engaged in this stupid, wasteful war for the rest of eternity.
It may be "stupid" and "wasteful", but most hobbies are. Some people are having a lot of fun with this. In any case, I'd much rather Nintendo create a business model based on technological means like DRM than to lean on the government for help by using copyright law. Which is how they did it in the past, and they almost certainly will fall back to once the system is cracked.
Re:You shouldn't have to depend on hackers. (Score:5, Informative)
Whether this is true or not is debatable - they were a little too firmly dedicated to the 2600 and compromised subsequent platforms in its favor. Also, the controller for the 5200 was terrible. But this is the principle that Nintendo operated under, and it certainly worked out well for them. The NES was the first console with a DRM chip.
Re:You shouldn't have to depend on hackers. (Score:4)
"Not lack of royalties, but a flood of low quality games that Atari had no control over."
nintendo has no problem with crapware on the switch marketplace as long as they get royalties...
Re: (Score:2)
nintendo has no problem with crapware on the switch marketplace as long as they get royalties...
You stopped reading after the first paragraph, didn't you? Besides, the decision was way back then. Nintendo kept what they were doing which seems to work fine with them. Their purpose might have changed nowadays, but that still consistent with what they are doing.
Re:You shouldn't have to depend on hackers. (Score:5, Informative)
Basically, what happened was EA and Activision happened, formed by a bunch of disgruntled Atari programmers. Basically Atari management refused to let the programmers put their names on the games and get some credit, so they left and formed EA and Activision. Since they were ex-Atari, they had all the inside knowledge on how it worked, so they started making their own games for it.
And make a ton of games they did - they kept cranking it out, because everyone wanted in on video games, so it was the best of times - crank out stuff. But then people came to the realization that most of what they had was... crap - churned out to make a quick buck because everyone was buying up games by the dozen - retailers were ordering hundreds of copies per store, etc. It was a boom time.
Then people realized most of it was crap and shovelware and stopped buying games. Retailers were stuck with thousands of cartridges and returned them in droves. Even worse, retailers were not buying games. Now this did not happen overnight, it basically took a couple of years where the video game industry declined. It became so bad, "video games" were a banned word at many retailers.
And this is where Nintendo comes in. They didn't call their system a video game system, they called it a toy, not to be sold in the now-banned video game section of the store, but where all the toys were. Problem number one - toy sections are girls, or boys. You can guess where Nintendo went, and potentially where we have such a gender imbalance in gaming today. (Check the ads - Atari ads always showed a relatively balanced family - mom, dad, son, daughter, playing their game system. Nintendo, though, showed only boys. No girls, no adults (it was a toy)).
Anyhow, the other reason for it is obvious - few people care about homebrew games on switch, everyone wants pirated games. So cracking the Switch really is for everyone to not pay for games ever again. (And ironically, this time around, it wouldn't be Nintendo strangling 3rd party developers). Face it, that's the real truth behind all the hacking.
Re: You shouldn't have to depend on hackers. (Score:3)
And this is where Nintendo comes in. They didn't call their system a video game system, they called it a toy, not to be sold in the now-banned video game section of the store, but where all the toys were.
That's some cute revisionism, but it's not exactly accurate. After the crash, Nintendo first attempted to position themselves as a full-fledged computer system. This failed, for various reasons. Following that, they then marketed their console as an "entertainment system" which was, as you say, listed as a "toy". However, all of your feminist editorialising is mostly bullshit; the idea that "toys have to be marketed either to boys or girls" is complete nonsense, which you could easily discover by walking
Re: (Score:2)
I'll concede that Nintendo may have targeted boys specifically. I have no recollection of such a campaign, but I was very young at the time so I may simply not have noticed it. But the idea that they HAD to do so due to some quirk in how toys are marketed is complete nonsense. Moreover, those of us who went to purchase a Nintendo system knew exactly what we were getting: a video game conaole. I didn't beg my parents to buy me a "boys toy"; I wanted a fucking video game system, and that's how I got my first NES.
Well I can check the back of my NES control deck box which shows Mom, Dad and Son. Actually to be blunt as someone that was a gamer starting with the 2600 video games were for "boys". (If you ever went to the arcade in the early 80's this was pretty obvious.) On the other hand back then it seemed like every company was more than happy if their hit appealed to everybody, like Pac-Man, Tetris, and Super Mario Bros.
Re: (Score:2)
Well I can check the back of my NES control deck box which shows Mom, Dad and Son.
Wow.
Well since they had the mom and not the daughter, I guess they had no problems with woman but hatted younger girls. Ageism at its worst!
Was every culture on the box? Just curious how far this discrimination goes...
Re: (Score:2)
Another interesting thing about the Crash I only learned about recently was that at the time, video games were sold from wholesalers to retailers under an unusual scheme which encouraged retailers to hoard large amounts of games. I don't recall the particulars but IIRC it led to large numbers of unsold games being put into the bargain bin.
Re: (Score:2)
So cracking the Switch really is for everyone to not pay for games ever again.
Well piracy is certainly part of it, but it's not a question of homebrew games or pirated games - you can do other things with a portable computer that connects to your TV. There's a lot of precedent for getting non-game utility from consoles. I'm sure you've heard of Kodi, previously XBMC (Xbox Media Center).
You're right though, I didn't meant to suggest that Nintendo is unconcerned with piracy. Only that Nintendo started putting DRM in their consoles in order to stop unlicensed developers, and that thi
Re: (Score:3)
I'm sure you've heard of Kodi, previously XBMC (Xbox Media Center).
Yeah, which people mostly use to pirate movies and TV.
Re: (Score:2)
Back in the 8 bits days, EA's titles for the Apple 2 were top of line quality.
That didn't last long and we have what we have today.
Re: (Score:2)
Newsflash, the boys did not keep the computers and game consoles hidden of sight or locked when they were using it, and a partner for playing would ALWAYS be welcomed.
You know what interest was shown by my sister and her friends?
Want to guess?
None....Nada. It was their OWN choice.
It should also be noted at the time such equipments would be a moderate investment for *many* families, and nobody
Re: (Score:2)
Oh please. The original NES library was rife with low quality games that were shoveled out by the dozen. Mostly games made after movie titles, but far from exclusively.
And you don't want me to start on the games for the N64, many of which were gimmicky wannabe-3d games with poor graphics, poor steering and worse content. Superman64, anyone?
Re: (Score:2)
shoveled out by the dozen
They were shoveled out at a rate of five per year. That was the much-protested maximum that Nintendo would allow licensees to release.
Nintendo did not screen every game and reject them if they weren't great, a developer would ask about publishing on their platform and it was the developer that Nintendo would evaluate. Then if the dev had some experience and showed some potential, they would become a licensee. After that they would make their games and unless they violated one of Nintendo's rules they wou
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
"They were shoveled out at a rate of five per year. That was the much-protested maximum that Nintendo would allow licensees to release."
There was more than one licensee, so they really were shoveled out by the dozens.
Re: (Score:1)
The IBM-PC had a thriving market for DOS games and microsoft didn't charge one penny for games to be licensed or have a licensing program YET it didn't kill the PC gaming market. In fact it did the opposite. The massive library and easily copyable pc games helped the IBM-PC beat apple, commodore and all the other computer/consoles at the time. So I call unlicensed games killing the platform bullshit.
Re: (Score:2)
Okay.... this is just my own opinion here, but one of the most spectacular examples of a game that played a significant role in the downfall of the console industry at the time was ET, the Extra Terrestrial, and that game was published by Atari, not a third party. Personally, I thought that Activision games were generally better than those published by Atari. Back in the day, I had about twice as many Activision cartr
Re: (Score:2)
Not lack of royalties, but a flood of low quality games that Atari had no control over.
Actually, some of the best games for the 2600 were made by third parties like Activision and Coleco (Pitfall, Demon Attack, etc.) and some of the worst were made by Atari (E.T., Pacman, etc.)
Re: (Score:1)
---PCJ
Re: (Score:2)
Well, I'm certain an awful lot of the people waiting for someone else to hack it are eager for the pirated games. Not so certain about the people actually trying to hack the system. I suspect they're in it mostly for the challenge / hacker cred. Possibly also for freeing up a whole bunch of hardware for whatever use its owner's want.
Heck, I'm sure there's plenty of people out there like me that want a hacked console so they can store their entire library on a single convenient always-attached drive inste
Re: (Score:2)
Can't happen in the USA at least, due to the DMCA. If the publisher makes their own cartridge which bypasses the executable signing to run unsigned code, that violates the anti-circumvention clause. Unlike Joe Hacker, the publisher has $Billions in the bank, and the full wrath of Nintendo's legal department will come down on them, turning them into an empty husk; expect their IP to be given to Nintendo as well.
Now, the cartridge could be sold in packaging with no Switch trademarks on it, or even a mention t
Re: (Score:2)
"Can't happen in the USA at least, due to the DMCA. If the publisher makes their own cartridge which bypasses the executable signing to run unsigned code, that violates the anti-circumvention clause."
That alone violates the anti-tying clauses in the Magnusson-Moss Warranty Act, because you can bet good money Nintendo would try to not honor the warranty on a system that had unlicensed cartridges used upon it.
Re: (Score:2)
Without DRM, that could still be accomplished via a proprietary interface between the medium that the content is distributed upon and patents on that interface. It wouldn't stop people from possibly making their own and just not telling anyone about it, but it would stop other people from publishing unlicensed c
Re: (Score:2)
This seems unlikely. If opening up the Switch is anything like the 3DS then the device owner will have to go out of there way to run/install programs to make the device do what they want. No reason to sell games to the small demographic who'd do that imo.
Re: You shouldn't have to depend on hackers. (Score:5, Interesting)
It's to prevent the 99% of people who won't bother to learn or take the time to hack their system.
99% won't learn, but they don't need to; as a 15 year old kid I made a booming business out of helping others modify their PlayStation consoles to play pirated discs, and then made more money selling them the actual games.
The majority of their user base might remain ignorant, but that's completely irrelevant as long as the users have access to a few guys who know what they're doing.
Re: (Score:2)
So what? The existence of freeloaders is irrelevant when they impose no marginal cost on the system, as is the case with digital goods.
In that case, they're only relevant at all if they *would* pay for things if they couldn't get them for free. And even then, eliminating them is only good for business if the resulting increase in sales is greater than the decrease in sales due to also eliminating the people that would have borrowed a copy for a while and then eventually bought their own (or gone on to buy
Re: (Score:1)
I WOULD have bought Fire Emblem Fates if it wasn't censored to hell and given a shit translation. So I jailbreak my 3DS and get the JP version and patch it with the new translation.
I WOULD have bought Puyo Puyo Tetris, Bravely Default: For The Sequel (the Japanese re-release which isn't censored) and several other games if Nintendo didn't region lock the 3DS for literally no reason. So I jailbroke my 3DS to make it play any game I put in the damn thing. If I put an official working product into an official
Re: You shouldn't have to depend on hackers. (Score:2)
Because in every single case where a gaming system has been hacked, that hack is used to play games the person didn't pay for.
Sure, but given that every platform is hacked in a matter of months, you would think that sooner or later they might wise up and realize that all the effort they put into trying to "protect" their platform could be put to much better use on making the system more versatile and flexible so that more people would purchase the devices as general use platforms. Then take a lesson from Android and the apple ecosystem, and throw in an app store with many free-to-try games which are either supported by adds or re
Re: (Score:1)
Sure, but given that every platform is hacked in a matter of months,
They aren't as such. Usually they hold out for years and years. It depends on your perspective.
For the most part these hacks are too difficult for the average user and it usually takes a year or so before enough of the hassle has been ironed out that even the technically inclined can claim it's convenient to use. Up until recently everything required a hardware device. The earlier cart based consoles required disc copiers, CD consoles needed a soldered in mod chip, the DS needed special flash carts that cou
Re: (Score:2)
Why would they want that?
Yes, allowing homebrew and allowing you to install your own OS would make you buy it. Maybe a few more. But that's not the goal. The console sales are the necessary evil, not the target. Consoles are often sold at minimal revenue, sometimes even at a loss, at least initially. What brings the money is licensing fee on games.
Ever noticed how console game tend to cost more than PC games? Even for the same game from the same developer? Take a wild guess where that extra money goes. Then
Re: You shouldn't have to depend on hackers. (Score:1)
Re: (Score:2)
Furthermore, for those homebrew things, if we are being honest with ourselves there are a plethora of products on the market that let you more easily access. the platform and cost about the same. Sure, the physical controller design is very nice as is the dock, but 7" tablets with approximately that much horsepower, HDMI out, and available bluetooth physical controllers exist.
The industrial design is certainly nicer and the way the controllers physically reconfigure is nice, but the big thing for Switch is
Re: (Score:3)
As someone who was active in the homebrew Wii scene. Let me tell you this. The nr 1 use of homebrew on the Wii was piracy. The nr 2 use was emulators, which is usually a different form of piracy.
Even if this wasn't the intention of the people who opened it up. It's the reality. Other homebrew applications where much less used. The video player saw some use, but performance wise wasn't great. Fully custom applications/games, very few actual users.
Re: (Score:2)
The only thing getting software and hardware out, of a company's doors to the end-user, is the simple fact that the user can value that product's features and spend money on it. In other words, it's the fact that B2C is a monetizing strategy just like B2B.
Companies restricting features and self-support of these products is part of that monetizing scheme. If monetizing is hampered to such an extent that the product's development/manufacturing is no longer profitable, companies stop making products. This is t
Re: (Score:2)
Re: (Score:2)
It's because prior to this, when they (and most other manufacturers) spent lots of extra work and trouble designing the computer to be unusually user-hostile, the consequences were that shoppers threw money at them.
I think people shouldn't be buying computers that were specifically made to be worse than they could be, where extra effort was put into making the compute
Re: (Score:2)
In the video they say otherwise.
It's a variation of the OS used on the 3DS, that while do use some BSD components, is not the BSD kernel.
Re: (Score:3)
I can either spend 50 bucks and play a game for a few hours or enjoy countless hours of digging through a console's inner workings FOR FREE?
That choice seems kinda easy.
Re: (Score:2)
Germany has a law against reverse engineering? Last time I checked they actually had a provision for just making exactly that legal in their legal code concerning copyright...
Not Coming to a Switch Near You (Score:3)
Userspace exploits had been achieved a while ago, but last I heard, nothing interesting had been found yet. Userspace exploits allow for homebrew to run, although there are sometimes limitations on this. Ever since the Wii was killed off (in part) due to piracy in its latter days, console hackers have been reluctant to release hacks that allow access to kernel space... which can be leveraged to modify the OS to allow pirated games to run. Sony's crackdown on the PS3 hackers cemented this tendency, and now hackers tend to hold on to kernelspace hacks, oftentimes for a few years if not forever. It was a few years after discovery (after the system was dead, even) before a new Wii U hack was released that granted kernel mode access; games had been smuggled through the back door of userspace for years prior (although online play was impossible this way). The Switch is less than a year old and hackers don't want to kill it dead via easy piracy; I imagine someone in China will eventually make a flash-cart that works, but even that took a few years for the 3DS.
That hackers keep using WebKit exploits is probably the main reason the Switch doesn't have a user-accessible web browser app; the 3DS was also hacked via its YouTube app, which is also why the Switch is probably lacking similar 3rd-party apps -- they want to ensure the app's security first. Nintendo also finally started a bug-bounty program for its consoles, which has supposedly paid out for many exploits already. The Switch has sold enough units that its success is all but assured, but console hackers seem to take a dimmer view on piracy nowadays, so I wouldn't count on an easy-to-use method of piracy on the Switch in the near future.
Citation: I have hacked many a game console
Re: (Score:2)
In a recent tweet they claimed to have exploited a vulnerability in the system's bootloader code, which can't be patched. Not sure why it can't be patched, maybe it's in ROM rather than flash memory.
How easy that will be to turn into a viable route for ordinary users to load pirated games I don't know.
My favourite hack was the Dreamcast. A magazine in the UK had a demo of the Action Replay software on its cover disc, which it turned out allowed you to boot copies as a well as original discs. Word got out an
Re: (Score:2)
My favorite hack still has to be the original Xbox. It needed only a few wires for a chip to bypass its internal boot ROM, all conveniently arranged in an unpopulated header on the board. MS tried to remove it on later versions, but people made adapters that let you add wires to connect the missing signals... or just searched around for an older model. And it was easily removed and installed in a different console. I even once found a dead Xbox with a chip, that I was able to install in another unit.
Unlike
Re: (Score:2)
I had a modded XBOX running XMBC back in the day. Originally used one of the chips you describe, but I think the second one I set up for a friend was some kind of soft-mod.
It was a great system, and the remote control was really responsive.
Re: (Score:2)
I did the soft mod as well. Loading from a saved game was enough to get xbmc and the dashboard on your machine. It made a great emulator. i quick google search for the game and it was splinter cell. I'm almost positive I used a different game but regardless, it was incredibly easy.
Re: (Score:1)
From memory I think I took the hard drive out, put it in the hard modded one and loaded the new dashboard, then put it back.
Re: (Score:2)
That hackers keep using WebKit exploits is probably the main reason the Switch doesn't have a user-accessible web browser app; the 3DS was also hacked via its YouTube app, which is also why the Switch is probably lacking similar 3rd-party apps -- they want to ensure the app's security first.
If Nintendo could be bothered to ship a WebKit that wasn't 6+ months old it wouldn't be such a security nightmare for them.
Another hw hole? (Score:3)
2018 is starting a trend in cpu holes, now the nvidia tegra has a build in backdoor (unintentinaly?) ready to exploit.
a cpu is no longer just a cpu, nothing is no longer a simple thing, and it's starting to cause problems.
Re: (Score:3)
You heard sad_, everyone! Let's all switch to the Atmel ATmega328p!