MissionControl VS fusee-launcher

> Pirates will always find a way

Except it's usually not pirates who find these exploits, rather curious tinkerers that want to unlock the full capabilities of the hardware that they own. The pirates / script kiddies usually come in after the groundwork has already been laid by these true hackers. E.g. the people who hacked the Switch in fact condemn piracy and any discussion of it on within their communities will lead to an immediate ban.

I'm proud to say that I've hacked my Switch, but have never pirated anything on it. An impressive homebrew scene has formed around the console, which has produced gems such as Mission Control, allowing you to seamlessly pair third party controllers. I use it with my PS4 controllers.

https://github.com/ndeadly/MissionControl

Now try installing Tinfoil to manage your games, themes and mission control so you can use any bluetooth controller! https://github.com/ndeadly/MissionControl

Here ya go

[https://github.com/ndeadly/missionControl/releases/tag/v0.1.0.

MissionControl

I think this is the page for it: https://github.com/ndeadly/MissionControl/issues/568

Awesome! I'd love to see a detailed writeup on how the exploit works, if someone has the time and interest to put one together.

We were incredibly lucky to get one for the Switch BootROM exploit: https://github.com/Qyriad/fusee-launcher/blob/master/report/...

This writeup of the bug avoids getting super-duper technical, but it is by necessity somewhat technical. The absolute simplest explanation goes something like this:

Yeah, all the console manufacturers have some pretty crap design choices one way or another, especially about security... and not saying that switch is entirely nvdia fault but, that SoC version was plagued with some issues that affected every device that used it

I unfortunately don't have an OMG cable, but don't they run Linux? You could try making a script to run this https://github.com/Qyriad/fusee-launcher

The original Switch uses a Tegra chip code-named "Erista," and it has a serious flaw -- the flaw we use to seize control of the bootloader. You can read a semi-technical overview of it here.

Jailbreaking a Switch relies on a badly-coded recovery mechanism that failed to restrict the size of a USB control request, allowing a stack-smash to take place which then executes attacker-controlled code at the highest privilege level, before privileges are reduced and control is transferred to the Switch's operating system. A more complete, technical treatment of the exploit can be found here.

Dang I’f you have a android phone or tablet that can launch cfw that would be worth a try and also found this https://github.com/Qyriad/fusee-launcher that seems it works for Mac.

u/GeenMachine already has a pretty great answer on this, but if you want a more recent example of a well-secured device being hacked, read into the fusee-gelee exploit on the Nintendo Switch.. Not only is it a hack that exploits the kernel of the Switch, but it is a coldboot exploit meaning that it was impossible to patch until Nintendo released a dedicated hardware upgrade in the form of v2.0 switches.

To confirm I tried to inject hekate (after having formatted my SD following this guide: https://www.youtube.com/watch?v=U2DTVnupXjQ) using https://github.com/Qyriad/fusee-launcher/find/master - unfortunately the launcher didn't do anything after 'smashing the stack' and the switch screen didn't turn on - so pretty confident that it's a patched switch.

The name Fusée comes from the vulnerability found in 2018 that enables all of the homebrew possibilities (https://github.com/Qyriad/fusee-launcher/blob/master/report/fusee_gelee.md). And surely the Fusée payload utilizes that vulnerability.