endgame-exploit VS fusee-launcher

Awesome! I'd love to see a detailed writeup on how the exploit works, if someone has the time and interest to put one together.

We were incredibly lucky to get one for the Switch BootROM exploit: https://github.com/Qyriad/fusee-launcher/blob/master/report/...

This writeup of the bug avoids getting super-duper technical, but it is by necessity somewhat technical. The absolute simplest explanation goes something like this:

Yeah, all the console manufacturers have some pretty crap design choices one way or another, especially about security... and not saying that switch is entirely nvdia fault but, that SoC version was plagued with some issues that affected every device that used it

I unfortunately don't have an OMG cable, but don't they run Linux? You could try making a script to run this https://github.com/Qyriad/fusee-launcher

The original Switch uses a Tegra chip code-named "Erista," and it has a serious flaw -- the flaw we use to seize control of the bootloader. You can read a semi-technical overview of it here.

Jailbreaking a Switch relies on a badly-coded recovery mechanism that failed to restrict the size of a USB control request, allowing a stack-smash to take place which then executes attacker-controlled code at the highest privilege level, before privileges are reduced and control is transferred to the Switch's operating system. A more complete, technical treatment of the exploit can be found here.

Dang I’f you have a android phone or tablet that can launch cfw that would be worth a try and also found this https://github.com/Qyriad/fusee-launcher that seems it works for Mac.

u/GeenMachine already has a pretty great answer on this, but if you want a more recent example of a well-secured device being hacked, read into the fusee-gelee exploit on the Nintendo Switch.. Not only is it a hack that exploits the kernel of the Switch, but it is a coldboot exploit meaning that it was impossible to patch until Nintendo released a dedicated hardware upgrade in the form of v2.0 switches.

To confirm I tried to inject hekate (after having formatted my SD following this guide: https://www.youtube.com/watch?v=U2DTVnupXjQ) using https://github.com/Qyriad/fusee-launcher/find/master - unfortunately the launcher didn't do anything after 'smashing the stack' and the switch screen didn't turn on - so pretty confident that it's a patched switch.

The name Fusée comes from the vulnerability found in 2018 that enables all of the homebrew possibilities (https://github.com/Qyriad/fusee-launcher/blob/master/report/fusee_gelee.md). And surely the Fusée payload utilizes that vulnerability.