There is an easy workaround developed by the Switch homebrew community, simply upgrade from within a custom firmware (such as Atmosphere-NX) and run a tool called ChoiDuJourNX which bypasses the fuse-burning.
If you're careful you can keep a backup trail going all the way back to your original device firmware and restore/downgrade it using the Hekate system tool. It has already been pointed out that there isn't much reason to do this, AFAIK the main reason people either held out on older firmwares or kept up a backup trail to them was in order to take advantage of possible firmware-version-specific exploits, the gold standard being a coldboot exploit.
The reason this "easy workaround" works at all is that there is a BootROM exploit that trivially allows running arbitrary code in the BootROM. This allows us to run our own bootloader instead of Nintendo's, bypassing their fuse burning logic. Had Nvidia not fucked up their USB implementation (along with other part of their platform), this would have been harder to bypass.
And for those who stayed on the 4.1.0 fuseset (or certain versions below that) there are warmboot exploits available. So those who are able to "normally" boot those firmwares do not need to use AutoRCM (or an RCM-"jig") to access RCM anymore.
Why is the upside only to Nintendo? If Nintendo can maintain a proper "hack free" device more third parties will be willing to release their games on the Switch - as a consumer my upside is that I get the games.
Justify to whom? I am a consumer and this is irrelevant to me. And Nintendo has always been aggressively fighting emulation/homebrew, so it is nothing new.
I don't think it's quite as cut and dry as that. In some sense, the restrictions _enhance_ THE thing I bought it for - playing a wide range of games. A platform where piracy is trivial is less attractive to some publishers, which may mean they don't release games there, or release later than on other platforms. If the largely theoretical benefits of a more open platform (I'm simply not interested in using the hardware for other purposes, whether I can or not) cause even modest damage to the range of games available, that's not a good trade off for me.
Sony[1] with the PSP claimed that:
> There's a number of titles from American publishers that will be there, but are we getting full-line support? No. I'm not going to bullshit you on that.
> A lot of the stuff that will be announced at E3 we're very excited about, because they are huge titles. And we also believe that there's a way that you will be able to, not stop, but slow down the piracy in the first 30 to 60 days from a tech perspective. [...] That's been the biggest problem, no question about it. It's become a very difficult proposition to be profitable, given the piracy right now.
Of course they're incentivised to portray piracy as damaging to the platform even if it isn't changing publisher decision making to any significant extent, but it's an argument that makes sense, and I find it difficult to believe that it wasn't dampening publisher enthusiasm to at least some extent.
In some ways, I'd like to see a phased path to openness, where say ten years down the line or when official support is dropped, some of the barriers are taken away (most platforms get there anyway due to third party efforts, and as Sony allude to above, _slowing_ piracy can be sufficient), even if only to aid game preservation and avoid games being forever tied to a particular physical hardware platform.
The switch is 3 years old and - as the other comments have noted - this technique is much older. Yet, on a website for self-styled hackers, so many are learning about it for the first time. Did people really care that much?
If the device depends on write-once ROM that was written in the factory, is that also anti-consumer?
This is not anti-consumer as consumers don’t care, nor running homebrew or pirated games are supported or advertised features. This is something that target precisely people who doesn’t want to be consumer: those that want to get and play games for free. Now, there is also the very very minor homebrew community, which should buy a devkit instead if running code is their main goal.
As far as i know Nintendo is the only console maker still having region locks and being extremely fussy about transferring your purchases when your hardware dies/is replaced.
I'd call THAT anti consumer.
Correct me if i'm wrong, but that's the impression I got from reading here and there and the reason I don't own Nintendo products.
> There are 256 bits in the set of ODM_RESERVED fuses, and there are 8 ODM_RESERVED. This allows for 32 fuses, or 32 future FW versions (provided they burn a fuse on every major release).
Can someone explain how the author gets from the numbers 256 and 8 to the count of 32 fuses?
Fuses are in 32 bit words. There are 8 such words available for ODM usage, giving a total of 256 fuse bits. However, of those only one word is used for the anti-downgrade stuff. So that's just 32 firmware levels.
I'm unclear on how these hardware fuses actually work. Are they actual fuses that can be burnt on will by excessive power?
When the article says:
> The boot loader verifies a specific fuse, FUSE_RESERVED_ODM7, to prevent downgrading. Each software version expects a different number of fuses to be blown [...]
Does this mean FUSE_RESERVED_ODM7 actually contains multiple fuses?
"Fuses" in this context are just non-volatile memory that cannot be reset. Once a bit is set to 1, it stays there. They're often used for configuration and for things like sealing off programming/readout on microcontrollers.
FUSE_RESERVED_ODM7 is 32 bits wide, hence contains "32 fuses". The system has many fuses, but 256 bits (RESERVED_ODM0-RESERVED_ODM7) are for the device manufacturers to use for their own purpose, which is what Nintendo is doing here.
> I'm unclear on how these hardware fuses actually work. Are they actual fuses that can be burnt on will by excessive power?
No, they're not like the fuses in your house. These can be blown by software to irrevocably change something which can then be verified later, or in other cases to prevent reprogramming of a microcontroller (which can be programmed only if the programming fuse is still intact.
>Does this mean FUSE_RESERVED_ODM7 actually contains multiple fuses?
No, that's the name of one fuse. Once you upgrade the device next time, the upgrade tool would, for example, blow FUSE_RESERVED_ODM8; older software would verify that this fuse (and the higher-numbered ones) are NOT blown, and refuse to boot otherwise.
They are produced by lithography and are on the actual die of the system-on-chip that contains the processor. I believe they're IBM's eFUSE technology on Tegra, but antifuses have been used for similar purposes:
> It’s theoretically possible to physically modify the SoC and replace the fuses, but it’s so prohibitively invasive and expensive that it’s not a real option.
Why do they bother with this if someone is going to make a software workaround? Seems like people who would look to downgrade firmware might also be the same that would be able to implement the workaround.
Apathy. The vast majority of consumers won't bother. Also, the Switch's security was actually comparatively solid. It was a flaw in the Tegra X1 (thanks Nvidia!) component that led to an exploit being discovered.
Fuses and OTP are a very common thing to throw in to systems.
Most microcontrollers offer capabilities like this, and now they're drifting into more general purpose, larger SOCs.
Maybe you use it to keep a serial number, or to separate product families, or for something like this.
Tegra's main purpose of the fuses is to handle holding cryptographic keys, boot parameters, and to disable the debug port. But since they have a fuse unit already, they provide a few words for the end-user to use as they please.
I too am curious what "non-retail" means in this context.
Lots of system-on-chip devices have an array of fuses. Usually there's one for "permanently turn off JTAG" after factory testing, and most of the rest will be user-defined. Other uses include embedding serial numbers and cryptographic keys.
One common use case of the fuses is to prevent attack vectors which downgrade software to a vulnerable version. Using the OTP fuses older versions can be prevented from running to some extend.
I don't think this applies to consoles like the Switch. I don't think the average user ever feels the need to revert to an earlier firmware version, and games don't target particular firmware versions. They tend to just work.
As a user, I feel Nintendo has been pretty good about updates: they don't update a lot, and each updates has user facing features with QOL improvements.
It's not in the same situation as iOS updates that were effectively slowing down the devices or Windows Update that don't seem to the user to bring anything.
[+] [-] hd4|5 years ago|reply
If you're careful you can keep a backup trail going all the way back to your original device firmware and restore/downgrade it using the Hekate system tool. It has already been pointed out that there isn't much reason to do this, AFAIK the main reason people either held out on older firmwares or kept up a backup trail to them was in order to take advantage of possible firmware-version-specific exploits, the gold standard being a coldboot exploit.
[+] [-] roblabla|5 years ago|reply
[0]: https://www.reddit.com/r/SwitchHacks/comments/7rq0cu/jamais_...
[+] [-] rekoil|5 years ago|reply
[+] [-] adrr|5 years ago|reply
[+] [-] Maxious|5 years ago|reply
[+] [-] kiplkipl|5 years ago|reply
This is the reason for threat models. Don't waste your time worrying about theoretical but redundant attacks.
[+] [-] londons_explore|5 years ago|reply
[+] [-] m-p-3|5 years ago|reply
[+] [-] bibabaloo|5 years ago|reply
[+] [-] manojlds|5 years ago|reply
[+] [-] Jonnax|5 years ago|reply
If someone buys it expecting something different that's really on them.
[+] [-] Wowfunhappy|5 years ago|reply
The iPhone bothers me much more because it's a general-purpose computer.
[+] [-] koonsolo|5 years ago|reply
For example increasing the price is always anti-consumer, but it might be part of the deal.
So I don't like to look at products from the perspective of 1 party, since it is always a negotiation between 2 parties where both end up with a win.
[+] [-] orloffm|5 years ago|reply
[+] [-] stordoff|5 years ago|reply
Sony[1] with the PSP claimed that:
> There's a number of titles from American publishers that will be there, but are we getting full-line support? No. I'm not going to bullshit you on that.
> A lot of the stuff that will be announced at E3 we're very excited about, because they are huge titles. And we also believe that there's a way that you will be able to, not stop, but slow down the piracy in the first 30 to 60 days from a tech perspective. [...] That's been the biggest problem, no question about it. It's become a very difficult proposition to be profitable, given the piracy right now.
Of course they're incentivised to portray piracy as damaging to the platform even if it isn't changing publisher decision making to any significant extent, but it's an argument that makes sense, and I find it difficult to believe that it wasn't dampening publisher enthusiasm to at least some extent.
In some ways, I'd like to see a phased path to openness, where say ten years down the line or when official support is dropped, some of the barriers are taken away (most platforms get there anyway due to third party efforts, and as Sony allude to above, _slowing_ piracy can be sufficient), even if only to aid game preservation and avoid games being forever tied to a particular physical hardware platform.
[1] Specifically, Sony Computer Entertainment America's then senior vice president of publisher relations, Rob Dyer - https://www.gamasutra.com/view/feature/133097/the_sony_situa...
[+] [-] kiplkipl|5 years ago|reply
If the device depends on write-once ROM that was written in the factory, is that also anti-consumer?
[+] [-] tasogare|5 years ago|reply
[+] [-] nottorp|5 years ago|reply
I'd call THAT anti consumer.
Correct me if i'm wrong, but that's the impression I got from reading here and there and the reason I don't own Nintendo products.
[+] [-] wolfgke|5 years ago|reply
Can someone explain how the author gets from the numbers 256 and 8 to the count of 32 fuses?
[+] [-] marcan_42|5 years ago|reply
[+] [-] nitrogen|5 years ago|reply
[+] [-] outadoc|5 years ago|reply
When the article says:
> The boot loader verifies a specific fuse, FUSE_RESERVED_ODM7, to prevent downgrading. Each software version expects a different number of fuses to be blown [...]
Does this mean FUSE_RESERVED_ODM7 actually contains multiple fuses?
[+] [-] arghwhat|5 years ago|reply
FUSE_RESERVED_ODM7 is 32 bits wide, hence contains "32 fuses". The system has many fuses, but 256 bits (RESERVED_ODM0-RESERVED_ODM7) are for the device manufacturers to use for their own purpose, which is what Nintendo is doing here.
[+] [-] pjc50|5 years ago|reply
[+] [-] ThePowerOfFuet|5 years ago|reply
No, they're not like the fuses in your house. These can be blown by software to irrevocably change something which can then be verified later, or in other cases to prevent reprogramming of a microcontroller (which can be programmed only if the programming fuse is still intact.
>Does this mean FUSE_RESERVED_ODM7 actually contains multiple fuses?
No, that's the name of one fuse. Once you upgrade the device next time, the upgrade tool would, for example, blow FUSE_RESERVED_ODM8; older software would verify that this fuse (and the higher-numbered ones) are NOT blown, and refuse to boot otherwise.
[+] [-] dvhh|5 years ago|reply
[+] [-] felipelemos|5 years ago|reply
[+] [-] CodeArtisan|5 years ago|reply
[+] [-] camgunz|5 years ago|reply
[+] [-] mlyle|5 years ago|reply
https://www.semanticscholar.org/paper/IBM-System-z9-eFUSE-ap...
[+] [-] wutbrodo|5 years ago|reply
> It’s theoretically possible to physically modify the SoC and replace the fuses, but it’s so prohibitively invasive and expensive that it’s not a real option.
[+] [-] m101|5 years ago|reply
[+] [-] hd4|5 years ago|reply
[+] [-] mmglr|5 years ago|reply
1. What was the intended use case behind the Tegra having 32 blowable fuses? Did Nvidia intend for those fuses to be used in this manner?
2. What is a non-retail switch?
[+] [-] mlyle|5 years ago|reply
Tegra's main purpose of the fuses is to handle holding cryptographic keys, boot parameters, and to disable the debug port. But since they have a fuse unit already, they provide a few words for the end-user to use as they please.
I too am curious what "non-retail" means in this context.
[+] [-] pjc50|5 years ago|reply
[+] [-] henrikeh|5 years ago|reply
[+] [-] izacus|5 years ago|reply
[+] [-] lkjaero|5 years ago|reply
[+] [-] unnouinceput|5 years ago|reply
[+] [-] classics2|5 years ago|reply
[+] [-] monadic2|5 years ago|reply
[+] [-] slim|5 years ago|reply
[+] [-] syspec|5 years ago|reply
[+] [-] daveFNbuck|5 years ago|reply
[+] [-] hrktb|5 years ago|reply
It's not in the same situation as iOS updates that were effectively slowing down the devices or Windows Update that don't seem to the user to bring anything.
[+] [-] ElCapitanMarkla|5 years ago|reply