How to hak your switch

Seeing the lack of proper guides out there, I've decided to write my own hacking guide here to hopefully help out anyone wanting to attempt this on their own switch. And help to point anyone in the right direction.

SSHnuke is also worth checking out as it has downloads for most of the software this guide uses

Will I get banned by nintendo?

Unless your cheating online, probably not. But it's worth putting your switch into airplane mode while running homebrew apps. I have been running homebrew apps while connected to the internet and I am yet to be banned. Edit: never mind the above, you likely will be banned at some point. Keep your internet off and reset your switch from NAND backups

UPDATE: I am now banned, unable to access Splatoon or e-shop.

Alternately you can use 90DNS which simply redirects all Nintendo internet traffic to a non-Nintendo server.

I have version 6.0 will this still work?

Yes, nintendo cannot fix this bug without direct access to your device, any version should work fine as long as your switch is unpatched (see checking if your switch is unpatched below).

So, assuming you’ve never hacked a switch before here's what you’ll need:

  • A pc preferably running windows 10, capable of reading a micro sd card
  • micro-sd card
  • usb-c to usb-a cable
  • A ‘jig’ (read below)
  • An unpatched Nintendo Switch

Hacking a switch can take quite a while especially if you are planning to run backups, so make sure you have a lot of free time.

First, the Jig

What is a jig?

A Jig is jumper that connects between the first and last pin in the bottom of the right joycon rail, connecting these enables RCM mode while your switch is booting. My best guess is that this is feature included by nintendo for quality control purposes during manufacturing, we will be taking advantage of this to sideload our own software.

A Jig can be anything that connects these two pins, like a paperclip, a specially made one from amazon, or you can 3D print your own.

To enter RCM mode you need to:

  1. Power off your switch
  2. Insert the Jig into the right Joycon rail
  3. Press and hold the volume up button, then press the power button.
  4. The switch should silently turn on, the screen will remain blank, if you see the Nintendo logo it did not work re-adjust your Jig and try again.

Checking if your switch is unpatched:

Instructions taken from this guide

To check you will require the Jig to enter RCM mode.

Download TegraRcmGUI and biskeydumpv6.

Open TegraRcmGUI and go to settings > install driver, then run through the install process for the usb driver.

Enter RCM mode using the instructions above

If it worked TegraRcmGUI should report that your switch is in RCM mode

Copy biskeydump into the TegraRcmGUI folder.

Copy the folder location from the address bar,

Open a new command prompt window as administrator and enter: “cd [paste file location]”

Run the command: “TegraRcmSmash.exe -w biskeydump.bin BOOT:0x0”

If your switch is showing a QR code, your switch is unpatched. If it isn’t your out of luck :( (for now at least)

Sideloading

Now RCM mode is useless without anything to sideload onto the switch.

So we need to sideload a bootmenu, the two best options is either sx-os or hekate. I suggest following their guides from this point on as the steps can differ a bit.

sx-os allows you to run custom firmware without paying but in order to run their homebrew menu you will need to pay, however you can run the normal homebrew menu by holding R and selecting the album menu.

Hekate is a free boot menu with a few custom features like dumping switch keys. Hekate does not include a custom firmware so you will need to find one (Such as ReiNX).

ReiNX also includes a boot menu with it's download. You will require the ReiNX Toolkit to enable features like autoRCM

Atmosphere is a new custom firmware with custom theme support. To load atmosphere place the contents of the zip file onto the root of your sd-card, then load fusee-primary.bin with TegraRcmGUI.

To sideload them you need to enter RCM mode and use TegraRcmGUI, simply download and select the payload, then hit inject and you should see a menu appear on your switch.

If your using a paperclip I suggest enabling autoRCM, as it will save you lots of time fiddling around to get it in the right spot. However this can lead the switch reporting incorrect battery levels, hekate does include a battery de-sync fix.

I also suggest creating NAND backups at this point, as you might accidentally corrupt the normal firmware.

Homebrew

To install homebrew apps and games, first you will need to install the homebrew launcher. Go to https://www.switchbru.com/appstore/ and download the two loaders (Homebrew Menu and Homebrew App Store). Extract the zip file and place hbmenu.nro in the root of your sd card, then extract appstore.zip and place the switch folder into the same location. Put the sd card back into your switch and launch the homebrew menu.

To open the homebrew menu open the album app on the the homescreen, sx-os will try to open its own menu so hold the right bumper and then open it and you should see the homebrew menu screen with the app store as your only application. To open the normal album hold the left bumper.

Atmosphere requires hbloader (hbl.nsp) in the /atmosphere/ folder to load the homebrew menu.

.xci

There's two ways of installing an .xci game, the first involves buying sx-os and the other involves converting the .xci to a .nsp

sx-os, all you need to do is drag the xci file to the sd card and install using the sx-os homebrew installer. (You will have to pay for sx-os to do this)

Converting a .xci to a .nsp is a bit more of an involved process.

First you will need to get your switch keys off your device, the easiest way to do this is to use kezplez (keys please).

Place kezplez-nx.nro into the switch folder and run the application using homebrew, the app should have generated a keys.txt file on the sd card (switch > kezplez-nx > keys.txt).

Download this XCI to NSP converter and extract the XCItoNSP folder to your desktop.

Place keys.txt into the folder, make two duplicates of keys.txt and rename one to keys.ini and the other to keys.dat.

Place your .xci file into the folder and drag the .xci onto 4nxci.exe.

Once done it should have created folder called 4nxci_extracted_xci and one or more .nsp files with a long name.

Tinfoil

sx-os sometimes has issues with the tinfoil install process, I suggest using ReiNX for this step.

Tinfoil is a homebrew app for installing .nsp files as normal switch games, so that way they appear properly on the home screen.

Download tinfoil and place the tinfoil.nro file into the switch folder on your sd card

Place the sd card back into the switch and run tinfoil through the homebrew menu.

Now put the sd card back into your pc and place either the extracted folder or the .nsp in the appropriate folder (tinfoil > extracted or nsp).

Place the sd card into the switch again and and install using tinfoil (title management > install nsp or install extracted nsp)

The game should now appear on the home menu.

Your installed games will corrupt if you decide to either change CFW or reboot into the normal firmware.

If the game is above 4GB, the fat32 file system will not let you transfer the game onto the sd-card

The best option here is reformat the card to the exFat, to do an exFat format you first need to format the card and place it in your switch to do a small system update then the card should be ready for use.

Or you can use tinfoil's network transfer feature to move the game straight to the switches NAND storage.

Simply open tinfoil on your switch and select network transfer

Run remote_install_switch_pc.py (tinfoil > tools) and follow the steps given by tinfoil.

ChoiDujour

ChoiDujour (and ChoiDujourNX) is a homebrew firmware updater that prevents your system from 'burning fuses'. This can also be used to apply the exfat update without having upgrade to the latest version.

Feel free to correct me or ask any questions about this, I'll be happy to help!

Posted Dec 6, 2018, 1:11 AM UTC

11
Loading comments…