Slashdot Mirror


Hackers Manage To Run Linux On a Nintendo Switch (techcrunch.com)

Romain Dillet reports via TechCrunch: Hacker group fail0verflow shared a photo of a Nintendo Switch running Debian, a distribution of Linux. The group claims that Nintendo can't fix the vulnerability with future firmware patches. According to fail0verflow, there's a flaw in the boot ROM in Nvidia's Tegra X1 system-on-a-chip. When your console starts, it reads and executes a piece of code stored in a read-only memory (hence the name ROM). This code contains instructions about the booting process. It means that the boot ROM is stored on the chip when Nvidia manufactures it and it can't be altered in any way after that. Even if Nintendo issues a software update, this software update won't affect the boot ROM. And as the console loads the boot ROM immediately after pressing the power button, there's no way to bypass it. The only way to fix it would be to manufacture new Nvidia Tegra X1 chips. So it's possible that Nintendo asks Nvidia to fix the issue so that new consoles don't have this vulnerability.

119 comments

  1. Uhhh... by Anonymous Coward · · Score: 0, Funny

    it reads and executes a piece of code stored in a read-only memory (hence the name ROM). This code contains instructions about the booting process. It means that the boot ROM is stored on the chip when Nvidia manufactures it and it can't be altered in any way after that.

    Did the person writing this not know that ROMs can be reprogrammed such as an EEPROM?

    1. Re: Uhhh... by Anonymous Coward · · Score: 3, Interesting

      I suspect this ROM will be deeply embedded as part of the IC and will be impossible to reprogram; it isnâ(TM)t an eprom itâ(TM)s part of the Silicon.

    2. Re: Uhhh... by darkain · · Score: 1

      Seconding this. From the way things read, it appears to be part of the Tegra chip itself, not a separate chip. However, that doesn't mean it isn't flashable. I'm not sure about this specific implementation, but playing with microcontrollers like ARM or AVR chips, they all have embedded persistent storage banks for code and data on the same die as the processor (and well everything else for that matter, being full SoC)

    3. Re: Uhhh... by Z00L00K · · Score: 1

      Some ROMs are OTP (One Time Programmable), so once you have loaded them they can't be changed.

      The question is if the hole can be easily plugged.

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    4. Re: Uhhh... by ShanghaiBill · · Score: 1

      Some ROMs are OTP (One Time Programmable), so once you have loaded them they can't be changed.

      That used to be common, but is rare today except in super cheap 8 and 4 bit chips. You can usually erase and rewrite programmatically, or using JTAG.

    5. Re: Uhhh... by Anonymous Coward · · Score: 1

      You would have had more credibility if you didn't post with your GOD DAMNED IPHONE

    6. Re: Uhhh... by DontBeAMoran · · Score: 5, Insightful

      When old-timers talk, ROM means ROM. If we meant EEPROM, we would have said EEPROM.

      Now get off the freakin' lawn!

      --
      #DeleteFacebook
    7. Re: Uhhh... by Anonymous Coward · · Score: 0

      Do you want to see my donger? Dang-nabbit, I'm going to show you my donger!

    8. Re: Uhhh... by Anonymous Coward · · Score: 0, Funny

      I'm posting from my Android, itâ(TM)s not my fault Slashdot sucks.

    9. Re: Uhhh... by willy_me · · Score: 3, Informative

      Yes, people now use FLASH memory but place it into read-only mode. It is cheaper when one requires relatively large amounts of memory - as would be required by a ROM. There is probably a way to program the memory if you interrupt the boot sequence before the OS is loaded. One would require a hardware connection - such as JTAG. But from the perspective of the OS, it behaves just like a ROM.

      Or perhaps there is a jumper to enable read/write access. I believe the Asus Chrome Box units protected their boot ROM this way. Only instead of a jumper you had to remove a screw.

    10. Re:Uhhh... by daid303 · · Score: 2

      Unmodifiable early boot rom is very common. The Wii also had it. The Wii also had a bug in it that they fixed in a later hardware version. See http://wiibrew.org/wiki/BootMi...

      The reason for it not being EEPROM is simple. They don't want anyone to modify it, as it's the start of the secure boot process. Allowing modifications on it would defeat the goal of this ROM.

    11. Re: Uhhh... by Anonymous Coward · · Score: 0

      I was going to say - never heard of patch space? Itâ(TM)s not unusual at all to fix boot rom issues with patches. The space is very limited, but can certainly be used to plug critical holes.

    12. Re: Uhhh... by Anonymous Coward · · Score: 0

      Nintendo can (and has) upgraded the bootchain since this hack was released, but there are other flaws that they can't fix without a hardware revision.

      Sadly, the sleep bug is fixable without breaking backwards compatibility, and because it can be used to dump the system's encryption keys, they will patch it. So using it as an entry point is going to be limited to systems with the bug. Although I'd imagine the damage Nintendo wants to prevent is done. They can update the key index to use by changing the boot loader version, but dumping keys is possible and any future update to change the index would be decryptable by older (exploitable) versions. (Even if you had to chain the exploits and step through the code in IDA to do so.)

    13. Re:Uhhh... by wonkey_monkey · · Score: 1

      Did the person writing this not know that ROMs can be reprogrammed such as an EEPROM?

      Did the person writing this not know that not all ROMs are EEPROMs? And that even if they are, if they are not exposed as such to the operating system then the operating system will not be able to reprogram them?

      --
      systemd is Roko's Basilisk.
    14. Re: Uhhh... by Anonymous Coward · · Score: 0

      Liar, androids don't fuck up characters.

    15. Re:Uhhh... by Anonymous Coward · · Score: 0

      It's very likely they want to make this claim because it makes Nintendo nervous that their system will end up being a piracy-box-of-choice like the existing nVidia shield is.

      That said, it's probably erroneous that it unpatchable. It can very likely be patched, and if it can't, it still doesn't mean the system is usable for anything. The only thing unique to the Switch that the Shield doesn't have is how the controller works. You get no benefit to running Linux on it any more than a DC, PS2/PS3, or Xbox.

      However it does open up one practical use that might otherwise be better done with the Shield, and that is directly using it to play video simultaneously on the device screen and plugged in screen. The shield does not have a touch screen. So as a projection device it would be a fair bit more useful than the current state of "plug in a laptop and use a wireless mouse backwards"

    16. Re: Uhhh... by Anonymous Coward · · Score: 0

      Burnable fuses are very common in generic processors. Apply a higher voltage to a few pins and nothing can be reprogrammed on die anymore.

    17. Re: Uhhh... by JustAnotherOldGuy · · Score: 1

      When old-timers talk, ROM means ROM. If we meant EEPROM, we would have said EEPROM.

      Exactly.

      --
      Just cruising through this digital world at 33 1/3 rpm...
    18. Re:Uhhh... by Anonymous Coward · · Score: 0

      I didn’t say all ROMs were PROMs. That was something stupid you made up. But just because something is a ROM does not by itself mean it can’t be changed.

    19. Re: Uhhh... by AmiMoJo · · Score: 1

      It really depends if they actually have the hardware necessary to write the flash memory. It requires a higher than normal voltage, so if the chip wants to have self programming capability then it has to have as high voltage generator.

      While this hardware is cheap it's not free, and carries risks. It can accidently erase or corrupt the flash memory. To mitigate that you need brown out protection, but even that isn't perfect so you will see a higher failure rate.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    20. Re: Uhhh... by Anonymous Coward · · Score: 0

      ROM === ROM && EEPROM === EEPROM && ROM != EEPROM

      All three are true.

    21. Re: Uhhh... by Highdude702 · · Score: 1

      I'm not even old, but been into electronics long enough, that when I read that I thought exactly the same thing(He would have said EE/EPROM had he meant it) If this was not already +5 insightful, I would have added one.

    22. Re:Uhhh... by drinkypoo · · Score: 2

      But just because something is a ROM does not by itself mean it canâ(TM)t be changed.

      If it's actually a ROM, that's exactly what it means. And even if it's a flash ROM that there's no way to write without attaching external hardware, then from the standpoint of a user who doesn't want Nintendo to patch away the vulnerability, it might as well be a mask ROM.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    23. Re:Uhhh... by Megane · · Score: 1

      It's a direct quote from TFA, and it reads like it was written for third-graders. Not very crunchy.

      --
      #naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
    24. Re: Uhhh... by Anonymous Coward · · Score: 0

      However, that doesn't mean it isn't flashable. I'm not sure about this specific implementation, but playing with microcontrollers like ARM or AVR chips, they all have embedded persistent storage banks for code and data on the same die as the processor

      You're correct that this doesn't mean it is (or isn't) flashable.

      But while most if not all microcontrollers let you flash the persistent memory on chip, if you've played with AVRs enough you've probably heard about the "fuse bits" that are on-die.

      Basically in the chip itself there are connections that are in essence fuses.
      Normally you take a power rail through a current limiting resistor and then through one of these fuses. On the other end of the fuse, you can use the output directly for other on-die components, or through a pull down resistor to ground to become a bit to read in the CPU circuitry.

      In the case of the on-die flash, there is a fuse that powers the "flash write" circuits.
      The programming interface allows you to send the full VCC current into the fuse, vs the normally resistor limited VCC current.
      This blows out the fuse and breaks the connection between power and the flashes write circuits.

      Once the fuse is blown, whatever was programmed into the flash is in essence permanent.
      The circuitry on the chip die required to overwrite the current values in flash can't be powered and so it can't function, making it read only.

      I haven't looked at the leaked SoC documentation so can't say if it has write protect fuses, or even if it does if nintendo utilized them.

    25. Re:Uhhh... by Anonymous Coward · · Score: 0

      I didnâ(TM)t say all ROMs were PROMs. That was something stupid you made up. But just because something is a ROM does not by itself mean it canâ(TM)t be changed.

      But this article isn't talking about some random "something", we are specifically talking about the SoC used in the switch.

      There is no point in speculating if it is ROM, EEPROM, PROM, or Flash. The documentation is available and answers this question directly.

      The storage is Flash memory, where the flash write circuitry on-die is powered through a fuse bit.
      After programming the fuse is blown so the flash write circuits on the die can never get power again to function.

      So the memory itself is Flash, but now without a "write" pin anywhere, which makes the data in it read-only.

      The only places in the world capable of doing anything about that, and a mindbogglingly crazy high expense, are chip foundries with both 28nm fabbing hardware, as well as the necessary electron microscopes and chip decapping equipment.
      "Fixing" would require quite literally rearranging the transistor junctions in the already doped wafers that make up the SoC silicon.

      It would literally be cheaper to have your very own run of a million chips directly from NVidia than it would be to usefully re-enable write functionality to the on-die flash.
      (Yes, yes that would cost many billions of dollars. And yes, I was not exaggerating saying that is the "cheaper" option. Rework on a 28nm already doped into silicon wafer chip will easily be hundreds if not a thousand times more expensive)

    26. Re: Uhhh... by willy_me · · Score: 1

      It really depends if they actually have the hardware necessary to write the flash memory. It requires a higher than normal voltage, so if the chip wants to have self programming capability then it has to have as high voltage generator.

      While this hardware is cheap it's not free, and carries risks. It can accidently erase or corrupt the flash memory. To mitigate that you need brown out protection, but even that isn't perfect so you will see a higher failure rate.

      All the SOC chips out there already require multiple power rails at various different voltages. Managing all the power rails is a real pain - TI and others make ICs with internal LDOs and DCDC switches to simplify the process. So all SOCs will all have access to the 3.3V / 1.8V rails required to write to FLASH. Without this, they would never be able to support a USB transceiver.

      The FLASH memory will not require additional hardware for writing - the controller will include all required components. The SOC will simply interface using quad-SPI or some other standardized bus. Unless they have specific reasons to make it complex, they will use a licensed IP module for FLASH memory and that is it. Making it a true ROM would add to the cost and complexity - significantly. WIth transistor budgets the way they are, savings from a read-only ROM are non-existent. Costs associated with an error in ROM that could have been fixed had it been FLASH - scary high.

    27. Re: Uhhh... by Anonymous Coward · · Score: 0

      Those are blown with a higher voltage as well.

    28. Re: Uhhh... by Anonymous Coward · · Score: 0

      Fix it in future versions of the nintendo switch... Yes yes.. by all means... god forbid that the damn overpriced mini console would become even remotely useful

    29. Re: Uhhh... by AmiMoJo · · Score: 1

      3.3v isn't enough to write cheap flash memory.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    30. Re: Uhhh... by marcansoft · · Score: 1

      Little ARM and AVR chips almost always have embedded Flash memory, and high-performance chips like x86 CPUs and mobile phone SoCs almost never do. It has to do with silicon technology. It is not practical to put Flash memory into a cutting edge silicon process for a bunch of technical reasons.

      So yes, it's ROM. Mask ROM. Not writable.

  2. Re:Women love fat men by Anonymous Coward · · Score: 0

    And bald with terrible comb overs.

  3. Guess my perspective is different by oldgraybeard · · Score: 4, Insightful

    "have this vulnerability" duh! a vulnerability?

    Anything I can re-purpose by loading Linux on it is a plus in my world ;)

    Just my 2 cents ;)

    1. Re:Guess my perspective is different by Z00L00K · · Score: 4, Interesting

      And is this a vulnerability to the Nintendo software and games? To me it looks like it's just a re-purposing of the hardware.

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    2. Re:Guess my perspective is different by Anonymous Coward · · Score: 4, Informative

      It could also be used to implement a custom bootloader stage that loads the next stage of Nintendo's OS, but ignore a bad signature so that it could have been modified to allow running pirated games. This is every bit as serious as the "sighax" one on 3DS -- a similar unpatchable vuln in the bootrom burned into the CPU -- except that sighax was discovered late in the product cycle.

  4. Not a vulnerability by Anonymous Coward · · Score: 4, Insightful

    You have to physically put something on the device to make it work in this way. Being in control of a device you physically control isn't a vulnerability, it's a feature. Being in control of a device because something something network internet packet is a vulnerability.

    1. Re:Not a vulnerability by Anonymous Coward · · Score: 0

      It's a vulnerability to the developers economic model. That is they get their ROI from selling games. If everyone can get a cheap copy easily then we end up like the mobile space. Ads, gambling through loot boxes, in game purchases, product placements, and spyware galore.

    2. Re:Not a vulnerability by Anonymous Coward · · Score: 0


      Being in control of a device you physically control isn't a vulnerability, it's a feature.

      It can be both. It's a vulnerability for Nintendo, which wants iron-fist control of their hardware to prevent piracy. It's a feature for end users who want the exact opposite.

    3. Re:Not a vulnerability by Anonymous Coward · · Score: 0

      No, this is a vulnerability. You're describing a remote vulnerability.

  5. Re:Women love fat men by PopeRatzo · · Score: 1

    Long as the wallet is fat.

    --
    You are welcome on my lawn.
  6. Imagine a beowulf cluster of these by Anonymous Coward · · Score: 0

    Running BSD until it's dying.

  7. Re:Women love fat men by Anonymous Coward · · Score: 0

    A BBW is made for a BBC.

  8. Congratulations! by Anonymous Coward · · Score: 1

    You used "Hacker" in the correct context!

    1. Re:Congratulations! by Anonymous Coward · · Score: 0

      Look at you, hacker: a pathetic creature of meat and bone.

  9. Re:Women love fat men by fizzer06 · · Score: 1

    Long as the wallet is fat.

    The only bulge in my pants the ladies seem to care about.

  10. You can run Linux on it, because of vulnerability by Anonymous Coward · · Score: 2, Interesting

    This is not something to celebrate.

    In the old days, when people said "Hackers got Linux running on a toaster", it meant that some clever people spent some time figuring out how to write hardware-specific Linux components for the toaster; it meant that Linux was improving, and growing.

    Today, when people say it, they mean that some shady group of people used some shady techniques to exploit a bug in the toaster, and if you want to do the same on your toaster, then you'll probably have to download from some shady website a shady black-box binary blob that will run the exploit for you, without you ever really knowing just WTF is going on; it means that personal computing is further collapsing.

  11. Re: You can run Linux on it, because of vulnerabil by Anonymous Coward · · Score: 0, Insightful

    Oh shut the fuck up Grandpa.

  12. Hackers? Illegal only if you brag about it. by Anonymous Coward · · Score: 0

    Term hackers implicates those involved in criminal activity. I know that doing this to your property cannot be a crime. So LONG AS YOU DON'T TELL ANYONE!

    1. Re:Hackers? Illegal only if you brag about it. by Anonymous Coward · · Score: 0

      No it doesn't. There was a period in the 90's when mainstream media misused the term "hackers" to imply cracking, but that meme died out with newspapers. In this era every media outlet writes glowing articles about "lifehacks", "jobhacks", or even fucking "ikeahacks". And every tech company from Apple on down boast to their shareholders of their hacker credentials. "Hacker" is a respectable and high status term.

  13. If you have to explain by Anonymous Coward · · Score: 1

    That Debian is a Linux distro and what a ROM is, perhaps this isn't an article meant for slashdot.

    1. Re:If you have to explain by DontBeAMoran · · Score: 1

      What is this? An article for ANTS?!

      --
      #DeleteFacebook
    2. Re:If you have to explain by hduff · · Score: 1

      What is this? An article for ANTS?!

      MakeArcherReferenceAboutThis.jpg

      --
      "I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
    3. Re:If you have to explain by DontBeAMoran · · Score: 1

      ThisWasAZoolanderReference.jpeg

      --
      #DeleteFacebook
  14. They managed? by darthsilun · · Score: 1

    The most common connotation in my half century of speaking English is that they somehow _barely_ did it. At the last minute, with duct tape and baling wire. And who knows, they might not be able to do it again.

    Whereas if they "got Linux running on it", then just say it plainly: they got Linux running.

    I mean WTF, this is like saying someone's "sorta pregnant." No, they're either pregnant or they're not. There is no half pregnant. There is no "managed to run it.". It's running. Case closed. End of Discussion.

    1. Re: They managed? by Anonymous Coward · · Score: 0

      The opinionated are so opinionated.
      End of every discussion.

  15. Download roms? by iamhassi · · Score: 1

    How long until we can download Switch roms? Sounds like you could even have your own switch store with free roms to download straight to the device

    --
    my karma will be here long after I'm gone
    1. Re:Download roms? by Anonymous Coward · · Score: 0

      Don't tell anybody, but the 3DS has a free store that downloads the binaries directly from Nintendo's CDN.

    2. Re:Download roms? by mentil · · Score: 1

      Technically, you can already download the ROMs, if you know where to look (some games technically come on NAND chips though). The Wii, Wii U and 3ds all had homebrew apps that let you download from a list of other homebrew apps. AFAIK noone bothered making an app that would download pirated stuff, since wherever it links to would be shut down right away.

      --
      Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
  16. Sure, it runs it much slower than the PS4 or Xbox by elrous0 · · Score: 0

    But it's got Mario!

    --
    SJW: Someone who has run out of real oppression, and has to fake it.
  17. Hackers Manage to Run Linux on. . . by RazorSharp · · Score: 2

    Hackers Manage to Run Linux on X is probably to most common beginning to a /. headline. As long as new devices are manufactured, nerds will make them run Linux. Imagine if all these countless man hours were spent making Linux work on PCs.

    --
    "From the depths of my skeptical and rationalist soul, I ask the Lord to protect me from California touchie-feeliedom."
    1. Re:Hackers Manage to Run Linux on. . . by Anonymous Coward · · Score: 0

      I think Linux already runs on PCs.

    2. Re:Hackers Manage to Run Linux on. . . by mentil · · Score: 2

      X runs on Linux, not the other way around.

      --
      Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
  18. Could mean kernel runs but drivers don't by tepples · · Score: 1

    There is no half pregnant.

    Depending on context, more precise terms could be any of the following:

    • Pregnant with one offspring, in a species that ordinarily produces litters of 2
    • Pregnant with offspring missing its hind limbs, as an analogy to the term "half lady" formerly used for circus performers missing both legs high above the knees. These include Jeanie Tomaini (then) or Jen Bricker (now).
    • Halfway to term in pregnancy

    There is no "managed to run it.". It's running.

    "Barely running Linux" is likely to mean running without driver support for the hardware features that an end user would expect to be able to use with a port of Linux. A Linux system without input, accelerated graphical output, audio output, persistent file system, networking, or power management is a starting point. But until it's shown running an application as a proof of concept, such as something using SDL, it's still in a state that one could describe as "barely" or "managed to".

    1. Re:Could mean kernel runs but drivers don't by JustAnotherOldGuy · · Score: 1

      There is no half pregnant.

      Depending on context, more precise terms could be any of the following:

      No, no, no. "Pregnant" is an absolute term, like "dead" or "unique" or "zero". There's no "half pregnant", or "almost unique" or "half zero".

      (Yes, people use the term "half dead", and it indicates imprecise thought. People also say shit like "really unique", and that's also ignorance at play.)

      --
      Just cruising through this digital world at 33 1/3 rpm...
    2. Re: Could mean kernel runs but drivers don't by Anonymous Coward · · Score: 0

      I will just leave this here.

      https://dcmontreal.wordpress.com/2013/04/27/an-absolute-shame-degrees-of-unique/

  19. BFD by Hugh+Jorgen · · Score: 0

    It's already running a BSD variant ... Yawn ...

  20. Wow. by Anonymous Coward · · Score: 0

    So, you didn't bother explaining what "LCS" meant in the article a few days ago, but you thought you had to tell us what DEBIAN was? FFS slashdot, WHO THE FUCK IS YOUR AUDIENCE?

    1. Re:Wow. by Anonymous Coward · · Score: 0

      I stopped reading at Debian, I now see I should have read the whole thing.

      You thought you had to explain what fucking ROM stands for? FUCK YOU SLASHDOT.

    2. Re:Wow. by hduff · · Score: 1

      So, you didn't bother explaining what "LCS" meant in the article a few days ago, but you thought you had to tell us what DEBIAN was? FFS slashdot, WHO THE FUCK IS YOUR AUDIENCE?

      Debian/Ubuntu, et al fanbois, it seems are the audience they are looking for.

      --
      "I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
    3. Re: Wow. by Anonymous Coward · · Score: 0

      Even worse. They said ROM is the name of read only memory. It's an acronym...not a name.

  21. No worries by Anonymous Coward · · Score: 0

    There'll be Rev. B.

  22. A new Tegra chip for Switch 2018 by Anonymous Coward · · Score: 0

    I have it on good authority that Nvidia is manufacturing a variant of the Tegra X1 just for the Switch. It is identical in every way except lower power (16FF process) and several security fixes are incorporated.

    I predict any Switch bought after Black Friday 2018 is going to be immune to these hacks as it will be a new chip with a [potentially] a new Boot ROM.

    This means we have an arms race Between homebrew and Nintendo/Nvidia. If Nvidia can push a new chip out in less than 9 months I really don't see the homebrew/hackers winning this fight.

    1. Re:A new Tegra chip for Switch 2018 by Megane · · Score: 1

      I guess that means I have to buy a Switch now before they come out with an updated boot ROM. I can put it next to the two Wiis I have that haven't even been turned on since Twilight Hack happened.

      --
      #naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
  23. But... by richy+freeway · · Score: 1

    Can it run Linux?

  24. DOOM? by hduff · · Score: 2

    But can it play DOOM?

    --
    "I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
    1. Re:DOOM? by richy+freeway · · Score: 1

      But can it run Crysis?

    2. Re:DOOM? by wonkey_monkey · · Score: 2
      --
      systemd is Roko's Basilisk.
    3. Re:DOOM? by Anonymous Coward · · Score: 0

      Finally, 25 years later!

      Well to be fair, it was released on the SNES in 1995. Though it did require an FX Chip (v2) to boost the console's capability.

    4. Re:DOOM? by Anonymous Coward · · Score: 0

      Only 2016 :(

  25. Mask ROM by Anonymous Coward · · Score: 0

    So this imost likely mask rom embedded in the chip during lithography/etching. New mask would need to be made and new chips etched.

  26. why not make it flash rom? by Joe_Dragon · · Score: 1

    why not make it flash rom?

    1. Re:why not make it flash rom? by Megane · · Score: 1

      Because then an exploit could re-program it to be even more... open.

      --
      #naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
  27. Re:Sure, it runs it much slower than the PS4 or Xb by Anonymous Coward · · Score: 0

    Games > Hardware. I don't care for first-person shooters or sports games. The Switch is perfect for me.

  28. How dare people control the computers they own! by jbn-o · · Score: 3, Insightful

    What you point out is a part of a larger and more significant problem that gets into another /. thread—"What is missing in tech today?". What's missing is an appreciation that computer owners ought to be able to use their computers in the way they wish, fully owning and controlling their own computers. What's present is a focus on relatively minor issues like what gadgets people might find slightly more convenient to use (but apparently not to own).

    Since people want this (the phrase "jailbreaking" is a testament to this; we wouldn't need this term if people enjoyed having their devices "jailed") the corporate proprietor-friendly media (and repeater sites) remind us when covering a story like this in multiple ways: from eschewing any reminder of the freedom to run, inspect, share, and modify published computer software like calling the installed OS "Linux" even when Debian calls their system GNU/Linux and the proper name is on the screenshot (just above the "fail0verflow" textual graphic), to using propagandistic language. There's also suggestion that the code is to be seen as "potential[ly] weak" instead of a means of allowing owners to control their own computers, and blaming fail0verflow should they choose to publish the means by which they installed Debian GNU/Linux on the Nintendo Switch for enabling "homebrew apps and (of course) software piracy". Ridiculous unchallenged and undefended anti-user views throughout which is par for the course in corporate media.

    1. Re:How dare people control the computers they own! by uvajed_ekil · · Score: 1

      Third parties like content providers and software developers are complicit in stopping you form using your hardware as you choose. One example off the top of my head: not being able to run certain streaming apps on rooted Android devices. If you have the audacity to simply take control of your hardware, some unrelated companies won't let you run their software or buy their content. I suppose they have a right to do this, and their terms of service are probably fairly well written, but that doesn't make them right. I suppose they can put what they want in the TOS though, since you don't have a God-given human right to use Netflix or PS Vue (or whatever) on your own terms.

      --
      This is a hacked account, for which the owner can not be held responsible.
  29. Idea to prevent hacking Nintendo Boxes by Anonymous Coward · · Score: 0

    If Nintendo really wanted to keep hackers out of the hardware - they could remove the incentive by allowing an owner installed OS mode. It might be OK for this to be an extra price option.
    Then Hackers would have less incentive to crack and reverse engineer the hardware.

    1. Re:Idea to prevent hacking Nintendo Boxes by pcjabber · · Score: 1

      Sony tried this several years ago with the PS3...and subsequently removed it after the community started to exploit it:
      https://en.wikipedia.org/wiki/...

  30. Re:Sure, it runs it much slower than the PS4 or Xb by Z80a · · Score: 1

    It's a portable gaming system pretending it is also a tv console to pretend nintendo didn't dropped the tv console market.
    But on the other hand, it does have the smallest gap to the consoles a nintendo portable ever did.

  31. Re: Women love fat men by Anonymous Coward · · Score: 0

    Fat man: hey girl, look my Nintendo is hacked!
    woman: oh! My place or your mom's basement?

  32. FTDI chip ? UART bootloader hack ? by thygate · · Score: 1

    There seems to be no requirement to open the console, or even solder, and the picture shows what seems to be a board with an FTDI chip, and 2 wires going to the console. Is it just a UART, and are they getting into the bootloader that way ? If this is all it takes, then I imagine piracy to be rampant soon. https://pbs.twimg.com/media/DV...

    1. Re:FTDI chip ? UART bootloader hack ? by Anonymous Coward · · Score: 0

      There seems to be no requirement to open the console, or even solder, and the picture shows what seems to be a board with an FTDI chip, and 2 wires going to the console. Is it just a UART, and are they getting into the bootloader that way ?

      Well, the joy con controllers have two ways to communicate to the switch console, wirelessly using a modified form of bluetooth, or wired by sliding them onto the sides of the console, where they use a high speed serial link via UART.

      It's quite hard to see the connector on the things, but along the rail at the very bottom, where on the plastic it has some downward pointing arrows. Directly behind those arrows is the connector.

      The switch starts out handshaking with a 1mbit/sec serial link using that. This lets the joycon identify itself and kick up the baud rate to 3.2mbit/sec to start blasting input date to the console.

      This is a 10 pin connector, but the serial part uses the same number of wires as expected for bi-directional hardware flow control.
      There is also a single "sense pin" that the console tells the joycon to not use wireless with.
      The rest are power/ground.

      As the sense line appears to just be a low/high signal, I'd guess they are just using the RX serial pin (receive from the POV of the console that is)

      People have been working on reverse engineering the joy con protocol and enough of the handshaking to get to that point. This info should be easy to google for.

      Going by the image on NintendoLife, if you'll note those various small flex cables barely in view, comparing this to teardown images of the joycons, I am guessing the bulk of the thing snapped on the side of their switch is a real joy con rail and board.

      https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering
      If you scroll down to the header text "Joy-Con to Console Communication" you'll see two pictures.
      A joycon case and rail with the PCB removed, and below just the rail itself.

      The NintendoLife image seems to be one of those rails, with the flex ribbon cable wrapped downwards and I assume out of frame or possibly under the console.
      They are likely taping into the solder points that connect the flex cable to the connector.

      As to what the switch is doing using those ports in the boot rom, and what they ended up having to do over that serial link to exploit it, I have no idea beyond "what kind of sorcery is this?!"

      At least some good news is those solder pads are still of a size that can be soldered to by hand.
      The tiny pitch of the connector pins would be a bitch to work with. I think the tip of my standard soldering iron is about the width of two or maybe three of those pins!

    2. Re:FTDI chip ? UART bootloader hack ? by Megane · · Score: 1

      If there is no requirement to open the console, why is there a strip of flex circuit sticking out of the right side in that picture? Or did they chop up a controller and that flex is from inside the controller?

      --
      #naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
    3. Re:FTDI chip ? UART bootloader hack ? by Anonymous Coward · · Score: 0

      That part is from inside a joycon controller.

      See my post to the same person you replied to, specifically the github link which has pictures of the joycon pcb, and connector rails.

    4. Re:FTDI chip ? UART bootloader hack ? by ledow · · Score: 1

      If true, it may be possible to just get a "mod controller" box that just replaces one of the controllers for a one-off exploit.

      I suppose it's possible that the nVidia chip involved has an exploit which is somehow possible to activate via a shared bus that happens to include the serial comms of the controllers. It would seem a bit silly, in design terms, but I suppose it's feasible.

      To be honest, I never get why console manufacturers go to such lengths anyway. Go the Android route - if your phone is rooted, we can detect it and deny access to the store. If it's not, you can play ordinary games. If someone is prepared to switch back and forth between the two, let them, it means they are still paying for and playing normal games. If someone buys it just to hack it for homebrew, you aren't going to stop them but at least you get a hardware sale of YOUR hardware rather than "easier-to-hack rival".

    5. Re:FTDI chip ? UART bootloader hack ? by drinkypoo · · Score: 1

      To be honest, I never get why console manufacturers go to such lengths anyway.

      Nintendo picks up a licensing fee for every official game sold on the console, so they are highly motivated to keep you purchasing licensed titles.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  33. Nothing on me by pooh666 · · Score: 1

    I ran Linuz on a potato clock, next...

  34. Re:You can run Linux on it, because of vulnerabili by Anonymous Coward · · Score: 0

    You don't know that they aren't going to contribute to free software. This hasn't been released yet so we don't know what license they will use, but the nintendo hacking community is pretty open. All of the major 3DS hacking tools are hosted on github for crying out loud, you can compile them yourself if you don't trust downloading a binary from a "shady" website (you probably define shady different to normal people based on your usage).

    Furthermore, there was really nothing to celebrate about Linux being hacked to run on a toaster. It's still a fucking toaster, and nothing of value is gained from having a in-kernel driver for a disposable piece of IoT trash. On the other hand turning the Switch into a general purpose computer is a serious improvement, so it's a hack worth celebrating.

  35. Re:You can run Linux on it, because of vulnerabili by Anonymous Coward · · Score: 0

    But I bought the toaster. What business do you have telling me what I can do with the toaster regardless of whether I people, shady or otherwise, helping me do what I want with my toaster. Did you become the toaster police?

  36. Highly detailed technical analysis .. by najajomo · · Score: 1

    "when your console starts, it reads and executes a piece of code stored in a read-only memory (hence the name ROM)"

    It's highly detailed technical analysis like the above that I come here for.
    --

    sig: I'll bet you're the kind of guy that hangs round Reddit fapping off over pictures of furries and yellow-scaled wingless dragonkin

  37. Re:Sure, it runs it much slower than the PS4 or Xb by elrous0 · · Score: 1

    This is true. It's basically Nintendo's backdoor way to exit the console market while saving face.

    --
    SJW: Someone who has run out of real oppression, and has to fake it.
  38. Lots of assumptions by people outside the industry by Anonymous Coward · · Score: 0

    I work on SoCs for a living. these things often have write-once fuses that let you replace small sections of the on-chip boot rom. It's not unusual to be limited to around 1024 bit. You can usually do this in the field, but not always.

    If there really are no fuses, then changing boot ROM is a metal layer change (ECO). You can definitely do in manufacturing for a current product line without it being horribly expensive. It doesn't resolve devices in the field.

  39. Drivers, or putting the cart before the GNU by tepples · · Score: 1

    from eschewing any reminder of the freedom to run, inspect, share, and modify published computer software like calling the installed OS "Linux" even when Debian calls their system GNU/Linux and the proper name is on the screenshot

    I too write the term "GNU/Linux" in part because it's a convenient way to say I don't mean Android. But this particular point isn't quite the strongest in your argument because practically, until enough drivers are ported to let the user interact meaningfully with the GNU operating environment, it's still "Linux".

    1. Re:Drivers, or putting the cart before the GNU by marcansoft · · Score: 1

      Not only that, 0% of the effort has to do with the GNU part. The article title is accurate in using the term Linux. You get the kernel to run, then you grab a binary userspace from your favorite distro. Linux is what matters. The rest follows automatically because it is barely hardware specific if at all.

      You only port GNU/Linux once to any given architecture. After that, all devices using the same architecture only require porting Linux to them.

  40. Fuck by Anonymous Coward · · Score: 0

    Who the fuck wrote this bullshit?

  41. Re:Sure, it runs it much slower than the PS4 or Xb by Anonymous Coward · · Score: 0

    It's a weak console pretending to also be a portable.

    The key to the portable market has always been having a device that fits in a pocket. Switch is enormous for a portable, which greatly limits its portability. It's intended for using when someone else is using the TV, not for carrying with you.

  42. Re:Women love fat men by Anonymous Coward · · Score: 0

    Women love fat men at the same rate that black men love fat white women. It isn't universally true that women love fat men, nor that all black men love fat white women, but the rate of white men loving fat women is much lower. Source: America.

  43. Re:Sure, it runs it much slower than the PS4 or Xb by mentil · · Score: 1

    It seems to me that Switch owners either use it predominantly as a handheld or as a portable, few actually 'switch' it up that much. Some people hate tiny screens, others hate cramped controls, others hate sitting in one spot or gaming at home. An unusually powerful handheld that gets all of Nintendo's AAA games means I only have to buy 1 Nintendo device each generation, instead of two, to get all the stuff I want.

    --
    Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
  44. Re:You can run Linux on it, because of vulnerabili by Anonymous Coward · · Score: 0

    But I bought the toaster. What business do you have telling me what I can do with the toaster regardless of whether I people, shady or otherwise, helping me do what I want with my toaster. Did you become the toaster police?

    You're looking at this all wrong. Nintendo can't stop you from hacking YOUR Switch, but they have every right to try to prevent you from doing so. The same thing applies to toasters. If hacking a toaster/Switch involves publishing or reveres-engineering code, then you might run afoul of copyright laws if you help other people do it, but that still doesn't mean you can't hack your own.

  45. Re: You can run Linux on it, because of vulnerabil by Anonymous Coward · · Score: 0

    If the damn switch was even remotely useful and priced sensibly in the first place. . Then people wouldn't need to hack it

  46. Re:Sure, it runs it much slower than the PS4 or Xb by ledow · · Score: 3, Informative

    To be honest, I've enjoyed the vast, vast majority of my gaming life on systems that would be considered so laughably slow and obsolete now that people wouldn't take them off your hands for free.

    It didn't once affect my enjoyment of the games, my enjoyment of replaying the games, or the nostalgia of going back to those same games 30 years later (whether on original hardware or via emulation).

    If you think that anyone who plays games care about how many MHz or how many CUDA cores or how much texture RAM a certain device has, you're sadly in the minority. I gamed through the home computer rivalries, the 8-bit and 16-bit rivalries, PC vs console, online vs local LAN, etc. and not once did I ever care about having what was technically best, compared to what played the games I most enjoyed.

    Nintendo are pretty much the only modern console company that get this. All their effort goes into the game design and new, fun twists, rather than what texture fill rate they can achieve.

    Even in my "PC gamer" years on my twitch-shooters, I still didn't really care about those people who bought the top-line gear, overclocked everything, etc. just to get a few more FPS or a lower ping. It was the game that mattered.

    Same as car-nuts. I'm sure your car does 0-60 in some unfathomably trivial fraction of a second faster than mine. But that's not why I bought the car. Don't put your use case onto me, or entire markets of billions of people who "just want to play a game with the kids".

  47. Dual boot Android by XSportSeeker · · Score: 1

    Call me when they have a dual boot ready for Android, or more specifically, using the Switch as a full nVidia Shield TV.
    I mean, I'm getting one anyways, but that would certainly double the value in my page. xD

  48. Re:You can run Linux on it, because of vulnerabili by marcansoft · · Score: 1

    Yes, because when I put Linux on a PS4 I certainly didn't spend several months figuring out how to write hardware-specific Linux components for the PS4.

    Oh, wait, I did. I also happened to reverse engineer the Radeon GPU microcode instruction set. So now every AMD Radeon user can benefit from being able to understand what their GPU firmware is doing, which they couldn't in the past.

    But hey, I guess GitHub is some shady website that serves shady black box binaries, and implementing kexec as a hot-patchable module for the FreeBSD kernel is a decidedly shady technique. Right.

  49. Re:You can run Linux on it, because of vulnerabili by marcansoft · · Score: 1

    Jesus, how did I manage to fuck up the links so badly. Link, link, link. And some bonus stuff.

  50. Re:Sure, it runs it much slower than the PS4 or Xb by Anonymous Coward · · Score: 0

    Funny then how I and several people I know never actually use it as a handheld device (I've tried it out for 5 minutes once just to try it). There goes your narrative! Oh well.

  51. Re:Sure, it runs it much slower than the PS4 or Xb by Anonymous Coward · · Score: 0

    Funny how this so called underpowered hardware runs a game that looks visually better than literally anything on either of those systems. :) I'm sorry your big boy console isn't as popular as mean old Nintendo's, why don't you go cry to mommy about it, precious little thing.

    Xbox and Playstation are pointless plastic boxes. I have a PC already.

  52. how usable by sad_ · · Score: 1

    how usable will this turn out the be?
    the nvidia tegra soc has horrible linux kernel support.
    it even made Linus flip the finger at nvidia.

    --
    On a long enough timeline, the survival rate for everyone drops to zero.
  53. financial implications for Nintendo. by JustNiz · · Score: 1

    > It could have some financial implications for Nintendo.

    Yeah they might sell more switches since they've now just become useful.