Switch Security Research : un projet de recherche de vulnérabilités sur Nintendo Switch
Salut tout le monde !
Je travaille actuellement sur un projet personnel en C++ appelé **Switch Security Research (SSR)**.
L'objectif est de développer un outil permettant d'étudier la sécurité des Nintendo Switch, notamment les différentes versions de leur firmware, afin d'identifier des vulnérabilités potentielles et d'évaluer leur intérêt en matière d'exploitation.
Le projet prévoit deux composants complémentaires :
# 1. Le NRO
Exécuté directement depuis Horizon OS, il a pour objectif de collecter des informations système et d'effectuer progressivement des contrôles de sécurité sur les ressources accessibles depuis son environnement.
Il devra notamment permettre d'étudier différentes familles de vulnérabilités :
* USB et gestion des périphériques ;
* IPC et communication entre les services Horizon ;
* Gestion de la mémoire ;
* Vulnérabilités connues et vérification des versions concernées.
Une première architecture modulaire est déjà en place. Le NRO compile actuellement, mais son fonctionnement sur une Switch réelle reste à valider et les modules de recherche sont encore en cours de développement.
# 2. Le BIN
Un second composant est prévu pour être exécuté depuis Hekate, avant le lancement d'Horizon OS.
Son objectif sera d'étudier certains éléments de la chaîne de démarrage et les composants accessibles dans cet environnement pré-démarrage.
Les deux composants auront des capacités différentes et devront pouvoir produire des rapports d'analyse compatibles.
# Objectif final
Je souhaite identifier des vulnérabilités de différents niveaux d'exploitation :
* **Niveau 0 :** vulnérabilité identifiée, exploitation non démontrée.
* **Niveau 1 :** possibilité d'exécution de code limitée.
* **Niveau 2 :** possibilité de lancer des homebrews utilisateur.
* **Niveau 3 :** possibilité de charger des sysmodules homebrew.
* **Niveau 4 :** contrôle étendu de la console.
Le niveau 2 constitue notre objectif minimal, mais les vulnérabilités de niveaux inférieurs restent intéressantes si elles peuvent contribuer à une future chaîne d'exploitation.
# Participation au projet
Le projet est open source et distribué sous licence **GPL-2.0-or-later**.
GitHub : [https://github.com/limule-fr/Switch-Security-Resechearch](https://github.com/limule-fr/Switch-Security-Resechearch)
Le développement est actuellement assisté par une IA. Je préfère être transparent à ce sujet. Le code reste public et chacun peut examiner les implémentations, signaler des erreurs ou proposer des améliorations.
Toute contribution, qu'elle concerne le développement C++, la sécurité de Horizon OS, l'architecture de la Switch ou la recherche de vulnérabilités, sera la bienvenue !
Merci d'avoir pris le temps de lire cette présentation. Je partagerai les avancées du projet au fur et à mesure de son développement.
https://redd.it/1xrbbmv
@r_SwitchHacks
[PORT RELEASE] Tekken 3: Definitive Edition for Nintendo Switch (41 Fighters, 28 Arcade 3D Stages, FULL HD 1080p Resolution, Locked 60 FPS on Stock Clocks & FULL SCREEN Compatibility (16:9)
https://redd.it/1xncd1s
@r_SwitchHacks
[Release] Ben 10: Protector of Earth (PSP) – native Switch port via static recompilation, ~30 FPS at 2x resolution
https://redd.it/1xp2pcy
@r_SwitchHacks
[Release] SaveSync 1.0 – sync your saves between Switch and Steam Cloud, directly on the console (67 games, testers wanted)
https://redd.it/1xpebdd
@r_SwitchHacks
Xbox client for Nintendo Switch (homebrew)
/r/xcloud/comments/1r7x392/xbox_client_for_nintendo_switch_homebrew/
https://redd.it/1r7yom6
@r_SwitchHacks
[Homebrew] NFS Most Wanted 2012 (Android port) for Switch – v0.2.8 fixes the crash at start-up on some consoles
https://redd.it/1x6ympr
@r_SwitchHacks
Idea for a universal anti-aliasing solution on Switch
​
Hey everyone,
I've had an idea for a homebrew project and wanted to know what you guys think.
Basically, the idea would be to create a sysmodule that adds a light anti-aliasing effect to Switch games. The goal would be to take advantage of the extra GPU headroom gained through overclocking to make games look a bit cleaner, especially those with really noticeable jagged edges.
Ideally, it would work through an overlay. You enable it, launch a game, and the module automatically applies the effect. You could also turn it off whenever you want.
I'm not talking about anything too demanding. Just a lightweight AA solution, something like FXAA, that smooths out the edges without making the image too blurry or hurting performance too much.
I think games like Persona 5 Strikers, Pokémon Scarlet and Violet, Zelda: Link's Awakening and SMT V could benefit from something like this. Some Switch games look great overall, but the aliasing can be pretty distracting, and a subtle improvement could make them much more enjoyable to look at.
Of course, I know overclocking doesn't give you unlimited performance, and I have no idea how difficult it would be to implement something like this across different games.
So my main questions are: would this even be technically possible? Could a sysmodule inject a post-processing effect into games, or would it require a different approach for each game?
I haven't developed anything yet, so this is just an idea for now. I'd love to hear from anyone who knows more about Switch homebrew, graphics or shader injection.
What do you guys think? Is this worth looking into?
https://redd.it/1x99nfx
@r_SwitchHacks
NFS Most Wanted 2012 (Android) for Nintendo Switch – v0.3.0: dock/undock while playing, Switch buttons in the game
https://redd.it/1xa8gjy
@r_SwitchHacks
Pokémon Omega Ruby running natively on Nintendo Switch through static recompilation — ROSA Native Switch
https://redd.it/1xb05ql
@r_SwitchHacks
[Release] Spider-Man 2 (original Xbox, 2004) for Switch 0.2.0: 720p/1080p, full-screen 16:9 without stretching, and vibration
https://redd.it/1xde81w
@r_SwitchHacks
like](https://preview.redd.it/nxeuxfohqgxh1.png?width=1280&format=png&auto=webp&s=e76ed8290369de056a3e9340a51ee1ddb6d402e8)
[And the quickconnect menu on PC](https://preview.redd.it/7d92ewujqgxh1.png?width=1280&format=png&auto=webp&s=fe39d1cbf53b087a1c99b68fba8ab6e8f0d6f49d)
# 🖥️ Now multiplatform
The same engine and web app now run on:
* **Nintendo Switch** (.nro from hbmenu)
* **PS5** (native dashboard title via ShadowMountPlus)
* **Windows** (.exe, x64, also runs on ARM)
* **Mac** (.app, Apple silicon)
* **Linux** (AppImage, x86\_64 and ARM64)
On a computer you get an app with a sidebar, full mouse support and an **SFTP server** (encrypted, the default) or FTP, so you can send files to and from your Switch with Chiral-FTP on both ends. Android and PS4 are planned. Screenshots of every version are in the README.
This is what the PC version looks like (Mac/Windows/Linux):
📥 Requirements and install
* Atmosphère custom firmware with hbmenu
* Download `chiral-ftp.nro` from the releases page.
1. Copy it to `/switch` on the SD card.
2. Launch it from hbmenu.
**Download and full changelog:** [https://github.com/Herbrax/Chiral-FTP/releases/](https://github.com/Herbrax/Chiral-FTP/releases/)
# 🙏 Credits
This builds on a lot of other people’s work: libnx and devkitPro, ftpd by Michael Theall, NX-Shell by Joel16, libusbhsfs by DarkMatterCore (with NTFS-3G and lwext4), John Törnblom (websrv and ftpsrv), and the Atmosphère team.
I’d love feedback, bug reports and feature requests, especially on other firmware versions, drive formats and Switch models.
https://redd.it/1xegwhj
@r_SwitchHacks
UZDoom port for Atmosphere 1.0 release, play DOOM with mods with real 60fps.
https://github.com/aeon1911/RDoom-NX
https://redd.it/1x5wnf2
@r_SwitchHacks
COD WAW ZOMBIES IOS PORT FOR SWITCH
/r/ModdedSwitch/comments/1x6bhtg/cod_waw_zombies_ios_port_for_switch/
https://redd.it/1x6bi17
@r_SwitchHacks
[Release] Ikemen NX v0.3.0: native Ikemen GO (MUGEN-compatible fighting engine) for Switch homebrew
/r/homebrew/comments/1x7osea/release_ikemen_nx_v030_native_ikemen_go/
https://redd.it/1x7pe75
@r_SwitchHacks
Release Bomberman 64: Recompiled - native Switch port (NSP/NRO, 60 FPS)
I ported Bomberman 64: Recompiled (N64Recomp static recompilation) to the Switch. It's native code, not emulation, and runs at 60 FPS.
⚠️ This is an early release (beta). It's been tested on a Switch OLED, but not everything has been tested yet. Please report any bugs or issues here: https://github.com/paulodiasred/BM64Switch/issues
🎬 Video: https://youtu.be/Wp8GkGGbpl0
\- NSP with a HOME menu icon, or an NRO
\- In-game settings menu: resolution, AA, VSync, CPU clock, controls
\- Includes a Brazilian Portuguese translation
Bring your own Bomberman 64 (USA) ROM.
Release: https://github.com/paulodiasred/BM64Switch/releases/tag/v1.0.0
Source: https://github.com/paulodiasred/BM64Switch
⭐ A star on the repo would mean a lot if you like it!
https://redd.it/1x7xsnc
@r_SwitchHacks
DriftDroid (Native Switch MKWii port) 1.4.0 update for Nintendo Switch)
https://redd.it/1xnb0it
@r_SwitchHacks
Release NXTether - A sysmodule enabling USB tethering from Android devices to your Switch
GitHub: https://github.com/dvnvdx/NX-Tether
Yes, I used AI for this. Sorry (not sorry)
For a while, there was no way for me to get WiFi at my home as no Internet providers provided service in my area and 5G home internet was too slow and unreliable. Using USB tethering on my PC was always faster than just using a mobile hotspot, so I wanted the same functionality on my Switch. Unfortunately, it does not support USB tethering by default (at least I don't think so? At least I couldn't get it to work) so I created this sysmodule to enable tethering. Currently, I have only tested this on an S26 Ultra, reaching speeds of up to 10MB/s (unsure if this is a hardware limitation or not as the module emulates an Ethernet adapter), which was sufficient for my needs. Hopefully anybody who also utilizes USB tethering regularly finds this helpful as it's certainly helped me 🙏
https://redd.it/1xo90fh
@r_SwitchHacks
Compendium 0.0.2: a free Persona mod manager for Switch that installs GameBanana mods and builds the game's CPK on the console, no PC needed (homebrew, test version)
https://redd.it/1xpchpf
@r_SwitchHacks
[Release] Switch Hero 0.4.0 – five-fret rhythm game with career, rival duels, bosses and 2–4 player band mode
https://redd.it/1xqlx4l
@r_SwitchHacks
Is there an American mcgee Alice in maddness returns port or any of the Alice games on the swicth yet
Was playing it on my pc the other day and was wondering if I could get this on a switch for me to play it anywhere cus I'm tired of carrying my PC around
https://redd.it/1xi3omn
@r_SwitchHacks
[Release] Ikemen NX v0.3.0: native Ikemen GO (MUGEN-compatible fighting engine) for Switch homebrew
/r/homebrew/comments/1x7osea/release_ikemen_nx_v030_native_ikemen_go/
https://redd.it/1x7osvq
@r_SwitchHacks
SwitchAirCast – AirPlay receiver for Switch (Mac, iPhone and iPad screen mirroring, YouTube, music...)
https://redd.it/1x9i1u5
@r_SwitchHacks
Jumping Finn Turbo - Switch Port
https://redd.it/1xa40o5
@r_SwitchHacks
SSX Tricky Nintendo Switch Edition - Port of OpenTricky Decomp Project
https://redd.it/1xcgxq2
@r_SwitchHacks
Kirikae: a static recompiler that turns Nintendo Switch executables into native Windows programs, written in Rust with Cranelift
/r/decomps/comments/1xdg7k9/kirikae_a_static_recompiler_that_turns_nintendo/
https://redd.it/1xedy3e
@r_SwitchHacks
[Release] Chiral-FTP v1.1: FTP server, web file manager, FTP/SFTP client and Quick connect for Switch, with USB drive support
Hi everyone!
Today I’m releasing Chiral-FTP on Switch, as part of a big v1.1 update. If you’re discovering the project, keep reading!
**SWITCH 2 VERSION IN DEVELOPMENT**
**Please upvote and comment to give the project visibility!** [Download here!](https://github.com/Herbrax/Chiral-FTP/releases/)
Chiral-FTP is a file manager and FTP toolbox **that runs as a normal homebrew (.nro) from hbmenu**.
The goal of the project is to be **the best FTP client and file manager on consoles**: fast, simple, and the same on every device.
Chiral-FTP started as a **PS5 homebrew**. The whole project is built on the same C codebase, with a shared engine and web app and only a thin platform layer for each device. That made it possible to port it to **Switch** and to **Windows, Mac and Linux**, and the features and interface stay the same everywhere. A fix or feature added for one version benefits all of them, and the versions can talk to each other (see Quick connect below).
[Start Menu](https://preview.redd.it/eds03atwpgxh1.png?width=1920&format=png&auto=webp&s=296621ad820cd9141b39a05595298f642461fd43)
It has four modes or “sub-apps”.
* **FTP server:** turns your Switch into an FTP server. Connect with FileZilla or any FTP app. You can change the user, password and port, or allow anonymous login, and you get live connection and transfer stats.
[FTP Server](https://preview.redd.it/yssw1crypgxh1.png?width=1920&format=png&auto=webp&s=333608666476fd4aca9e3ee1d36849545a701214)
* **Web app:** open it in a browser on your PC or phone to browse, upload (drag and drop works), download, copy, move, rename and delete files on the SD card. It also has a FileZilla-style FTP client tab.
[Web App](https://preview.redd.it/0jqzdz80qgxh1.png?width=1920&format=png&auto=webp&s=ef414adad162baf3465cdf17649de883680969eb)
* **File manager:** a two-pane manager on the console to copy and move files between the SD card and USB drives.
[Web App](https://preview.redd.it/hqy2i732qgxh1.png?width=1920&format=png&auto=webp&s=935e16eaec7e8f2ed41f096ba8d1e44a2efdfd40)
[This is what the webapp looks from your browser](https://preview.redd.it/xzser8z3qgxh1.png?width=1440&format=png&auto=webp&s=810d0cdf0a9c7f4d544fbbc5a52c92a66dcd1e6e)
[You can also just quickdrop files](https://preview.redd.it/qawcih96qgxh1.png?width=1440&format=png&auto=webp&s=cf15be4b2f04cd9179de77526bd50298f4eaa828)
* **FTP/SFTP client:** connect from the Switch to a PC, NAS or another console and transfer files in both directions. It has saved sites, recent connections, resume, and up to 30 simultaneous transfers. It’s also useful for sending files from your Switch to a PS5 or a computer.
[It also has a client](https://preview.redd.it/2m6z85m8qgxh1.png?width=1920&format=png&auto=webp&s=5fdbc5e61e9676d685fae0e1ee8a4d6ae405113e)
# 🔗 Quick connect
Every copy of Chiral-FTP on your network now shows up in a list with no setup, so you don’t have to type IPs or passwords.
[QuickConnect Menu](https://preview.redd.it/iqm7rc1bqgxh1.png?width=1920&format=png&auto=webp&s=a6c574494edcd68f7779f53fa62adb208cae63bf)
1. One device sends a request, and both screens show the same 4-digit code.
[QuickConnect Asking](https://preview.redd.it/7suejk4cqgxh1.png?width=1920&format=png&auto=webp&s=bb75b68a938ff77ce7ad577b87cd073f17ee62f6)
1. The other side checks the code and allows or denies.
[QuickConnect Request](https://preview.redd.it/nh1nd31fqgxh1.png?width=1920&format=png&auto=webp&s=b921cc74061880b6ff29be09d79600a0d85eb758)
1. The other device starts its server and you connect.
The login only works from the requesting device and only while that server runs. If you deny or the request times out (30 s), nothing is shared. It works between any two versions, for example Switch to PC, Switch to PS5 or Switch to Switch.
[This is what the PC version looks
PlayGuard :the Switch’s own parental controls and play-time limit, set offline on a modded console
https://redd.it/1x62px5
@r_SwitchHacks
Running Sonic Adventure 2 via Steam Port and Carafe
I have SA2 PC Port running on my Switch to the menu only, but feel free to give it a try. You'll need a way to bypass the DRM on your legally obtained copy of SA2.
I suspect it relates to how shit the port is just on PC. E.G. immediate menu crashes happen frequently on PC without adjusting settings.
I could not get the "Controllers" to work, so I set the config file to mouse and keyboard, then mapped the keys to the joycons. Also only seems to want to work in 720p mode?
I guess the research part is that this "may" allow for recomped games to be ported over more easily if theyre x32.
Just a thought.
Feel free to DM me for more details.
https://redd.it/1x7h78h
@r_SwitchHacks
Animal Crossing New Horizons Inventory Offsets (3.0.3)
I'm writing a python app that uses sys-botbase to send commands over to ACNH 3.0.3 and I'm haivng a difficult time finding the memory address for Inventory Slots 21-40. I know the formula for the first 20 slots is 0xB27BB758 + (0x131F70 * (number of profiles on your island - 1)) and you convert that to hexadecimal. However, the 21-40 slots live in another place in RAM and I have no idea where. If I could be pointed in the right direction or a tool that can read Switch RAM in real time, that would be great.
https://redd.it/1x7yihg
@r_SwitchHacks
Call of Duty: Black Ops 1 and 2 Are in Development for Nintendo Switch!
https://redd.it/1x804yj
@r_SwitchHacks
