Nintendo Switch Hacking Guide: Unlock the Full Potential of Your Console¶
Welcome to the comprehensive guide on hacking a Nintendo Switch, the innovative gaming console from Nintendo that has taken the gaming world by storm. This wiki aims to provide you with an in-depth understanding of the various techniques, tools, and methods used to hack a Nintendo Switch, allowing you to explore its hidden capabilities, expand its functionality, and personalize your gaming experience.
Note
Before diving into the world of Nintendo Switch hacking, it is essential to clarify the purpose and scope of this guide. Hacking, in this context, refers to the process of modifying the console’s software, firmware, or hardware to access features or functionalities not originally intended by the manufacturer. It’s important to note that hacking a Nintendo Switch can void its warranty, and improper use of these techniques may lead to system instability, loss of data, or even permanent damage. Therefore, this guide is intended for educational purposes and assumes you have the necessary technical skills, knowledge, and consent to explore the possibilities of your console.
The Nintendo Switch, released in 2017, is a versatile gaming device that combines the power of a home console with the convenience of a portable handheld. While Nintendo has provided a rich gaming library, online services, and regular system updates, hacking the Switch opens up a realm of possibilities beyond the manufacturer’s intended design. From installing custom firmware to running homebrew applications, the world of Nintendo Switch hacking offers a wide range of features and benefits for the curious and adventurous gamers.
Throughout this wiki, we will explore various hacking methods, including software exploits, custom firmware installation, and the use of external tools. We will delve into the world of homebrew development, emulators, modding, and customizations, enabling you to tailor your Nintendo Switch experience according to your preferences. It is crucial to understand that hacking a Nintendo Switch may have legal implications, as unauthorized modifications can potentially infringe on copyright or licensing agreements. Always make sure to respect the intellectual property rights and comply with local laws and regulations when exploring the world of Nintendo Switch hacking.
With this guide, we aim to empower you with the knowledge and tools necessary to make informed decisions about hacking your Nintendo Switch. Remember to exercise caution, take appropriate precautions, and ensure you understand the potential risks before proceeding. Let’s embark on this journey together, uncovering the hidden capabilities and pushing the boundaries of what your Nintendo Switch can do. Get ready to unlock a world of possibilities as we dive into the fascinating realm of Nintendo Switch hacking!
Note
Some parts of this guide were taken from Switch Homebrew official but updated and modified in order to run signed code so all credit for the CFW guide goes to them.
Checking RCM¶
This section of the guide will teach you how to access RCM, determine if your Switch is vulnerable to fusee, and run a payload.
RCM is the best way to run CFW as it supports all firmwares. Even if you plan to use a software-based exploit, you should always know if your Switch has an exploitable RCM and how to push payloads.
Step 0: What You Will Need¶
A way to ground pin 10 on the right joycon rail
To access RCM, you must hold down volume up, power and the home button. The home button described here is not the home button on the joycon, but instead a hardware home button (think of the physical home button found on smartphones). The Nintendo Switch doesn’t have this button, but you can simulate pressing it down by grounding pin 10 of the right joycon rail.
There are many ways to do this. You can see a list of methods here. Some of these options are permanent hardmods, others are temporary. For now, you should pick a method that does not require teardown or soldering, in case your console is not vulnerable.
Later in the guide, if your Switch is unpatched, you will learn of a way to have the Switch automatically enter RCM on every boot through a software mod.
A device to send a payload
This guide will cover options for Windows, macOS, Linux and Android, though note that options exist for Chromebooks and jailbroken iOS devices.
You can also use a dedicated payload sending device (a “dongle” or modchip) if you have one. Intructions will not be provided on how to use these as each device is different. Check the manufacturers website.
A USB Type C to A/Micro USB/USB Type C cable/adapter
Some kind of cable to connect your Switch to your payload sender of choice.
You can usually chain cables and adapters if necessary.
This is not needed if you are using a dedicated payload sending device.
A payload sending application (Download and install one now)
For Windows, you can use TegraRcmGUI by eliboa and rajkosto.
For macOS and Linux, you can use fusee-launcher by ReSwitched.
For Android, you can use Rekado by MenosGrante.
If you don’t already have one, after determining if your Switch is vulnerable to fusee, you can also choose to purchase any number of dedicated payload sending dongles, or purchase and install a modchip.
A Micro SD Card
You should have an SD card at least 4GB in size, however 64GB or higher is recommended. A small SD card is enough to get CFW running, but larger ones are preferred for installing games, performing NAND backups efficiently, and creating emuMMCs.
This test payload downloaded to your payload sender device to verify if your Switch is vulnerable to fusee.
Step 1: Accessing RCM:¶
It’s time to get into recovery mode.
Completely power off your Switch
Hold the power button on your Switch for 3 seconds and choose to power down in the menu
Ground pin 10 of your right Joycon rail
Using a method from the guide linked above, ground pin 10. Be very careful, bridging the wrong pins can fry your Switch!
Press Volume Up + Power
While you’re grounding pin 10, hold down Volume Up and then tap Power. You can release all buttons after tapping power.
You will know you are successful if the Switch seemingly does not turn on.
If your Switch turns on, try again. This does not mean fusee-gelee is patched as RCM is still available on patched Switches.
Warning
This can be an extemely frustrating and tedious process without a jig. Keep trying, you’ll get it eventually.
Did it work? Pat yourself on the back, you just finished the hardest part!
Step 2: Determining if Your Switch is Vulnerable to fusee¶
Time to find out if any of this prep was worth it.
Only follow the part related to the payload sender you chose. If you are using a payload sender not listed here, you’ll need to determine how to use it by yourself.
If you are using TegraRcmGUI, follow these instructions:
Open TegraRCMGUI
Navigate to the Settings tab.
Click on Install Driver (this will install the driver required to communicate with your Switch).
After the driver is installed, navigate to the Payload tab.
Plug your Switch into your PC using your USB cable
Your PC should play the device connected sound and your Switch should not turn on. If your Switch turns on, repeat Step 1 to enter RCM.
Once your Switch is plugged in, you should see a green icon with the message “RCM OK”.
Select the fusee-test.bin test payload you downloaded earlier
- Select “Inject Payload” if the payload has not already been injected.
If you get the error “RC=-50”, restart the application and try again.
Important
A success message should now be displayed on your Switch. If so, celebrate! Your Switch is vulnerable and you can now push payloads!
Error
If the application says the payload launch was successful, but nothing appears on your screen, unfortunately your Nintendo Switch is likely patched. You should try a few more times to be certain, and consider trying another USB cable. If your Switch is patched and running firmware 4.1.0, you can still access CFW. If your Switch is patched and running a higher firmware version, unfortunately your Switch cannot be hacked right now.
Error
TegraRcmGUI reporting the line “Smashed the stack with a 0x0000 byte SETUP request!” (specifically 0x0000 instead of some other number) is a reliable indicator that your Switch is patched. You should try a few more times to be certain, and consider trying another USB cable.
SD Card Setup¶
At this point, you’ve verified that you can exploit fusee to run CFW. You will now prepare your SD card with the necessary software.
Downloading Software¶
- For the necessary software, you will need to download the following:
Atmosphere (the latest release) and extract it to the root of your SD card, keep the fusee payload.bin as it is the payload you will need every time you want to boot into CFW.
AIO Updater This software is used to update your CFW and homebrew applications. Extract the contents of the zip file to the root of your SD card.
Tinfoil Installer Tinfoil is an application to install backups of gamers. Extract the contents of the zip file to the root of your SD card.
Signature Patches This is a zip file that contains the necessary patches to run backups. Extract the contents of the zip file to the root of your SD card.
NX Themes Installer NX Themes Installer is an application to install custom themes on your switch. Extract the contents of the zip file to the root of your SD card. Put the NRO somewhere in the switch folder.
Hekate You will need hekate at first to setup the emmuNAND and once that is done you will go back to fusee.
After Setup¶
Launching Atmosphere CFW¶
To launch Atmosphere:
Enter RCM on your Switch
Push the Hekate payload to your Switch
Tap ‘Launch > CFW (sysMMC)’
Hekate will now boot Atmosphere. Note that Atmosphere CFW does not look fundamentaly different to the normal Switch operating system. You can verify you are in Atmosphere by trying to load the Homebrew Menu (see below) or checking if the system version string in System Settings contains (AMS x.x.x).
Create an emuMMC¶
Before getting started you will need the following:
A hackable Nintendo Switch.
An SD Card that is 64GB or larger.
Latest version of Atmosphere and Hekate.
Once you are ready, follow the guide below:
Launch Hekate.
Select Tools, open the bottom right table and select Partition SD Card
If you see this screen you can continue, otherwise backup the files via USB
Drag the emuMMC (RAW) slider around to match your needs. One emuMMC copy is 29856MB in size
Select Next Step, Start and wait for it to finish
Go back to the home menu and select emuMMC
Select Create emuMMC
Select SD Partition
Select the partition you want
Wait for it to finish
Tap on “Close” on the top right, tap on “Launch”, and boot into your emuMMC.
Note
If you downloaded Hekate by itself then you needed to create a hekate_ipl.ini file in your bootloader folder. That is outside the scope of this guide. If you don’t know how to do that then use the SDSetup bundle.
Congratulations you are done. You can go into “System Settings”, scroll down to “System”, and you should see an “E” at the end of your “Current version:” indicating you are in your emuMMC.
Safety Precautions¶
You are now able to run Hekate on your Nintendo Switch to launch the Atmosphere custom firmware. These next steps will make sure you’re being as careful as possible in regards to keeping your Switch from bricking and getting banned. These steps are optional but highly recommended
Step 1: Backing up your NAND and BIS keys¶
By backing up your NAND (the Switch’s internal memory), you will later be able to restore it in the event that anything goes wrong, essentially rewinding it back to a previous state. BIS keys are also good to backup so you can reinstall any firmware version manually should your NAND backup become corrupted or lost.
Enter RCM and send the Hekate payload provided in the SDSetup download to your Switch (refer to Section 1: Accessing RCM for instructions about sending the Hekate payload)
In Hekate, select ‘Tools > Backup eMMC > eMMC BOOT0 & BOOT1’
When finished, remove your SD card (you don’t need to shutdown Hekate), insert it into your PC, and copy the ‘backup’ folder to a safe location on your PC. Afterwards, delete the ‘backup’ folder on your SD card.
Insert your SD card back into your Switch
In Hekate, select ‘Tools > Backup eMMC > eMMC RAW GPP’
If your SD card has less than ~32GB free space, Hekate will provide additional instructions every few minutes about pulling files off of your SD card so it can continue.
If you weren’t required to copy files during the backup process, once again copy the ‘backup’ folder off of your SD card and put it in a safe location on your PC. Delete the ‘backup’ folder on your SD card.
Close the Backup menu, go back to the Home tab and tap ‘Reboot > RCM’
Send the “Lockpick_RCM.bin” payload provided in the SDSetup download to your Switch (if you do not have this payload, you can obtain it from GitHub).
Select Dump from SysNAND and press Power to confirm; press again Power when finished to go back to the Lockpick menu
Select poweroff from the menu once finished.
Insert your SD card into your PC.
Copy the /switch/prod.keys file to a safe location.
Warning
It is highly recommended that you store these backups and keys in multiple locations (ex. cloud storage, external harddrive, etc) as they may be critical to restoring your Switch if anything goes wrong in the future.
Step 2: (EU Only) Enabling GDPR Protections¶
Users with EU Nintendo Network accounts have the option of enabling GDPR protections in their account settings. Doing so has been confirmed to disable lots of telemetry that can get you banned. This setting will not appear if your account is not from the EU.
Login with your NNID
Under ‘Other settings’, Edit ‘Usage information’ and set it to ‘Don’t share’
Save your changes
Step 3: Blocking Updates & Telemetry with 90DNS¶
You can configure your WiFi settings to use a custom DNS server that blocks all connections to Nintendo servers (except the internet connection test server). This will prevent your Switch from communicating telemetry to Nintendo which could result in your console being banned, while still allowing Homebrew to access the internet. Note for this to be effective, you must enable these settings before doing anything bannable and keep them enabled until that NAND (either emuMMC or sysMMC, these will be explained later) is factory reset, or a NAND backup is restored to a time before you did anything bannable.
Simply running Atmosphere CFW and using basic homebrew has not been a known cause for console bans.
Doing this will make games unable to be played online, block eShop, game updates and system updates. If you are OK with this, follow these instructions:
Boot your Switch with or without CFW.
Open settings and go to the Internet tab
Configure a WiFi connection if you have not already done so
Select your Wifi network and pick Change Settings
Set DNS Settings to Manual
Set ‘Primary DNS’ to ‘163.172.141.219’
Set ‘Secondary DNS’ to ‘207.246.121.77’
Save and perform a connection test by connecting to the network. The connection test should pass.
NX Themes Setup¶
Now, you’re getting comfortable with the switch, maybe a little too much… Want to make it yours. Simple, theme it!
Extract Home screen¶
To begin, open NX Themes that we installed earlier.
Then select the Extract Home screen option.
Download theme within NX Themes¶
Go to the first page
Type your keyword in the search bar
Select the theme(s) you want to download
Install Tinfoil¶
Tinfoil is a popular homebrew application for the Nintendo Switch, designed to enhance the functionality and customization options of hacked consoles. This section provides an overview of Tinfoil, highlighting its features, uses, and important considerations for users.
What is Tinfoil?¶
Tinfoil is a homebrew application that enables Nintendo Switch users to manage, install, and play games, updates, DLCs, and other content on their hacked consoles. It acts as a versatile content management tool, providing an alternative way to access and enjoy a wide range of software titles beyond the official Nintendo ecosystem.
Features and Functionality¶
- Tinfoil offers several key features that contribute to its popularity within the Nintendo Switch hacking community. These features include:
Game Installation: Tinfoil allows users to install games and applications directly onto their Nintendo Switch consoles. This feature is particularly useful for accessing homebrew projects, custom game mods, and other unofficial content.
Title Management: Tinfoil provides a user-friendly interface for organizing and managing installed titles. Users can view detailed information about each title, delete unwanted games, and manage updates and DLCs.
Customization Options: Tinfoil supports various customization features, allowing users to personalize their gaming experience. This includes the ability to install custom themes, icons, and other visual modifications to create a unique look and feel for their Nintendo Switch console.
External Content Sources: Tinfoil enables users to download and install content from various sources, including Tinfoil shops and other trusted repositories. This expands the range of available titles beyond official Nintendo releases.
Note
While Tinfoil offers exciting possibilities for Nintendo Switch enthusiasts, it’s crucial to be aware of certain considerations and responsibilities:
Legal Implications: Installing and using Tinfoil, as well as downloading and installing unauthorized content, may infringe upon copyright and licensing agreements. It is essential to respect intellectual property rights and only use Tinfoil for legal purposes.
Security Risks: The use of unofficial content carries inherent security risks. Users should exercise caution when downloading files from unknown sources, as they may contain malware or other malicious elements. Stick to trusted sources and verify the integrity of files before installation.
Warranty Voidance: Hacking a Nintendo Switch, including using Tinfoil, may void the console’s warranty. It is important to understand and accept this risk before engaging in any hacking activities.
User Responsibility: Users must educate themselves about the potential risks associated with using Tinfoil and ensure they comply with local laws and regulations. Engage in responsible and ethical practices to protect both personal and gaming community interests.
By understanding the capabilities and considerations of Tinfoil, Nintendo Switch users can make informed decisions about its usage, explore new gaming possibilities, and fully enjoy the benefits offered by this powerful homebrew application.
In order to install Tinfoil, go in the homebrew menu and select the option to install Tinfoil. This will download and install the latest version of Tinfoil. If you already have Tinfoil installed and want to update to the latest version, you first need to delete the current version of Tinfoil from your switch and then install the latest version of Tinfoil using the homebrew menu.
Usage¶
Tinfoil is a powerful homebrew application for the Nintendo Switch that allows users to manage, install, and customize games, updates, and other content on hacked consoles. With its user-friendly interface, users can easily navigate through different sections such as Titles, Shops, Files, and Settings. Tinfoil provides the ability to browse and install games from Tinfoil shops, manage installed titles, and customize the console’s appearance. However, it’s important to use Tinfoil responsibly, respecting copyright and licensing agreements, and being cautious when downloading content from untrusted sources. By leveraging the capabilities of Tinfoil, Nintendo Switch users can enhance their gaming experience and explore a wide range of unofficial content.
The tinfoil UI has a lot of hidden sections so we will go over them now
To add a Shop go to file browser and click the - button. From there simply follow the respective prompts for the shop you want to add.
To search for a title once the shop has been added, once again go to the file browser and click the + button. From there simply type the game you are looking for.
Tinfoil Shops¶
In the realm of Nintendo Switch hacking, Tinfoil shops play a significant role as online marketplaces or repositories where users can access and install a wide range of unofficial content onto their hacked consoles. This section provides an overview of Tinfoil shops, their functions, and important considerations for users.
What is a Tinfoil Shop?¶
A Tinfoil shop is an unofficial online platform that allows Nintendo Switch users to download and install games, updates, DLCs, and other content using the Tinfoil homebrew application. These shops act as centralized hubs where users can browse, search, and select various titles to enhance their gaming experience on hacked consoles.
Features and Functionality¶
Tinfoil shops typically offer a range of features to make the process of accessing and installing content more convenient.
In order to get an actual lists of shops, you can use the Tinfoil Shop List <https://www.reddit.com/r/SwitchPirates/wiki/shops/> maintained by the Tinfoil team.
Frequently Asked Questions¶
What actions can get me banned?¶
Instant ban:
Piracy
Installing homebrew NSP files
Changing your user icon with homebrew
Sketchy eShop behavior, including chargebacks
Using homebrew or PC tools with your console unique certificate to query or download from Nintendo’s CDN.
Likely ban, typically delayed:
Modding online games
Cheating in online games
Clearing system logs using homebrew
Using multiple NANDs online (sysMMC and emuMMC) without using a DNS like 90DNS or PegaScape on all or all but one of them.
Not a ban, so far:
Atmosphere CFW
Homebrew
Custom themes
Custom sysmodules
Mods/cheating in offline games with no multiplayer or online component
Overclocking
emuMMC
Simply running Fusee payloads
Running other operating systems such as Android or Linux
Should I disable WiFi?¶
This is an extreme that you don’t necessarily need to take, though it will basically 100% guarantee you won’t get banned (since you are basically banning yourself).
Using 90DNS (163.172.141.219 or 207.246.121.77) or enabling GDPR protections is usually enough to keep from being banned as long as you don’t care about NSP files.
Can’t load Homebrew Launcher?¶
When trying to access Album, or any game, hold the R button and this will launch Homebrew Launcher.
What are sigpatches?¶
Sigpatches allow your Switch to install and run unofficial NSP files (digital titles that appear on the home menu). Note that you must use CFW to launch these applications even after installation as sigpatches are always required to do so.
Important
Using ES or FS patches are not supported by Atmosphere and never will be. Please use Google to answer any questions regarding this.
Is it safe to update to the latest firmware version?¶
When a new firmware update is released, you should always wait for SDSetup to add support for it, or if a trusted source says it is safe. New firmware versions can also bring unwanted telemetry. Ultimately, whether or not you update is up to you.
As of writing, the latest firmware version is 14.1.0. It is currently completely safe to update as long as you are using Atmosphere v1.3.1+ or a bundle from SDSetup downloaded after May 3rd 2022.
What does ‘burning fuses’ mean? / Can I downgrade my Nintendo Switch?¶
The Switch uses a common anti-downgrade technique that utilizes microscopic (ie. cannot be replaced) fuses built into the CPU. When you turn on your Switch through regular means, the firmware performs a fuse check:
The firmware will first check for how many fuses are burnt
If there are less fuses burnt than the firmware version expects, it will burn up fuses up to as many as it expects and reboot.
If there are exactly enough fuses burnt as the firmware expects, it will allow the Switch to load
If there are too many fuses burnt, your Switch will shutdown, not allowing the firmware to boot.
The fusee-gelee exploit happens before any of these checks occur, meaning these checks can be bypassed. Hekate, ReiNX, and SX OS all block fuses from being burnt and bypass the fuse check, meaning you can keep your Switch in a downgradable state if you update your firmware manually.
Tip
If this page doesn’t answer your question, feel free to ask on the Team Neptune’s discord:.
Switch Terminology¶
RCM¶
RCM stands for ReCovery Mode.
OFW¶
OFW stands for Original Firmware. It is your devices unmodified firmware.
Homebrew¶
A term used to describe unofficial software created by developers for a locked down system. When it comes to the Switch, such software can include save managers, emulators, or games.
CFW¶
CFW Stands for Custom Firmware. It is a firmware that modifies the system firmware to allow it to run homebrew.
NAND¶
The NAND is your devices built in memory (not to be confused with the SD card). The Nintendo Switch has the memory size of 32GB and by default has 25.9GB of free storage, and the rest is taken up by the operating system.
SysNAND¶
SysNAND stands for “System NAND”. The SysNAND is the contents stored on your devices built in memory (not to be confused with OFW). It contains everything ranging from the operating system itself, to games, screenshots, videos, and save files. Every device, hacked or unhacked, has a SysNAND.
EmuNAND¶
EmuNAND stands for “Emulated NAND”. The EmuNAND is a copy of your SysNAND that resides on your SD card and not on your devices internal memory. Think of it as having a secondary Nintendo Switch on your SD card. It is used to isolate any actions that you might perform from your SysNAND that could either harm your device or performing any other actions that might get you banned. Any changes or actions that you perform in your EmuNAND won’t affect your SysNAND since it is just a copy.
Signature Patches¶
Signature patches or SigPatches allow your device to bypass signature checks performed by horizon for installed titles.
Hekate¶
A custom bootloader that allows you to bypass fuse checks and has a lot of useful tools. It is used to boot into CFW and to create and restore NAND backups.
NSP¶
Nintendo Submission Package or NSP is either a dump of an installed title or a homebrew package that can be installed.
XCI¶
XCI is a cartridge dump of a Nintendo Switch game. It can be played on a hacked Nintendo Switch using a CFW.
NRO¶
An extension that homebrew applications use.