Hacking Misc Getting the MIG Switch to load an XCI dump without its original Initial Data

cavv

New Member
OP
Newbie
Joined
Apr 5, 2024
Messages
1
Trophies
0
XP
24
Country
Italy
Hello guys, this is my first post here! I just got a MIG Switch card out of curiosity and I was tinkering with it.
For those who don't know, it's used by placing XCI dumps as well as other game specific bin files in the sd card of the MIG Switch, and are obtained from the original cartridge by using an app like nxdumptool.
Two of these bin files are mandatory to get the game to boot: Initial Data.bin and Certificate.bin. They stay the same for every cartridge of a specific game.
Now, if you want to use an XCI dump from a shady website it's impossible to get it to work without those files. By using the Certificate.bin from another game it has no problem, but this does not count for the Initial Data.bin. So I looked for a way to obtain this Initial Data from an XCI file and read a bit of the XCI file documentation from switchbrew dot org.

Here's what I understood so far:
The Switch checks if the cartridge is valid by doing a challenge–response authentication on the Initial Data.

The Package ID is contained both on the XCI and the Initial Data, on positions 0x110 and 0x0 respectively.
2024-04-05 17_43_53-HxD.png


The Initial Data hash is on the XCI at position 0x160. It is calculated by doing a SHA-256 hash on the full Initial Data content.
2024-04-05 17_48_24-HxD.png


So I was wondering, is there a way to to construct a functional Initial Data file starting from an XCI dump?
I also tried a reverse approach by editing the Package ID in the Initial Data from another game, generating the Initial Data hash and putting it in the XCI file but is not enough to get the Switch believe it's a real game.

Sorry if this may seem stupid but let me know what you think.
 

pharrowking

New Member
Newbie
Joined
Mar 30, 2024
Messages
4
Trophies
0
Age
33
XP
22
Country
Canada
i spent alot of time. about 3-4 days testing what you're asking with a partner, and it does not work. the data from initial data thats found within the xci is signed.

according to this structure the signature of signed data is stored in 0x0 to 0x100 of the xci cardheader,
the signed data is everything after: 0x100 to 0x200

CardHeader​


OffsetSizeDescription
0x00x100RSA-2048 PKCS #1 signature over the header (data from 0x100 to 0x200)
0x1000x4Magic ("HEAD")
0x1040x4RomAreaStartPageAddress (in Gamecard page units, which are 0x200 bytes)
0x1080x4BackupAreaStartPageAddress (always 0xFFFFFFFF)
0x10C0x1TitleKeyDecIndex (high nibble) and KekIndex (low nibble)
0x10D0x1#RomSize
0x10E0x1CardHeaderVersion
0x10F0x1#Flags
0x1100x8PackageId (used for challenge–response authentication)
0x1180x4ValidDataEndAddress (in Gamecard page units, which are 0x200 bytes)
0x11C0x4Reserved
0x1200x10Iv (reversed)
0x1300x8PartitionFsHeaderAddress
0x1380x8PartitionFsHeaderSize
0x1400x20PartitionFsHeaderHash (SHA-256 hash of the #PartitionFsHeader)
0x1600x20InitialDataHash (SHA-256 hash of the #InitialData)
0x1800x4#SelSec
0x1840x4SelT1Key (always 2)
0x1880x4SelKey (always 0)
0x18C0x4LimArea (in Gamecard page units, which are 0x200 bytes)
0x1900x70#CardHeaderEncryptedData



changing the data at any point will result in the switch unable to read gamecard.

including using a loaner xci and cloning its entire header to a different xci dump. without the signing keys that was used to sign the cardheader, your out of luck. unless those keys can be found on the switch....im not sure.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • NinStar @ NinStar:
    nes remix 1 had the bad one, nes remix 2 had the good one
  • SylverReZ @ SylverReZ:
    @genistopitauniverfrocrami, What drugs is this dude on?
    +1
  • NinStar @ NinStar:
    CRAZY HAMBURGER
  • The Real Jdbye @ The Real Jdbye:
    @NinStar both nes remix 1 and 2 had some stinkers in there
    +1
  • The Real Jdbye @ The Real Jdbye:
    but at least 2 doesn't have sports games
  • The Real Jdbye @ The Real Jdbye:
    loved nes remix, but hated having to play Baseball, Tennis and Golf in order to progress
    +1
  • The Real Jdbye @ The Real Jdbye:
    or fucking Clu Clu Land for that matter
  • Psionic Roshambo @ Psionic Roshambo:
    Not a big fan of NES kid Icarus either... I know it was popular but I didn't care for it.
  • Psionic Roshambo @ Psionic Roshambo:
    Yesterday I learned my BD Burner drive can burn CD's at 56X lol
  • cearp @ cearp:
    What stuff were you burning?
    I used to burn tons of dvds (data files) many years ago, but haven't burnt a disk in ages.
  • Psionic Roshambo @ Psionic Roshambo:
    My car actually reads MP3 CD's lol
  • Psionic Roshambo @ Psionic Roshambo:
    So mix CDs for myselt :)
  • Psionic Roshambo @ Psionic Roshambo:
    Pantera, Metallica, Hollywood Undead, Five Finger Death Punch, some others lol
  • Psionic Roshambo @ Psionic Roshambo:
    I can put like 90 songs on a CD lol
  • The Real Jdbye @ The Real Jdbye:
    if only it could read dvds then you would just need 1 disc
    +1
  • BakerMan @ BakerMan:
    i tell ya what, i could go for a fuckin gyro right about now
    +1
  • cearp @ cearp:
    I hope your brother is doing ok Mr BakerMan
    +1
  • cearp @ cearp:
    and Psi - I had a cd player / radio that played mp3 cds once, very cool
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    BakerMan yeah me too.... maybe that's gonna be dinner for me there is this place near me I have been dying to try and they have them lol
  • K3Nv2 @ K3Nv2:
    I miss usb mp3 players they were shit but at the time a go to
  • Psionic Roshambo @ Psionic Roshambo:
    @The Real Jdbye, I thought about that and I have blank DVD's and Blurays but honestly after like 90 songs I just listen to it a couple of hundred times toss it out and burn something else or have like 2-3 CD's. Florida here the heat in the car tends to ruin the CD's after like a few months even commercial pressed ones don't last too long.
  • The Real Jdbye @ The Real Jdbye:
    my music collection is just too big, i require variety
    The Real Jdbye @ The Real Jdbye: my music collection is just too big, i require variety