Merge pull request #3 from falquinho/master
Did some changes that i believe help usability.pull/5/head^2
Elijah Bansley
GitHub
commit
43dfd1b57e
175
index.html
175
index.html
|
|
@ -6,75 +6,152 @@
|
|||
<link rel="stylesheet" type="text/css" href="style.css" />
|
||||
<link href="favicon.png" rel="icon" type="image/x-icon" />
|
||||
<title>Switch Payload Loader v1.2</title>
|
||||
|
||||
<!-- JQuery: needed for some Bootstrap Components -->
|
||||
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
|
||||
|
||||
<!-- Bootstrap 3 framework -->
|
||||
<!-- Latest compiled and minified CSS -->
|
||||
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">
|
||||
<!-- Optional theme -->
|
||||
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css" integrity="sha384-rHyoN1iRsVXV4nD0JutlnGaslCJuC7uwjduW9SVrLvRYooPp2bWYgmgJQIXwl/Sp" crossorigin="anonymous">
|
||||
<!-- Latest compiled and minified JavaScript -->
|
||||
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js" integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa" crossorigin="anonymous"></script>
|
||||
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<div id="title">
|
||||
<body class="container-fluid">
|
||||
<div class="row" id="title">
|
||||
<h1>Nintendo Switch Payload Loader</h1>
|
||||
<p>Fusee Launcher ported to JavaScript using WebUSB.</p>
|
||||
<div id="disclaimer">
|
||||
<p>
|
||||
Source can be found on <a href="https://github.com/ElijahZAwesome/web-cfw-loader/">GitHub</a> (or by hitting view source, there is no backend!).<br>
|
||||
Ported from <a href="https://github.com/reswitched/fusee-launcher">fusee-launcher</a>.
|
||||
Thanks to ktemkin and ReSwitched, as well as <br><a href="https://atlas44.s3-us-west-2.amazonaws.com/web-fusee-launcher/index.html">Atlas44 and his website</a> as a beginning point for this one.
|
||||
</p>
|
||||
<h4>Fusee Launcher ported to JavaScript using WebUSB.</h4>
|
||||
</div>
|
||||
|
||||
<div class="row margin-top-md">
|
||||
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
<div class="btn-group" role="group" aria-label="...">
|
||||
<a class="btn btn-info disabled" href="#">English</a>
|
||||
<a class="btn btn-info" href="./it_IT/index.html">Italiano</a>
|
||||
<a class="btn btn-info" href="./pt_BR/index.html">Português</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<br>
|
||||
<p style="text-align: center; font-size: 1vw;">Se sei italiano, clicca <a href="./it_IT">qui.</a></p><br>
|
||||
|
||||
<button class="btn" id="instructionsbutton" onclick="openInstructions();">Instructions</button>
|
||||
<button class="btn" id="infobutton" onclick="openInfo();">Info</button>
|
||||
|
||||
<div id="infodiv"></div>
|
||||
<div class="row margin-top-md" id="infodiv">
|
||||
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
|
||||
<div class="alert alert-danger" role="alert">
|
||||
<p>This is moderately tested. Although no issues have been discovered, I'm not responsible if anything goes wrong!</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>This does NOT work on Windows due to a limitation in the Chrome implementation of WebUSB (and probably other reasons!)</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>This does NOT currently work on any browser but Chrome, because they don't implement WebUSB.</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>On Linux, you might get an access denied error! If you do, you can try creating a file at <code>/etc/udev/rules.d/50-switch.rules</code>With the following contents:<br><code>SUBSYSTEM==\"usb\", ATTR{idVendor}==\"0955\", MODE=\"0664\", GROUP=\"plugdev\"</code></p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>Hekate for 4.x has not been tested, as I do not have a 4.x switch. However, all other payloads will be tested as they are uploaded.</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>This has been tested and appears to work on Linux, OSX, Android (unrooted) and Chromebooks. Your mileage may vary.</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-info" role="alert">
|
||||
<h4>Instructions:</h4>
|
||||
<ul>
|
||||
<li>Put the Switch in RCM, and connect it to your device.</li>
|
||||
<li>Select either the example payload, or upload one.</li>
|
||||
<li>Press 'Run Payload!'</li>
|
||||
<li>On the consent screen that appears, select 'APX' and hit confirm.</li>
|
||||
<li>If all goes well, the payload will launch!</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row">
|
||||
<div class="class=col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
<h1>Setup Payload Delivery</h1>
|
||||
|
||||
<div>
|
||||
<h1>Load a Payload:</h1>
|
||||
<div>
|
||||
<form id="mainForm">
|
||||
<p>
|
||||
<input type="radio" name="payload" id="instaboot" value="instaboot" checked>
|
||||
<label for="instaboot">Instantly boot CFW (5.0.x)</label>
|
||||
</p>
|
||||
<div class="row">
|
||||
<div class="col-xs-6">
|
||||
<h4>Select Payload:</h4>
|
||||
</div>
|
||||
|
||||
<p>
|
||||
<input type="radio" name="payload" id="hekate v5" value="hekate v5">
|
||||
<label for="hekate v5">Hekate for 5.0.x Switches</label>
|
||||
</p>
|
||||
<div class="col-xs-6">
|
||||
<select class="pull-right" id="payloadSelect" onchange="onSelectChange()">
|
||||
<option value="instaboot">Instantly boot CFW (5.0.x)</option>
|
||||
<option value="hekate v5">Hekate for 5.0.x Switches</option>
|
||||
<option value="hekate v4">Hekate for 4.0.x Switches</option>
|
||||
<option value="fusee">(Re)Switched test payload (fusee)</option>
|
||||
<option value="uploaded">Upload payload</option>
|
||||
</select>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p>
|
||||
<input type="radio" name="payload" id="hekate v4" value="hekate v4">
|
||||
<label for="hekate v4">Hekate for 4.x Switches</label>
|
||||
</p>
|
||||
<div class="row" id="uploadContainer" style="display: none">
|
||||
<div class="row-xs-12">
|
||||
<input style="float: right" type="file" id="payloadUpload" accept=".bin"/>
|
||||
</div>
|
||||
</div>
|
||||
<div class="row divider-line"></div>
|
||||
|
||||
<p>
|
||||
<input type="radio" name="payload" id="fusee" value="fusee">
|
||||
<label for="fusee">(Re)Switched test payload (fusee)</label>
|
||||
</p>
|
||||
|
||||
<p>
|
||||
<input type="radio" name="payload" id="uploaded" value="uploaded">
|
||||
<label for="uploaded">Upload payload:<br></label>
|
||||
<input type="file" id="payloadUpload" accept=".bin">
|
||||
</p>
|
||||
|
||||
<p>
|
||||
<input type="checkbox" name="shouldDebug" id="shouldDebug">
|
||||
<label for="shouldDebug">Get payload byte array (don't sploit)</label>
|
||||
</p>
|
||||
<div class="row margin-top-md">
|
||||
<div class="col-xs-10">
|
||||
<h4>Get payload byte array (don't sploit)</h4>
|
||||
</div>
|
||||
<div class="col-xs-2">
|
||||
<input class="pull-right" type="checkbox" name="shouldDebug" id="shouldDebug">
|
||||
</div>
|
||||
</div>
|
||||
<div class="row divider-line"></div>
|
||||
</form>
|
||||
|
||||
<button class="btn" id="goButton">Run Payload!</button>
|
||||
<div class="row margin-top-md">
|
||||
<div class="col-xs-12">
|
||||
<button class="btn btn-primary btn-lg pull-right" id="goButton">Deliver Payload!</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row">
|
||||
<div class="class=col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
<h3>Log:</h3>
|
||||
<div id="output"></div><br>
|
||||
<button class="btn" id="clearlogsbutton" onclick="clearLog();">Clear Logs</button><br><br>
|
||||
<div id="output"></div>
|
||||
<button class="btn btn-primary pull-right margin-top-md" id="clearlogsbutton" onclick="clearLog();">Clear Logs</button><br><br>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<script src="./payloads.js"></script>
|
||||
<script src="./main.js"></script>
|
||||
</body>
|
||||
|
||||
</html
|
||||
>
|
||||
<div class="row margin-top-md" id="page-footer">
|
||||
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
<div id="disclaimer">
|
||||
<p>Source can be found on <a href="https://github.com/ElijahZAwesome/web-cfw-loader/">GitHub</a> (or by hitting view source, there is no backend!).</p>
|
||||
<p>Ported from <a href="https://github.com/reswitched/fusee-launcher">fusee-launcher</a>.</p>
|
||||
<p>Thanks to ktemkin and ReSwitched, as well as <br><a href="https://atlas44.s3-us-west-2.amazonaws.com/web-fusee-launcher/index.html">Atlas44 and his website</a> as a beginning point for this one. </p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</html>
|
||||
|
|
|
|||
173
it_IT/index.html
173
it_IT/index.html
|
|
@ -6,74 +6,151 @@
|
|||
<link rel="stylesheet" type="text/css" href="style.css" />
|
||||
<link href="favicon.png" rel="icon" type="image/x-icon" />
|
||||
<title>Switch Payload Loader v1.2</title>
|
||||
|
||||
<!-- JQuery: needed for some Bootstrap Components -->
|
||||
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
|
||||
|
||||
<!-- Bootstrap 3 framework -->
|
||||
<!-- Latest compiled and minified CSS -->
|
||||
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">
|
||||
<!-- Optional theme -->
|
||||
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css" integrity="sha384-rHyoN1iRsVXV4nD0JutlnGaslCJuC7uwjduW9SVrLvRYooPp2bWYgmgJQIXwl/Sp" crossorigin="anonymous">
|
||||
<!-- Latest compiled and minified JavaScript -->
|
||||
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js" integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa" crossorigin="anonymous"></script>
|
||||
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<div id="title">
|
||||
<body class="container-fluid">
|
||||
<div class="row" id="title">
|
||||
<h1>Nintendo Switch Payload Loader</h1>
|
||||
<p>Fusee Launcher portato a JavaScript usando WebUSB.</p>
|
||||
<div id="disclaimer">
|
||||
<p>
|
||||
Il source puo essere trovato a <a href="https://github.com/ElijahZAwesome/web-cfw-loader/">GitHub</a> (o premendo guarda source, ma non c'è backend!).<br>
|
||||
Portato da <a href="https://github.com/reswitched/fusee-launcher">fusee-launcher</a>.
|
||||
Grazie tante a ktemkin e ReSwitched, e non dimentichiamoci <br><a href="https://atlas44.s3-us-west-2.amazonaws.com/web-fusee-launcher/index.html">Atlas44 e il suo sito</a> come punto di inizio per questo.
|
||||
</p>
|
||||
<h4>Fusee Launcher portato a JavaScript usando WebUSB.</h4>
|
||||
</div>
|
||||
|
||||
<div class="row margin-top-md">
|
||||
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
<div class="btn-group" role="group" aria-label="...">
|
||||
<a class="btn btn-info" href="../index.html">English</a>
|
||||
<a class="btn btn-info disabled" href="#">Italiano</a>
|
||||
<a class="btn btn-info" href="../pt_BR/index.html">Português</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<br>
|
||||
|
||||
<button class="btn" id="instructionsbutton" onclick="openInstructions();">Istruzioni</button>
|
||||
<button class="btn" id="infobutton" onclick="openInfo();">Info</button>
|
||||
<div class="row margin-top-md" id="infodiv">
|
||||
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
|
||||
<div id="infodiv"></div>
|
||||
<div class="alert alert-danger" role="alert">
|
||||
<p>Questo è stato moderatamente testato. Anche se nessun problema è stato riportato, non sono responsabile in caso di brick!</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>Questo non funziona in Windows per la implementazione scorretta di WinUSB di Chrome(E probabilmente altre ragioni)!</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>Questo non funziona attualmente su nessun browser ma Chrome perchè è l'unico con WinUSB.</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>Su Linux, potresti ottenere un errore Access Denied! Se succede, potresti provare a creare un file a <code>/etc/udev/rules.d/50-switch.rules</code>Con i seguenti contenuti:<br><code>SUBSYSTEM==\"usb\", ATTR{idVendor}==\"0955\", MODE=\"0664\", GROUP=\"plugdev\"</code></p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>Hekate 4.x non è stato testato visto che non ho una Switch 4.x. Tuttavia, tutti gli altri payload verranno testati al momento dell'aggiunta.</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>Questo è stato testato e funziona su Linux, OSX, Android (no root) and Chromebooks. Risultati potrebbero variare.</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-info" role="alert">
|
||||
<h4>Istruzioni:</h4>
|
||||
<ul>
|
||||
<li>Metti lo Switch in RCM e collega il dispositivo.</li>
|
||||
<li>Scegli il payload di esempio o caricane uno.</li>
|
||||
<li>Pemi 'Avvia payload!'</li>
|
||||
<li>Nello schermo di conferma, scegli 'APX' ae premi conferma.</li>
|
||||
<li>Se tutto funziona il payload si avvierà!</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row">
|
||||
<div class="class=col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
<h1>Setup Payload Delivery</h1>
|
||||
|
||||
<div>
|
||||
<h1>Carica un payload:</h1>
|
||||
<div>
|
||||
<form id="mainForm">
|
||||
<p>
|
||||
<input type="radio" name="payload" id="instaboot" value="instaboot" checked>
|
||||
<label for="instaboot">Avvia istantaneamente CFW (5.0.x)</label>
|
||||
</p>
|
||||
<div class="row">
|
||||
<div class="col-xs-6">
|
||||
<h4>Payload:</h4>
|
||||
</div>
|
||||
|
||||
<p>
|
||||
<input type="radio" name="payload" id="hekate v5" value="hekate v5">
|
||||
<label for="hekate v5">Hekate per Switch su 5.0.X</label>
|
||||
</p>
|
||||
<div class="col-xs-6">
|
||||
<select class="pull-right" id="payloadSelect" onchange="onSelectChange()">
|
||||
<option value="instaboot">Avvia istantaneamente CFW (5.0.x)</option>
|
||||
<option value="hekate v5">Hekate per Switch su 5.0.X</option>
|
||||
<option value="hekate v4">Hekate per Switch su 4.0.X</option>
|
||||
<option value="fusee">(Re)Switched payload di test (fusee)</option>
|
||||
<option value="uploaded">Carica payload</option>
|
||||
</select>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p>
|
||||
<input type="radio" name="payload" id="hekate v4" value="hekate v4">
|
||||
<label for="hekate v4">Hekate per Switch su 5.0.X</label>
|
||||
</p>
|
||||
<div class="row" id="uploadContainer" style="display: none">
|
||||
<div class="row-xs-12">
|
||||
<input style="float: right" type="file" id="payloadUpload" accept=".bin"/>
|
||||
</div>
|
||||
</div>
|
||||
<div class="row divider-line"></div>
|
||||
|
||||
<p>
|
||||
<input type="radio" name="payload" id="fusee" value="fusee">
|
||||
<label for="fusee">(Re)Switched payload di test (fusee)</label>
|
||||
</p>
|
||||
|
||||
<p>
|
||||
<input type="radio" name="payload" id="uploaded" value="uploaded">
|
||||
<label for="uploaded">Carica payload:<br></label>
|
||||
<input type="file" id="payloadUpload" accept=".bin">
|
||||
</p>
|
||||
|
||||
<p>
|
||||
<input type="checkbox" name="shouldDebug" id="shouldDebug">
|
||||
<label for="shouldDebug">Ottieni byte array del payload (no exploit)</label>
|
||||
</p>
|
||||
<div class="row margin-top-md">
|
||||
<div class="col-xs-10">
|
||||
<h4>Ottieni byte array del payload (no exploit)</h4>
|
||||
</div>
|
||||
<div class="col-xs-2">
|
||||
<input class="pull-right" type="checkbox" name="shouldDebug" id="shouldDebug">
|
||||
</div>
|
||||
</div>
|
||||
<div class="row divider-line"></div>
|
||||
</form>
|
||||
|
||||
<button class="btn" id="goButton">Avvia Payload!</button>
|
||||
<div class="row margin-top-md">
|
||||
<div class="col-xs-12">
|
||||
<button class="btn btn-primary btn-lg pull-right" id="goButton">Avvia Payload!</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row">
|
||||
<div class="class=col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
<h3>Log:</h3>
|
||||
<div id="output"></div><br>
|
||||
<button class="btn" id="clearlogsbutton" onclick="clearLog();">Pulisci logs</button>
|
||||
<div id="output"></div>
|
||||
<button class="btn btn-primary pull-right margin-top-md" id="clearlogsbutton" onclick="clearLog();">Pulisci Logs</button><br><br>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<script src="./payloads.js"></script>
|
||||
<script src="./main.js"></script>
|
||||
</body>
|
||||
|
||||
</html
|
||||
>
|
||||
<div class="row margin-top-md" id="page-footer">
|
||||
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
<div id="disclaimer">
|
||||
<p>Il source puo essere trovato a <a href="https://github.com/ElijahZAwesome/web-cfw-loader/">GitHub</a> (o premendo guarda source, ma non c'è backend!).</p>
|
||||
<p>Portato da <a href="https://github.com/reswitched/fusee-launcher">fusee-launcher</a>.</p>
|
||||
<p>Grazie tante a ktemkin e ReSwitched, e non dimentichiamoci <br><a href="https://atlas44.s3-us-west-2.amazonaws.com/web-fusee-launcher/index.html">Atlas44 e il suo sito</a> come punto di inizio per questo.</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</html>
|
||||
|
|
|
|||
|
|
@ -7,10 +7,14 @@ const intermezzo = new Uint8Array([
|
|||
0x5C, 0xF0, 0x01, 0x40, 0x00, 0x00, 0x02, 0x40, 0x00, 0x00, 0x01, 0x40
|
||||
]);
|
||||
|
||||
|
||||
|
||||
const RCM_PAYLOAD_ADDRESS = 0x40010000;
|
||||
const INTERMEZZO_LOCATION = 0x4001F000;
|
||||
const PAYLOAD_LOAD_BLOCK = 0x40020000;
|
||||
|
||||
|
||||
|
||||
function createRCMPayload(intermezzo, payload) {
|
||||
const rcmLength = 0x30298;
|
||||
|
||||
|
|
@ -33,6 +37,8 @@ function createRCMPayload(intermezzo, payload) {
|
|||
return rcmPayload;
|
||||
}
|
||||
|
||||
|
||||
|
||||
function bufferToHex(data) {
|
||||
let result = "";
|
||||
for (let i = 0; i < data.byteLength; i++)
|
||||
|
|
@ -40,6 +46,8 @@ function bufferToHex(data) {
|
|||
return result;
|
||||
}
|
||||
|
||||
|
||||
|
||||
async function write(device, data) {
|
||||
let length = data.length;
|
||||
let writeCount = 0;
|
||||
|
|
@ -58,6 +66,8 @@ async function write(device, data) {
|
|||
return writeCount;
|
||||
}
|
||||
|
||||
|
||||
|
||||
function readFileAsArrayBuffer(file) {
|
||||
return new Promise((res, rej) => {
|
||||
const reader = new FileReader();
|
||||
|
|
@ -68,16 +78,24 @@ function readFileAsArrayBuffer(file) {
|
|||
});
|
||||
}
|
||||
|
||||
|
||||
|
||||
function logOutput(...message) {
|
||||
document.getElementById("output").innerHTML = document.getElementById("output").innerHTML + message.join(" ") + "<br>";
|
||||
}
|
||||
|
||||
|
||||
|
||||
function clearLog() {
|
||||
document.getElementById("output").innerHTML = "";
|
||||
}
|
||||
|
||||
|
||||
|
||||
let device;
|
||||
|
||||
|
||||
|
||||
async function launchPayload(payload) {
|
||||
await device.open();
|
||||
logOutput(`Connected to ${device.manufacturerName} ${device.productName}`);
|
||||
|
|
@ -87,7 +105,6 @@ async function launchPayload(payload) {
|
|||
const deviceID = await device.transferIn(1, 16);
|
||||
logOutput(`Device ID: ${bufferToHex(deviceID.data)}`);
|
||||
|
||||
|
||||
const rcmPayload = createRCMPayload(intermezzo, payload);
|
||||
logOutput("Sending payload...");
|
||||
const writeCount = await write(device, rcmPayload);
|
||||
|
|
@ -109,21 +126,26 @@ async function launchPayload(payload) {
|
|||
}, vulnerabilityLength);
|
||||
}
|
||||
|
||||
|
||||
|
||||
document.getElementById("goButton").addEventListener("click", async () => {
|
||||
clearLog();
|
||||
var debugCheckbox = document.getElementById("shouldDebug");
|
||||
const payloadType = document.forms.mainForm.payload.value;
|
||||
if(debugCheckbox.checked) {
|
||||
logOutput("Logging payload bytes...");
|
||||
const payloadType = document.getElementById("payloadSelect").value;
|
||||
|
||||
let payload;
|
||||
if (payloadType === "hekate v5") {
|
||||
payload = hekate5;
|
||||
|
||||
} else if (payloadType === "hekate v4") {
|
||||
payload = hekate4;
|
||||
|
||||
} else if (payloadType === "fusee") {
|
||||
payload = fusee;
|
||||
|
||||
} else if (payloadType === "instaboot") {
|
||||
payload = instaboot;
|
||||
|
||||
} else if (payloadType === "uploaded") {
|
||||
const file = document.getElementById("payloadUpload").files[0];
|
||||
if (!file) {
|
||||
|
|
@ -132,9 +154,13 @@ document.getElementById("goButton").addEventListener("click", async () => {
|
|||
}
|
||||
payload = new Uint8Array(await readFileAsArrayBuffer(file));
|
||||
} else {
|
||||
logOutput("You're trying to load a payload type that doesn't exist.");
|
||||
logOutput("<span style='color:red'>You're trying to load a payload type that doesn't exist.</span>");
|
||||
return;
|
||||
}
|
||||
|
||||
if(debugCheckbox.checked) {
|
||||
logOutput("Logging payload bytes...");
|
||||
|
||||
var payloadToLog = "";
|
||||
for (var i = 0; i < payload.length; i++) {
|
||||
payloadToLog += "0x" + payload[i].toString(16) + ", ".toUpperCase();
|
||||
|
|
@ -143,49 +169,38 @@ document.getElementById("goButton").addEventListener("click", async () => {
|
|||
logOutput(payloadToLog);
|
||||
return;
|
||||
}
|
||||
|
||||
logOutput("Requesting access to device...");
|
||||
device = await navigator.usb.requestDevice({ filters: [{ vendorId: 0x0955 }] });
|
||||
|
||||
logOutput(`<span style='color:blue'>Preparing to launch ${payloadType}...</span>`);
|
||||
|
||||
let payload;
|
||||
if (payloadType === "hekate v5") {
|
||||
payload = hekate5;
|
||||
} else if (payloadType === "hekate v4") {
|
||||
payload = hekate4;
|
||||
} else if (payloadType === "fusee") {
|
||||
payload = fusee;
|
||||
} else if (payloadType === "instaboot") {
|
||||
payload = instaboot;
|
||||
} else if (payloadType === "uploaded") {
|
||||
const file = document.getElementById("payloadUpload").files[0];
|
||||
if (!file) {
|
||||
alert("You need to upload a file, to use an uploaded file.");
|
||||
return;
|
||||
}
|
||||
payload = new Uint8Array(await readFileAsArrayBuffer(file));
|
||||
} else {
|
||||
logOutput("<p style='color:red'>You're trying to load a payload type that doesn't exist.</p>");
|
||||
return;
|
||||
}
|
||||
|
||||
launchPayload(payload);
|
||||
});
|
||||
|
||||
|
||||
|
||||
function onSelectChange() {
|
||||
if (document.getElementById("payloadSelect").value === "uploaded")
|
||||
document.getElementById("uploadContainer").style.display = "block"
|
||||
else
|
||||
document.getElementById("uploadContainer").style.display = "none"
|
||||
}
|
||||
|
||||
|
||||
|
||||
function openInfo() {
|
||||
if(document.getElementById("infodiv").innerHTML != "") {
|
||||
document.getElementById("infodiv").innerHTML = "";
|
||||
} else {
|
||||
document.getElementById("infodiv").innerHTML = "<h4>Info:</h4><p>Questo è stato moderatamente testato. Anche se nessun problema è stato riportato, non sono responsabile in caso di brick!</p><p>Questo non funziona in Windows per la implementazione scorretta di WinUSB di Chrome(E probabilmente altre ragioni)!</p><p>Questo non funziona attualmente su nessun browser ma Chrome perchè è l'unico con WinUSB.</p><p>Su Linux, potresti ottenere un errore Access Denied! Se succede, potresti provare a creare un file a <code>/etc/udev/rules.d/50-switch.rules</code>Con i seguenti contenuti:<br><code>SUBSYSTEM==\"usb\", ATTR{idVendor}==\"0955\", MODE=\"0664\", GROUP=\"plugdev\"</code></p><p>Hekate 4.x non è stato testato visto che non ho una Switch 4.x. Tuttavia, tutti gli altri payload verranno testati al momento dell'aggiunta.</p><p>Questo è stato testato e funziona su Linux, OSX, Android (no root) and Chromebooks. Risultati potrebbero variare.</p>";
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
function openInstructions() {
|
||||
if(document.getElementById("infodiv").innerHTML != "") {
|
||||
document.getElementById("infodiv").innerHTML = "";
|
||||
} else {
|
||||
document.getElementById("infodiv").innerHTML = "<h4>Istruzioni:</h4><p>Metti lo Switch in RCM e collega il dispositivo</p><p>Scegli il payload di esempio o caricane uno.</p><p>Pemi 'Avvia payload!'</p><p>Nello schermo di conferma, scegli 'APX' ae premi conferma.</p><p>Se tutto funziona il payload si avvierà!</p>";
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
document.getElementById("payloadUpload").addEventListener("change", () => document.forms.mainForm.payload.value = "uploaded");
|
||||
|
|
|
|||
|
|
@ -4,7 +4,6 @@ body {
|
|||
margin-top: 0px;
|
||||
margin-left: 0px;
|
||||
margin-right: auto;
|
||||
text-align: center;
|
||||
font-family: 'Open Sans', sans-serif;
|
||||
}
|
||||
|
||||
|
|
@ -17,44 +16,30 @@ body {
|
|||
background-color: black;
|
||||
background-image: url("https://icdn1.digitaltrends.com/image/nintendo-switch-review-photos-pdx-580.jpg");
|
||||
color: white;
|
||||
width: 100%;
|
||||
margin-top: 0px;
|
||||
top: 0px;
|
||||
}
|
||||
|
||||
#output {
|
||||
margin-left: 0px;
|
||||
width: 700px;
|
||||
height: 200px;
|
||||
border: 1px solid black;
|
||||
margin-right: 0px;
|
||||
margin: auto;
|
||||
overflow: scroll;
|
||||
}
|
||||
|
||||
.btn {
|
||||
background: #3498db;
|
||||
background-image: -webkit-linear-gradient(top, #3498db, #2980b9);
|
||||
background-image: -moz-linear-gradient(top, #3498db, #2980b9);
|
||||
background-image: -ms-linear-gradient(top, #3498db, #2980b9);
|
||||
background-image: -o-linear-gradient(top, #3498db, #2980b9);
|
||||
background-image: linear-gradient(to bottom, #3498db, #2980b9);
|
||||
-webkit-border-radius: 12;
|
||||
-moz-border-radius: 12;
|
||||
border-radius: 12px;
|
||||
font-family: Arial;
|
||||
color: #ffffff;
|
||||
font-size: 23px;
|
||||
padding: 12px 20px 10px 20px;
|
||||
text-decoration: none;
|
||||
#page-footer {
|
||||
padding: 32px;
|
||||
background: #222528;
|
||||
color: whitesmoke;
|
||||
}
|
||||
|
||||
.btn:hover {
|
||||
background: #3cb0fd;
|
||||
background-image: -webkit-linear-gradient(top, #3cb0fd, #3498db);
|
||||
background-image: -moz-linear-gradient(top, #3cb0fd, #3498db);
|
||||
background-image: -ms-linear-gradient(top, #3cb0fd, #3498db);
|
||||
background-image: -o-linear-gradient(top, #3cb0fd, #3498db);
|
||||
background-image: linear-gradient(to bottom, #3cb0fd, #3498db);
|
||||
text-decoration: none;
|
||||
#disclaimer {
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.divider-line {
|
||||
border-bottom: 1px solid gainsboro;
|
||||
}
|
||||
|
||||
.margin-top-md {
|
||||
margin-top: 24px;
|
||||
}
|
||||
|
|
|
|||
95
main.js
95
main.js
|
|
@ -7,10 +7,14 @@ const intermezzo = new Uint8Array([
|
|||
0x5C, 0xF0, 0x01, 0x40, 0x00, 0x00, 0x02, 0x40, 0x00, 0x00, 0x01, 0x40
|
||||
]);
|
||||
|
||||
|
||||
|
||||
const RCM_PAYLOAD_ADDRESS = 0x40010000;
|
||||
const INTERMEZZO_LOCATION = 0x4001F000;
|
||||
const PAYLOAD_LOAD_BLOCK = 0x40020000;
|
||||
|
||||
|
||||
|
||||
function createRCMPayload(intermezzo, payload) {
|
||||
const rcmLength = 0x30298;
|
||||
|
||||
|
|
@ -33,6 +37,8 @@ function createRCMPayload(intermezzo, payload) {
|
|||
return rcmPayload;
|
||||
}
|
||||
|
||||
|
||||
|
||||
function bufferToHex(data) {
|
||||
let result = "";
|
||||
for (let i = 0; i < data.byteLength; i++)
|
||||
|
|
@ -40,6 +46,8 @@ function bufferToHex(data) {
|
|||
return result;
|
||||
}
|
||||
|
||||
|
||||
|
||||
async function write(device, data) {
|
||||
let length = data.length;
|
||||
let writeCount = 0;
|
||||
|
|
@ -58,6 +66,8 @@ async function write(device, data) {
|
|||
return writeCount;
|
||||
}
|
||||
|
||||
|
||||
|
||||
function readFileAsArrayBuffer(file) {
|
||||
return new Promise((res, rej) => {
|
||||
const reader = new FileReader();
|
||||
|
|
@ -68,16 +78,24 @@ function readFileAsArrayBuffer(file) {
|
|||
});
|
||||
}
|
||||
|
||||
|
||||
|
||||
function logOutput(...message) {
|
||||
document.getElementById("output").innerHTML = document.getElementById("output").innerHTML + message.join(" ") + "<br>";
|
||||
}
|
||||
|
||||
|
||||
|
||||
function clearLog() {
|
||||
document.getElementById("output").innerHTML = "";
|
||||
}
|
||||
|
||||
|
||||
|
||||
let device;
|
||||
|
||||
|
||||
|
||||
async function launchPayload(payload) {
|
||||
await device.open();
|
||||
logOutput(`Connected to ${device.manufacturerName} ${device.productName}`);
|
||||
|
|
@ -87,7 +105,6 @@ async function launchPayload(payload) {
|
|||
const deviceID = await device.transferIn(1, 16);
|
||||
logOutput(`Device ID: ${bufferToHex(deviceID.data)}`);
|
||||
|
||||
|
||||
const rcmPayload = createRCMPayload(intermezzo, payload);
|
||||
logOutput("Sending payload...");
|
||||
const writeCount = await write(device, rcmPayload);
|
||||
|
|
@ -109,54 +126,26 @@ async function launchPayload(payload) {
|
|||
}, vulnerabilityLength);
|
||||
}
|
||||
|
||||
|
||||
|
||||
document.getElementById("goButton").addEventListener("click", async () => {
|
||||
clearLog();
|
||||
var debugCheckbox = document.getElementById("shouldDebug");
|
||||
const payloadType = document.forms.mainForm.payload.value;
|
||||
if(debugCheckbox.checked) {
|
||||
logOutput("Logging payload bytes...");
|
||||
let payload;
|
||||
if (payloadType === "hekate v5") {
|
||||
payload = hekate5;
|
||||
} else if (payloadType === "hekate v4") {
|
||||
payload = hekate4;
|
||||
} else if (payloadType === "fusee") {
|
||||
payload = fusee;
|
||||
} else if (payloadType === "instaboot") {
|
||||
payload = instaboot;
|
||||
} else if (payloadType === "uploaded") {
|
||||
const file = document.getElementById("payloadUpload").files[0];
|
||||
if (!file) {
|
||||
alert("You need to upload a file, to use an uploaded file.");
|
||||
return;
|
||||
}
|
||||
payload = new Uint8Array(await readFileAsArrayBuffer(file));
|
||||
} else {
|
||||
logOutput("You're trying to load a payload type that doesn't exist.");
|
||||
return;
|
||||
}
|
||||
var payloadToLog = "";
|
||||
for (var i = 0; i < payload.length; i++) {
|
||||
payloadToLog += "0x" + payload[i].toString(16) + ", ".toUpperCase();
|
||||
}
|
||||
payloadToLog = payloadToLog.toUpperCase();
|
||||
logOutput(payloadToLog);
|
||||
return;
|
||||
}
|
||||
logOutput("Requesting access to device...");
|
||||
device = await navigator.usb.requestDevice({ filters: [{ vendorId: 0x0955 }] });
|
||||
|
||||
logOutput(`<span style='color:blue'>Preparing to launch ${payloadType}...</span>`);
|
||||
const payloadType = document.getElementById("payloadSelect").value;
|
||||
|
||||
let payload;
|
||||
if (payloadType === "hekate v5") {
|
||||
payload = hekate5;
|
||||
|
||||
} else if (payloadType === "hekate v4") {
|
||||
payload = hekate4;
|
||||
|
||||
} else if (payloadType === "fusee") {
|
||||
payload = fusee;
|
||||
|
||||
} else if (payloadType === "instaboot") {
|
||||
payload = instaboot;
|
||||
|
||||
} else if (payloadType === "uploaded") {
|
||||
const file = document.getElementById("payloadUpload").files[0];
|
||||
if (!file) {
|
||||
|
|
@ -169,23 +158,49 @@ document.getElementById("goButton").addEventListener("click", async () => {
|
|||
return;
|
||||
}
|
||||
|
||||
if(debugCheckbox.checked) {
|
||||
logOutput("Logging payload bytes...");
|
||||
|
||||
var payloadToLog = "";
|
||||
for (var i = 0; i < payload.length; i++) {
|
||||
payloadToLog += "0x" + payload[i].toString(16) + ", ".toUpperCase();
|
||||
}
|
||||
payloadToLog = payloadToLog.toUpperCase();
|
||||
logOutput(payloadToLog);
|
||||
return;
|
||||
}
|
||||
|
||||
logOutput("Requesting access to device...");
|
||||
device = await navigator.usb.requestDevice({ filters: [{ vendorId: 0x0955 }] });
|
||||
|
||||
logOutput(`<span style='color:blue'>Preparing to launch ${payloadType}...</span>`);
|
||||
launchPayload(payload);
|
||||
});
|
||||
|
||||
|
||||
|
||||
function onSelectChange() {
|
||||
if (document.getElementById("payloadSelect").value === "uploaded")
|
||||
document.getElementById("uploadContainer").style.display = "block"
|
||||
else
|
||||
document.getElementById("uploadContainer").style.display = "none"
|
||||
}
|
||||
|
||||
|
||||
|
||||
function openInfo() {
|
||||
if(document.getElementById("infodiv").innerHTML != "") {
|
||||
document.getElementById("infodiv").innerHTML = "";
|
||||
} else {
|
||||
document.getElementById("infodiv").innerHTML = "<h4>Info:</h4><p>This is moderately tested. Although no issues have been discovered, I'm not responsible if anything goes wrong!</p><p>This does NOT work on Windows due to a limitation in the Chrome implementation of WebUSB (and probably other reasons!)</p><p>This does NOT currently work on any browser but Chrome, because they don't implement WebUSB.</p><p>On Linux, you might get an access denied error!If you do, you can try creating a file at <code>/etc/udev/rules.d/50-switch.rules</code>With the following contents:<br><code>SUBSYSTEM==\"usb\", ATTR{idVendor}==\"0955\", MODE=\"0664\", GROUP=\"plugdev\"</code></p><p>Hekate for 4.x has not been tested, as I do not have a 4.x switch. However, all other payloads will be tested as they are uploaded.</p><p>This has been tested and appears to work on Linux, OSX, Android (unrooted) and Chromebooks. Your mileage may vary.</p>";
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
function openInstructions() {
|
||||
if(document.getElementById("infodiv").innerHTML != "") {
|
||||
document.getElementById("infodiv").innerHTML = "";
|
||||
} else {
|
||||
document.getElementById("infodiv").innerHTML = "<h4>Instructions:</h4><p>Put the Switch in RCM, and connect it to your device.</p><p>Select either the example payload, or upload one.</p><p>Press 'Run Payload!'</p><p>On the consent screen that appears, select 'APX' and hit confirm.</p><p>If all goes well, the payload will launch!</p>";
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
document.getElementById("payloadUpload").addEventListener("change", () => document.forms.mainForm.payload.value = "uploaded");
|
||||
|
|
|
|||
|
|
@ -0,0 +1,21 @@
|
|||
MIT License
|
||||
|
||||
Copyright (c) 2018 atlas44
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
# web-cfw-loader
|
||||
Fusee Launcher, in a browser!
|
||||
|
||||
# Description
|
||||
This is a port of [fusee-launcher](https://github.com/reswitched/fusee-launcher) to JavaScript using WebUSB. This has been mildly tested and appears to work on Linux, Android (unrooted), OSX and ChromeOS. Today, this only works on Chrome because only Chrome implements WebUSB. It also does NOT work on Windows because the WebUSB Windows implementation does not allow sending the required USB packet.
|
||||
|
||||
# Forked
|
||||
This is also a fork of [web-fusee-launcher](https://github.com/atlas44/web-fusee-launcher), which I fixed up a bit, added hekate 5 and 4, and did some CSS stuff.
|
||||
|
||||
# Try it out
|
||||
Either use a web server to host the files (must be on https!) or you can try the [demo](https://elijahzawesome.github.io/web-cfw-loader/).
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 18 KiB |
|
|
@ -0,0 +1,156 @@
|
|||
<!doctype html>
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<link rel="stylesheet" type="text/css" href="style.css" />
|
||||
<link href="favicon.png" rel="icon" type="image/x-icon" />
|
||||
<title>Switch Payload Loader v1.2</title>
|
||||
|
||||
<!-- JQuery: needed for some Bootstrap Components -->
|
||||
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
|
||||
|
||||
<!-- Bootstrap 3 framework -->
|
||||
<!-- Latest compiled and minified CSS -->
|
||||
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">
|
||||
<!-- Optional theme -->
|
||||
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css" integrity="sha384-rHyoN1iRsVXV4nD0JutlnGaslCJuC7uwjduW9SVrLvRYooPp2bWYgmgJQIXwl/Sp" crossorigin="anonymous">
|
||||
<!-- Latest compiled and minified JavaScript -->
|
||||
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js" integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa" crossorigin="anonymous"></script>
|
||||
|
||||
</head>
|
||||
|
||||
<body class="container-fluid">
|
||||
<div class="row" id="title">
|
||||
<h1>Nintendo Switch Payload Loader</h1>
|
||||
<h4>Fusee Launcher portado para JavaScript usando WebUSB.</h4>
|
||||
</div>
|
||||
|
||||
<div class="row margin-top-md">
|
||||
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
<div class="btn-group" role="group" aria-label="...">
|
||||
<a class="btn btn-info" href="../index.html">English</a>
|
||||
<a class="btn btn-info" href="../it_IT/index.html">Italiano</a>
|
||||
<a class="btn btn-info disabled" href="#">Português</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row margin-top-md" id="infodiv">
|
||||
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
|
||||
<div class="alert alert-danger" role="alert">
|
||||
<p>Esta ferramenta não foi completamente testada. Apesar de não ter encontrado nenhuma falha, não me responsabilizo se algo der errado!</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>Isto NÃO funciona no Windows devido uma limitação do Chrome na implementação do WebUSB (e, possivelmente, outros motivos).</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>Isto NÃO funciona, atualmente, em nenhum browser além do Chrome, que é o único a implementar WebUSB.</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>No Linux você pode receber um erro de Acesso Negado! Caso receba, tente criar o arquivo <code>/etc/udev/rules.d/50-switch.rules</code> com o seguinte conteúdo: <br><code>SUBSYSTEM==\"usb\", ATTR{idVendor}==\"0955\", MODE=\"0664\", GROUP=\"plugdev\"</code></p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>Hekate 4.x NÃO foi testado, já que não tenho um Switch na versão 4.x. Entretanto todos os outros payloads serão testados antes de disponibilizados.</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning alert-dismissible" role="alert">
|
||||
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
|
||||
<p>Isto foi testado -e aparentemente funciona- no Linux, OSX, Android (sem precisar de root) e Chromebooks. Resultados podem variar.</p>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-info" role="alert">
|
||||
<h4>Instruções:</h4>
|
||||
<ul>
|
||||
<li>Coloque o Switch no modo RCM e conecte-o ao dispositivo.</li>
|
||||
<li>Escolha um dos payloads disponíveis ou faça upload de um.</li>
|
||||
<li>Clique em "Enviar Payload"!</li>
|
||||
<li>No diálogo de confirmação escolha "APX" e clique em Confirmar</li>
|
||||
<li>Se tudo der certo, o payload executará!</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row">
|
||||
<div class="class=col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
<h1>Configurar Entrega de Payload</h1>
|
||||
|
||||
<form id="mainForm">
|
||||
<div class="row">
|
||||
<div class="col-xs-6">
|
||||
<h4>Payload:</h4>
|
||||
</div>
|
||||
|
||||
<div class="col-xs-6">
|
||||
<select class="pull-right" id="payloadSelect" onchange="onSelectChange()">
|
||||
<option value="instaboot">Execução Instantânea CFW (5.0.x)</option>
|
||||
<option value="hekate v5">Hekate para Switch ver. 5.0.X</option>
|
||||
<option value="hekate v4">Hekate para Switch ver. 4.0.X</option>
|
||||
<option value="fusee">Payload de teste do time (Re)Switched (fusee)</option>
|
||||
<option value="uploaded">Upload de Payload</option>
|
||||
</select>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row" id="uploadContainer" style="display: none">
|
||||
<div class="row-xs-12">
|
||||
<input style="float: right" type="file" id="payloadUpload" accept=".bin"/>
|
||||
</div>
|
||||
</div>
|
||||
<div class="row divider-line"></div>
|
||||
|
||||
<div class="row margin-top-md">
|
||||
<div class="col-xs-10">
|
||||
<h4>Recuperar array de bytes do payload (favor não exploitar)</h4>
|
||||
</div>
|
||||
<div class="col-xs-2">
|
||||
<input class="pull-right" type="checkbox" name="shouldDebug" id="shouldDebug">
|
||||
</div>
|
||||
</div>
|
||||
<div class="row divider-line"></div>
|
||||
</form>
|
||||
|
||||
<div class="row margin-top-md">
|
||||
<div class="col-xs-12">
|
||||
<button class="btn btn-primary btn-lg pull-right" id="goButton">Enviar Payload!</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row">
|
||||
<div class="class=col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
<h3>Log:</h3>
|
||||
<div id="output"></div>
|
||||
<button class="btn btn-primary pull-right margin-top-md" id="clearlogsbutton" onclick="clearLog();">Limpar Logs</button><br><br>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<script src="./payloads.js"></script>
|
||||
<script src="./main.js"></script>
|
||||
</body>
|
||||
|
||||
<div class="row margin-top-md" id="page-footer">
|
||||
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
|
||||
<div id="disclaimer">
|
||||
<p>Código fonte disponível em <a href="https://github.com/ElijahZAwesome/web-cfw-loader/">GitHub</a> (ou simplesmente clicando 'ver código', não há backend).</p>
|
||||
<p>Um port do <a href="https://github.com/reswitched/fusee-launcher">fusee-launcher</a>.</p>
|
||||
<p>Muito obrigado a Ktemkin e time (Re)Switched, bem como <br><a href="https://atlas44.s3-us-west-2.amazonaws.com/web-fusee-launcher/index.html">Atlas44 e seu website</a> que é a base deste.</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</html>
|
||||
|
|
@ -0,0 +1,206 @@
|
|||
const intermezzo = new Uint8Array([
|
||||
0x44, 0x00, 0x9F, 0xE5, 0x01, 0x11, 0xA0, 0xE3, 0x40, 0x20, 0x9F, 0xE5, 0x00, 0x20, 0x42, 0xE0,
|
||||
0x08, 0x00, 0x00, 0xEB, 0x01, 0x01, 0xA0, 0xE3, 0x10, 0xFF, 0x2F, 0xE1, 0x00, 0x00, 0xA0, 0xE1,
|
||||
0x2C, 0x00, 0x9F, 0xE5, 0x2C, 0x10, 0x9F, 0xE5, 0x02, 0x28, 0xA0, 0xE3, 0x01, 0x00, 0x00, 0xEB,
|
||||
0x20, 0x00, 0x9F, 0xE5, 0x10, 0xFF, 0x2F, 0xE1, 0x04, 0x30, 0x90, 0xE4, 0x04, 0x30, 0x81, 0xE4,
|
||||
0x04, 0x20, 0x52, 0xE2, 0xFB, 0xFF, 0xFF, 0x1A, 0x1E, 0xFF, 0x2F, 0xE1, 0x20, 0xF0, 0x01, 0x40,
|
||||
0x5C, 0xF0, 0x01, 0x40, 0x00, 0x00, 0x02, 0x40, 0x00, 0x00, 0x01, 0x40
|
||||
]);
|
||||
|
||||
|
||||
|
||||
const RCM_PAYLOAD_ADDRESS = 0x40010000;
|
||||
const INTERMEZZO_LOCATION = 0x4001F000;
|
||||
const PAYLOAD_LOAD_BLOCK = 0x40020000;
|
||||
|
||||
|
||||
|
||||
function createRCMPayload(intermezzo, payload) {
|
||||
const rcmLength = 0x30298;
|
||||
|
||||
const intermezzoAddressRepeatCount = (INTERMEZZO_LOCATION - RCM_PAYLOAD_ADDRESS) / 4;
|
||||
|
||||
const rcmPayloadSize = Math.ceil((0x2A8 + (0x4 * intermezzoAddressRepeatCount) + 0x1000 + payload.byteLength) / 0x1000) * 0x1000;
|
||||
|
||||
const rcmPayload = new Uint8Array(new ArrayBuffer(rcmPayloadSize))
|
||||
const rcmPayloadView = new DataView(rcmPayload.buffer);
|
||||
|
||||
rcmPayloadView.setUint32(0x0, rcmLength, true);
|
||||
|
||||
for (let i = 0; i < intermezzoAddressRepeatCount; i++) {
|
||||
rcmPayloadView.setUint32(0x2A8 + i * 4, INTERMEZZO_LOCATION, true);
|
||||
}
|
||||
|
||||
rcmPayload.set(intermezzo, 0x2A8 + (0x4 * intermezzoAddressRepeatCount));
|
||||
rcmPayload.set(payload, 0x2A8 + (0x4 * intermezzoAddressRepeatCount) + 0x1000);
|
||||
|
||||
return rcmPayload;
|
||||
}
|
||||
|
||||
|
||||
|
||||
function bufferToHex(data) {
|
||||
let result = "";
|
||||
for (let i = 0; i < data.byteLength; i++)
|
||||
result += data.getUint8(i).toString(16).padStart(2, "0");
|
||||
return result;
|
||||
}
|
||||
|
||||
|
||||
|
||||
async function write(device, data) {
|
||||
let length = data.length;
|
||||
let writeCount = 0;
|
||||
const packetSize = 0x1000;
|
||||
|
||||
while (length) {
|
||||
const dataToTransmit = Math.min(length, packetSize);
|
||||
length -= dataToTransmit;
|
||||
|
||||
const chunk = data.slice(0, dataToTransmit);
|
||||
data = data.slice(dataToTransmit);
|
||||
await device.transferOut(1, chunk);
|
||||
writeCount++;
|
||||
}
|
||||
|
||||
return writeCount;
|
||||
}
|
||||
|
||||
|
||||
|
||||
function readFileAsArrayBuffer(file) {
|
||||
return new Promise((res, rej) => {
|
||||
const reader = new FileReader();
|
||||
reader.onload = e => {
|
||||
res(e.target.result);
|
||||
}
|
||||
reader.readAsArrayBuffer(file);
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
|
||||
function logOutput(...message) {
|
||||
document.getElementById("output").innerHTML = document.getElementById("output").innerHTML + message.join(" ") + "<br>";
|
||||
}
|
||||
|
||||
|
||||
|
||||
function clearLog() {
|
||||
document.getElementById("output").innerHTML = "";
|
||||
}
|
||||
|
||||
|
||||
|
||||
let device;
|
||||
|
||||
|
||||
|
||||
async function launchPayload(payload) {
|
||||
await device.open();
|
||||
logOutput(`Connected to ${device.manufacturerName} ${device.productName}`);
|
||||
|
||||
await device.claimInterface(0);
|
||||
|
||||
const deviceID = await device.transferIn(1, 16);
|
||||
logOutput(`Device ID: ${bufferToHex(deviceID.data)}`);
|
||||
|
||||
const rcmPayload = createRCMPayload(intermezzo, payload);
|
||||
logOutput("Sending payload...");
|
||||
const writeCount = await write(device, rcmPayload);
|
||||
logOutput("Payload sent!");
|
||||
|
||||
if (writeCount % 2 !== 1) {
|
||||
logOutput("Switching to higher buffer...");
|
||||
await device.transferOut(1, new ArrayBuffer(0x1000));
|
||||
}
|
||||
|
||||
logOutput("Trigging vulnerability...");
|
||||
const vulnerabilityLength = 0x7000;
|
||||
const smash = await device.controlTransferIn({
|
||||
requestType: 'standard',
|
||||
recipient: 'interface',
|
||||
request: 0x00,
|
||||
value: 0x00,
|
||||
index: 0x00
|
||||
}, vulnerabilityLength);
|
||||
}
|
||||
|
||||
|
||||
|
||||
document.getElementById("goButton").addEventListener("click", async () => {
|
||||
clearLog();
|
||||
var debugCheckbox = document.getElementById("shouldDebug");
|
||||
const payloadType = document.getElementById("payloadSelect").value;
|
||||
|
||||
let payload;
|
||||
if (payloadType === "hekate v5") {
|
||||
payload = hekate5;
|
||||
|
||||
} else if (payloadType === "hekate v4") {
|
||||
payload = hekate4;
|
||||
|
||||
} else if (payloadType === "fusee") {
|
||||
payload = fusee;
|
||||
|
||||
} else if (payloadType === "instaboot") {
|
||||
payload = instaboot;
|
||||
|
||||
} else if (payloadType === "uploaded") {
|
||||
const file = document.getElementById("payloadUpload").files[0];
|
||||
if (!file) {
|
||||
alert("You need to upload a file, to use an uploaded file.");
|
||||
return;
|
||||
}
|
||||
payload = new Uint8Array(await readFileAsArrayBuffer(file));
|
||||
} else {
|
||||
logOutput("<span style='color:red'>You're trying to load a payload type that doesn't exist.</span>");
|
||||
return;
|
||||
}
|
||||
|
||||
if(debugCheckbox.checked) {
|
||||
logOutput("Logging payload bytes...");
|
||||
|
||||
var payloadToLog = "";
|
||||
for (var i = 0; i < payload.length; i++) {
|
||||
payloadToLog += "0x" + payload[i].toString(16) + ", ".toUpperCase();
|
||||
}
|
||||
payloadToLog = payloadToLog.toUpperCase();
|
||||
logOutput(payloadToLog);
|
||||
return;
|
||||
}
|
||||
|
||||
logOutput("Requesting access to device...");
|
||||
device = await navigator.usb.requestDevice({ filters: [{ vendorId: 0x0955 }] });
|
||||
|
||||
logOutput(`<span style='color:blue'>Preparing to launch ${payloadType}...</span>`);
|
||||
launchPayload(payload);
|
||||
});
|
||||
|
||||
|
||||
|
||||
function onSelectChange() {
|
||||
if (document.getElementById("payloadSelect").value === "uploaded")
|
||||
document.getElementById("uploadContainer").style.display = "block"
|
||||
else
|
||||
document.getElementById("uploadContainer").style.display = "none"
|
||||
}
|
||||
|
||||
|
||||
|
||||
function openInfo() {
|
||||
if(document.getElementById("infodiv").innerHTML != "") {
|
||||
document.getElementById("infodiv").innerHTML = "";
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
function openInstructions() {
|
||||
if(document.getElementById("infodiv").innerHTML != "") {
|
||||
document.getElementById("infodiv").innerHTML = "";
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
document.getElementById("payloadUpload").addEventListener("change", () => document.forms.mainForm.payload.value = "uploaded");
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,45 @@
|
|||
@import url('https://fonts.googleapis.com/css?family=Open+Sans');
|
||||
|
||||
body {
|
||||
margin-top: 0px;
|
||||
margin-left: 0px;
|
||||
margin-right: auto;
|
||||
font-family: 'Open Sans', sans-serif;
|
||||
}
|
||||
|
||||
#title {
|
||||
text-align: center;
|
||||
font-size: 1.5vw;
|
||||
padding-top: 10vw;
|
||||
padding-bottom: 10vw;
|
||||
background-size: cover;
|
||||
background-color: black;
|
||||
background-image: url("https://icdn1.digitaltrends.com/image/nintendo-switch-review-photos-pdx-580.jpg");
|
||||
color: white;
|
||||
margin-top: 0px;
|
||||
top: 0px;
|
||||
}
|
||||
|
||||
#output {
|
||||
height: 200px;
|
||||
border: 1px solid black;
|
||||
overflow: scroll;
|
||||
}
|
||||
|
||||
#page-footer {
|
||||
padding: 32px;
|
||||
background: #222528;
|
||||
color: whitesmoke;
|
||||
}
|
||||
|
||||
#disclaimer {
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.divider-line {
|
||||
border-bottom: 1px solid gainsboro;
|
||||
}
|
||||
|
||||
.margin-top-md {
|
||||
margin-top: 24px;
|
||||
}
|
||||
43
style.css
43
style.css
|
|
@ -4,7 +4,6 @@ body {
|
|||
margin-top: 0px;
|
||||
margin-left: 0px;
|
||||
margin-right: auto;
|
||||
text-align: center;
|
||||
font-family: 'Open Sans', sans-serif;
|
||||
}
|
||||
|
||||
|
|
@ -17,44 +16,30 @@ body {
|
|||
background-color: black;
|
||||
background-image: url("https://icdn1.digitaltrends.com/image/nintendo-switch-review-photos-pdx-580.jpg");
|
||||
color: white;
|
||||
width: 100%;
|
||||
margin-top: 0px;
|
||||
top: 0px;
|
||||
}
|
||||
|
||||
#output {
|
||||
margin-left: 0px;
|
||||
width: 700px;
|
||||
height: 200px;
|
||||
border: 1px solid black;
|
||||
margin-right: 0px;
|
||||
margin: auto;
|
||||
overflow: scroll;
|
||||
}
|
||||
|
||||
.btn {
|
||||
background: #3498db;
|
||||
background-image: -webkit-linear-gradient(top, #3498db, #2980b9);
|
||||
background-image: -moz-linear-gradient(top, #3498db, #2980b9);
|
||||
background-image: -ms-linear-gradient(top, #3498db, #2980b9);
|
||||
background-image: -o-linear-gradient(top, #3498db, #2980b9);
|
||||
background-image: linear-gradient(to bottom, #3498db, #2980b9);
|
||||
-webkit-border-radius: 12;
|
||||
-moz-border-radius: 12;
|
||||
border-radius: 12px;
|
||||
font-family: Arial;
|
||||
color: #ffffff;
|
||||
font-size: 23px;
|
||||
padding: 12px 20px 10px 20px;
|
||||
text-decoration: none;
|
||||
#page-footer {
|
||||
padding: 32px;
|
||||
background: #222528;
|
||||
color: whitesmoke;
|
||||
}
|
||||
|
||||
.btn:hover {
|
||||
background: #3cb0fd;
|
||||
background-image: -webkit-linear-gradient(top, #3cb0fd, #3498db);
|
||||
background-image: -moz-linear-gradient(top, #3cb0fd, #3498db);
|
||||
background-image: -ms-linear-gradient(top, #3cb0fd, #3498db);
|
||||
background-image: -o-linear-gradient(top, #3cb0fd, #3498db);
|
||||
background-image: linear-gradient(to bottom, #3cb0fd, #3498db);
|
||||
text-decoration: none;
|
||||
#disclaimer {
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.divider-line {
|
||||
border-bottom: 1px solid gainsboro;
|
||||
}
|
||||
|
||||
.margin-top-md {
|
||||
margin-top: 24px;
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue