Mount Switch nand partition after mount with Hekate USB Tools

[simondubrulle]

Hi,

I am trying to mount any partition of my Switch nand (eMMC & emuMMC) on my M1 Mac, with no succes so far. The Switch is mounted and accessible on my Mac at /dev/disk4 via Hekate USB tools (in read-only mode).

The issue I encounter is the following (some paths have been 'anonymised' but they have been checked):

>> /Library/Frameworks/Python.framework/Versions/3.10/bin/mount_nandhac --keys /Users/xxxxxx/....../prod.keys /dev/disk4 /Users/xxxxxx/Mounts/switch -o allow_other 
[HAC] Found and using openssl lib.
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.10/bin/mount_nandhac", line 33, in <module>
    sys.exit(load_entry_point('ninfs==2.0a9', 'console_scripts', 'mount_nandhac')())
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ninfs/main.py", line 134, in main
    exit(mount(basename(argv[0])[6:].lower()))
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ninfs/main.py", line 90, in mount
    return module.main(prog=prog)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ninfs/mount/nandhac.py", line 290, in main
    with open(a.image, mode) as f:
PermissionError: [Errno 13] Permission denied: '/dev/disk4'

I have tried to run the command as root as well and it does not help. I also tried to disable SIP ('csrutil disable') with no luck. I installed the dmg image and created a symbolic link of /dev/disk4 somewhere accessible: same permission error. I also tried same manipulations with full read-write mode in Hekate, still the same issue.

I am able to dump an image of the 'hekate eMMC GPP Media' media using Mac disk utility. I am also able to properly mount the SD card using Hekate USB tools.

Am I missing something here? Any idea of what I can do to better debug the issue?

Here is my setup :

• macOS 12.5.1 (21G83) - Kernel: Darwin 21.6.0
• Hekate v5.8.0
• ninfs==2.0a9
• Python 3.10.6 (v3.10.6:9c7b4bd164

Thanks in advance for your help

[ihaveamac]

Just out of curiosity are you able to try manually opening it in Python running as root? Like this:

a = open('/dev/disk4', 'rb+')

I don't remember if I tested this with Switch MMC connected over usb. I did once with a 3DS hardmod and it worked no problem on my Mac (but that was years ago).

[simondubrulle]

Good point, I've tried this and I still get the same permission error (for my own user & root). I have also tried to grant "Full Disk Access" to /Library/Frameworks/Python.framework/Versions/3.10/bin/mount_nandhac but it does not help. I am quite new to MacOS but it does look like a restriction from the OS. Unless you have another idea, it may be better that I spend some more time in understanding the OS better, then I'll come back to you.

[ihaveamac]

Try granting Full Disk Access to:

• /Library/Frameworks/Python.framework/Versions/3.10/Resources/Python.app
• /Library/Frameworks/Python.framework/Versions/3.10/bin/python3.10

These are the actual Python programs. The first one is the application that shows up in the dock when a gui shows up.

[ihaveamac]

Or to ninfs.app if you use the standalone build (which is Apple Silicon compatible)

[simondubrulle]

I indeed also tried with the latest ninfs.app + Full Disk Access (and symlinking /dev/disk4 to /Users/xxx/..., otherwise I cannot see it in the Finder) and still same error.

No luck with granting accesses to Python bins as well. To clarify, I also test the manipulations logged in as root.

I also tried to change usb port just in case. At some point I saw that newer MacOS versions had some more restrictions to reading raw devices in /dev but "csrutil disable" should have solved the issue (which is not the case).

[ihaveamac]

Well I was able to do open('/dev/disk#', 'rb+') (not a switch mmc over usb but still an external device) on my M1 Mac without issues. SIP is not disabled. Maybe you could also try this with a generic external device. If that doesn't work then it might be some other permission issue.

[ihaveamac]

Oh it might be worth checking that there are no mounted volumes. Something like diskutil unmountDisk disk4 before attempting to open an external device (switch mmc or otherwise).

[simondubrulle]

Oh I had done it based on the comments of an older issue. The diskutil unmountDisk shows successful status but it does not help :

~ % diskutil unmountDisk disk4
Unmount of all volumes on disk4 was successful

It's really strange as I am able to dump the device through the MacOS's Disk Utility app, so I know it is readable somehow. Sorry I am lacking a bit of MacOS experience to help here but I am still trying to debug it further, trying to catch more detailed error message.

[simondubrulle]

Well I was able to do open('/dev/disk#', 'rb+') (not a switch mmc over usb but still an external device) on my M1 Mac without issues. SIP is not disabled. Maybe you could also try this with a generic external device. If that doesn't work then it might be some other permission issue.

This makes me feel more confident it is not related to your work. Please do not spend more time on it unless you have another simple check in mind. I will come back to you after some more checkings on my side. Thanks anyway :)

[simondubrulle]

I am now able to make it work :).

It turns out that it is related to the "read-only" mode from Hekate. I did try the read/write mode from Hekate at some point but not as root (..) . As ninfs does not allow write by default (from what I understood), it is perfectly fine for me. SIP does not need to be disabled as you mentionned.

Setting proper ACL on /dev/disk4 also allows me to mount it with non-root users and it is also working with your latest standalone build 'ninfs.app' (still need to ln -s /dev/disk4 /path/to/accessible/folder to make the device available in Finder).

I am still wondering how does the Disk Utility manage to dump an image out of the device in read-only mode, but I'll leave it for another time.

@ihaveamac thanks for your time, reactivity and your app ! On my side, I use it to perform fast and small backups of my Switch (both eMMC and emuMMC). Using ninfs to mount the USER & SYSTEM partitions, and duplicacy to perform incremental (& deduplicated) backups.

[simondubrulle]

Solution: "read/write" mode needs to be selected in Hekate USB Tools + needs to run mount_nandhac as root or open permissions on /dev/diskX.