NXBoot

This application enables provisioning a Tegra X1 powered device with early boot code using an iOS or macOS device. For example, you may use this application to start the Hekate Bootloader or the Lakka Linux Distrobution (RetroArch) on a supported Nintendo Switch.

Disclaimer: Early boot code has full access to the device it runs on and can damage it. No boot code is shipped with this application. Responsibility for consequences of using this application and executing boot code remains with the user.

Released Features

• Command line tool for iOS and macOS
• Native app for iOS
• Fusée and ShofEL2 (Coreboot/Linux) payloads are supported
• Hekate integration (command line tool only)
• Store multiple payloads and easily switch between them
• Install payloads via iTunes File Transfer or any iCloud/Files-Compatible file transfer app
• Auto-boot, just connect your device while the app is opened

Planned Features

There is no ETA on those, it's just a bunch of ideas that I think are nice to have for this app:

• Managed payload profiles with auto-updates (always have the latest Hekate etc. available without any effort)
• Optional Substrate tweak that disables the unsupported device message when a Switch is connected
• Proper macOS GUI (currently limited working but unreleased Mac Catalyst port)
• Hekate integration for GUI

Prerequisites

• A jailbroken or TrollStore iOS device with iOS 9 or later
• Proper sandbox patches installed by the jailbreak (unc0ver works as-is)
• A USB 3 Type A to Type C cable
• An OTG (Lightning to USB 2.0 or 3.0) adapter. Apple's costs $35, and cheaper third-party adapters may work.

Installation

For installation instructions please visit the project homepage at mologie.github.io. The apps and command line tool can be built from source via build.sh after running quickstart.sh once. You will need to edit Config.xcconfig for code signing settings.

Components

• NXBoot: The iOS 9+ UIKit app for jailbroken/TrollStore devices
• NXBootCmd: iOS 9+ and macOS 10.11+ command line tool for injecting payloads
• NXBootKit: The framework that powers the above tools

License

All included source code is licensed under the GPLv3. Pull requests must be made available under the same license.

Attribution and Prior Work

CVE-2018-6242 was discovered by Kate Temkin (@ktemkin) and fail0verflow (@fail0verflow). Fusée Gelée was implemented by @ktemkin; ShofEL2 was implemented by @fail0verflow.

JustBrandonT has implemented a proof-of-concept Fusée app for iOS 11.1 and earlier at GBAtemp. This application was developed independently of JustBrandonT's work.