To Hack or not to Hack

Here is how I toed the line between performance tuning a jailbroken gaming console and using it officially with Nintendo Online.

For context, after realizing how mucher smoother and quicker Overcooked runs on other consoles, I took it as a challenge to find a way to bring that same experience to my Switch—and not get banned.

Docked Nintendo Switch running Overcooked at 720p 60 FPS

Terminology

• Tegra = the NVIDIA chipset that Nintendo uses inside the Switch
• RCM = Recovery Mode
• CFW = Custom Firmware
• OFW = Original Firmware
• eMMC/sysNAND = the internal system memory (terms are loosely used interchangeably)
• emuMMC/emuNAND = emulated system memory (terms are loosley used interchangeably)
  • This is written to an SD card, since SD card contents are never readable by Nintendo for privacy
• EMC = Embedded Memory Controller i.e. the RAM on the device
• MEM = another term for the RAM
• NX = the original codename for the Switch, first publicly mentioned in March 2015¹
• HOS = Horizon OS, the internal name for the stock Nintendo firmware
• Erista/Mariko = codenames for the non-OLED Switch models. The original Erista can be soft-modded because of the Tegra exploit, but latter chipsets need a surrogate chip installed to re-enable the exploit.²

Objectives

1. Overclock the CPU/GPU/Memory so that performance of various games is improved
2. Continue to play online with friends/family
3. Continue to use Nintendo Save Data Cloud
4. Prevent the Switch from getting banned
5. Prevent my Nintendo Online account from getting banned

Imperatives

These naturally follow from my objectives.

Design

1. Hekate is the bootloader, and Atmosphère is the CFW. RCM is used to enter the bootloader, and the bootloder is used to launch the CFW.
2. There are two ways to load Atmosphère from Hekate: (a) the “side-chain” approach using payload or (b) using Hekate’s launch configs using ff0.^{13 14} The latter is better because Hekate has specific flags to force sysNAND vs emuNAND whereas the side-chain approach can accidentally boot into sysNAND.⁴
3. Ever since Atmosphère 1.0.0, fusee-primary and fusee-secondary no longer exist. It was rewritten.¹⁵ When reading old guides, the files were renamed as follows: fusee-primary.bin -> fusee.bin and fusee-secondary.bin -> package3

Customized Playbook

There are few chief resources out there, sometimes with contradictory instructions.

• https://switch.homebrew.guide (update 2024: now retired indefinitely)
• https://rentry.org/SwitchHackingIsEasy
• https://switch.hacks.guide/

Since my goals are slightly different than most online guides, the following is my own secret sauce.

Mac vs PC

When writing to the SD card, the Mac can tend to leave extra files. It also can mess with the archive bit on files and folders, which can prevent Atmosphère to boot up at launch sometimes.¹⁶

However, Hekate has an option under Tools > Arch bit • RCM • Touch • Partition > Fix Archive Bit to scan the whole SD card and fix the archive bit. I simply do this after copying stuff. For me this is a better compromise than using a program like Android File Transfer, which has its own quirks, or busting out a spare PC.¹⁷

There are also some safe eject scripts¹⁸ the community has made for Mac, but I haven’t needed to really use these.

What to Download

Like all tech stacks, getting the right versions to play together is important. Here is what I have tried and tested.

Note: for Atmosphère, be sure to download fusee.bin as well as the .zip file!

Last but not least, we need a way to flash the Hekate payload. My favorite does neither requires installing additional dependencies nor requires Gatekeeper exemptions. Instead I use the browser-based web-fusee-launcher, which requires nothing other than Chrome on MacOS.

Download my fork from https://github.com/NaanProphet/web-fusee-launcher, open index.html and enjoy!

Preparing the SD Card

Although Nintendo’s instructions¹⁹ recommend using the official SD Memory Card Formatter (Apple Silicon compatible!), this will likely format larger SD cards as exFAT. We will reformat the card as FAT32 later using Hekate itself (because it is for better performance and compatibility.^{20 21 22})

For now, just insert the SD card into the computer and copy files normally. To merge folders, holding Option while dragging and dropping.

• Unzip hekate*.zip and copy the bootloader folder to the root of the SD card.
• Unzip atmosphere-x.x.x-master.zip and copy the atmosphere folder, switch folder, and hbmenu.nro to the root of the SD card.
• Place the file named fusee.bin in your /bootloader/payloads/ folder.
• Merge the contents of nx-ovlloader.zip into the atmosphere folder
• Merge the contents of ovlmenu.zip into the switch folder (this will copy over the switch/.overlays/ folder)
• Unzip sys-clk-*.zip and merge the atmosphere, config and switch folders
• Unzip Status-Monitor-Overlay.zip and merge the config and switch folders
• Unzip SaltyNX-*.zip and merge the atmosphere folder. Copy over the SaltySD folder (new).
• Copy ReverseNX-RT-ovl.ovl into the switch/.overlays/ folder (you may need to show hidden files in Finder)
• Copy FPSLocker.ovl into the switch/.overlays/ folder (you may need to show hidden files in Finder)
• Copy Lockpick_RCM.bin into your /bootloader/payloads/ folder, if you want it. See the Lockpick section below for more info.

Note: here we skip SigPatches, because we are not interesting in pirating games.

Booting Into Hekate

1. Factory reset the Switch by going to System Settings > System > Formatting Options > Restore Factory Settings
2. After it reboots, set up the device like normal (connect to WiFi, Nintendo Account, etc.)
3. Connect to the Nintendo eShop to make sure the console starts unbanned!
4. Now DISABLE cloud save and Wi-Fi (as a safety precaution), and turn off the Switch.
5. Enter the coveted RCM by first inserting your RCM Jig²³. While holding the Volume Up button, press the Power button. The screen will stay black if successful.
6. Use a USB-C cable to connect the device to your computer. Launch Chrome and open index.html from web-fusee-launcher. Send the initial test payload fusee-test.bin.
7. Now boot into Hekate by flashing the actual payload hekate_ctcaer_6.0.3.bin (or similar name)
8. Setup date/time using the touchscreen, woo!

You will now have bootloader/hekate_ipl.ini and bootloader/nyx.ini files.

Step 2.

• Insert the SD card into the Nintendo Switch
• Flash the hekate payload using web-fusee-launcher
• Formatting the SD card using Hekate automatically backs up the bootloader folder only. the switch and backups folder got wiped.

Any other partition will be wiped!withDon’t BackupandOK. Press OK. Partition Manager: Your files will be backed up and restored! Any other partition will be wiped!`

Finalizing the SD Card

1. First off, we need to re-format the SD card using Hekate. Navigate to Tools > Partition SD Card.

2. A dialog will popup either saying The SD Card files will be backed up automatically! or The SD Card cannot be backed up automatically!. It should be the former, because there is hardly anything on the SD card at this point, and the internal Switch 32 GB storage should have enough to temporarily backup/restore. Select OK.

3. Drag the FAT32 slider all the way to the right. Select Next Step and then Start.

4. The re-format and restore should be successful! This will rename the SD card to SWITCH SD woo!

5. Next, navigate to Tools > Backup and backup both eMMC BOOT0 & BOOT1 and eMMC RAW GPP (15 mins for the 32 GB model).

6. Eject the SD card while Hekate is running. A popup will say SD card was removed! Nyx will reload after inserting it. That is fine. (Otherwise enter USB storage mode Tools > USB Tools > SD Card which is about 3x slower.)

7. Copy the new backup folder’s contents from the SD card to a safe location (5 mins). Delete the backup folder from the SD card after, if desired.

8. The original /bootloader/hekate_ipl.ini should read as follows.

   Original

   [config]
   autoboot=0
   autoboot_list=0
   bootwait=3
   backlight=100
   noticker=0
   autohosoff=0
   autonogc=1
   updater2p=0
   bootprotect=0
   

   Now add the following secret sauce at the bottom.

   [CFW (sysNAND)]
   payload=bootloader/payloads/fusee.bin
   emummc_force_disable=1
   icon=bootloader/res/icon_payload.bmp
   
   [Stock]
   fss0=atmosphere/package3
   stock=1
   emummc_force_disable=1
   icon=bootloader/res/icon_switch.bmp
   

   Note: we will be leave AutoRCM OFF. This is the default. This means if you reboot the Switch without the RCM Jig, it will go back to vanilla HOS. I find this helpful for when you want to still play/upgrade firmware (without overclocking).

   Also: we skip exosphere and hosts blocking because our sysNAND needs to communicate with Nintendo’s servers to play online.

9. Place the SD card back into the Switch.

10. Lastly, go to Tools > Arch bit • RCM • Touch • Partition > Fix Archive Bit to sanity-check the SD card before booting.

11. Return to the home menu, select Launch and then boot into the CFW (sysNAND) entry

12. Re-enable WiFi, and enjoy!

13. To enter the Tesla overlay menu, press L+DDOWN+RSTICK. To exit hold down L+DDOWN+RSTICK.

Results

It’s been really fun tweaking the clock speeds and seeing the FPS in realtime on various games! Surprisingly a lot of upper tier games are already at 60 FPS.

| Title | Default | Tweaked | | – | | – | – | | Overcooked | 30 FPS @ 1080p | 60 FPS @ 720p (this is an acceptable tradeoff for me) | | Prince of Persia: The Lost Crown | 60 FPS @ 1080p gameplay, 30 FPS @1080p cutscenes | | | Mario Kart | 60 FPS @ 1080p | | | Super Mario 3D World | 60 FPS @ 1080p | |

Keeping Updated

In order to use Nintendo Cloud Save, the Switch needs to have the latest official firmware. However, sometimes there is a lag before matching Hekate/Atmosphère versions are released. So I either wait until the matching CFW comes out — or just simply update and boot into the vanilla firmware, temporarily forsaking any overclocking.

Also note that if you have two Switch consoles, one vanilla and another with CFW, in order to use Nintendo Save Data Cloud, both have to be on the latest Nintendo version.

Lastly, remember again to use the merge feature in Finder when updating software on the SD card by holding Option while dragging and dropping.

Appendix

emuNAND

Here are some additional notes on emuNAND that I learned while researching my build.

1. If an ADDITIONAL emuNAND partition is desired (for cheats/mods), it is crucial that Nintendo’s servers are blocked and never contacted on the emuNAND. Otherwise, when Nintendo sees the emulated signature and compares it to the stock signature (assuming the stock Switch has already gone online at least once), it will trigger a ban. ䷏ CFW on an external emuNAND must never, ever contact the internet.
2. Never mix same gave files from your emuNAND and sysNAND, especially if there are mods/cheats in the emuNAND. This is largely uncharted and full of unnecessary risk. ䷏ Isolate the emuNAND as a completely separate entity with its own save files. KISS.

Lockpick

If you wish to play your own LEGALLY owned games via an emulator, you will need Lockpick to extract the private keys from the Switch. The keys change with each Horizon OS version, so it is good to extract them regularly.

While still in USB mode, copy Lockpick_RCM.bin (into bootloader/payloads). Select Dump from SysNAND to extract the keys.

Note that I didn’t get any title.keys written, similar to this post.²⁴ It turns out those are only for digital games.

See these guides for download links and for more info:

• https://rentry.org/DumpingKeys
• https://github.com/Ryujinx/Ryujinx/wiki/Keys

Safe Limits

Here is the cheat sheet of official and max safe clock speeds from sys-clk manager. In summary, on a docked Erista, the CPU can be increased by 75%, GPU by 20%, and MEM by 20%.

It is possible to push the system too hard and cause the internal corruption. This is called memory binning. One Reddit post²⁵ cautions against this:

My understanding is that unstable memory clocks can cause Horizon to corrupt itself. An annoyance at best with emuNAND, and a brick if you’re daft enough to do it on sysNAND. Caveat emptor.

Lucky for us, we ARE intentionally “daft enough” to install CFW on the sysNAND. 😛 However, sys-clk, by default, limits the available options only to the safe limits.

References