atmosphere-nx / hac2l

hac2l is a tool to view information about, decrypt, and extract common file formats for the Nintendo Switch, especially Nintendo Content Archives.

Atmosphère is a work-in-progress customized firmware for the Nintendo Switch.

Components

Atmosphère consists of multiple components, each of which replaces/modifies a different component of the system:

• Fusée: First-stage Loader, responsible for loading and validating stage 2 (custom TrustZone) plus package2 (Kernel/FIRM sysmodules), and patching them as needed. This replaces all functionality normally in Package1loader/NX Bootloader.
  • Sept: Payload used to enable support for runtime key derivation on 7.0.0.
• Exosphère: Customized TrustZone, to run a customized Secure Monitor
• Thermosphère: EL2 EmuNAND support, i.e. backing up and using virtualized/redirected NAND images
• Stratosphère: Custom Sysmodule(s), both Rosalina style to extend the kernel/provide new features, and of the loader reimplementation style to hook important system actions
• Troposphère: Application-level Horizon OS patches, used to implement desirable CFW features

Licensing

This software is licensed under the terms of the GPLv2, with exemptions for specific projects noted below.

You can find a copy of the license in the LICENSE file.

Exemptions:

• Nintendo is exempt from GPLv2 licensing and may (at its option) instead license any source code authored for the Atmosphère project under the Zero-Clause BSD license.

Credits

Atmosphère is currently being developed and maintained by SciresM, TuxSH, hexkyz, and fincs.
In no particular order, we credit the following for their invaluable contributions:

• switchbrew for the libnx project and the extensive documentation, research and tool development pertaining to the Nintendo Switch.
• devkitPro for the devkitA64 toolchain and libnx support.
• ReSwitched Team for additional documentation, research and tool development pertaining to the Nintendo Switch.
• ChaN for the FatFs module.
• Marcus Geelnard for the bcl-1.2.0 library.
• naehrwert and st4rk for the original hekate project and its hwinit code base.
• CTCaer for the continued hekate project's fork and the minerva_tc project.
• m4xw for development of the emuMMC project.
• Riley for suggesting "Atmosphere" as a Horizon OS reimplementation+customization project name.
• hedgeberg for research and hardware testing.
• lioncash for code cleanup and general improvements.
• jaames for designing and providing Atmosphère's graphical resources.
• Everyone who submitted entries for Atmosphère's splash design contest.
• All those who actively contribute to the Atmosphère repository.

hac2l's Issues

Trying to extract XCI using `--rootdir` results in segfault

Trying to extract XCI (both with and without an appended key area via nxdumptool) by using a command similar to $ hac2l -t xci "Input XCI here.xci" --rootdir "Output Directory Here" results in segfault when trying on the step Saving root:/normal.
Binary was built in the gcc:12.2.0-bullseye Docker container, and container was updated before building to the latest version of software from the repositories.

Example output of issue using linux_x64_release build, with most XCI/Title info stripped:

$ hac2l -t xci "Aggelos 1.0.2 [010004D00A9C0000][v131072] (keyarea) (certless) (untrimmed).xci" --rootdir "Aggelos 1.0.2 [010004D00A9C0000][v131072] (keyarea) (certless) (untrimmed)"
...
            Sections:
                Section 0:
                    Offset:                         0x000005AC7600
                    Size:                           0x000001500000
                    Version:                        2
                    Fs Type:                        PartitionFs
                    Hash Type:                      HierarchicalSha256Hash
                    Encryption Type:                AesCtr
                    Encryption Iv:                  000000010000000100000000005AC760
                    Has Sparse Layer:               0
                    Has AesCtrEx Table:             0
                    Has Indirect Table:             0
                    Has Compression Layer:          0
                Section 1:
                    Offset:                         0x000000004000
                    Size:                           0x000005AC3600
                    Version:                        2
                    Fs Type:                        RomFs
                    Hash Type:                      HierarchicalIntegrityHash
                    Encryption Type:                AesCtrEx
                    Encryption Iv:                  00000002000000010000000000000400
                    Has Sparse Layer:               0
                    Has AesCtrEx Table:             1
                    Has Indirect Table:             1
                    Has Compression Layer:          0
Saving root:/update...  [========================================] Done!
Saving root:/logo...  [========================================] Done!
Saving root:/normal...  [                                        ][1]    399320 segmentation fault  hac2l -t xci  --rootdir

Running the linux_x64_audit build in gdb shows this:

$ gdb --args ~/Downloads/Games/Switch/Tools/Docker/hac2l/hac2l-debian_audit -t xci "Aggelos 1.0.2 [010004D00A9C0000][v131072] (keyarea) (certless) (untrimmed).xci" --rootdir "Aggelos 1.0.2 [010004D00A9C0000][v131072] (keyarea) (certless) (untrimmed)"
GNU gdb (Debian 10.1-1.7) 10.1.90.20210103-git
...
Reading symbols from /home/whovian/Downloads/Games/Switch/Tools/Docker/hac2l/hac2l-debian_audit...
(gdb) set substitute-path /AMS/tools/hac2l /home/whovian/Downloads/Games/Switch/Tools/Docker/hac2l/Atmosphere/tools/hac2l
(gdb) run
Starting program: /home/whovian/Downloads/Games/Switch/Tools/Docker/hac2l/hac2l-debian_audit -t xci Aggelos\ 1.0.2\ \[010004D00A9C0000\]\[v131072\]\ \(keyarea\)\ \(certless\)\ \(untrimmed\).xci --rootdir Aggelos\ 1.0.2\ \[010004D00A9C0000\]\[v131072\]\ \(keyarea\)\ \(certless\)\ \(untrimmed\)
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
...
            Sections:
                Section 0:
                    Offset:                         0x000005AC7600
                    Size:                           0x000001500000
                    Version:                        2
                    Fs Type:                        PartitionFs
                    Hash Type:                      HierarchicalSha256Hash
                    Encryption Type:                AesCtr
                    Encryption Iv:                  000000010000000100000000005AC760
                    Has Sparse Layer:               0
                    Has AesCtrEx Table:             0
                    Has Indirect Table:             0
                    Has Compression Layer:          0
                Section 1:
                    Offset:                         0x000000004000
                    Size:                           0x000005AC3600
                    Version:                        2
                    Fs Type:                        RomFs
                    Hash Type:                      HierarchicalIntegrityHash
                    Encryption Type:                AesCtrEx
                    Encryption Iv:                  00000002000000010000000000000400
                    Has Sparse Layer:               0
                    Has AesCtrEx Table:             1
                    Has Indirect Table:             1
                    Has Compression Layer:          0
Saving root:/update...  [========================================] Done!
Saving root:/logo...  [========================================] Done!
Saving root:/normal...  [                                        ]
Program received signal SIGSEGV, Segmentation fault.
0x0000000000405da2 in ams::hactool::(anonymous namespace)::ProgressPrinter<40, (char)'=', (char)' '>::Render (this=<optimized out>) at /AMS/tools/hac2l/source/hactool_fs_utils.cpp:56
56                          std::memset(prog + m_segs, Empty, Count - m_segs);
(gdb) bt
#0  0x0000000000405da2 in ams::hactool::(anonymous namespace)::ProgressPrinter<40, (char)'=', (char)' '>::Render (this=<optimized out>) at /AMS/tools/hac2l/source/hactool_fs_utils.cpp:56
#1  0x2020202020202020 in ?? ()
#2  0x2020202020202020 in ?? ()
#3  0x2020202020202020 in ?? ()
#4  0x2020202020202020 in ?? ()
#5  0x2020202020202020 in ?? ()
#6  0x2020202020202020 in ?? ()
#7  0x2020202020202020 in ?? ()
#8  0x2020202020202020 in ?? ()
#9  0x2020202020202020 in ?? ()
#10 0x2020202020202020 in ?? ()
#11 0x2020202020202020 in ?? ()
#12 0x2020202020202020 in ?? ()
#13 0x2020202020202020 in ?? ()
#14 0x2020202020202020 in ?? ()
#15 0x2020202020202020 in ?? ()
#16 0x2020202020202020 in ?? ()
#17 0x2020202020202020 in ?? ()
#18 0x2020202020202020 in ?? ()
#19 0x2020202020202020 in ?? ()
#20 0x2020202020202020 in ?? ()
#21 0x2020202020202020 in ?? ()
#22 0x2020202020202020 in ?? ()
#23 0x2020202020202020 in ?? ()
#24 0x2020202020202020 in ?? ()
#25 0x2020202020202020 in ?? ()
#26 0x2020202020202020 in ?? ()
#27 0x2020202020202020 in ?? ()
#28 0x2020202020202020 in ?? ()
#29 0x2020202020202020 in ?? ()
#30 0x2020202020202020 in ?? ()
#31 0x2020202020202020 in ?? ()
#32 0x2020202020202020 in ?? ()
#33 0x2020202020202020 in ?? ()
#34 0x2020202020202020 in ?? ()
#35 0x2020202020202020 in ?? ()
#36 0x2020202020202020 in ?? ()
...
#6690 0x2020202020202020 in ?? ()
#6691 0x2020202020202020 in ?? ()
#6692 0x2020202020202020 in ?? ()
#6693 0x2020202020202020 in ?? ()
#6694 0x2020202020202020 in ?? ()
#6695 0x2020202020202020 in ?? ()
#6696 0x2020202020202020 in ?? ()
#6697 0x2020202020202020 in ?? ()
Backtrace stopped: Cannot access memory at address 0x7ffffffff000
(gdb) step

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.
(gdb) quit