diff --git a/docs/building.md b/docs/building.md new file mode 100644 index 000000000..47d230b8a --- /dev/null +++ b/docs/building.md @@ -0,0 +1,6 @@ +# Building Atmosphère +The process for building Atmosphère is similar to building Fusée Gelée payloads and other Switch apps. + +In order to build Atmosphère you must have devkitARM and devkitA64 installed on your computer. You can find instructions on how to install and setup devkitARM and devkitA64 on various OSes [here](https://devkitpro.org/wiki/Getting_Started). + +Once you have finished installing devkitARM and devkitA64, simply clone the Atmosphère repo, change to it and run `make`. diff --git a/docs/components/exosphere.md b/docs/components/exosphere.md new file mode 100644 index 000000000..b8a1103c8 --- /dev/null +++ b/docs/components/exosphere.md @@ -0,0 +1,10 @@ +# Exosphère +Exosphère is a reimplementation of Arm's TrustZone (TZ), also known as Secure Monitor (Secure_Monitor.bin). It has the highest privilege mode available on the Switch’s processor, and has access to everything on the console. + +Exosphère will potentially play a big role in Jamais Vu and Déja Vu, which are upcoming software exploits for the Switch, allowing one to launch Atmosphère on a Fusée-Gélee patched (ipatched) Switch console, and will also enable one to launch into CFW directly from the Switch itself without the use of any sort of external device, such as a computer or RCM jig, provided they are on a low enough system firmware. + +## TrustZone/Secure Monitor +TrustZone is responsible for all the cryptographic operations on the Switch. The idea behind the way it operates is that all the keys stay in the TrustZone, and userspace only gets "handles" to them. This would make sure that keydata never leaks and is kept secure. It also has a few more responsibilities, such as power management, providing a source of random numbers, and providing access to various pieces of information that are stored in the fuses. + +## Extensions +Exosphère currently only contains one extension, an SMC allowing homebrew to find which version of Atmosphère is currently running, in order to find out what extensions are allowed to be used. diff --git a/docs/components/fusee/BCT.md b/docs/components/fusee/BCT.md new file mode 100644 index 000000000..35c9f8246 --- /dev/null +++ b/docs/components/fusee/BCT.md @@ -0,0 +1,26 @@ +# BCT.ini +BCT.ini is the configuration file used by fusée-primary and fusée-secondary. It is read by fusee-primary.bin to setup and boot fusee-secondary.bin and is also read by fusee-secondary.bin to configure Exosphère or to specify the environment it should boot. + +## Configuration +This file is located at the root of your SD. +``` +BCT0 +[stage1] +stage2_path = fusee-secondary.bin +stage2_addr = 0xF0000000 +stage2_entrypoint = 0xF0000000 +``` +Add the following lines and replace the `X` according to the following list if you have trouble booting past the firmware version detection. +`target_firmware` is the OFW major version. +``` +[exosphere] +target_firmware = X +``` +``` +1.0.0 = 1 +2.X.X = 2 +3.X.X = 3 +4.X.X = 4 +5.X.X = 5 +6.0.0 = 6 +``` diff --git a/docs/components/fusee/fusee.md b/docs/components/fusee/fusee.md new file mode 100644 index 000000000..64c9575bd --- /dev/null +++ b/docs/components/fusee/fusee.md @@ -0,0 +1,20 @@ +# Fusée +Fusée (not to be confused with Fusée Gelée) is a custom bootloader needed to start Atmosphère and replaces Nintendo's Package1loader/bootloader. It currently utilizes the [Tegra X1 RCM Vulnerability](https://nvidia.custhelp.com/app/answers/detail/a_id/4660/~/security-notice%3A-nvidia-tegra-rcm-vulnerability) in order to function. + +Fusée is split into two separate parts: fusée-primary and fusée-secondary. This is due to the RCM Vulnerability only allowing payloads of a limited filesize to be sent to the device. + +As of June 2018, there are new Switch systems being sold that prevent Fusée (or any payload that requires the Fusée Gelée exploit) from working due to having an ipatched bootrom. All ipatched systems share the HAC-S-JXE-C3 product code. While Fusée cannot work on these ipatched units, they still come on firmware 4.1.0, which is vulnerable to the upcoming Déja Vu software exploit. Note that if you update past 4.1.0 on one of these ipatched units, your odds of being able to install Atmosphère or run any homebrew become practically non-existent. + +Additionally, a hardware revision of the Switch known as “Mariko” is believed to be in development. No such units have been seen in stores yet, but it is expected Nintendo will roll them out silently. The Mariko units will most likely patch the bootrom vulnerability Fusée Gelée, which is currently used to access CFW, and will likely have their own proprietary bootloader. + +## Fusée-Primary +Fusée-primary is the payload file (fusee-primary.bin) sent to the Switch from an external device. Once sent, fusée-primary makes initial preparations before loading fusée-secondary from the Switch’s SD Card. + +Fusée-primary can be configured via the [BCT.ini](../fusee/BCT.md) file located on the Switch’s SD card. + +## Fusée-Secondary +Fusée-secondary is a payload file that stays on the root of the Switch’s SD Card (fusee-secondary.bin). It is automatically launched once fusée-primary has finished, and is responsible for preparing the Switch’s hardware for future running environments, such as the homebrew menu. Fusée-secondary is also responsible for validating and launching Exosphère. + +Fusée-secondary contains various [.kip modules](/docs/main.md#modules). These modules modify existing features in the OS, and can also add new ones. + +Fusée is also capable of chainloading other payloads such as Linux. diff --git a/docs/components/stratosphere.md b/docs/components/stratosphere.md new file mode 100644 index 000000000..58813ab77 --- /dev/null +++ b/docs/components/stratosphere.md @@ -0,0 +1,10 @@ +# Stratosphère +Stratosphère allows customization of the Horizon OS and Switch kernel. It includes custom sysmodules that extend the kernel and provide new features. It also includes a reimplementation of the loader sysmodules to hook important system actions. + +The sysmodules that Stratosphère includes are: ++ [boot](../modules/boot.md): This module boots the system and initalizes hardware. ++ [creport](../modules/creport.md): Reimplementation of Nintendo’s crash report system. Dumps all error logs to the SD card instead of saving them to the NAND and sending them to Nintendo. ++ [fs_mitm](../modules/fs_mitm.md): This module can log, deny, delay, replace, and redirect any request made to the File System. ++ [loader](../modules/loader.md): Enables modifying the code of binaries that are not stored inside the kernel. ++ [pm](../modules/pm.md): Reimplementation of Nintendo’s Process Manager. ++ [sm](../modules/sm.md): Reimplementation of Nintendo’s Service Manager. diff --git a/docs/components/thermosphere.md b/docs/components/thermosphere.md new file mode 100644 index 000000000..c29483598 --- /dev/null +++ b/docs/components/thermosphere.md @@ -0,0 +1,6 @@ +# Thermosphère +Thermosphère is a hypervisor based implementation of emuNAND. An emuNAND is a copy of the firmware on the Switch’s internal memory (sysNAND), and is typically installed on an external SD Card. + +An emuNAND operates completely independently of the sysNAND. This allows one to make or test various modifications and homebrew safely without needing to restore their NAND backup afterwards by testing things on the emuNAND, and switching back to the sysNAND when finished. In the case of past Nintendo systems such as the 3DS, an emuNAND could also be used to update your system to the latest firmware while keeping your sysNAND on a lower version, however this may be more difficult to do on the Switch due to Nintendo using efuse technology for major system updates. + +Thermosphère is currently planned to be included in the 1.0 release of Atmosphère. diff --git a/docs/components/troposphere.md b/docs/components/troposphere.md new file mode 100644 index 000000000..2664843d8 --- /dev/null +++ b/docs/components/troposphere.md @@ -0,0 +1,2 @@ +# Troposphère +Troposphère contains various application-level modifications to the OS, such as launching homebrew directly from the homemenu or executing cheat/gameshark codes, similar to Luma3DS. Troposphère is not yet implemented in Atmosphère. diff --git a/docs/main.md b/docs/main.md new file mode 100644 index 000000000..5a6dfad1a --- /dev/null +++ b/docs/main.md @@ -0,0 +1,26 @@ +# Atmosphère +Atmosphère is a work-in-progress customized firmware for the Nintendo Switch. Atmosphère consists of several different components, each in charge of performing different system functions of the Nintendo Switch. + +The components of Atmosphère are: ++ [Fusée](../docs/components/fusee/fusee.md), a custom bootloader. ++ [Exosphère](../docs/components/exosphere.md), a fully-featured custom secure monitor. ++ [Stratosphère](../docs/components/stratosphere.md), a set of custom system modules. ++ [Thermosphère](../docs/components/thermosphere.md), a hypervisor-based emuNAND implementation. This component has not been implemented yet. ++ [Troposphère](../docs/components/troposphere.md), Application-level patches to the Horizon OS. This component has also not been implemented yet. + +### Modules +The Stratosphère component of Atmosphère contains various modules. These have a `.kip` extension. They provide custom features, extend existing features, or replace Nintendo sysmodules. + +Stratosphère's modules include: ++ [boot](../docs/modules/boot.md) ++ [creport](../docs/modules/creport.md) ++ [fs_mitm](../docs/modules/fs_mitm.md) ++ [loader](../docs/modules/loader.md) ++ [pm](../docs/modules/pm.md) ++ [sm](../docs/modules/sm.md) + +### Building Atmosphère +A guide to building Atmosphère can be found [here](../docs/building.md). + +### Release Roadmap +A roadmap of the releases of Atmosphère can be found [here](../docs/roadmap.md). diff --git a/docs/modules/boot.md b/docs/modules/boot.md new file mode 100644 index 000000000..53013b32c --- /dev/null +++ b/docs/modules/boot.md @@ -0,0 +1,2 @@ +# boot +The boot module is responsible for booting the system and initalizing hardware. A second boot module known as boot2 is integrated with the [pm (process manager)](../modules/pm.md) sysmodule in Atmosphère, and launches other processes. diff --git a/docs/modules/creport.md b/docs/modules/creport.md new file mode 100644 index 000000000..a6a996f43 --- /dev/null +++ b/docs/modules/creport.md @@ -0,0 +1,2 @@ +# creport +creport is a reimplementation of Nintendo's crash reporter. Atmosphère's creport catches all error logs that would have been saved to the NAND and instead saves them to the SD card for debugging purposes. This is helpful because the errors no longer go to Nintendo and developers of homebrew can still see the errors to help with the debugging process. creport catches system errors, game crashes, and homebrew crashes. diff --git a/docs/modules/fs_mitm.md b/docs/modules/fs_mitm.md new file mode 100644 index 000000000..345c42275 --- /dev/null +++ b/docs/modules/fs_mitm.md @@ -0,0 +1,2 @@ +# fs_mitm +fs_mitm is a sysmodule that enables intercepting file system operations. This module can log, deny, delay, replace, or redirect any request made to the filesystem. It enables LayeredFS to function, which allows for game mods. diff --git a/docs/modules/loader.md b/docs/modules/loader.md new file mode 100644 index 000000000..954873bb4 --- /dev/null +++ b/docs/modules/loader.md @@ -0,0 +1,64 @@ +# loader + +loader is a reimplementation of the loader sysmodule. This module is responsible for creating processes from executable NSO images and registering their access control with the kernel, sm, and fs. + +## Atmosphère Extensions + +Atmosphère extends this module to allow executables to be replaced or patched by files stored on the SD card. Note that a few services are required for SD card access and therefore cannot be replaced or patched in this manner. This includes psc, bus, and pcv. + +### Exefs Replacement + +TODO: details on buttons affecting this. + +When a process is created, loader will search for several NSO filenames in the title's exefs directory. +These filenames are, in this order: + + - rtld + - main + - subsdk0 + - subsdk1 + - ... + - subsdk9 + - sdk + +Each NSO that is found will be loaded into the process contiguously. The process's entrypoint is at the first NSO to be loaded, usually `rtld` or `main`. + +Additionally, when a process is loaded, loader will search for a `main.npdm` file in the exefs directory specifying the title's permissions. + +Atmosphère extends this functionality by also searching for these files on the SD card. When searching for a file, loader will first check if it exists on the SD card. If it does, that file will be used instead. Otherwise, it will use the copy located in the exefs, if that is present. The following directory will be searched. + +``` +sdmc:/atmosphere/titles/