Is my Switch hackable?
All current Switch models are hackable, however the exploit methods are different and vary in difficulty.
This guide will help you identify which Switch model you own and what exploit you can use.
Early Switch models had a hardware flaw which can be used to start custom code and custom firmware (CFW). This flaw is usually referred to as the RCM exploit or RCM vulnerability, as it uses the Switch RCM (ReCovery Mode) as the entry-point to start custom code with a payload.
This unpatched Switch model is often referred to as Erista because of Nvidia's chipset codename for the chip used (Tegra X1). Or just v1, for using the "first generation" chip.
The newer models uses an improved version of the chip (Tegra X1+, codenamed Mariko) where the RCM exploit is patched, and a modchip is required to be installed to use CFW. This chip is a lot more power efficient than the previous version giving newer models a better battery life.
Identify your model
First you'll want to identify if you have an unpatched console or require having a modchip installed.
The Nintendo Switch Lite and Nintendo Switch OLED are all using the new Mariko chip and are patched.
Find your serial on the bottom of the console or by checking in the Switch's System Settings:
System Settings ➔ System ➔ Serial Information
Check serial: on the website IsMySwitchPatched? you can easily check if it's an early serial and if it's likely unpatched or patched.
≣ Or check the serial info list here: (click to expand)
| Prefix | Unpatched | Possibly patched | Patched |
|---|---|---|---|
| XAW1 | XAW10000000000 to XAW10074000000 | XAW10074000000 to XAW10120000000 | XAW10120000000 + |
| XAW4 | XAW40000000000 to XAW40011000000 | XAW40011000000 to XAW40012000000 | XAW40012000000+ |
| XAW7 | XAW70000000000 to XAW70017800000 | XAW70017800000 to XAW70030000000 | XAW70030000000+ |
| XAJ1 | XAJ10000000000 to XAJ10020000000 | XAJ10020000000 to XAJ10030000000 | XAJ10030000000+ |
| XAJ4 | XAJ40000000000 to XAJ40046000000 | XAJ40046000000 to XAJ40060000000 | XAJ40060000000+ |
| XAJ7 | XAJ70000000000 to XAJ70040000000 | XAJ70040000000 to XAJ70050000000 | XAJ70050000000+ |
| XAK1 | XAK10000000000 + |
-
Possibly patched? There's zero risk with trying to injecting a payload on a patched console.
Get a jig (
) (~$5) and try injecting Hekate.
If you use TegraRCMgui and it showsSmashed the stack with a 0x0000it's a patched unit. -
Unlisted: If your serial is not listed it's patched and you need a modchip.
-
Patched: You will need to have a modchip installed.
-
Unpatched: If you have an unpatched console congratulations, continue with CFW setup.
Current Switch models
Erista (Unpatched)
- If you purchased your switch before august 2018, then you have an unpatched Erista model and your Switch can use the RCM vulnerability.
Erista (IPatched)
- If you purchased your Switch after august 2018, it may not be patched. You can still check if your Switch is unpatched on this site.
- If your Switch is unpatched, then your Switch can use the RCM vulnerability.
- If your Switch is patched and is on firmware
4.1.0or lower, then you can use PegaScape to hack your Switch. - If your Switch is patched and is on a later firmware version then you can install a compatible modchip.
Mariko
- If you have a Switch that came in a red box it's a Mariko model.
- If it's a Switch Lite or an OLED Switch, then it's a Mariko model.
- Mariko models can not use the RCM vulnerability. However you can install a compatible modchip.
Switch modchips
All Switch modchips require being soldered onto the Switch motherboard. Doing this requires being able to micro solder and should be done by an experienced person.
-
SX Core/SX Lite
- These modchips have been discontinued and are extremely hard to find
-
HWFLY
- Easier to find but are very expensive. Price range is $80~
-
PicoFly
- Easy to find. Price range is around $4~
- PicoFly modchips are boards that use the RP2040 micro controller
- Currently, the most used board is the RP2040-Zero
↵ Getting started 🦝
SHISE Guide pages
Getting Started ↧⤒
Getting started with CFW:
᛫ Is my Switch hackable?
᛫ Avoid getting banned
᛫ Launching payloads
᛫ Create/Restore a NAND backup
᛫ Dumping device keys
᛫ Terminology (Switch/Homebrew)
CFW setup & migration ↧⤒
Unpatched Switch setup:
᛫ Set up Atmosphère with emuMMC for an unpatched Switch
᛫ Set up Atmosphère for an unpatched Switch
Modchipped Switch setup:
᛫ Set up Atmosphère with emuMMC for a modchipped Switch
᛫ Set up Atmosphère for a modchipped Switch
Migrate setup from old micro SD or CFW:
᛫ Migrate your emuMMC to a new SD card
᛫ Cleanup (or Migrate from Atmosphère 0.x to 1.+)
᛫ Migrate from SXOS to Atmosphère
Updating CFW, FW + ↧⤒
Updating CFW / FW:
᛫ Update your CFW
᛫ Dump your Switch firmware
᛫ Upgrade Switch firmware, offline
Migrate setup from old micro SD or CFW:
᛫ Migrate your emuMMC to a new SD card
᛫ Cleanup (or Migrate from Atmosphère 0.x to 1.+)
᛫ Migrate from SXOS to Atmosphère
Modchip firmware:
᛫ Update Picofly chip firmware
᛫ Flash Spacecraft-NX (HWFLY-NX) to SX Core / Lite
᛫ Update Spacecraft-NX (HWFLY-NX) chip firmware
Homebrew & misc. ↧⤒
Homebrew:
᛫ Tesla overlay menu
᛫ Emulating Amiibos
᛫ Guide for installing themes (HOS themes)
᛫ Manage system modules
᛫ Manage Cheats
PC related use:
᛫ How create or restore a full system backup
᛫ Backup or restore your Switch save files
᛫ Dumping Titles
᛫ Installing dumped titles - USB Installations
᛫ Browse SD Card Contents Via USB
᛫ Verifying Dumps
Additional guides and information:
᛫ What are bans / Avoiding bans
᛫ Exosphere / DNS.mitm Setup (blocking Nintendo)
᛫ Incognito Setup (deprecated)
᛫ Enable Gamecard Reader
᛫ Launching payloads
᛫ How to dump device keys
᛫ Format SD Card To FAT32
᛫ Atmosphère CFW on Both sysMMC and emuMMC options