How do tinfoil shops identify Switches uniquely? (2024)

Was just wondering about this from a technical standpoint.

Supposedly, Incognito/exosphere.ini zeroes out your serial number and blanks out your PRODINFO.
How are these tinfoil shops identifying Switches uniquely and enforcing rules such "only max of X switches per account" if you have Incognito/exosphere?

Is this something Nintendo themselves can use to identify Switches, and why aren't they doing it?

---

Background:
I haven't used a tinfoil shop since the days when things like carcaschoi still worked (supposedly not anymore).
When everything stopped working, I just got it from other sources and installed it myself, and just didn't bother with shops asking for eShop cards.

Just started reading on them again after reading a random post talking about how private some shops are now, where you can't get access via eShop cards anymore, and them banning accounts and enforcing one Switch per account or something.
Which sounded crazy to me, back in the days of the non-private shops I just added them and forgot about it, never even joined any discords.
Now they sound like so much trouble, even requiring phone numbers for verification (like whoa what?)

So I got curious.

I got banned from a free shop for no reason other than a power trip mod didn't like a joke I made? Discord mod moment.

Yeah, it sucks that some discord people can just banhammer you on a whim and lock out your entire switch.

@personDoingSwitchStuff
I guess it uses a combination of both joycons IDs + battery ID (BHACABCDEFG01234567891) + LCD Vendor ID (0А123456) + WiFi & BT physical MAC addresses (012ABC3D4F4A) + real Device SN (not a mitm blanked or 000ed one), and some closed hash functions to summarize them all as one unique ID in one string.

Big Nin already has had all the telemetry, so there's no need to worry about them in this way.

mathew77 said:

@personDoingSwitchStuff
I guess it uses a combination of both joycons IDs + battery ID (BHACABCDEFG01234567891) + LCD Vendor ID (0А123456) + WiFi & BT physical MAC addresses (012ABC3D4F4A) + real Device SN (not a mitm blanked or 000ed one), and some closed hash functions to summarize them all as one unique ID in one string.

Big Nin already has had all the telemetry, so there's no need to worry about them in this way.

Click to expand...

So if a console had been pre registered you can just change the joycons?

Kallim said:

So if a console had been pre registered you can just change the joycons?

Click to expand...

No. It is best to just make a separate discord account for the shops and avoid talking in chat.

Kallim said:

So if a console had been pre registered you can just change the joycons?

Click to expand...

I was wondering how as my friend just bought a switch off ebay. I modded and tried to register with one of the shops.... But it wouldn't and you can't unlink.

I was thinking of trying the prodinfo gen tool or nx nand manager. So I can just change the joycon and it'll change the device id?

Post automatically merged: Jun 4, 2023

Blakejansen said:

No. It is best to just make a separate discord account for the shops and avoid talking in chat.

Click to expand...

I don't think I can the discord account is ok. The switch was previously registered. I'm seeing if there's a way I can do it as they don't allow unlinking.

But I'm not really sure how it identifies anything. I wouldn't feel right passing the problem on (unless they just wanted a normal switch).

We couldn't even warn bidders if it was relisted as eBay would ban the listing.... It's a bit frustrating.

@Kallim I'm really interested in your findings, if you ever decide to experiment with this.

I don't want to register my Switch with these shops (until I really have to, which I don't, I've so far managed to find what I want or need myself from other sources), but I'm curious how their systems work (from a technical standpoint).

Please do continue posting with any findings you make.

Purple_Shyguy said:

I got banned from a free shop for no reason other than a power trip mod didn't like a joke I made? Discord mod moment.

Yeah, it sucks that some discord people can just banhammer you on a whim and lock out your entire switch.

Click to expand...

Typical Discord mod behavior.
They often go on a mad power trips and ban people left and right.
Happened to me.
Good thing there's always alternatives, even with free shops.

personDoingSwitchStuff said:

@Kallim I'm really interested in your findings, if you ever decide to experiment with this.

I don't want to register my Switch with these shops (until I really have to, which I don't, I've so far managed to find what I want or need myself from other sources), but I'm curious how their systems work (from a technical standpoint).

Please do continue posting with any findings you make.

Click to expand...

All I can tell you is there is a fingerprint ID inside the options.json file. You can view this in any text editor.
You can't edit or delete the file tinfoil just remakes it. I don't know how it gets that ID number but its unique to your switch.

I'm assuming it somehow gets it from the prod.keys file in the switch folder. This is made when you run Lockpick.rcm (picklock now) . You can view the keys in any text editor but there are loads of lines of keys.... so its not just a case of your serial number this is a huge key.

I'm assuming the fingerprint ID is a combination of 1 or more of them, but its probably encrypted anyway.

What we were going to try was replacing the keys with one from a working console with a wiped prodinfo. We didn't in the end becuase I beleive this causes issues on firmware updates.... and I don't know if it'd work anyway. If you do try this also use a clean atmosphere folder as I think there is backup of the keys in there too.

Post automatically merged: Jun 7, 2023

Kallim said:

All I can tell you is there is a fingerprint ID inside the options.json file. You can view this in any text editor.
You can't edit or delete the file tinfoil just remakes it. I don't know how it gets that ID number but its unique to your switch.

I'm assuming it somehow gets it from the prod.keys file in the switch folder. This is made when you run Lockpick.rcm (picklock now) . You can view the keys in any text editor but there are loads of lines of keys.... so its not just a case of your serial number this is a huge key.

I'm assuming the fingerprint ID is a combination of 1 or more of them, but its probably encrypted anyway.

What we were going to try was replacing the keys with one from a working console with a wiped prodinfo. We didn't in the end becuase I beleive this causes issues on firmware updates.... and I don't know if it'd work anyway. If you do try this also use a clean atmosphere folder as I think there is backup of the keys in there too.

Click to expand...

Or rather we were going to generate keys.... no point getting a console banned from the shops. Obviously you can't generate keys to go online with nintendo (as they'll know they didn't make a console with those keys). But it should be possible to unban a switch from a shop (or rather it'll become a different switch).

This is where I'm a little morally torn.... should I be doing this? I mean its not my fault or my friends fault someone sold us a banned switch.

But then a lot of is to stop people making massive profits pre loading the shops with loads of games.... which I also don't agree with.

The flip side of that is if they are clever enough to generate prodinfo's and do that level of hacking then they deserve the money. There will never be a guide for that as its only a small percentage of consoles that are banned, from a small number who install the shops, from a small number who Mod switches. I'm pretty sure there is a way as I know its been ran on a PC.