Notice: this is old and dirty method. You can just call system settings services "SetT" in order to get this done. This tool will help you : https://github.com/CaiMiao/Tencent-switcher-GUI/releases
P. S. If you want to know more about iQue Switches, read my other articles in the same section as this.First things first, I am not responsible to any damage dealt to your Switch in this operation process, even you have exactly followed my steps correctly ! The reply I made on GBATemp, saying this is impossible, is wrong ! The reason I failed is injecting modified Prodinfo by Incognito itself, which doesn't really work. Dunno why, but seems the SX Core chip is getting in the way.A. Before We Start- You cannot go online multiplayer or use eShop with this unless you want an insta ban, even if you don't use any kind of unlicensed or pirated software. And actually, this will even increase the banning possibility since there will be things that cannot match up in your device identification after such operation, like your device serial will still begin with XKC, which is iQue specific. Wiping out or modify serial and other console-specific data may help out a little, but we don't suggest you doing such operation, since using wrong tools and/or wrong methods while manipulating Prodinfo partition could result in irreversible brick (e.g. incognito module in Tinfoil).
- It's NOT recommended to do this operation on your sysNand since this operation involves dangerous procedures like manipulating Prodinfo partition. Only try it on emuNand.
- You can actually region lock an international version Switch in the same manner, but seems it doesn't make much sense.
- You will lose all your NSP games, updates, DLCs, and game saves in this operation. Please back them up if they are still needed.
- Currently I don't sure if you will gain/lose the ability to run iQue eShop games and iQue cartridges after this operation, for I don't sure if some kind of key derivation process is done in factory reset process, and I have no iQue cartridges, let alone my iQue Switch is banned. If you found you lost such ability and there is necessity for you to run iQue eShop games and iQue cartridges, you can still boot to your unmodified sysNand and enjoy them. Also, if that do happen, contact me to let me know.
B. How it worksThere is a partition called Prodinfo in Switch Nand, and there is a part called CAL0 inside, which contains some device identification information, including region code. Here is a link for you to know more:
https://switchbrew.org/wiki/CalibrationDespite so many weird features and behaviors on iQue Switch OS, what's under the hood is surprisingly simple: On the first boot, it only check the region code in Prodinfo. If it's "CN" (0x04), then it activates iQue Switch features; otherwise, it activates international features. This is quite different compared to its ancestors like iQue 3DS which got major difference in software, and sometimes even in hardware compared to their equivalent international models.
So, we just modify Prodinfo and then get back to first boot status, then we will be able to change region lock status.
0. Software Needed- Lockpick.nro (not LockpickRCM. that one won't work since there is no way to push payload on Mariko units.)
- Incognito.nro (again, not it's RCM version.)
- GoldLeaf.nro
- CheckPoint.nro/JKSV.nro (this is not required, but definitely useful, since you will lose everything )
- NxNandManager
- HxD
These tools should be easy to get just by Googling their name, so download links are not given out here to make it tidy.
[/list]
1. Pick The KeysFirstly, get your tools prepared. After you downloaded all those tools, put NxNandManager and HxD on your PC, and everything else goes into the root of the SD card of your Switch.
And then, launch LockPick. It's a homebrew, just click the album and then choose "HOMEBREW" in CFW menu and then click on LockPick.
When you see this, the process is done. Press + to exit. Now you got the key which we need to decrypt the Prodinfo later.
2. Dump Decrypted ProdinfoLaunch Incognito. When you see this menu, press "B" to get prodinfo.bin . When it tells you success (usually in less than 1 second), it's done. Press + to exit.
3. Modify ProdinfoEject the SD card in your Switch, get it in a reader and hook it up to your PC. You will find a prodinfo.bin file in sdcard:/backup . copy that file to somewhere safe in case something went wrong later on. Open HxD, and open that prodinfo.bin . Press Ctrl+G, type in "3510", and then enter, since what we gonna modify is at offset 0x3510 (also 0x351E) . Notice these two values shown in the picture:
Left one is at offset (you can think that offset is just a fancy name of "location") 0x3510, and the right one is at offset 0x351E. That "03 00" is the region code, while "63 3B" is the checksum. You can change them to these values :
0x3510 0x351E Region
00 00 66 FF JP
01 00 66 3E US
------------------------------
04 00 63 3B iQue
For those who have never used a hex editor: click directly on the number you want to modify and then key in the number. Don't type anything in that "dotty" area. The content in the "dotty" area may change when you are keying in numbers on the left, no need to worry.
Actually which region code doesn't really matter. It only cares whether it's iQue or not. Notice that
0x3510 and 0x351E must match up or you will get a brick !After you are done, press "save" and then exit HxD.
4. Inject Modified Prodinfo Into EmunandNotice: this is assuming you save your Emunand as files. If you save your Emunand as a hidden partition, you may have take extra steps to unhide the partition and assign it a drive letter before continuing. This is kinda complex and off topic so I don't want to talk about it too much; Google is your friend.Open NxNandMgr, and click Options - Configure Keyset, since we need to set up our keys first. Click "import keys from file", then select your prod.keys file. It's under sdcard:/switch . Then those empty boxes will be filled up automatically. Then you can close that window. If it tells you that it failed to parse the key file, close NxNandMgr, right click on its icon, and select "run as administrator", then try again.
Click File - Open File, then select your Emunand part 0, which is in sdcard:/sxos/emunand/full.00.bin, (if your emunand is saved as partition, then you should click File - Open drive, then select your emunand partition.) then click "PRODINFO". Click "Restore from file", and then select your modified prodinfo.bin, which is under sdcard:/backup/prodinfo.bin . Click OK in the pop up window and when it's done, close NxNandManager.
5. Send Switch Back to First Boot You will lose all your game saves by doing this ! Backup them with Checkpoint/JKSV first !Put the SD card back into Switch and turn it on. Run Goldleaf and select "Explore Content - Console Memory(System) ," and then focus the cursor on "save" folder. Press Y button and then select "Delete". then do the same with "savemeta" folder. You may find that "save" folder is still there, but all the contents inside are gone. This is as expected.
And then, Exit GoldLeaf by pressing +, then go to system settings and do a factory reset. You may find your Switch suddenly turn off very short after it begin to factory reset: this is as expected. Just turn it back on, and you got a region unlocked iQue Switch.
Z. Thanks - zestiva, for purposing such procedure as as idea on GBATemp.
- HenryMin, for confirming such procedure is possible, and pointed out why my first few attempts failed.
- CBPS, for running the form I post this tutorial on.
- TX, I mean both TX, both for creating weird and fun hardware for us to research on.
We are free, We are free !