🔒 encrypted .nca firmware
       |
       v  🔑 (hactool + prod.keys)
🔓 decrypted .nso binaries
       |
       v  🗡️ (switchblade)
💀 disassembled + analyzed + vulnerability-scanned

📄 .nso file ──▶ LOADER ──▶ raw bytes ──▶ DECODER ──▶ instructions ──▶ ANALYZER ──▶ functions ──▶ API ──▶ UI
                                                            |
                                                            ▼
                                                      🤖 VULN SCANNER
                                                      🔄 DIFF ENGINE

 6 components. each one is a standalone python file.
 each one works by itself. each one you can test from the command line.
 no frameworks. no dependencies. simple enough to hold in your head.

🗡️ switchblade/
  📄 loader.py       ◀── M1: parse NSO header, extract .text/.rodata/.data
  📄 decoder.py      ◀── M2: 4 bytes ──▶ ARM64 instruction
  📄 analyzer.py     ◀── M3: find syscalls, label with Horizon OS names, rank targets
  📄 cfg.py          ◀── M4: function discovery, CFG, cross-references
  📄 api.py          ◀── M5: FastAPI serving JSON
  📄 diff.py         ◀── M7: diff two firmware versions
  📄 scanner.py      ◀── M8: pattern + AI vuln scanner
  📄 decompiler.py   ◀── M9: ARM64 ──▶ C pseudocode
  📁 ui/
    📄 index.html    ◀── M6: three-panel layout
    📄 app.js        ◀── M6: fetch API, render disasm + CFG

b'NSO0'  version=0  flags=56
  compressed: text=0 rodata=0 data=0
.text:      2459492 bytes  mem=0x0
.rodata:     757936 bytes  mem=0x259000
.data:       118168 bytes  mem=0x313000
============================================================
  00000000  03 00 00 14 18 90 25 00 4c 90 25 00 1f 00 00 f1  ......%.L.%.....
  00000010  01 04 00 54 f3 03 01 2a 60 19 00 f0 00 80 36 91  ...T...*`.....6.
  00000020  e2 59 00 b0 42 40 08 91 42 00 00 cb 01 00 80 52  [email protected]
  00000030  d0 41 09 94 60 fe ff 10 41 19 00 b0 21 20 03 91  .A..`...A...! ..

found 7118 functions
function at 0x100 - 0x150 (size 80 bytes)
function at 0x150 - 0x4e0 (size 912 bytes)
...
CFG for function at 0x100:
  0x110 -> 0x114
  0x118 -> 0x134, 0x11c
  0x130 -> 0x4ab0
  0x140 ->

xrefs: 45043 calls, 5885 data refs

✅ M1  LOADER         "i can open any Switch binary and see its guts"
✅ M2  DECODER        "i can read ARM64 machine code as assembly"
✅ M3  SYSCALLS       "i know every kernel call in every binary"
✅ M4  ANALYZER       "i can find every function and trace its control flow"
✅ M5  API + BROWSER  "i can explore all 74 services in my browser"
✅ M6  UI + GRAPH     "i can see function graphs and navigate visually"
✅ M7  DIFF ENGINE    "i can see what Nintendo patched between versions"
✅ M8  VULN SCANNER   "AI flags suspicious functions across all binaries"
✅ M9  DECOMPILER     "i can read ARM64 as C code"
⬜ M10 SHIP           "the tool is packaged and ready"

  🔓 STEP 1: EXTRACT
  .nca (encrypted) ──▶ hactool + prod.keys ──▶ .nso (ARM64 binaries)

  🔬 STEP 2: ANALYZE
  .nso ──▶ switchblade ──▶ functions, syscalls, CFG, xrefs

  🎯 STEP 3: HUNT
  strategy: follow untrusted input through the code

  🌐 network packets  ──▶ ssl, bsdsocket
  📡 wireless frames  ──▶ bluetooth, wlan
  📱 NFC tags         ──▶ nfc
  🎮 USB devices      ──▶ hid
  🌍 web content      ──▶ LibAppletWeb
  🖼️ images           ──▶ jpegdec, capsrv

  🔄 STEP 4: DIFF
  firmware 20.1.5 vs 20.2.0 ──▶ what did Nintendo patch?
  patches reveal what was broken. broken = exploitable on older versions.

  📋 STEP 5: REPORT
  find bug ──▶ write report ──▶ responsible disclosure 

🎮 Target:     Nintendo Switch Firmware 20.1.5
📦 Services:   74 ARM64 system binaries
💾 Total size: 261 MB of decompressed machine code
🔧 Arch:       AArch64 (ARMv8-A, 64-bit)
📄 Format:     NSO (Nintendo Switch Object)
🔑 Extracted:  hactool + prod.keys