Skip to main content

Switch (NX)/Switch 2 (Ounce)

Because these platforms are cross-compatible (to an extent), they're lumped together here. Assuming you have a title.keys and a prod.keys dumped (😉) from a Switch, you can extract both the game's main (a custom-format NSO executable) and its res.pak with NxFileViewer.

Working with save data​

Emulator users​

If you're running Dead Cells in Ryujinx, this is trivial: right-click the game in your game list and select Open Save Data Location (or View user save folder, depending on your Ryujinx version). The save files will be loose on disk and ready to use however you need.

Real hardware​

Nintendo does not provide any official, user-facing way to export save data as files.

This means that getting a raw save file off a real Switch requires custom firmware (CFW). There is currently no homebrew-free method that produces a parseable file.

If your Switch is already set up with a CFW like Atmosphere, the rest of this process is quick. If it isn't, setting up CFW is outside the scope of this doc - there are many existing guides for this depending on your console's hardware revision and firmware version, and the process changes often enough that reproducing it here would go stale quickly.

  1. Install a save manager homebrew app. JKSV is the standard tool for this and is actively maintained. Checkpoint is a similar alternative if JKSV doesn't work for you.
  2. Launch JKSV from the Homebrew Menu.
  3. Find Dead Cells in the title list (it's sorted by icon/name, so just scroll to it).
  4. Export the save. Select the title, then choose to back up / export the save data. JKSV will write the save folder contents to your SD card, typically under /JKSV/<game title>/<backup name>/.
  5. Copy the exported folder off the SD card to your PC.

main​

Using this IDA Pro plugin, you can pretty easily load the executable into IDA. At first, you may glance at the top bar and exclaim to yourself, "Look at all that unexplored data! This must be JIT!". But if you exclaimed that, you would be, in fact, completely wrong.

IDA Pro top bar NX

In actuality, if you jump to those addresses, what you find is not beautiful, delicious Hashlink bytecode, but instead:

useless garbage

In fact, this main executable is indeed still just an HL/C compiled binary, which we can tell specifically by this telltale string initialization routine:

str init hl

In retrospect, this is also obvious because the HL VM doesn't support ARM, which is what the Switch family uses (aarch64 and NVIDIA Tegra APUs).

res.pak​

This is another typical v0/1 PAK file that can be extracted with any standard PAKTool.