From 4c233196dda5f5b1e72519d9cc6015fab3e0e69d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Chris=20Br=C3=A4ucker?=
 <7303810+chrisbraucker@users.noreply.github.com>
Date: Wed, 14 Oct 2026 20:48:41 +0200
Subject: [PATCH] Fall back to RSA device certificate for cal0 authenticity
 check (#2887)

* Fix device ID check in cal0 backup path

Only the ECC device certificate was used, which may be absent on some devices. Adds a fallback to use the RSA device certificate which is present on those.

* Move cert validity check into device ID check

* Fix ecc case condition

in cases where ECC is not blank and not valid, instead of aborting, it falls through to RSA
---
 .../ams_mitm/source/amsmitm_prodinfo_utils.cpp      | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/stratosphere/ams_mitm/source/amsmitm_prodinfo_utils.cpp b/stratosphere/ams_mitm/source/amsmitm_prodinfo_utils.cpp
index 1e419f8f8..c56b3f47b 100644
--- a/stratosphere/ams_mitm/source/amsmitm_prodinfo_utils.cpp
+++ b/stratosphere/ams_mitm/source/amsmitm_prodinfo_utils.cpp
@@ -256,7 +256,6 @@ namespace ams::mitm {
         bool IsValid(const CalibrationInfo &cal) {
             return IsValidHeader(cal)                                                                                                          &&
                    IsValid(cal.GetBlock<SerialNumberBlock>())                                                                                  &&
-                   IsValid(cal.GetBlock<EccB233DeviceCertificateBlock>())                                                                      &&
                    IsValid(cal.GetBlock<SslKeyBlock>())                                                                                        &&
                    IsValid(cal.GetBlock<SslCertificateSizeBlock>())                                                                            &&
                    cal.GetBlock<SslCertificateSizeBlock>().ssl_certificate_size <= sizeof(cal.GetBlock<SslCertificateBlock>().ssl_certificate) &&
@@ -267,7 +266,8 @@ namespace ams::mitm {
                    IsValidSerialNumber(cal);
         }
 
-        bool ContainsCorrectDeviceId(const EccB233DeviceCertificateBlock &block, u64 device_id) {
+        template<typename Block>
+        bool ContainsCorrectDeviceId(const Block &block, u64 device_id) {
             static constexpr size_t DeviceIdOffset = 0xC6;
             char found_device_id_str[sizeof("0011223344556677")] = {};
             ON_SCOPE_EXIT { std::memset(found_device_id_str, 0, sizeof(found_device_id_str)); };
@@ -279,7 +279,14 @@ namespace ams::mitm {
         }
 
         bool ContainsCorrectDeviceId(const CalibrationInfo &cal) {
-            return ContainsCorrectDeviceId(cal.GetBlock<EccB233DeviceCertificateBlock>(), exosphere::GetDeviceId());
+            const auto &ecc = cal.GetBlock<EccB233DeviceCertificateBlock>();
+            if (!IsBlank(ecc)) {
+                return IsValid(ecc) && ContainsCorrectDeviceId(ecc, exosphere::GetDeviceId());
+            }
+
+            /* Newer consoles may leave the ECC certificate unprogrammed. */
+            const auto &rsa = cal.GetBlock<Rsa2048DeviceCertificateBlock>();
+            return !IsBlank(rsa) && IsValid(rsa) && ContainsCorrectDeviceId(rsa, exosphere::GetDeviceId());
         }
 
         bool IsValidForSecureBackup(const CalibrationInfo &cal) {