When you exploit it it doesn't save the fact that you've opened the app before, so closing and reopening normally seems to fix this. Locate your new song and play it to start the Homebrew Menu!įixing the annoying bird: Click through all of the bird tips then close the app normally. Insert the SD card into the 3DS and start Nintendo 3DS Sound. Save the soundhax song file and copy to the root of your SD.ĭownload the otherapp payload for your 3DS version, rename it to otherapp.bin, and copy it to the root of the SD card.ĭownload the Homebrew Menu and place boot.3dsx in the root of the SD card (if it is not there already). It can be used along pre9otherapp to launch an arm9 payload from the SD card on pre 9.0 firms (2.1 - 9.2).ĭownload the relevant soundhax-region-console-firmware.m4a file for your device. If your box is checked, then put otherapp.bin on the root of your SD card along with soundhax.m4a and launch the song from the sound player. This bug is particularly good, because as far as I can tell it is the first ever homebrew exploit that is free, offline, and works on every version of the firmware for which the sound app is available.Īll existing versions of Nintendo 3DS Sound prior to Nintendo fixing the vulnerability are now supported. They didn’t.A heap overflow in tag processing leads to code execution when a specially- crafted m4a file is loaded by Nintendo 3DS Sound. They added this was all done in the Summer of 2015 and just waited to see if Nintendo would eventually fix it. So they tried overwriting data on Boot11 and discovered it was not blacklisted! Instant dump. When looking at the unprotected part of the ARM11 BootROM, they noticed there were references to the ARM11 RAM. derrekr said they could have tried the same process as earlier, but went with something different. Let us hope this gets released! BootROM11 dumped too!Īt this point the only thing left to do was dumping the BootROM of the ARM11 processor (the previous was the ARM9 processor’s BootROM). This means that the 3DS might have complete custom firmware on boot. This is even bigger than a9lh that only allowed us to patch code as it was loaded. This means that from now on, if this gets released, developers will be able to sign their own firmwares. With this enormous flaw figured out, they were able to bruteforce their way into the valid part of the signature. After a long explanation about the CPU of the 2DS and the RSA signatures Nintendo uses, he talks about how they were able to figure out that it doesn’t look for an entire signature, but only part of it. This next part however is when everyone got really hyped. That allowed for injection of code that led to the dumping of the BootROM. It was mentioned there is a flaw in the 3DS hardware in which some RAM is not cleared on a reboot. He said that half of it is visible and the other half isn’t and they used that as a starting point. He spent a good time talking about the entire process of hacking the BootROM and how it is protected. This is when derrekr took to the stage to talk about the BootROM. While I don’t understand the nitty-gritty of it, I do know it will allow for CIA installation on the exploitable firmwares and if it goes like last year, probably more. An good example of this is how games like Cubic Ninja shot from $5 to values like $80 just because of Ninjhax.įasthax is kernel11 exploit which we can assume will work on all current firmwares (so that’s up to 11.2 at least). For what you care about, Soundhax means now you will have a free exploit that works offline! That’s great news since the discovery of exploits in games usually leads to horrible price gouging (this was mentioned by nedwill in the presentation). As is the case with many exploits on the 3DS, it is a buffer overflow exploit. Soundhax is an exploit which was presented by hacker nedwill that relies on the 3DS’ sound player. The talk started with the announcement of both Soundhax and Fasthax. With nothing left to crack, derrekr6 just told the audience they were ready for the Nintendo Switch. A few things were discussed, but the short version is that the 3DS is completely cracked at this point. It was a pretty interesting show, even for someone such as me who barely understands the meat of the matter.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |