Hacking 3DS Hacking Ideas: Post Your Ideas Here!

[lambstone]

and i forgot about eshop.. it is not possible to packet inject it? or edit packets which are sent to the 3ds? i am aware about probably having something like SSL protection but come on, how it is not possible to manipulate messages if we are the courier who delivered letters from the beggining...

i mean, let's say, all your communication to your friend goes through me, if you send crypted letters, your friend will not be able to read it, unless you send him the keys and that keys must go through me...

Yes. I get what you mean.

However from what I understand, when you inject/add/sideload/install other stuff onto your 3DS, there will be a file signature verification to ensure that the file is legit. Now to generate a legit file signature is impossible because of the heavy encryption etc etc. Long story short, you'll need a couple of quantum computers to break the encryption to be able to generate a legit signature.

So what the current solution is to disable the file signature verification which allows you to inject/add/sideload/install anything you want. It works because the system no long checks for a legit signature.

"Wait. You're telling me there is a current solution?"

Yes! Of course! However it will never see the daylights because of somewhat misaligned piracy fears.

"What should I do then?"

You should wait for SSSpwn because that'll allow you to sideload a specific library of apps and games.

 

[migles]

Yes. I get what you mean.

However from what I understand, when you inject/add/sideload/install other stuff onto your 3DS, there will be a file signature verification to ensure that the file is legit. Now to generate a legit file signature is impossible because of the heavy encryption etc etc. Long story short, you'll need a couple of quantum computers to break the encryption to be able to generate a legit signature.

So what the current solution is to disable the file signature verification which allows you to inject/add/sideload/install anything you want. It works because the system no long checks for a legit signature.

"Wait. You're telling me there is a current solution?"

Yes! Of course! However it will never see the daylights because of somewhat misaligned piracy fears.

"What should I do then?"

You should wait for SSSpwn because that'll allow you to sideload a specific library of apps and games.

That makes sense, and of course the 3ds could get out of nintendo factory with some kind of connection key...

and since no one so far was able to use ds download play (on nds) for send software to the console whithout a flashcart (except the first ones)... it is harder...

 

[Arsen Tufankjian]

i mean, let's say, all your communication to your friend goes through me, if you send crypted letters, your friend will not be able to read it, unless you send him the keys and that keys must go through me...

SSL certificates yo

If the packets are SSL encrypted, you're not reading that. I used to shark packets off my school network a while ago. Anything that was SSL encrypted (everything https) was useless to me. SSL encrypts for each session and I highly doubt you'd be able to encrypt and send the proper packets to the 3DS.

 

[migles]

SSL certificates yo

If the packets are SSL encrypted, you're not reading that. I used to shark packets off my school network a while ago. Anything that was SSL encrypted (everything https) was useless to me. SSL encrypts for each session and I highly doubt you'd be able to encrypt and send the proper packets to the 3DS.

can you explain basically how it works? i mean, if SSL encrypts in every session, how do the destination will read that? wouldn't you be able to capture SSL handshakes?

 

[Duo8]

can you explain basically how it works? i mean, if SSL encrypts in every session, how do the destination will read that? wouldn't you be able to capture SSL handshakes?

https://en.wikipedia.org/wiki/Secure_Sockets_Layer

 

[Reisyukaku]

SSL certificates yo

If the packets are SSL encrypted, you're not reading that. I used to shark packets off my school network a while ago. Anything that was SSL encrypted (everything https) was useless to me. SSL encrypts for each session and I highly doubt you'd be able to encrypt and send the proper packets to the 3DS.

Was it protected against MitM attacks?

 

[Duo8]

Was it protected against MitM attacks?

Even if we could inject something in how are we going to run unsigned stuff?

 

[Reisyukaku]

Even if we could inject something in how are we going to run unsigned stuff?

I'm just saying, decrypting SSL or even TSL isnt impossible.. in fact, there's currently a TSL vulnerability that allows MitM.. Although no one can say for sure if 3DS uses the same implementation. Packet injection type stuff would only be good for wonder trade hax anyways.

 

[cloud1250000]

Well we can try to get an exception by returning wrong value.. or too much characters... Ahah

 

[Arsen Tufankjian]

Was it protected against MitM attacks?

Yep, that's exactly what I was doing a few years ago. Cain & Able was what I used, Wireshark can do the same thing. You can use the network card of a computer to intercept wireless transmissions while it's inbetween the client and the server. Everything is encrypted by the time it flys off the target's network card, so it's impossible to do anything. I was aiming for unencrypted transmissions (passwords sent to the insecure mail server)

 

[Celice]

How do any flashcarts/exploits handle a DS virtual console game?


http://tinycartridge.com/post/65520237149/advance-wars-days-of-ruin-weirdness-one-of

A while back, a small interesting thing occurred where the last DS Advance Wars game was finally released to Japan, but as a 3DS downloadable title for club Nintendo members.​

​

It just struck me that I'm not sure how this title actually works on the 3DS side of things. I'm guessing it would just launch into the DS mode... but is there the infrastructure to have a full game launch from3DS mode but run sustained in DS mode?​

​

Anyone have any ideas or have tried this game yet, if a dump exists?​

I posted this in this forum a couple days ago but forgot about this thread. I'm wondering if there's any strange handling of DS/3DS mode stuff that could be useful for payloads, just as some are speculating on DS download play also being used as a payload.

 

[Funklord]

Read this whole thread, but I couldn't find much mention about running a modified bootloader.
Where exactly is the console-unique key located?
It doesn't seem to be a feature of either ARM9 nor ARM11 dies.

If it's some sort of SoC bootrom addition, is it likely to be real rom (expensive) or an nvram type?
Any links to the vendor who provides the solution?

 

[saphris]

I'm wondering if theres some way to trick the 3ds into thinking that you actually bought the digital game off of the eshop that is put on the sd card. maybe like some sort of app that syncs and signs it for you. or a program that could be added to the ds, that gives you your key, or reads the key and then automatically adds it to anything you load up that would normally require the eshop or nintendo servers to do it..

or maybe something that tricks the 3ds into thinking your actually contacting the eshop servers, but instead some sort of homebrew/hacking community's server which holds the raw data of the games on it, and then having some program on the 3ds or on the server that would sign it to your 3ds when you were downloading it.

maybe using the browser on the dashboard(via 3ds) could be the start of something in it for those who dont purchase or have flashcarts or those who don't want to use the flash carts due to the wear and tear they do on the console.
such as a program that loads in the browser, that then finds some sort of glitch or loop hole or opening in the security of the system, or maybe doing that while deleting the whole OS on the 3ds and rebooting it with like a tethered or untethered way of a hack exploit. ???
(of course, in any event, backing up everything prior to deleting the os would be the best thing. and maybe causing a begining program that always runs prior to actually starting the 3ds software up, and allow it to have a feature to restore from a saved back up??? .. or with a tethered expliot type of hack, it wouldn't be a concrete thing. as soon as the 3ds died, or got turned off (maybe even in sleep mode), it would revert to the original state, until the person turned it on using the tethered version, and let it run its course.. or maybe have a "demo" game that launches from the sd card, but its only masked as a demo, and the ids and everything that makes the 3ds think that its the real demo, and then within the "demo" you can use a hack and it works like a tethered version, just minus the computer plugging in everytime, and would only require the person to reload the demo each time the system gets turned on to use the hacked verison of 3ds.?)

 

[gamesquest1]

Sometimes I feel this thread is only intended as a shooting range, I will let someone else take this down I'm showing mercy

 

[BobDoleOwndU]

I'm wondering if theres some way to trick the 3ds into thinking that you actually bought the digital game off of the eshop that is put on the sd card. maybe like some sort of app that syncs and signs it for you. or a program that could be added to the ds, that gives you your key, or reads the key and then automatically adds it to anything you load up that would normally require the eshop or nintendo servers to do it..

or maybe something that tricks the 3ds into thinking your actually contacting the eshop servers, but instead some sort of homebrew/hacking community's server which holds the raw data of the games on it, and then having some program on the 3ds or on the server that would sign it to your 3ds when you were downloading it.

maybe using the browser on the dashboard(via 3ds) could be the start of something in it for those who dont purchase or have flashcarts or those who don't want to use the flash carts due to the wear and tear they do on the console.
such as a program that loads in the browser, that then finds some sort of glitch or loop hole or opening in the security of the system, or maybe doing that while deleting the whole OS on the 3ds and rebooting it with like a tethered or untethered way of a hack exploit. ???
(of course, in any event, backing up everything prior to deleting the os would be the best thing. and maybe causing a begining program that always runs prior to actually starting the 3ds software up, and allow it to have a feature to restore from a saved back up??? .. or with a tethered expliot type of hack, it wouldn't be a concrete thing. as soon as the 3ds died, or got turned off (maybe even in sleep mode), it would revert to the original state, until the person turned it on using the tethered version, and let it run its course.. or maybe have a "demo" game that launches from the sd card, but its only masked as a demo, and the ids and everything that makes the 3ds think that its the real demo, and then within the "demo" you can use a hack and it works like a tethered version, just minus the computer plugging in everytime, and would only require the person to reload the demo each time the system gets turned on to use the hacked verison of 3ds.?)

The app would need to be signed with the private key in order to work on the 3DS, and if we already knew the private key to sign the app, it would make the app useless. Nobody knows how to decrypt the private key in any reasonable amount of time, so the only way to actually hack the 3DS is to find some sort of exploit, that tricks it into running a custom app without checking if it's signed.

 

[cloud1250000]

what about heartbleed bug? maybe we can take control over the data transfered to 3ds???

 

[st4rk]

With the Heartbleed you can't inject code, you can read "trashing date" in memory(64 kb, right ? lol').

 

[cloud1250000]

you can retrieve private key with heartbleed, that mean we can sign data and then send it to 3ds. And you can repeat it the amount of time you want (so no 64kb limit)

 

[Duo8]

what about heartbleed bug? maybe we can take control over the data transfered to 3ds???

Only works if Nintendo uses an exploitable OpenSSL version.

 

[cloud1250000]

yeah, well, they had plenty of time to fix it :/