Hacking Wii U Hacking & Homebrew Discussion

[Marionumber1]

Does the WiiU crash when running it's layout/unit test or it didn't have one and he had to try it by himself?
If I'm not supposed to ask/know this then I'm sorry, just tell me so.

There was a unit test we found on Google Code, and a description of what it did on PC. We verified that it crashed the Wii U, saw what it did to another PPC WebKit browser in an emulator, got binaries from comex, and found similar code in the Wii U binaries.

 

[IbbyPlays]

So Kelton's bug is exploitable? How about mine?

 

[Onion_Knight]

There was a unit test we found on Google Code, and a description of what it did on PC. We verified that it crashed the Wii U, saw what it did to another PPC WebKit browser in an emulator, got binaries from comex, and found similar code in the Wii U binaries.

Thank you for the very clear and succinct answer. What emulator did you use if don't mind answering?

EDIT:

One other question, Do you know what the base address of coreinit.rpl is in 5.3.2?

 

[VinsCool]

There was a unit test we found on Google Code, and a description of what it did on PC. We verified that it crashed the Wii U, saw what it did to another PPC WebKit browser in an emulator, got binaries from comex, and found similar code in the Wii U binaries.

That is neat progress Keep up the good work.

 

[Marionumber1]

Thank you for the very clear and succinct answer. What emulator did you use if don't mind answering?

QEMU.

One other question, Do you know what the base address of coreinit.rpl is in 5.3.2?

No, I'm trying to find out.

 

[Onion_Knight]

QEMU.

Thanks much for that info. Been wondering howto set breakpoints and examine the registers during a crash that would mirror the webkit browser.

No, I'm trying to find out.

likewise

 

[Marionumber1]

I believe 0x101c400 is the coreinit base on 5.3.2. Got this by adding the size of the loader's .text section to 0x01000000 and rounding to the nearest 0x400.

 

[Onion_Knight]

I believe 0x101c400 is the coreinit base on 5.3.2. Got this by adding the size of the loader's .text section to 0x01000000 and rounding to the nearest 0x400.

Thanks!

 

[PhyChris]

delete me

 

[zecoxao]

this seems interesting, although i'm not sure if it allows anything new:
http://www.inulledmyself.com/2015/02/exploiting-memory-corruption-bugs-in.html

 

[Hykem]

I just want to thank MN1 and NWP. Whenever I look online for information on a Webkit exploit all I see is PS4 WebKit Exploit! and same for the PSVita. Most of the PS4 news points to the PSVita. However, none of the news for these systems really acknowledges the Wii U. I see things like "A talented team of hackers made and exploit on the PSVita using the internet browser." and "The exploit that some people made for the PSVita has been ported to the PS4."

What I don't see is "A hacking group led by Marionumber1 and NWPlayer123 made a WebKit based exploit for the Wii U that has been ported to sony systems!"

That's because it never happened...
I've worked and I'm still working on exploiting both the Vita and the Wii U, so I know pretty accurately how the exploits were developed.

The PlayStation Vita's exploit is a heap buffer overflow known as CVE-2012-3648 (a Proof of Concept for this exploit was released under the tag PSA-2013-0903-1). It was being used for a long time by Vita developers before it went public and, it terms of security, it's a considerably powerful exploit.

The Wii U's exploit is a use-after-free bug that was published here: https://code.google.com/p/chromium/issues/detail?id=226696
It's not as powerful and it's definitely not the bug used in the Vita.

The exploit found for the Vita works on the PS4 as well, so it makes sense it was simply ported over.
This exploit drew more attention because people thought those systems were quite secure and nothing had been done with them yet. On the other hand, Fail0verflow had already cracked the Wii U wide open and even gave a detailed on presentation on how to do it.
Obviously, finding a WebKit and exploiting it wouldn't get as much attention since it was already expected to happen.

What you could have mentioned is that Gateway is using the exact same bug to exploit the 3DS, as Yifan Lu posted here: http://yifan.lu/2015/01/10/reversing-gateway-ultra-first-stage-part-1/

 

[dojafoja]

this seems interesting, although i'm not sure if it allows anything new:
http://www.inulledmyself.com/2015/02/exploiting-memory-corruption-bugs-in.html

An interesting read, thank you

 

[Reecey]

Are we on 5.3.2 now on the WiiU. I thought the WiiU had updated since then to 5.3.4 now, I'm not sure anyone know please? Cause some are saying they are updating to 5.3.2 to go online but I thought the WiiU had gone on since then?

 

[jammybudga777]

Are we on 5.3.2 now on the WiiU. I thought the WiiU had updated since then to 5.3.4 now, I'm not sure anyone know please?

nintendo's official website will have all info on past and current updates

 

[IbbyPlays]

That's because it never happened...
I've worked and I'm still working on exploiting both the Vita and the Wii U, so I know pretty accurately how the exploits were developed.

The PlayStation Vita's exploit is a heap buffer overflow known as CVE-2012-3648 (a Proof of Concept for this exploit was released under the tag PSA-2013-0903-1). It was being used for a long time by Vita developers before it went public and, it terms of security, it's a considerably powerful exploit.

The Wii U's exploit is a use-after-free bug that was published here: https://code.google.com/p/chromium/issues/detail?id=226696
It's not as powerful and it's definitely not the bug used in the Vita.

The exploit found for the Vita works on the PS4 as well, so it makes sense it was simply ported over.
This exploit drew more attention because people thought those systems were quite secure and nothing had been done with them yet. On the other hand, Fail0verflow had already cracked the Wii U wide open and even gave a detailed on presentation on how to do it.
Obviously, finding a WebKit and exploiting it wouldn't get as much attention since it was already expected to happen.

What you could have mentioned is that Gateway is using the exact same bug to exploit the 3DS, as Yifan Lu posted here: http://yifan.lu/2015/01/10/reversing-gateway-ultra-first-stage-part-1/

Oh, It's just I read an article saying that the Wii U exploit worked on the PSVita and assumed it was the current PSVita exploit.

 

[dojafoja]

Are we on 5.3.2 now on the WiiU. I thought the WiiU had updated since then to 5.3.4 now, I'm not sure anyone know please?

My wiiu is online 24/7 with No ip blacklisting of any sort and I'm only on 5.3.2

 

[Reecey]

My wiiu is online 24/7 with No ip blacklisting of any sort and I'm only on 5.3.2

Thanks you are US though? I wounder if the UK the same, I presume it is.

Edit: yeah just looked we are on 5.3.2 might as well update then and enjoy MK8 & SSB online while it lasts don't see the point in staying on 5.3.0 anymore when they are just the same position as each other

 

[jammybudga777]

yes of course they would be the same. maybe the updates wouldnt be released exactly the same times but yea they would all be the same

 

[Onion_Knight]

That's because it never happened...
I've worked and I'm still working on exploiting both the Vita and the Wii U, so I know pretty accurately how the exploits were developed.

The PlayStation Vita's exploit is a heap buffer overflow known as CVE-2012-3648 (a Proof of Concept for this exploit was released under the tag PSA-2013-0903-1). It was being used for a long time by Vita developers before it went public and, it terms of security, it's a considerably powerful exploit.

The Wii U's exploit is a use-after-free bug that was published here: https://code.google.com/p/chromium/issues/detail?id=226696
It's not as powerful and it's definitely not the bug used in the Vita.

The exploit found for the Vita works on the PS4 as well, so it makes sense it was simply ported over.
This exploit drew more attention because people thought those systems were quite secure and nothing had been done with them yet. On the other hand, Fail0verflow had already cracked the Wii U wide open and even gave a detailed on presentation on how to do it.
Obviously, finding a WebKit and exploiting it wouldn't get as much attention since it was already expected to happen.

What you could have mentioned is that Gateway is using the exact same bug to exploit the 3DS, as Yifan Lu posted here: http://yifan.lu/2015/01/10/reversing-gateway-ultra-first-stage-part-1/

Thank you for the insight!

 

[fatsquirrel]

I believe 0x101c400 is the coreinit base on 5.3.2. Got this by adding the size of the loader's .text section to 0x01000000 and rounding to the nearest 0x400.

MarioNumber1:

I know you get these questions a lot and Im sorry for making another one but I cant help myself Im too worried that I will lose the ability to run the exploit.
The thing is I bought Captain Toad for my sons birthday yesterday and I just figured out that it has 5.1.2. patch on it. Im currently on 4.1.0.
Are you absolutely sure that updating to 5.1.2. is safe for homebrew and possible backup (only the ones i own ofc) loading? Is there anything that I could miss going from 4.1.0 to 5.1.2 for a final user like me?
Again im sorry for the annoying question but I and my son would really like to be absolutely sure.

Regards
N