Homebrew Clarification Thread - What is going on?

[Deleted member 373223]

@JustPingo after you implemeted snshax you will try with memchunchak too?

 

[SLiV3R]

Nice post!

 

[perkel]

Isn't this subject to the same problem mentioned in other contexts, including Wii-U hacking? Namely, the hackers should keep the exploit secret, because as soon as you publish it, Nintendo is going to patch it, and that's bad in the long run.

And how do you prevent Nintendo Engineers from downloading hack themselves and run it through their tools to see what it does ?

They have all keys and access they want, know how, engineers and so on.

 

[JustPingo]

@JustPingo after you implemeted snshax you will try with memchunchak too?

Probably no. People that know memory chunk headers better than me are probably doing it as we're speaking.

 

[Deleted member 373223]

Probably no. People that know memory chunk headers better than me are probably doing it as we're speaking.

and who is the memchunkhax people? (in that way their profile would be destroyed by views)

 

[Mrrraou]

And how do you prevent Nintendo Engineers from downloading hack themselves and run it through their tools to see what it does ?

They have all keys and access they want, know how, engineers and so on.

The exploits were already released. So it's going to be patched.

 

[Deleted User]

No. For many reasons.
memchunkhax2 will be better.

But there's no guarantee that memchunkhax2 is even being worked on though
Oh well, maybe I'll finally upgrade to a new3ds

 

[Deleted member 373223]

The exploits were already released. So it's going to be patched.

announced and explained not released

 

[anonymoose]

..., so could I downgrade my 10.3 old3DS?

 

[Mrrraou]

Also, a question: Isn't there an old kernel9 exploit which was patched, but above 9.2? If so, could menchunkhax2 be used in combination with this to give full access on whatever version didn't patch it?

firmlaunchhax was actually an arm9 kernel exploit that was used on 9.2 and lower that was patched on 9.5

 

[Deleted member 373223]

..., so could I downgrade my 10.3 old3DS?

soon(tm)

 

[JustPingo]

and who is the memchunkhax people? (in that way their profile would be destroyed by views)

Gateway, people working with pasta, etc.

 

[Mrrraou]

announced and explained not released

That's called releasing. Exploits =/= programs

 

[motezazer]

• There is a way to get the key that blocks emuNAND 9.6+ on N3DS (it unlocks the new layer of security added to ARM9 bootrom on the N3DS).

No. There is a way to USE these keys, not to OBTAIN them.

 

[Substance12]

Gateway, people working with pasta, etc.

The Pasta team is the one working on rxTools right now?

 

[Xenon Hacks]

No. There is a way to USE these keys, not to OBTAIN them.

I always appreciate your work/posts think you can go into more detail and share what you know?

--------------------- MERGED ---------------------------

The Pasta team is the one working on rxTools right now?

rxTools is open source anyone can make a commit.

 

[mathieulh]

• arm9loaderhax is a way to inject a payload directly into a N3DS bootrom (just after the the firm boot). This is like a CFW coldboot N3DS-only.

It requires hardware, you need the firmware blob to "decrypt" into a branch point, the problem is, the Kernel9 loader uses a hash derived from a per 3DS OTP (which you don't know) in other to decrypt keys stored in NAND, most particularly key #2 which you replace with a garbage key in the hope of obtaining the branch point mentioned above (used to get the Kernel9 loader to jump to your payload), since you can't predict the output, you can't generalize this hack as it needs trials and errors for each units, therefore requires a way to write the nand using hardware.

• There is a way to get the key that blocks emuNAND 9.6+ on N3DS (it unlocks the new layer of security added to ARM9 bootrom on the N3DS).
  

No, there isn't, you only gain code execution AFTER the Kernel9 loader runs, this means you can't read the OTP and keyslot 0x11 gets cleared, not to mention you would be replacing the NAND key #2 used to decrypt the new Kernel9 with garbage anyway (since that's required for this hack to work in the first place) good luck decrypting 9.6+ kernel9 this way...

• There is also a way to calculate the AES key of the console, which is pretty cool to be honest.

There is not an "AES key of the console" what you can do is to calculate/bruteforce the constant used by the key scrambler and use that to generate missing KeyX for known normal (AES) keys + KeyY and of course bypass the keyscrambler all together.

You need to keep in mind that :

- there aren't a lot of normal keys in the wild, only the one used by NFC and used by the WiiU, so you won't be getting a lot of KeyX

- most of the keyX are set in write only keyslots (which can be used as arguments for the key scrambler) which are set by the bootrom and cannot be read, therefore you won't be able to get the normal key even if you do know KeyY and have the keyscrambler operations + constant figured out.

(You need keyX + keyY to generate a normal key, likewise you need Normal key + keyY to generate KeyX)

 

[Substance12]

rxTools is open source anyone can make a commit.

Wasn't it that Roxas stopped coding and he passed the work to the Pasta team?

 

[motezazer]

I always appreciate your work/posts think you can go into more detail and share what you know?

That's not complicated.
When the flaw is exploited, the N3DS keys are loaded, but the 0x11 key used to generate them was cleared, so you can't generate the keys again. You can only use them (write-only keyslots).

 

[Xenon Hacks]

Wasn't it that Roxas stopped coding and he passed the work to the Pasta team?

Yes but anyone can make a commit https://github.com/roxas75/rxTools
this is getting off topic

--------------------- MERGED ---------------------------

That's not complicated.
When the flaw is exploited, the N3DS keys are loaded, but the 0x11 key used to generate them was cleared, so you can't generate the keys again. You can only use them (write-only keyslots).

And just like that my hopes and dreams have been crushed, guess im staying on 9.2 with 9.5 Emunand thanks for the info.