Hacking 3DBrew / ctrtool / 3DSExplorer discussion

3DSGuy

No longer in scene
OP
Member
Joined
May 22, 2012
Messages
345
Trophies
0
XP
467
Country
United States
Just hours ago, neimod updated his github once again;

ramtracer 5 hours ago Merge branch 'master' of github.com:/neimod/ctr [neimod]

Could 3DSguy or someone shed some light on the significance of this, if any ?

https://github.com/neimod/ctr

also in that "ramtracer" folder, there was:
host 5 hours ago Added support for live debugging. [neimod]
He's just updating his RAM tracer code, so he can debug while it is connected to the 3DS RAM at the same the 3DS is on. That's just an educated guess though.

EDIT: from IRC

with debugging, you can just run it and inspect the values -- it's much faster
 

MoshMarioMaldona

Member
Newcomer
Joined
Jul 25, 2012
Messages
19
Trophies
0
XP
75
Country
Mexico
Just hours ago, neimod updated his github once again;

ramtracer 5 hours ago Merge branch 'master' of github.com:/neimod/ctr [neimod]

Could 3DSguy or someone shed some light on the significance of this, if any ?

https://github.com/neimod/ctr

also in that "ramtracer" folder, there was:
host 5 hours ago Added support for live debugging. [neimod]
He's just updating his RAM tracer code, so he can debug while it is connected to the 3DS RAM at the same the 3DS is on. That's just an educated guess though.

EDIT: from IRC

with debugging, you can just run it and inspect the values -- it's much faster
that mean exactly?
 

3DSGuy

No longer in scene
OP
Member
Joined
May 22, 2012
Messages
345
Trophies
0
XP
467
Country
United States
Again this is not about 3DBrew/ctrtool/3DSExplorer. And the change "does exactly what it says on the tin" so to speak. CCM is a mode of AES encryption, so it adds support encryption support to the client api. It isn't a very major update, it doesn't reveal anything special.

And like SifJar said, is it really necessary to post every change neimod makes to his githubs which aren't covered by this thread?


 

justinkb

Well-Known Member
Member
Joined
Oct 7, 2012
Messages
625
Trophies
1
XP
347
Country
Netherlands
Changing values on the go, while the 3DS RAM is being used by the 3DS.

I may be wrong, but looking at the code, I think the only thing he added was breakpoints and inspecting values, not actually altering them. (I think his gizmo only reads the memory chip.)

If he could alter them, he could already run homebrew of course. Just replace a bunch of memory with program data (opcodes etc.) and replace the instruction pointer to point to wherever he put that stuff.

i'm hopeful by the way that homebrew is not far away, given that he can read the ram(!) (massive kudos on this btw). my next step would be checking out pieces of code that handle user supplied data, stepping through them with the debugger to see where there may be vulnerabilities. i guess the 3ds browser would be a really obvious target. browsers on any platform are notoriously exploitable. i think the browser even uses webkit, which may even have some exploits discovered already. all that would be left is a proper payload.

has neimod released the specs of his custom hardware? schematic or so? i'm sure more people would be interested in doing some pcb fab and soldering (and screwing with their 3ds) to help his efforts.
 

3DSGuy

No longer in scene
OP
Member
Joined
May 22, 2012
Messages
345
Trophies
0
XP
467
Country
United States
Changing values on the go, while the 3DS RAM is being used by the 3DS.

I may be wrong, but looking at the code, I think the only thing he added was breakpoints and inspecting values, not actually altering them. (I think his gizmo only reads the memory chip.)

If he could alter them, he could already run homebrew of course. Just replace a bunch of memory with program data (opcodes etc.) and replace the instruction pointer to point to wherever he put that stuff.

i'm hopeful by the way that homebrew is not far away, given that he can read the ram(!) (massive kudos on this btw). my next step would be checking out pieces of code that handle user supplied data, stepping through them with the debugger to see where there may be vulnerabilities. i guess the 3ds browser would be a really obvious target. browsers on any platform are notoriously exploitable. i think the browser even uses webkit, which may even have some exploits discovered already. all that would be left is a proper payload.

has neimod released the specs of his custom hardware? schematic or so? i'm sure more people would be interested in doing some pcb fab and soldering (and screwing with their 3ds) to help his efforts. Not that I know of :/
Another IRC quote said:
did you dump it or are you debuggin on device?
Dovoto, realtime=on device
realtime != on device (although it heavily implies it ;)
on device
as in a real live runnning 3ds
interesting, are you glitching are do you actually have code injection?
code injection
* Dovoto has quit (Read error: Operation timed out)
* Dovoto_2 is completely out of the loop...for all i know there is a pirate cart for 3ds already :)
there is not
thats pretty awesome
it sure is
static analysis can only get you so far
even with an enormous amount of time, it's still alot of work just to figure out what exactly the parameters are to called functions
with debugging, you can just run it and inspect the values -- it's much faster
 
  • Like
Reactions: 2 people

Hunter X

Well-Known Member
Member
Joined
Apr 3, 2012
Messages
117
Trophies
0
XP
68
Country
United States

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    SylverReZ @ SylverReZ: https://www.youtube.com/watch?v=ZokeA2lKB6o