Hacking 3DS Hacking Ideas: Post Your Ideas Here!

Devrim

Well-Known Member
Member
Joined
Mar 2, 2014
Messages
113
Trophies
0
Age
54
XP
554
Country
Netherlands
Okay, and would it be possible to modify a small part of the firmware to f.e. disable a rom decryptor/legitimacy check jump? Would this allow running homebrew/hacks/fan translations (maybe even from the sd card)?

I think the real problem is, is that no one really is interested in hacking the 3DS. Best case scenario some gateway/r4/supercard-like company will take the exploit and sell cards and make money out of it.
 
D

Deleted User

Guest
Okay, and would it be possible to modify a small part of the firmware to f.e. disable a rom decryptor/legitimacy check jump? Would this allow running homebrew/hacks/fan translations (maybe even from the sd card)?
But how would n00bs do this?
 
D

Deleted User

Guest
Learn ARM ASM and reverse engineer the firmware.

But it doesn't matter here, because just editing some things on the running firmware doesn't fix the problems caused by the exploit.

You make it sound so easy
 

pokefan92

Well-Known Member
Newcomer
Joined
May 29, 2009
Messages
80
Trophies
0
XP
222
Country
You make it sound so easy

Nothing it's impossible. You think it's really difficult and it isn't. It's as easy as you know how things work and what you have to do.

The matter is... how many people invest their time in that? Most people don't know how to program a simple calculator... I'm surprised that the thing that surprises you most is that someone hacks something made by other person...

Maybe you don't know persons like Leibniz because he didn't make a flashcart or similar.
 
D

Deleted User

Guest
Nothing it's impossible. You think it's really difficult and it isn't. It's as easy as you know how things work and what you have to do.

The matter is... how many people invest their time in that? Most people don't know how to program a simple calculator... I'm surprised that the thing that surprises you most is that someone hacks something made by other person...

Maybe you don't know persons like Leibniz because he didn't make a flashcart or similar.

All I am saying is i dont want a flashcart i dont want something which sounds impossible or i have to put my final 2 brain cells together just to do it XD
 

X_Frost

Well-Known Member
Member
Joined
Aug 30, 2011
Messages
129
Trophies
0
XP
360
Country
United States
DLCs are as secure as normal titles. And normal titles are very secure.

Understood, thanks for clarifying.

How about using patches for games, to run code, instead of standalone DLC.

I think the real problem is, is that no one really is interested in hacking the 3DS. Best case scenario some gateway/r4/supercard-like company will take the exploit and sell cards and make money out of it.

This thread couldn't exist if that was true, though. And many of us wish we could but are severely limited skill wise.

The matter is... how many people invest their time in that?

Not many can, it's the reason we rely on the people here, instead of doing this ourselves.
 

daniilS

Active Member
Newcomer
Joined
Dec 28, 2013
Messages
28
Trophies
0
Age
24
XP
62
Country
Netherlands
I think there are enough people who are enthusiastic about this, but not many of them are skilled. I myself have some experience with arm7 assembly, and would give this a try if I had an idea how. Modifying a part of the firmware run-time may work, but will need to be repeated every time and I don't know how and where the firmware is stored after decryption. My guess is if we want something like this, we'd either need to modify the bios to decrypt and redirect the firmware to an accessible and known place, (hard without the chip being decapped), or find a way to modify the firmware right before it gets re-encrypted, like during a software update. Would that be possible?
 

UraKn0x

Official senpai
Member
Joined
Mar 20, 2014
Messages
370
Trophies
0
XP
735
Country
France
Hello, another hack idea (sorry if it was already posted) : do you think title banners/icons are encrypted with the same security level as the titles themselves? If it is not the case, maybe we could attack it by, for example, not putting the image end byte and write awesome homebrew code here. I know smealum played with the banners and icons, but I don't know if he tried to attack it.

@daniiilS : It would not be possible, firmware is never decrypted then re-encrypted by the console, it just gets decrypted with an asymetric key; if you modify the bios, (I don't know how, but maybe it could be possible), you could eventually run code before any other code is loaded, then you could do whatever you want, as I think the bios is not encrypted (there must be any thing that is not encrypted, as I think the decryption is done softwareside and not hardware-side)

PS : Feel free to tell me if I'm doing any error (I'm not very experimented)
(And if you just don't understand what I'm trying to say, don't worry, I'm French and my English is relatively bad, feel free to correct me again ^_^)
 

Duo8

Well-Known Member
Member
Joined
Jul 16, 2013
Messages
3,613
Trophies
2
XP
3,024
Country
Vietnam
Understood, thanks for clarifying.

How about using patches for games, to run code, instead of standalone DLC.

Patches are DLCs IIRC.

Okay, and would it be possible to modify a small part of the firmware to f.e. disable a rom decryptor/legitimacy check jump? Would this allow running homebrew/hacks/fan translations (maybe even from the sd card)?
Yeah. But not permanently.
 

Foxi4

Endless Trash
Global Moderator
Joined
Sep 13, 2009
Messages
30,825
Trophies
3
Location
Gaming Grotto
XP
29,841
Country
Poland
I meant insert code through the vulnerabilities that required patching in the first place.
Use the patch to introduce code when the original game loads.
Just because something requires patching doesn't mean that it's a vulnerability, not to mention that not all bugs and crashes can be used to load anything, especially not code. On top of that, there's a whole spectrum of obstacles to get through just to get the loaded code to actually work.
 

Kargaroc

Well-Known Member
Member
Joined
Nov 29, 2013
Messages
183
Trophies
0
XP
231
Country
United States
The boot-rom (BIOS) is stored in mask-ROM on the CPU die. It would be easier to just get the private key than it would be to change it in any way that's usable for homebrew.
 

daniilS

Active Member
Newcomer
Joined
Dec 28, 2013
Messages
28
Trophies
0
Age
24
XP
62
Country
Netherlands
The boot-rom (BIOS) is stored in mask-ROM on the CPU die. It would be easier to just get the private key than it would be to change it in any way that's usable for homebrew.
Yes, I know. My idea was if it's maybe to keep the original bios in its place, but block the signals and send a modified custom version instead. But so far we don't know enough about the 1048 0H to do that, sadly.
 

Arsen Tufankjian

New Member
Newbie
Joined
Mar 28, 2014
Messages
3
Trophies
0
Age
29
XP
41
Country
United States
Has anyone gotten a successful RAM dump working? If so could I have a link to a blog post or something?
Maybe someone has had this idea already but I'm still working through all the pages of this thread.
I was thinking maybe there's something we can snatch up from RAM when the system goes to create a save game backup.
 

lambstone

No. Nyet. 不. Non. Nein.
Banned
Joined
Aug 14, 2011
Messages
614
Trophies
0
XP
310
Country
it is not possible to packet inject the pokebank app, or another game?

And even then pokebank will be useless because of the new 7.x keys used. The only way pokebank would work is if you were on 7.x and injecting it then would be pointless because well... eshop.
 

migles

All my gbatemp friends are now mods, except for me
Member
Joined
Sep 19, 2013
Messages
8,033
Trophies
0
Location
Earth-chan
XP
5,299
Country
China
And even then pokebank will be useless because of the new 7.x keys used. The only way pokebank would work is if you were on 7.x and injecting it then would be pointless because well... eshop.

and i forgot about eshop.. it is not possible to packet inject it? or edit packets which are sent to the 3ds? i am aware about probably having something like SSL protection but come on, how it is not possible to manipulate messages if we are the courier who delivered letters from the beggining...

i mean, let's say, all your communication to your friend goes through me, if you send crypted letters, your friend will not be able to read it, unless you send him the keys and that keys must go through me...
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Psionic Roshambo @ Psionic Roshambo: I am the cancer!!! lol