Hacking Firmware Reverse Engineering (Info Dump)

[FunThomas]

Bumping this thread to inform all those who signed up to my forum , if they havent been in a while to check out the progress made and see if you could offer assistance ...

edit: removed link if its not wanted

its hard in this time to do find out whats wanted or not ;-)

btw real nice introduction to ROP on your forum ;-) thanx

 

[pwsincd]

Well if I had wanted too .

 

[FaTaL_ErRoR]

Damn, this got buried.
I actually have a question. So, does loadiine actually load modded games? (I don't know because I don't use it)
If it can load modded games then what would stop me from modding a pause menu of a game to be a terminal?
From there I could call to the sd where my capstone framework is and proceed to disassemble things.
Also, may be able to build a linux tree and install it to the sd card and run it from the terminal in my modded game.
The modded game would allow full access to all the hardware as well. I ask this because I am considering having a go at modding assassins creed black flag and taking some swings at the Uplay channel. This may also allow a way to not be so dependent on the pc running as a webserver.
Just a thought...

 

[RealityNinja]

If it can load modded games then what would stop me from modding a pause menu of a game to be a terminal?

Are you serious? ... O_O Is it possible??

 

[rw-r-r_0644]

Are you serious? ... O_O Is it possible??

No, it's not possible

 

[FaTaL_ErRoR]

Are you serious? ... O_O Is it possible??

It should be. With the work from triunix I should be able to upright a terminal. Just need to replace a few files in the game so when it goes to pause it pulls from different library then previous pause menu. Just not sure if loadiine is capable of loading such things.

No, it's not possible

Is this confirmation loadiine cannot load unsigned files?
Because I am doing some reading and starting to see file modding is able to be done via loadiine. Much like a mod menu worked on wii I am thinking it will work for the U.
This actually appears to be real promising the more about loadiine I am reading.

 

[rw-r-r_0644]

It should be. With the work from triunix I should be able to upright a terminal. Just need to replace a few files in the game so when it goes to pause it pulls from different library then previous pause menu. Just not sure if loadiine is capable of loading such things.

A. Games have not full access to hardware and 90% of them neither have access to SD
B. If you runn a Game from Loadiine making the WiiU think that you are running MiiMaker, it obviously give you the same access as MiiMaker
C. WiiU doesn't have a terminal
D. The files would anyway need a lot of patches to work in WiiU mode
E. It would be a lot easier (and would have the same results) running something from MarioNumber1's OSLoader

So sorry but no, it's not possible

 

[shaneod]

90% of them neither have access to SD

10% of them do have SD access, though, so this bit isn't really relevant.

 

[davetheshrew]

I had a dream about using skylanders and writing a sploit to nfc tag and had usb access...pity it was just a dream.

 

[FaTaL_ErRoR]

A. Games have not full access to hardware and 90% of them neither have access to SD
B. If you runn a Game from Loadiine making the WiiU think that you are running MiiMaker, it obviously give you the same access as MiiMaker
C. WiiU doesn't have a terminal
D. The files would anyway need a lot of patches to work in WiiU mode
E. It would be a lot easier (and would have the same results) running something from MarioNumber1's OSLoader

So sorry but no, it's not possible

The game has enough access to hardware to do what I need and one could modify the game in question to access the sd the same way smash does. MiiMaker has enough access to onboard library. Wii u doesnt need a terminal as I am injecting one. And lets just say I have access to "wiiu mode" and not really worried about "patching". And if I am asking the limitations to loadiine so I can upright a terminal via a game why on earth would I want to run something from an OSLoader?
Not doing the lettering thing there.

I had a dream about using skylanders and writing a sploit to nfc tag and had usb access...pity it was just a dream.

In wii this is very possible. Works much like the twilight princess hack. And with the latest skylander game two characters and a car can be placed on the portal. Payload in the first tag, usb parameters in second tag, and hbc in third tag. Between all three tags there is enough space to execute such an attack.

 

[rw-r-r_0644]

The game has enough access to hardware to do what I need and one could modify the game in question to access the sd the same way smash does. MiiMaker has enough access to onboard library. Wii u doesnt need a terminal as I am injecting one. And lets just say I have access to "wiiu mode" and not really worried about "patching". And if I am asking the limitations to loadiine so I can upright a terminal via a game why on earth would I want to run something from an OSLoader?
Not doing the lettering thing there.

In wii this is very possible. Works much like the twilight princess hack. And with the latest skylander game two characters and a car can be placed on the portal. Payload in the first tag, usb parameters in second tag, and hbc in third tag. Between all three tags there is enough space to execute such an attack.

I'm sorry if my previous reply appeared a bit rude, that wasn't my intention
Also I guess I didn't corrctly explain some points; with WiiU Mode I mean not-vWii-mode because trinux was made to run on WiiU's vWii mode. And OSLoader is a very useful program made by MarioNumber1 that is able to load another kernel, so in that case, the Linux kernel.
Anyway there are no reasons to patch a game with loadiine when you can easily load elf files from the homebrew launcher: "just" patch a lot of source of trinux, make osldr an elf and make it load from sd and you are done

 

[FaTaL_ErRoR]

I had a dream about using skylanders and writing a sploit to nfc tag and had usb access...pity it was just a dream.

I'm sorry if my previous reply appeared a bit rude, that wasn't my intention
Also I guess I didn't corrctly explain some points; with WiiU Mode I mean not-vWii-mode because trinux was made to run on WiiU's vWii mode. And OSLoader is a very useful program made by MarioNumber1 that is able to load another kernel, so in that case, the Linux kernel.
Anyway there are no reasons to patch a game with loadiine when you can easily load elf files from the homebrew launcher: "just" patch a lot of source of trinux, make osldr an elf and make it load from sd and you are done

no not rude at all. I was saying im too lazy to do it in that format. (Abc...ect)
And I think you missed my point. My intention is to trigger this in game. And from there hope to jump through it and exploit the uplay channel. This is because the uplay channel gets triggered ingame. And uplay accesses ios. Also uplay has usb access as well. The terminal and capstone framework will help with working in console. That and smack nint in the face. And making a run at this will force another area they have to watch and patch. Which will in turn result in patches that arent so well thought out and riddled with new bugs. Im not interested in linux itself, just pushing the limits on modded games a bit in search of a new point of entry