Hacking Pasta CFW - A CFW that allows unsigned CIA to be installed on Old and New 3DS! (required ninjhax)

[shinyquagsire23]

wouldn't it make sense to start implementing features that already have been documented? for someone who's able to read assembly and write C code, implementing features such as region free and bypassing updates shouldn't pose a problem.

Hah. Even RxTools doesn't even have ARM11 hooking, I doubt this project would be able to get it any time soon. It's probably the most difficult thing to hook actually, considering the lengths you have to go just to get something going at boot. .cia wouldn't work past home menu patches and service patches, so it's value would hardly be useful nor elegant.

Just for the record, it took KARL (now SALT) about a week (10 days after getting newer FIRMs to load, about a month or so from starting kernel hax) to get emuNAND working, vs 3 months for ARM11. Granted, we put it off for a long time because I had been stuck for a while and if we didn't it probably would have only taken a week or two of actual work. Sure we could have cheated and used a .cia, but it's clunky and doesn't work well. In any case, I'd stick to ARM9 before frustrating yourselves over ARM11.

 

[JoostinOnline]

The real problem is that the pasta payload is arm9 but oot3dhax requires arm11(Don't quote me on that)

Quoted, just because I haven't screwed someone over in awhile and I'm a bad person.

 

[Mazamin]

Quoted, just because I haven't screwed someone over in awhile and I'm a bad person.

YOU EVIL!!!

 

[kactusss]

Just for the record, it took KARL (now SALT)

SALT ? What happened to KARL ?

 

[shinyquagsire23]

SALT ? What happened to KARL ?

We disliked the name and found a better one.

 

[Suiginou]

Salt:

1. actual salt
2. alternative name for the NaCl library (http://nacl.cr.yp.to/)
3. a very odd way to put someone is angry ("WHY DO I KEEP GETTING NOSCOPED?!" - "Wow, that's some serious salt right there.")
4. payment processing software (http://salt.com/)
5. a Swiss phone and Internet provider (http://salt.ch/)
6. common name for the SaltStack automation software (http://saltstack.com/)
7. a mythical unicorn of a 3DS CFW (http://salthax.tumblr.com/), formerly known as KARL (http://gbatemp.net/threads/wip-karl...ninjhax-loadcode.382113/page-218#post-5530021)

Anything I missed?

 

[kactusss]

We disliked the name and found a better one.

What does this one mean?

 

[zoogie]

http://www.urbandictionary.com/define.php?term=salty

I'll leave it open to interpretation as to whether the devs or their followers are the salty party. Maybe a little of both.

 

[hairyfairy]

Hah. Even RxTools doesn't even have ARM11 hooking, I doubt this project would be able to get it any time soon. It's probably the most difficult thing to hook actually, considering the lengths you have to go just to get something going at boot.

sorry i couldn't disagree more and say, why do you discourage people? arm11 hooking isn't difficult at all, it just depends on the perspective. i.e. who is it difficult for? "rxtools" isn't something that i'd compare anything with. the main difference between your karl team and the pasta guys is that your team is driven by curiousity and research and the pasta guys are not. this is where the pasta guys need to get at. it's not the motives that matter, in the end it's the ways and the outcome -> slowly shifting a basically nonexisting 3ds scene away from piracy towords a healthy development and 'hacking' scene. getting people to learn something about the handheld, processor architectures and reverse engineering.

.cia wouldn't work past home menu patches and service patches, so it's value would hardly be useful nor elegant.

wrong. you could implement a hooking mechanism the way that NTR does it, just to name one example. why are you neglecting all the possibilities?

Just for the record, it took KARL (now SALT) about a week (10 days after getting newer FIRMs to load, about a month or so from starting kernel hax) to get emuNAND working, vs 3 months for ARM11. Granted, we put it off for a long time because I had been stuck for a while and if we didn't it probably would have only taken a week or two of actual work. Sure we could have cheated and used a .cia, but it's clunky and doesn't work well. In any case, I'd stick to ARM9 before frustrating yourselves over ARM11.

i do congratulate you and your team for your personal and technical advancements. still, i couldn't care less in what time you achieved what. all it takes is the will to do it and dedication.

 

[Suiginou]

i do congratulate you and your team for your personal and technical advancements. still, i couldn't care less in what time you achieved what. all it takes is the will to do it and dedication.

Can you show me what your will and dedication has produced so far?

 

[hairyfairy]

Can you show me what your will and dedication has produced so far?

i once toggled a JNZ. what about you?

 

[shinyquagsire23]

http://www.urbandictionary.com/define.php?term=salty

I'll leave it open to interpretation as to whether the devs or their followers are the salty party. Maybe a little of both.

It's mostly something actually less tacky for a name.

 

[Deleted-355425]

sorry i couldn't disagree more and say, why do you discourage people? arm11 hooking isn't difficult at all, it just depends on the perspective. i.e. who is it difficult for? "rxtools" isn't something that i'd compare anything with. the main difference between your karl team and the pasta guys is that your team is driven by curiousity and research and the pasta guys are not. this is where the pasta guys need to get at. it's not the motives that matter, in the end it's the ways and the outcome -> slowly shifting a basically nonexisting 3ds scene away from piracy towords a healthy development and 'hacking' scene. getting people to learn something about the handheld, processor architectures and reverse engineering.



wrong. you could implement a hooking mechanism the way that NTR does it, just to name one example. why are you neglecting all the possibilities?



i do congratulate you and your team for your personal and technical advancements. still, i couldn't care less in what time you achieved what. all it takes is the will to do it and dedication.

It's a free world isn't it?

 

[hairyfairy]

It's a free world isn't it?

yours might be. matter of perception

 

[Deleted-355425]

yours might be. matter of perception

Either way its a first world problem.

 

[Suiginou]

SpiderPasta for 4.X is completed and now is in debugging (still crashes somewhere and I have to find where). I'm working alone but now I'm going to ask some help to the other PASTA devs to complete this step.

After this I planned to do the port to 9.X and then to return working on MSET entry point.

Hype thrusters activate!

 

[zoogie]

Hype thrusters activate!

You think he's still working on it with rxtools pasta a thing now? The mset would still be cool, but I'm not sure if even that's enough motivation anymore.

 

[Suiginou]

You think he's still working on it with rxtools pasta a thing now? The mset would still be cool, but I'm not sure if even that's enough motivation anymore.

It's got one major use: bootstrapping 2DS users without Cubic Ninja/Gateway. They can't downgrade to 4.5 for PBT/Palantine and any CIA installation app via browser requires kernel hax to be still intact, which rxPasta butchers.

It'd be the first open source CFW launching via spider, too.

 

[nop90]

You think he's still working on it with rxtools pasta a thing now? The mset would still be cool, but I'm not sure if even that's enough motivation anymore.

Yes, working on it. Slowly but working.

I had been very busy these days so I missed all the news on rxtools with patched sign check, but if I'm not wrong it's not open source yet.

Since my objective is not pirating games but knowledge, I'm not giving up.

Now a little update:

Gpu mem copy ROP gadget for spider of FW 7.1 doesn't work on a 4.x FW. Maybe it's only a problem of virtual addressing mapping since it doesn't crash, but nothing is copied in FCRAM. I know because I made some dumps after copying specific patterns in memory and did not found them in the dumps.

For the same reason we can't load a code.bin using the loadcode web page on duke site with a 4.X FW.

Now I installed the 4.X spider version, that can load and run with no problems a code.bin arm11 file using the loadcode4 page.

The bad thing is that we miss the IWrite_File rop gadget to dump the memory and search the others needed gadget to complete Spiderpasta.

I wrote a simple code bin that scans the memory to search the first 7 words of the IWrite_File and I found it in memory (I placed a infine loop in code to know if pattern is found).

Now I have to get the found address and I'm using the trick of the open file with write/create flag to create an empty file with the address encoded in the filename.

Yesterday night I stopped working with at this point with the code crashing. In the weekend I'll try to fix it and get a memory dump.

I hope I'm not making big mistakes at this point.

 

[arcangelnew]

Yes, working on it. Slowly but working.

I had been very busy these days so I missed all the news on rxtools with patched sign check, but if I'm not wrong it's not open source yet.

Since my objective is not pirating games but knowledge, I'm not giving up.

Now a little update:

Gpu mem copy ROP gadget for spider of FW 7.1 doesn't work on a 4.x FW. Maybe it's only a problem of virtual addressing mapping since it doesn't crash, but nothing is copied in FCRAM. I know because I made some dumps after copying specific patterns in memory and did not found them in the dumps.

For the same reason we can't load a code.bin using the loadcode web page on duke site with a 4.X FW.

Now I installed the 4.X spider version, that can load and run with no problems a code.bin arm11 file using the loadcode4 page.

The bad thing is that we miss the IWrite_File rop gadget to dump the memory and search the others needed gadget to complete Spiderpasta.

I wrote a simple code bin that scans the memory to search the first 7 words of the IWrite_File and I found it in memory (I placed a infine loop in code to know if pattern is found).

Now I have to get the found address and I'm using the trick of the open file with write/create flag to create an empty file with the address encoded in the filename.

Yesterday night I stopped working with at this point with the code crashing. In the weekend I'll try to fix it and get a memory dump.

I hope I'm not making big mistakes at this point.

Keep the good work, It doesn't matter if rxtools was released or not, knowledge is the best you will achieve of this project, and also a lot of people will continue your steps using your code in the future, so please keep it open, so anyone can modify and test it by himself.