Homebrew Unlaunch DSi | First public bootcode exploit for DSi

[bennyman123abc]

I checked his forum thread. It appears his mitigation for the issue was to write protect flag the tmd file. (which appearently Nintendo's apps will obey?). Would still like to see him open source this at some point though....

I second this. Perhaps someone else (Like Apache) could contribute help and make the exploit a bit more stable.

 

[incidentallyscribble]

It's great that this is being worked on to be made more stable, but as it was said before, it should be open-sourced.

 

[Apache Thunder]

Seems 0.6 can still result in bricks. Launcher SRL needs the write protect flag too. But this one is recoverable. Seems exploit still works because Stage2 doesn't even get far enough along to check that the SRL even exists. TMD file is loaded first.

Makes sense since TMD file determines file name of the .app file. It's how it would know what file name to expect for the .app.

 

[bennyman123abc]

Seems 0.6 can still result in bricks. Launcher SRL needs the write protect flag too. But this one is recoverable. Seems exploit still works because Stage2 doesn't even get far enough along to check that the SRL even exists. TMD file is loaded first.

Makes sense since TMD file determines file name of the .app file. It's how it would know what file name to expect for the .app.

So, you're saying that a brick in this case would be soft-recoverable? If so, I consider that stable! I mean, look at the way A9LH used to be! As long as the brick was recoverable through software methods, it wasn't really a brick!

 

[GhostLatte]

This is great for the scene.

 

[Mnecraft368]

This is great for the scene.

Indeed. Hopefully it satisfies everybody until RocketLauncher + HiyaCFW

 

[Billy Acuña]

Indeed. Hopefully it satisfies everybody until RocketLauncher + HiyaCFW

RocketLauncher alreally is obsolete, also may be the case for HiyaCFW as UnLaunch alreally patch the Launcher.

 

[Mnecraft368]

RocketLauncher alreally is obsolete, also may be the case for HiyaCFW as UnLaunch alreally patch the Launcher.

Oh yeah. Haven't seen any homebrew on home menu yet though.

 

[Deleted member 381889]

Oh yeah. Haven't seen any homebrew on home menu yet though.

i have

 

[Mnecraft368]

i have

Any pictures?

 

[Deleted member 381889]

Any pictures?

Source: DSiBrew Discord
dunno if it's real or not

 

[Mnecraft368]

Source: DSiBrew Discord
dunno if it's real or not

Was scrolling through that discord and found it just as you posted. Fake tmd/Tiks apparently.

 

[TheLegendofMario]

Was scrolling through that discord and found it just as you posted. Fake tmd/Tiks apparently.

Which Discord?

 

[Mnecraft368]

Which Discord?

NDS(i)Brew Discord

 

[ThisIsDaAccount]

Was scrolling through that discord and found it just as you posted. Fake tmd/Tiks apparently.

The tiks are basically the same for all DSiWare on one console, so that's not really too hard to make for homebrew apps. That said, I wonder how the tmds work without checks- would just copying one from another app work or maybe some hex editing to add the appropriate short ID?

Regardless, I'll be adding instructions to TempNand as soon as I figure it out

 

[TheLegendofMario]

oh derp a derp, Weird that I haven't seen it there

 

[Mnecraft368]

The tiks are basically the same for all DSiWare on one console, so that's not really too hard to make for homebrew apps. That said, I wonder how the tmds work without checks- would just copying one from another app work or maybe some hex editing to add the appropriate short ID?

Regardless, I'll be adding instructions to TempNand as soon as I figure it out

Unlaunch bypasses checks...

 

[ChampionLeake]

yes. It patches RSA

 

[ThisIsDaAccount]

Unlaunch bypasses checks...

I know it does but the tmd still has information in it besides stuff for checks, such as what the .app file will be called and, maybe, what title ID the app is to not confuse it with other apps in the home menu.

Even without checks, that information still has to be there

 

[Mnecraft368]

I know it does but the tmd still has information in it besides stuff for checks, such as what the .app file will be called and, maybe, what title ID the app is to not confuse it with other apps in the home menu.

Even without checks, that information still has to be there

http://dsibrew.org/wiki/Title_metadata
Have fun reverse engineering it then.