Hacking Misc Updating the certificates on the DS/DSi browsers

[Beta-Alexis128]

So I have a short thought some time ago about a possibility of a ROM hack or something that gives DS/DSi access to modern SSL/TLS websites. I'm curious about it and if it's possible.

 

[RocketRobz]

Yeah, I'm pretty sure it's possible.
Though it depends on where to get the certificates, as well as which ones to use.

 

[theaxd]

im working on it. i extracted the dsi browser rom and found that the certificates are located in a folder labeled "ca" and i found that 14 of the certificates are expired so im going to try to find newer ones to replace them. hopefully it works

 

[Beta-Alexis128]

im working on it. i extracted the dsi browser rom and found that the certificates are located in a folder labeled "ca" and i found that 14 of the certificates are expired so im going to try to find newer ones to replace them. hopefully it works

What is in the certificates and how could we somehow replace it with better and updated certificates?

 

[theaxd]

What is in the certificates and how could we somehow replace it with better and updated certificates?

i just looked looked for the name of the expired certificates and downloaded the newest certificate from the company who issued them. but now i have a issue that the certificates from google are in .crt or .pem and the ones from the rom are in .ca

 

[Beta-Alexis128]

i just looked looked for the name of the expired certificates and downloaded the newest certificate from the company who issued them. but now i have a issue that the certificates from google are in .crt or .pem and the ones from the rom are in .ca

I find some source about the format itself: https://stackoverflow.com/questions/20501865/ssl-certificate-files-no-ca-file

 

[Beta-Alexis128]

i just looked looked for the name of the expired certificates and downloaded the newest certificate from the company who issued them. but now i have a issue that the certificates from google are in .crt or .pem and the ones from the rom are in .ca

Can you rename it as .ca instead? Does it work?
Also, what tools do you use?

 

[Beta-Alexis128]

i just looked looked for the name of the expired certificates and downloaded the newest certificate from the company who issued them. but now i have a issue that the certificates from google are in .crt or .pem and the ones from the rom are in .ca

So... I checked the files (Nintendo DS Browser) via Tinke 0.9.2 and I found out that the cert folder actually uses .pem files:

 

[Beta-Alexis128]

After changing some files, it doesn't work...

 

[Takokeshi]

It's always possible it might be hardcoded to only use those specific certificate file names and that it might not be able to just dynamically load new ones.

 

[Beta-Alexis128]

It's always possible it might be hardcoded to only use those specific certificate file names and that it might not be able to just dynamically load new ones.

So i tried changing the files with exact filenames. Either it's true that they hardcoded it to the code, which is not my expertise or something... The only thing bothering me is the DSi browser.

 

[Beta-Alexis128]

Some updates: I tried modifying the config file and recompile the DSi browser and that didn't do well. I used dslazy for this.
EDIT:

 

[Takokeshi]

There may be a config setting for this but there is no guarantee that they are even implemented in the code in the first place. Higher TLS versions being enabled and implemented wouldn't really matter anyway, because the browser still needs valid (non-expired) certificates for those sites to load.

 

[Beta-Alexis128]

There may be a config setting for this but there is no guarantee that they are even implemented in the code in the first place. Higher TLS versions being enabled and implemented wouldn't really matter anyway, because the browser still needs valid (non-expired) certificates for those sites to load.

Pretty sure that was the case, I could recommend using some rendering proxy for this for now.

 

[banjo2]

Some updates: I tried modifying the config file and recompile the DSi browser and that didn't do well. I used dslazy for this.
EDIT:
View attachment 307537

You might want to use https://github.com/R-YaTian/TinkeDSi/releases, I don't think DSLazy would correctly repack the ROM

That being said, I don't think you can just turn on TLS 1.3