# iQue Player Code Execution achieved!



## dark_samus3 (Apr 29, 2018)

Today we were able to successfully execute code on the iQue player! This is the first publically known code execution.

 Technical details: we were able to implement a known attack on the encryption scheme used with the iQue (AES-CBC) to inject custom data into the game data stored on the iQue NAND. This data is unchecked (but encrypted with keys we don't know) once it has been converted to ".rec" format. We also took advantage of a save file; they're unchecked and mapped to a certain region of RAM, so it's basically free space for us.

 The CBC attack: AES-CBC uses the previous encrypted block and XORs it against the next block, after it has been decrypted, to produce the final plaintext decryption. XOR is deterministically modifiable, if you know the plaintext (which we do, thankfully  ). This attack does sacrifice a block of data (which will decrypt to random garbage) but it gains us control over arbitrary sections of code in the next block, and ultimately doesn't matter; we were able to sacrifice an unused section to control exactly the code we wanted. (see here for AES-CBC decryption procedure: image)

very first successful result: 


In action:


Shoutouts: Marshallh, Normmatt, and Riley/ROL


----------



## Jayro (Apr 29, 2018)

VERY exciting stuff, good job! (I'm guessing a ROM loader is out of the question?)


----------



## Searinox (Apr 29, 2018)

Woohoo! Homebrew on a new console. Or close to that? So this is what a padding oracle attack?


----------



## Jhynjhiruu (Apr 29, 2018)

Searinox said:


> Woohoo! Homebrew on a new console. Or close to that? So this is what a padding oracle attack?





Jayro said:


> VERY exciting stuff, good job! (I'm guessing a ROM loader is out of the question?)


Still quite a long way off from proper homebrew, or a ROM loader. But we're working on it, as quickly as we can!


----------



## EdTheNerd (Apr 29, 2018)

Woo! I've been eyeing iQue's for _years_. Time to import one.


----------



## Kevinpuerta (Apr 29, 2018)

EdTheNerd said:


> Woo! I've been eyeing iQue's for _years_. Time to import one.


Less than 5 mins later. You actually bought one lol


----------



## EdTheNerd (Apr 29, 2018)

Kevinpuerta said:


> Less than 5 mins later. You actually bought one lol


It was overdue


----------



## asper (Apr 29, 2018)

Tested and working ! Thanks to Jynji for all the support


----------



## DarthDub (Apr 29, 2018)

Brb buying an iQue.


----------



## KiiWii (Apr 29, 2018)

Amazing, I definitely need to invest....


----------



## zoogie (Apr 30, 2018)

Very interesting direction to take console hacking! I didn't even know about this until yesterday.
These aren't to badly priced online either, thinking about snagging one.

(SUXXORS is credited too? Isn't that a warez group? Not complaining, just a little bit of an unusual greet )


----------



## dark_samus3 (Apr 30, 2018)

zoogie said:


> Very interesting direction to take console hacking! I didn't even know about this until yesterday.
> These aren't to badly priced online either, thinking about snagging one.
> 
> (SUXXORS is credited too? Isn't that a warez group? Not complaining, just a little bit of an unusual greet )


It wouldn't have been possible without them; the AES-CBC attack we used required knowing the plaintext of a game, so they indirectly helped us ¯\_(ツ)_/¯


----------



## Psi-hate (Apr 30, 2018)

Congrats! I've always wanted to import an iQue to get my OoT Romhacks working if there'd be a ROM loader, and it looks like that's now something I can feasibly hope for! Great job, I'm beyond excited to see what you guys manage to pull off.


----------



## MockyLock (Apr 30, 2018)

I'm very intrested by this iQue scene revival.
Congratulations !


----------



## Nintendrew (Apr 30, 2018)

Great work, guys. Really hoping we'll eventually see a homebrew replacement for the defunct iQue download service to inject the retail roms back onto iQue hardware (whether by rom loader or other means). Thanks for the update!


----------



## Jhynjhiruu (Apr 30, 2018)

Nintendrew said:


> Great work, guys. Really hoping we'll eventually see a homebrew replacement for the defunct iQue download service to inject the retail roms back onto iQue hardware (whether by rom loader or other means). Thanks for the update!


Well, for that, we would have to figure out how to sign tickets... or get psychic paper working. Something more akin to USB Loader GX is more likely, short-term.


----------



## leon315 (Apr 30, 2018)

i vener heard of that iQue thing, what is it?? and what you can do with it??


----------



## Jhynjhiruu (Apr 30, 2018)

leon315 said:


> i vener heard of that iQue thing, what is it?? and what you can do with it??


Check the Wikipedia page for 'iQue Player'


----------



## leon315 (Apr 30, 2018)

Jhynjhiruu said:


> Check the Wikipedia page for 'iQue Player'


wow interesting indeed! then what has tc done so far?? did he manage to crack it?


----------



## Jhynjhiruu (Apr 30, 2018)

leon315 said:


> wow interesting indeed! then what has tc done so far?? did he manage to crack it?


tc?


----------



## leon315 (Apr 30, 2018)

Jhynjhiruu said:


> tc?


tc=topic creator!!!

in this case, tc is @dark_samus3


----------



## Jhynjhiruu (Apr 30, 2018)

leon315 said:


> tc=topic creator!!!
> 
> in this case, tc is @dark_samus3


Ah yes, stuckpixel. Watch the video, it says credits. (Most people say OP, by the way).
He's pretty involved at this point, like, a good portion of the work required to get ACE was his.


----------



## Psi-hate (Apr 30, 2018)

Just bought an iQue with the help of a few amazing people. Look forward to seeing what else you all accomplish!


----------



## dark_samus3 (May 2, 2018)

https://twitter.com/pixel_stuck/status/991481373658681344

( ͡° ͜ʖ ͡°)


----------



## Deleted User (May 4, 2018)

@dark_samus3 how is this possible if the game is "unreleased"? Does it exist on the server hand they somehow forged a ticket?
https://twitter.com/fpga_nugga/status/992252329242996737


----------



## dark_samus3 (May 4, 2018)

parrotgeek1 said:


> @dark_samus3 how is this possible if the game is "unreleased"? Does it exist on the server hand they somehow forged a ticket?
> https://twitter.com/fpga_nugga/status/992252329242996737


We injected it over OoT. The games are entirely unchecked once they're put into their ".rec" format, so if you can get the keys for it (which we did) you can just properly encrypt the game, and since it's unchecked, it'll run.


----------



## Deleted User (May 4, 2018)

dark_samus3 said:


> We injected it over OoT. The games are entirely unchecked once they're put into their ".rec" format, so if you can get the keys for it (which we did) you can just properly encrypt the game, and since it's unchecked, it'll run.


But where did you *get* the game?


----------



## dark_samus3 (May 4, 2018)

parrotgeek1 said:


> But where did you *get* the game?


There's a copy of it on the CDN, along with it being in a certain recent "release"


----------



## Deleted User (May 4, 2018)

dark_samus3 said:


> There's a copy of it on the CDN, along with it being in a certain recent "release"


where is that spreadsheet with a list of everything on the CDN? I lost my bookmark


----------



## Felixraku (May 5, 2018)

dark_samus3 said:


> https://twitter.com/pixel_stuck/status/991481373658681344
> 
> ( ͡° ͜ʖ ͡°)



I got a iQue just now but I found it hasn’t any USB function. Am I stucked if I cannot find another usb-compatible iQue from my friends or anyone else?


----------



## Jhynjhiruu (May 5, 2018)

Felixraku said:


> I got a iQue just now but I found it hasn’t any USB function. Am I stucked if I cannot find another usb-compatible iQue from my friends or anyone else?


Yes, but you can just mail the card to someone else.


----------



## Psi-hate (May 5, 2018)

Felixraku said:


> I got a iQue just now but I found it hasn’t any USB function. Am I stucked if I cannot find another usb-compatible iQue from my friends or anyone else?


Apparently you can have someone with another iQue update it, so should anyone here want to help you out, that'd fix your issue.


----------



## Felixraku (May 6, 2018)

Jhynjhiruu said:


> Yes, but you can just mail the card to someone else.


I found a seller who has some stock of iQue consoles. But he doesn’t know which model is USB-compatible or not. Can people tell the differences from the system setting or main menu?


----------



## Jhynjhiruu (May 6, 2018)

Felixraku said:


> I found a seller who has some stock of iQue consoles. But he doesn’t know which model is USB-compatible or not. Can people tell the differences from the system setting or main menu?


Not yet, perhaps in the future. If the box has a purple sticker on it, it's compatible, otherwise it might not be. Anyone with a compatible one can update yours, so you shouldn't need to worry.


----------



## daniguti (Jun 2, 2020)

News???

--------------------- MERGED ---------------------------

News??


----------



## Kevinpuerta (Jun 3, 2020)

daniguti said:


> News???
> 
> --------------------- MERGED ---------------------------
> 
> News??


a group called SUXXORS released all the roms and tickets to public. The ique discord was able to inject some roms into their iques, update them to newest version, and made a work around for the demo time limits to make them pretty much unlimited time.


----------



## teamlocust (Jun 3, 2020)

I am happy for those 2 people having ique player. Kudos to the Devs btw.


----------



## daniguti (Jun 11, 2020)

Kevinpuerta said:


> a group called SUXXORS released all the roms and tickets to public. The ique discord was able to inject some roms into their iques, update them to newest version, and made a work around for the demo time limits to make them pretty much unlimited time.



but is easy?? I can make in my Ique?? How?? I have 5 original games in my memory card because before servers down, i put the maximum games in memory card, but i have all games released  =(  but i lost games in ique´s servers... I want play the all games. How do i do?


----------



## daniguti (Jun 21, 2020)

???


----------



## asper (Jun 30, 2020)

daniguti said:


> ???


Join iQueBrew channel on discord.


----------



## KiiWii (Dec 22, 2022)

I got mine a few months ago now and never did anything with it. 

Has there been any advances? Do we still need a VM and win XP?

Edit: I actually got mine in October 2021 lol, been more than “a few months”… time flies!


----------



## M4x1mumReZ (Dec 22, 2022)

Has anyone made some good homebrew, CFW, or any amazing things for the iQue yet?


----------



## KiiWii (Dec 23, 2022)

M4x1mumReZ said:


> Has anyone made some good homebrew, CFW, or any amazing things for the iQue yet?


I don’t think so, also I think the drivers used are from the leak and so are 32bit only, hence the requirement for XP… Can’t 10/11 run 32bit drivers? I have no idea.

Edit: also I guess any N64 rom could be converted to play, but you need to generate a ticket I think, so potentially any Spooky Jam entries or homebrew could work?


----------



## M4x1mumReZ (Dec 23, 2022)

KiiWii said:


> I don’t think so, also I think the drivers used are from the leak and so are 32bit only, hence the requirement for XP… Can’t 10/11 run 32bit drivers? I have no idea.


Only if the OS is 32-bit and not 64-bit, I haven't done any testing to confirm that though. If the drivers are NT based then they should be fine.


----------

