Hacking Post your ideas regarding how to hack the 3DS, here

[wchill]

I think everyone is looking at the wrong kind of exploit. I think what should be done is look for a hardware-based leak, not a software-based one. Then, once a leak in the hardware is found, we can create a payload that can be delivered to make the system do what we want. Then, once that payload is created, we can create a modchip (Like the first Wii exploits) and allow the modchip to be able to hook up through some kind of cord to a computer to update the payload if a new system menu is released.

Hardware-based exploits would work to discover software-based exploits, yes. However, I have never heard of a modchip for a cartridge-based system, because we use flashcarts/flashcards. The closest thing that I know of is a passthrough device (like the PassMe devices of the early DS days). We can't rely on a hardware-based exploit for general use. I can't think of a way to connect such a device to a computer without opening the 3DS, unless you somehow do everything through the game card slot. Anyway, there are all sorts of problems with this. Just can't think of them right now.

Refer to Tweezer exploit. And we don't rely on payloads anymore for the PS3 either, it's all about keys.

Granted, if you replace the firmware then it doesn't matter what protection is used. Of course, the firmware that we'd need to change is probably Mask ROM that only checks the signed Flash ROM. Wait, isn't this what the original Gameboy used but with carts instead of Flash ROM? DER!!! (LOL, if an exploit exists for the checker, it's pretty much unfixable without new CPU dies and not always even then)

Well, I'll wait a while and see what happens. I imagine we'll see a heated race between modders and system manufacturers in the next few years with the Vita and 3DS. I'm curious as to what they'll do.

Yes, Mask ROM would be what needs to be changed if we replaced the firmware (short of keys and such). Next to impossible to replace.

wouldn't we be able to get the private key if we somehow cracked the console key of an encrypted nand dump. i know its a stupid idea but it seams possible

No. Console key = public key, which you use to decrypt. Public key != private key, which you use to encrypt. You can get the private key from a public key, but it requires integer factorization of a semi-prime (assuming the 3DS uses RSA, which I think it does). Try doing that for a 1024-bit number. It's not feasible within our lifetimes (much less the 3DS's lifetime).

Forgive me if this has been posted before. To refrain from sounding like a complete noob, I'll say right now that I have little or no knowledge about this subject, I'm just throwing this out there.

I've seen people post ideas about attempting to inject code by using a proxy to download a modded firmware to the 3DS. This could be a good idea imo if you just took out the mods. Download a 100% legit firmware to the 3DS and find some way to use the computer/proxy as a scanner as it goes through to the 3DS. Again, I have no real knowledge here, but in theory it could reveal some clues as to how the 3DS manages its encryption.

Furthermore, would it not be possible to trick the NUS servers, (I'm assuming that's still where all this is kept) into thinking your computer is a 3DS, in a way tricking the firmware into revealing the encryption keys?

Again, I have very little knowledge on this subject, I'm just making a suggestion. Feel free to troll me now.

User agent faking? Anyone can do that. But we don't have the keys to make the servers give us data, and nintendo will hate our guts for "hacking" our server.

Incorrect. We CAN grab data from the servers. However, the data (ie. System Menu updates) is encrypted. So you can get the data, but it's useless. The 3DS downloads the update and then decrypts it with its onboard public keys (which we don't have as of yet). So unless you have the computational power to crack the keys, there's no point. Not to mention that you'd still be missing the private keys. Those are far more useful as we could then sign our own System Menu.

 

[Janthran]

Can't we use internet settings to make the 3DS download a system update from somewhere else?
Theoretically you could make it download an app like Nintendo did with N-Zone.

 

[dman2073]

Can't we use internet settings to make the 3DS download a system update from somewhere else?
Theoretically you could make it download an app like Nintendo did with N-Zone.

I'm new to this, but maybe we could impliment something like this? http://nookdevs.com/...ng_With_Details that is how you hack a b&n nook, we may be able to do the same?

 

[Luigi2012SM64DS]

maybe using the savedongle you can make an exploitable save file that reads boot.3ds on the sd card?

 

[Janthran]

No.

Elaboration, please.

 

[wchill]

No.

Elaboration, please.

Doesn't matter if we use DNS poisoning (which is what was described). The 3DS performs checks on firmware before installing. If it were as easy as changing DNS servers, the 3DS would have been hacked already. Like I previously said, we need the private key in order for us to sign the firmware. Otherwise, this won't work.

Same with the Nook link. Similar idea. Won't work.

AFAIK once a game launches from slot 1, the SD card slot is disabled. Sudokuhax and the other DSiWare exploits used DSiWare, which DOES have access to the SD card slot. However, these exploits have long been patched, and you would need to look for vulnerabilities in software downloaded from the eShop (not DSiWare, stuff that uses 3DS features). It's not a trivial task. Certainly much easier than trying to crack the private key, but it's more difficult than one would think, and Nintendo can quickly patch it. Software updates would render it useless, and only the few people that downloaded the eShop title before the exploit is released would be able to use it. Not very practical.

And this still doesn't solve the problem of signature checking, which happens when any title is loaded. No 3DS homebrew or software not signed by Nintendo until we can crack the check.

 

[Maav]

And this still doesn't solve the problem of signature checking, which happens when any title is loaded. No 3DS homebrew or software not signed by Nintendo until we can crack the check.

Or until we can crack the keys and fakesign software ourselves.

 

[C-Kronos]

Is there any archived information on the 3DS's technical information and information in regards of the security it implements? I'm not too familiar with the 3DS, but I have a couple sitting here that I want to tinker with out of personal interest. PM me if you know anything.

 

[Vierv]

Ok, another "I have absolutely no idea how this works but lets speculate" post here.

As stated above I am not experienced in any programming language and I've never tried to hack something myself, but since I am getting a 3DS for my birthday/Christmas present I was recently looking into how hacking it was coming along and if any solutions had been found.
After talking to my brother about it, he suggested that a brute force method, as he called it, be tried.
I'm guessing this would be done by hooking up the 3DS to a computer using some method, maybe the ribbon cable I have no idea, once hooked up a program written to crack the private key value of d (or whatever it is) could just start chipping away.
From reading up on RSA; it's from wiki so I'm not sure how precise it is, my question is:

(d, e and n are the letters used in the wiki to represent numbers, so I'm also going to use them here.)

Is it possible to find d from the e and mod n that are in the public key? I was thinking this because in RSA the public and private keys both have a part of mod n, with the public key also having e for encrypting and the private key also having d for decrypting.

Although my instinct says no, because if so e and mod n wouldn't be given publicly.
Of course, this is assuming the public key is unencrypted (maybe while being read?), that e and mod n are in a readable format AND that they are distinguishable as e or mod n.
Since I'm not sure they would put it directly in the "e mod n" format...

I do apologise if this is confusing and frustrating to those who actually understand it, since it's probably riddled with holes in logic/equation misunderstandings, or whatever.
I'm rather tired now since I've been reading for like a couple hours, so it's understandable if everything I wrote is gibberish.

Man, I don't even want to post this since it seems like I made a stupid, but I spent too long on it.
LOL, fail.

 

[Janthran]

I found a file named 00000001.sav.
.SAV files can be opened with Notepad, right?

---

 

[Janthran]

The SD slot isn't disabled right when you boot a game, either. Some game (I think Tales of the Abyss) reads the SD card because you could customize a character which was then saved as a PNG.

 

[SifJar]

Has no one suggested sticking a hacked video on there yet? I'm a little shocked (and no I'm not suggesting it's a good idea, it's just the sort of thing I would have expected to have been suggested after the flurry of interest around getting videos on the 3DS following the recent update)

I found a file named 00000001.sav.
.SAV files can be opened with Notepad, right?

Any file "can" be opened with Notepad. Many cannot be meaningfully understood or edited in Notepad.

Here's a thought: The 3DS system itself decrypts the things while reading them, right? So if we were to use a microSD+adapter, we could take out the microSD while it's decrypted..?

No. Files will either be loaded into RAM, decrypted there and used from there or else decrypted, copied to a temporary folder on NAND and read from there.

 

[chyyran]

Here's a thought: The 3DS system itself decrypts the things while reading them, right? So if we were to use a microSD+adapter, we could take out the microSD while it's decrypted..?

Theoretically you could, but you'd need the correct game, and Chuck Norris's reflexes to do it.

 

[SifJar]

Here's a thought: The 3DS system itself decrypts the things while reading them, right? So if we were to use a microSD+adapter, we could take out the microSD while it's decrypted..?

Theoretically you could, but you'd need the correct game, and Chuck Norris's reflexes to do it.

No you couldn't. Decrypted files will never be on SD.

 

[Dolei]

The problem with the copy is that it's not encrypted. The system wouldn't accept anything that isn't signed/encrypted by Nintendo. Also, that's if you can make an unencrypted copy. That doesn't happen normally. A system pausing is actually taking the time to encrypt it in memory before it writes it to a file. That's how encryption works. Saving it to a file before encrypting it would be slower, because it would still write to the file, then read the file, encrypt the data, then rewrite the file with the encrypted data. So it's highly doubtful you could copy it.

There's signed PSP games aren't there? Could they do the same thing with 3DS games and/or saves? Or maybe even somehow have a loader for a modified firmware on a flashcart which skips the encryption? (idk i'm a hacking noob sorry if i sound stupid lol )

Can't we use internet settings to make the 3DS download a system update from somewhere else?
Theoretically you could make it download an app like Nintendo did with N-Zone.

Or that

 

[wchill]

And this still doesn't solve the problem of signature checking, which happens when any title is loaded. No 3DS homebrew or software not signed by Nintendo until we can crack the check.

Or until we can crack the keys and fakesign software ourselves.

Fakesigning was only possible because of a flaw with Nintendo's signature checking code. They've since patched that up obviously. Without a foothold, fakesigning is another chicken-egg problem: not usable without the 3DS being hacked already.

Ok, another "I have absolutely no idea how this works but lets speculate" post here.

As stated above I am not experienced in any programming language and I've never tried to hack something myself, but since I am getting a 3DS for my birthday/Christmas present I was recently looking into how hacking it was coming along and if any solutions had been found.
After talking to my brother about it, he suggested that a brute force method, as he called it, be tried.
I'm guessing this would be done by hooking up the 3DS to a computer using some method, maybe the ribbon cable I have no idea, once hooked up a program written to crack the private key value of d (or whatever it is) could just start chipping away.
From reading up on RSA; it's from wiki so I'm not sure how precise it is, my question is:

(d, e and n are the letters used in the wiki to represent numbers, so I'm also going to use them here.)

Is it possible to find d from the e and mod n that are in the public key? I was thinking this because in RSA the public and private keys both have a part of mod n, with the public key also having e for encrypting and the private key also having d for decrypting.

Although my instinct says no, because if so e and mod n wouldn't be given publicly.
Of course, this is assuming the public key is unencrypted (maybe while being read?), that e and mod n are in a readable format AND that they are distinguishable as e or mod n.
Since I'm not sure they would put it directly in the "e mod n" format...

I do apologise if this is confusing and frustrating to those who actually understand it, since it's probably riddled with holes in logic/equation misunderstandings, or whatever.
I'm rather tired now since I've been reading for like a couple hours, so it's understandable if everything I wrote is gibberish.

Man, I don't even want to post this since it seems like I made a stupid, but I spent too long on it.
LOL, fail.

I posted earlier that yes, it is possible to extract the private key from the public key. However, doing so requires integer factorization of a semi-prime number. This number is so huge - for a 512-bit RSA key, the number could be up to 1.34*10^154 - that it is technically unfeasible. Modern CPUs can't do this without a lot of time (decades or more).

The SD slot isn't disabled right when you boot a game, either. Some game (I think Tales of the Abyss) reads the SD card because you could customize a character which was then saved as a PNG.

Ah, okay then. I was thinking about the DSi. However, a game exploit, while more useful, can still be worked around (the only reason why the iEvo still works in DSi Mode is because the exploit is in the save data on the cartridge and not the SD card). This is similar to how Nintendo patched the Twilight Hack back in the day.

Here's a thought: The 3DS system itself decrypts the things while reading them, right? So if we were to use a microSD+adapter, we could take out the microSD while it's decrypted..?

Theoretically you could, but you'd need the correct game, and Chuck Norris's reflexes to do it.

No you couldn't. Decrypted files will never be on SD.

Not to mention you could quite possibly corrupt your SD card. Everything will be in memory. If you would like to monitor the memory data bus, it's quite possible that you could find what you're looking for. However, you'd only get the public key by doing so. It's helpful by allowing us to analyze encrypted code, but not to the point of guaranteeing us permanent hacks.

The problem with the copy is that it's not encrypted. The system wouldn't accept anything that isn't signed/encrypted by Nintendo. Also, that's if you can make an unencrypted copy. That doesn't happen normally. A system pausing is actually taking the time to encrypt it in memory before it writes it to a file. That's how encryption works. Saving it to a file before encrypting it would be slower, because it would still write to the file, then read the file, encrypt the data, then rewrite the file with the encrypted data. So it's highly doubtful you could copy it.

There's signed PSP games aren't there? Could they do the same thing with 3DS games and/or saves? Or maybe even somehow have a loader for a modified firmware on a flashcart which skips the encryption? (idk i'm a hacking noob sorry if i sound stupid lol )

Can't we use internet settings to make the 3DS download a system update from somewhere else?
Theoretically you could make it download an app like Nintendo did with N-Zone.

Or that

We don't have the keys to sign games and such. The loader method will not work either; we're looking to exploit 3DS Mode, and this means that the 3DS WILL perform signature checks on the flashcart itself. The flashcart will fail to load unless it passes the checks (which it won't, or we'd have 3DS Mode already).

And I mentioned earlier that the Internet settings idea wouldn't work. Same issue with signature checking and encryption. All you'd be changing is where the 3DS would get the data from (which would help AFTER we can get it to accept whatever we send it).

 

[Axl.]

We have 3ds game dumps.

That means we have access to the updates inside some games.

We can look into that but it wont be easy.

 

[SifJar]

We have 3ds game dumps.

That means we have access to the updates inside some games.

We can look into that but it wont be easy.

No "we" don't. The ROMs are encrypted. You'll get nothing useful out of them.

 

[Vierv]

I posted earlier that yes, it is possible to extract the private key from the public key. However, doing so requires integer factorization of a semi-prime number. This number is so huge - for a 512-bit RSA key, the number could be up to 1.34*10^154 - that it is technically unfeasible. Modern CPUs can't do this without a lot of time (decades or more).

I see. Unless there is some sort of short cut to rule out a large swath of those numbers from being the number, it's not a good technique to use.
So I guess we'll have to wait until EA releases some shop stuff. If there's gonna be a temporary software exploit...

Edit: Just something I was wondering, every 3DS has it's own unique decryption number, correct? If so, then even if the number for one 3DS was somehow found, it wouldn't be very helpful for everyone else. Although I'm sure there must be some part of that which would be the same on all 3DS' so that it would be recognised as a 3DS even if it had it's own key... I think.

 

[wchill]

I posted earlier that yes, it is possible to extract the private key from the public key. However, doing so requires integer factorization of a semi-prime number. This number is so huge - for a 512-bit RSA key, the number could be up to 1.34*10^154 - that it is technically unfeasible. Modern CPUs can't do this without a lot of time (decades or more).

I see. Unless there is some sort of short cut to rule out a large swath of those numbers from being the number, it's not a good technique to use.
So I guess we'll have to wait until EA releases some shop stuff. If there's gonna be a temporary software exploit...

Edit: Just something I was wondering, every 3DS has it's own unique decryption number, correct? If so, then even if the number for one 3DS was somehow found, it wouldn't be very helpful for everyone else. Although I'm sure there must be some part of that which would be the same on all 3DS' so that it would be recognised as a 3DS even if it had it's own key... I think.

There is no shortcut, sadly. The only way to crack the key is to get lucky. Some researchers cracked a 768-bit key, but it took them 2 years and tons of computational power (far more than what we have).

Also (not sure about unique decryption keys) if we can decrypt an update or game ROM on one 3DS, that'll at least allow us to look for exploits and such.