Hacking 3DBrew / ctrtool / 3DSExplorer discussion

[3DSGuy]

Just hours ago, neimod updated his github once again;

ramtracer 5 hours ago Merge branch 'master' of github.com:/neimod/ctr [neimod]

Could 3DSguy or someone shed some light on the significance of this, if any ?

https://github.com/neimod/ctr

also in that "ramtracer" folder, there was:
host 5 hours ago Added support for live debugging. [neimod]

He's just updating his RAM tracer code, so he can debug while it is connected to the 3DS RAM at the same the 3DS is on. That's just an educated guess though.

EDIT: from IRC

with debugging, you can just run it and inspect the values -- it's much faster

 

[yuyuyup]

19 hours ago, ctrclient 19 hours ago Added CCM support with associated data to client api.
https://github.com/neimod/ctr/tree/master/ramtracer

 

[RodrigoDavy]

19 hours ago, ctrclient 19 hours ago Added CCM support with associated data to client api.
https://github.com/n...aster/ramtracer

A quick look at wikipedia and I found this: http://en.wikipedia.org/wiki/CCM_mode
Not sure you're gonna find huge news by visiting neimod github frequently, any important news will be announced on gbatemp.

 

[SifJar]

19 hours ago, ctrclient 19 hours ago Added CCM support with associated data to client api.
https://github.com/n...aster/ramtracer

Do you really feel the need to post every single time neimod updats the github? I don't think it's really necessary...

 

[MoshMarioMaldona]

Just hours ago, neimod updated his github once again;

ramtracer 5 hours ago Merge branch 'master' of github.com:/neimod/ctr [neimod]

Could 3DSguy or someone shed some light on the significance of this, if any ?

https://github.com/neimod/ctr

also in that "ramtracer" folder, there was:
host 5 hours ago Added support for live debugging. [neimod]

He's just updating his RAM tracer code, so he can debug while it is connected to the 3DS RAM at the same the 3DS is on. That's just an educated guess though.

EDIT: from IRC

with debugging, you can just run it and inspect the values -- it's much faster

that mean exactly?

 

[3DSGuy]

19 hours ago, ctrclient 19 hours ago Added CCM support with associated data to client api.
https://github.com/n...aster/ramtracer

Again this is not about 3DBrew/ctrtool/3DSExplorer. And the change "does exactly what it says on the tin" so to speak. CCM is a mode of AES encryption, so it adds support encryption support to the client api. It isn't a very major update, it doesn't reveal anything special.

And like SifJar said, is it really necessary to post every change neimod makes to his githubs which aren't covered by this thread?

---

 

[justinkb]

Changing values on the go, while the 3DS RAM is being used by the 3DS.

I may be wrong, but looking at the code, I think the only thing he added was breakpoints and inspecting values, not actually altering them. (I think his gizmo only reads the memory chip.)

If he could alter them, he could already run homebrew of course. Just replace a bunch of memory with program data (opcodes etc.) and replace the instruction pointer to point to wherever he put that stuff.

i'm hopeful by the way that homebrew is not far away, given that he can read the ram(!) (massive kudos on this btw). my next step would be checking out pieces of code that handle user supplied data, stepping through them with the debugger to see where there may be vulnerabilities. i guess the 3ds browser would be a really obvious target. browsers on any platform are notoriously exploitable. i think the browser even uses webkit, which may even have some exploits discovered already. all that would be left is a proper payload.

has neimod released the specs of his custom hardware? schematic or so? i'm sure more people would be interested in doing some pcb fab and soldering (and screwing with their 3ds) to help his efforts.

 

[3DSGuy]

Changing values on the go, while the 3DS RAM is being used by the 3DS.

I may be wrong, but looking at the code, I think the only thing he added was breakpoints and inspecting values, not actually altering them. (I think his gizmo only reads the memory chip.)

If he could alter them, he could already run homebrew of course. Just replace a bunch of memory with program data (opcodes etc.) and replace the instruction pointer to point to wherever he put that stuff.

i'm hopeful by the way that homebrew is not far away, given that he can read the ram(!) (massive kudos on this btw). my next step would be checking out pieces of code that handle user supplied data, stepping through them with the debugger to see where there may be vulnerabilities. i guess the 3ds browser would be a really obvious target. browsers on any platform are notoriously exploitable. i think the browser even uses webkit, which may even have some exploits discovered already. all that would be left is a proper payload.

has neimod released the specs of his custom hardware? schematic or so? i'm sure more people would be interested in doing some pcb fab and soldering (and screwing with their 3ds) to help his efforts. Not that I know of :/

did you dump it or are you debuggin on device?
Dovoto, realtime=on device
realtime != on device (although it heavily implies it
on device
as in a real live runnning 3ds
interesting, are you glitching are do you actually have code injection?
code injection
* Dovoto has quit (Read error: Operation timed out)
* Dovoto_2 is completely out of the loop...for all i know there is a pirate cart for 3ds already
there is not
thats pretty awesome
it sure is
static analysis can only get you so far
even with an enormous amount of time, it's still alot of work just to figure out what exactly the parameters are to called functions
with debugging, you can just run it and inspect the values -- it's much faster

 

[MoshMarioMaldona]

what this or that means?
https://github.com/3dshax/3ds/blob/master/3dsfuse/Makefile

 

[Hunter X]

what this or that means?
https://github.com/3...dsfuse/Makefile

It's a makefile, that's what it means.

 

[Janthran]

what this or that means?
https://github.com/3...dsfuse/Makefile

Well if you overload it you blow a fuse.
Just kidding, I have no idea.

 

[SifJar]

what this or that means?
https://github.com/3...dsfuse/Makefile

A fairly standard makefile. It gives a list of instructions to the "make" binary for how to compile a program. If you don't understand what it is, you don't need to worry about it. It means nothing of interest for you.

 

[Hunter X]

what this or that means?
https://github.com/3...dsfuse/Makefile

A fairly standard makefile. It gives a list of instructions to the "make" binary for how to compile a program. If you don't understand what it is, you don't need to worry about it. It means nothing of interest for you.

Shh. You're going to tip him off that it's a set of instructions to how to take over the world.

 

[DeShelly]

Good luck Neimod...