Hacking 3DS Hacking Ideas: Post Your Ideas Here!

[LinkBlaBla]

Since we can compose messages on the 3DS a presumed key needs to be in there.
Which means that it probably can be dug out.

That what i want the people to find because im to noob in language programming Their is surely a solution to find the key within the message send on swapnote , Take example if i dont got a key to open the door of my house i got 3 solution, first is to call an locker expert, second is to pick-lock the door ,third is to hack through the door, it is exactly the same way as for finding a hack/exploit on the 3ds we got alot of solution we need just to try all of those.

 

[Rydian]

Well, most console/handhelds hacks don't actually involve finding the encryption key...

 

[LinkBlaBla]

Well, most console/handhelds hacks don't actually involve finding the encryption key...

Yea i know but in the case of swapnote message the only way is the encryption key inside each message to make them work with the exploit/hack. I think

 

[Rinnux]

Yea i know but in the case of swapnote message the only way is the encryption key inside each message to make them work with the exploit/hack. I think

Someone please correct me if I'm wrong. But I don't believe the swapnote messages contain the encryption key.

 

[GoldenSun3DS]

The swapnote 'notes' you create on your 3DS would HAVE to be signed, otherwise you could easily edit them on a computer to run unsigned code or a crash through it.

 

[Rydian]

The swapnote 'notes' you create on your 3DS would HAVE to be signed, otherwise you could easily edit them on a computer to run unsigned code or a crash through it.

Check the first post, you can't just inject a blob of code through a crash anymore.

 

[Boy12]

Is this thread cleaned up or something?
I remember it being 80 pages long or so...

 

[Rydian]

Is this thread cleaned up or something?
I remember it being 80 pages long or so...

New thread for cleanup, yar.

 

[Boy12]

Alright

 

[GoldenSun3DS]

Check the first post, you can't just inject a blob of code through a crash anymore.

That's not entirely correct.

http://www.3dbrew.org/wiki/3DS_exploits

The 3DS uses the XN feature of the ARM processor, and only apps that have the necessary permissions in their headers can set memory to be executable. This means that although a usable buffer overflow exploit would still be useful, it would not go the entire way towards allowing code to be run in an easy/practical fashion (ie an actual homebrew launcher) - for that, an exploit in the system is required. A buffer overflow exploit does, however, provide enough wriggle room through the use of return-oriented programming to potentially trigger a system exploit.

A buffer overflow exploit does, however, provide enough wriggle room through the use of return-oriented programming to potentially trigger a system exploit.

 

[Rydian]

That's not entirely correct.

http://www.3dbrew.org/wiki/3DS_exploits

And ROP is not a single blob of code like the old days. They already have had some ROP stuff running on the 3DS for a while, but when the hole they use to get in closes, they can't do anything since they still haven't shown any progress in editing the system.

 

[Rinnux]

The swapnote 'notes' you create on your 3DS would HAVE to be signed, otherwise you could easily edit them on a computer to run unsigned code or a crash through it.

I know they would have to be signed. but it's not like if you opened the file there would be a text document labelled "3ds decryption key". Besides, the 3ds receiving the swapnote has a decryption key. Unless each system has a unique decryption key, there would be no reason for the swapnote to contain the key.

 

[Wolvenreign]

Just had myself a crazy idea. Would it be possible to pack a rom played on the Gateway 3DS with a fake update that installs custom firmware?

 

[GoldenSun3DS]

Just had myself a crazy idea. Would it be possible to pack a rom played on the Gateway 3DS with a fake update that installs custom firmware?

That firmware would still have to be signed before it'll run.

 

[Wolvenreign]

That firmware would still have to be signed before it'll run.

Ah. What a shame.

 

[jhemps]

If someone were to try to brute force the key, how could it be tested? In other words, it would be silly to sign a file, copy to the 3ds, and try to run it. How could each generated key be tested from a PC?

 

[Rydian]

If someone were to try to brute force the key, how could it be tested? In other words, it would be silly to sign a file, copy to the 3ds, and try to run it. How could each generated key be tested from a PC?

You would have to try it on the 3DS. In order to test it on the PC you'd need the common key and that hasn't been extracted (they didn't get the DSi common key for like 2-3 years IIRC).

 

[Thorhian]

You would have to try it on the 3DS. In order to test it on the PC you'd need the common key and that hasn't been extracted (they didn't get the DSi common key for like 2-3 years IIRC).

And unless we had the entire databases inside of Utah that are being ran under the NSA (and if they had Computing tech far beyond than we know), your probably never going to brute force that key until Graphene computing comes around...

 

[Katsumi San]

Hmm I I think I understand main post(only little). The "trick" is to slip custom code while it does "signature check"? Or perhaps guess the correct key?

 

[Gabelvampir]

Hmm I I think I understand main post(only little). The "trick" is to slip custom code while it does "signature check"? Or perhaps guess the correct key?

Yes that's right. To get custom code to run the signature check needs to get bypassed or disabled or somehow fooled.
But forget guessing or brute-forcing the key, that would take longer then we all will live.