Hacking 3DS HTTP/S with Fiddler or similar?

[pcmantinker]

Has anyone managed to install Fiddler's root certificate on the 3DS to decrypt SSL traffic? I managed to reverse engineer the HTTP/S traffic of some mobile apps using this technique. I would prefer doing it on Gateway emuNAND, but if someone has done it on their CFW, I would be interested in their findings. I want to understand the HTTP/S traffic sent to/from the 3DS so I can analyze applications such as Friends and potentially the eShop. It would be cool to provide some sort of public API for querying friends' online statuses or searching the eShop for instance.

 

[pcmantinker]

Am I on the right track if I can successfully decrypt/unpack certs.db? I don't know much about 3DS NAND, but I saw on http://3dbrew.org/wiki/Title_Database that certs.db refers to certificates for verifying TMD and other certificates. It's possible that SSL certificates live here too, but I'm not sure. Can anyone shed some light on this?

 

[cearp]

Am I on the right track if I can successfully decrypt/unpack certs.db? I don't know much about 3DS NAND, but I saw on http://3dbrew.org/wiki/Title_Database that certs.db refers to certificates for verifying TMD and other certificates. It's possible that SSL certificates live here too, but I'm not sure. Can anyone shed some light on this?

sure, but surely that too is signed, right? i don't think it would be so simple - but yeah try.

 

[pcmantinker]

After some time, I'm afraid that I don't quite have knowledge currently to decrypt, encrypt and sign certificates as needed. It would be really great to view HTTP traffic though as we could confirm what gets sent from any application or game on the 3DS. It could solve the mystery of whether 3DZ game headers are sent with HTTP requests to Nintendo's servers. I can see this being beneficial for other uses too. Eventually, we could reverse engineer enough HTTP traffic to create custom game servers. Of course, each game probably has its own protocol, but getting the HTTP messages would be a good start.

 

[Oishikatta]

cearp do you have any hints for getting 3DS stuff loaded into IDA?

 

[shinyquagsire23]

cearp do you have any hints for getting 3DS stuff loaded into IDA?

code.bin is loaded into 0x100000 by default I believe. Not sure about anything else though.

 

[cearp]

cearp do you have any hints for getting 3DS stuff loaded into IDA?

ha i am the last person to ask!