Hacking [WIP] open source Kernel access on 3DS

[vingt-2]

I'm also working on this on my free time (that I don't have that much right now ).

 

[weatMod]

Really? You ARE aware that open source means anyone can contribute to the code/improve upon it. Just because people are being paid for a task doesn't mean they have the same level of skill as someone who isn't, either. Personally I've got a little bit of a sore spot when it comes to companies whose sole purpose is profiteering off of piracy as well (pirate all you want, IMO, but don't try and profit from it).

"Really? You ARE aware that open source means anyone can contribute to the code/improve upon it."

yes i just said that

"Just because people are being paid for a task doesn't mean they have the same level of skill as someone who isn't"

yes i understand that but it just seems that the way these scenes are going lately that that is infact the case sadly
sadly seems like all the people talented enough to do it dont't want to do it for free anymore

seems like scenes of the past like wii scene for example will never come again and i think it's sad, but i think its also reality now ...sadly

 

[aliak11]

Is it possible to have the source of the gateway launcher.dat decryptor?

I know that the information to decrypt it are all out there, but having it ready will help me to speed up some experiment.

#define _CRT_SECURE_NO_WARNINGS true
 
#include <stdio.h>
#include <stdlib.h>
 
void main() {
    FILE *IFile = fopen("Launcher.dat", "rb+");
    int *buffer = (int*) malloc(0x46699F);
    fseek(IFile, 0x00012000, SEEK_SET);
    fread(buffer, 1, 0x46699F, IFile);
    fclose(IFile);
    int state = 0;
    auto i;
    for (i = 0; i < 0x46699F / 4; i++) {
        state += 0xD5828281;
        buffer[i] += state;
    }
    IFile = fopen("launcher_dec.dat", "wb+");
    fwrite(buffer, 0x1, 0x46699F, IFile);
    fclose(IFile);
}

 

[kheldar]

is this only for 3ds or does it include n3ds as well?

 

[NyaakoXD]

is this only for 3ds or does it include n3ds as well?

Both

 

[zoogie]

#define _CRT_SECURE_NO_WARNINGS true
 
#include <stdio.h>
#include <stdlib.h>
 
void main() {
    FILE *IFile = fopen("Launcher.dat", "rb+");
    int *buffer = (int*) malloc(0x46699F);
    fseek(IFile, 0x00012000, SEEK_SET);
    fread(buffer, 1, 0x46699F, IFile);
    fclose(IFile);
    int state = 0;
    auto i;
    for (i = 0; i < 0x46699F / 4; i++) {
        state += 0xD5828281;
        buffer[i] += state;
    }
    IFile = fopen("launcher_dec.dat", "wb+");
    fwrite(buffer, 0x1, 0x46699F, IFile);
    fclose(IFile);
}

Uh, I think that's wrong past 0x4000. The add counter resets every 0x4000 bytes.

Here is a slight enhancement of ernie's program that decrypts each firmware region properly and to separate files.

#define _CRT_SECURE_NO_WARNINGS true
 
#include <stdio.h>
#include <stdlib.h>
int decrypt(char * filename,int offset);
 
void main(int argc, char *argv[])
{
    int location=0xA000;
    int numberLocations=5;
    int i=0;
 
    printf("\nGW30Decryptor by Ernilos\n\n");
 
    if(!argv[1])
    {
        printf("\nUsage: GW30Decryptor gateway3.0file\nOr drag-n-drop file on this exe\n",argv[0]);
        getchar();
        return;
    }
 
    for(i; i< numberLocations; i++)
    {
        if( decrypt(argv[1],location) ) return;
        location+=0x4000;
    }
    getchar();
}
 
int decrypt(char * filename,int offset)
{
    FILE *IFile = fopen(filename, "rb+");
    if(!IFile)
    {
        printf("Error reading file.\n");
        getchar();
        return 1;
    }
    int *buffer = (int*)malloc(0x4000);
    char output[80];
    fseek(IFile, offset, SEEK_SET);
    fread(buffer, 1, 0x4000, IFile);
    fclose(IFile);
    int state = 0,i;
    for (i = 0; i < 0x4000 / 4; i++)
    {
        state += 0xD5828281;
        buffer[i] += state;
    }
    sprintf(output,"offset_0x%5.5X.bin",offset);
    printf(output);
    printf("\tdumped\n");
    IFile = fopen(output, "wb+");
    fwrite(buffer, 0x1, 0x4000, IFile);
    fclose(IFile);
}

 

[raulpica]

Okay guys, since the KARL3DS thread is a crap-post magnet, I don't want this thread to go the same way, as such:

1) No naming debates. The developers have already decided a name. IF they want to change it AND want your suggestions, wait until they say so.
2) Keep the KARL3DS vs OSKA dialog constructive. Any fanboyism will lead to removed posts AND will possibly also lead to warns.
3) NO ANTI/PRO PIRACY DISCUSSION. Zero, nilch, NADA. It's not the right place to discuss that and overall, I think it's not sane to discuss it at all.

Keep it classy, GBAtemp.

Thanks,
rp

 

[Polarialis]

Okay guys, since the KARL3DS thread is a crap-post magnet, I don't want this thread to go the same way, as such:

1) No naming debates. The developers have already decided a name. IF they want to change it AND want your suggestions, wait until they say so.
2) Keep the KARL3DS vs OSKA dialog constructive. Any fanboyism will lead to removed posts AND will possibly also lead to warns.
3) NO ANTI/PRO PIRACY DISCUSSION. Zero, nilch, NADA. It's not the right place to discuss that and overall, I think it's not sane to discuss it at all.

Keep it classy, GBAtemp.

Thanks,
rp

But there are no developers per se, just an anonymous collective of contributors. Anybody who suggests a name change could very well be a 'dev'. I agree with the other two points, but this is open source, we're all the developers here - all suggestions matter. :/

 

[fuyukaidesu]

Eh.

Why not look for a new entry point instead of rewriting something that already exists.

 

[Hashtastrophe]

Eh. Why not look for a new entry point instead of rewriting something that already exists.

Because that's quite a bit more difficult than utilizing a publicly available point of access. I mean you see how long it took gateway to come up with that horrible save hack, right? You need a second (old) 3DS (or a save dongle), the N3DS, and OoT just to run the launcher to use your gateway.

Edit: fixed post. My statement still stands though, it's pretty bad that after all this time they release a save hax for a game that's been out of print for ages just to launch the menu to use their product.

 

[raulpica]

But there are no developers per se, just an anonymous collective of contributors. Anybody who suggests a name change could very well be a 'dev'. I agree with the other two points, but this is open source, we're all the developers here - all suggestions matter. :/

Not really anonymous, all the names are here: https://github.com/Aliak/OSKA/graphs/contributors

If one of them asks, then feel free to suggest new names, otherwise nope.

 

[fuyukaidesu]

You need a second (old) 3DS, the N3DS, OoT, and a save dongle just to run the launcher to use your gateway.

You need an O3DS OR a save dongle.

Obviously it's more difficult because you don't have anyone to copy anything from. But, it'll greatly benefit the scene vs releasing a 4th emunand attempt.

Not really anonymous, all the names are here: https://github.com/Aliak/OSKA/graphs/contributors

This is a fork of KARL3DS's bootstrap, so it has the names of the contributors of KARL on it + Aliak.

 

[raulpica]

This is a fork of KARL3DS's bootstrap, so it has the names of the contributors of KARL on it + Aliak.

Err yeah, you need to select only the latest timeframe with the mouse. It looks like the only contributor right now is Aliak.

 

[Polarialis]

Not really anonymous, all the names are here: https://github.com/Aliak/OSKA/graphs/contributors

If one of them asks, then feel free to suggest new names, otherwise nope.

Not gonna lie, having Shiny and Wulfy in on this really makes no sense. Surely it'd just be replicating their efforts from KARL3DS, and even going against their closed source 'ethos' of KARL3DS. It would make more sense to have a unified project rather than stretching themselves thin between duplicate projects. Weird shit, but okay. I'm bailing out.

Edit:

Err yeah, you need to select only the latest timeframe with the mouse. It looks like the only contributor right now is Aliak.

Oh, guess you were just confused. Nevermind.

Edit 2: I guess that means name suggestions are back in after all. Not that I particularly give a shit either way.

 

[raulpica]

Edit 2: I guess that means name suggestions are back in after all. Not that I particularly give a shit either way.

I haven't seen Aliak request for one, so no.

 

[w0dash]

This thread was fine, I don't know why there is already the need for moderation...

 

[Hashtastrophe]

There's always a need for moderation.

 

[Zidapi]

Why not look for a new entry point instead of rewriting something that already exists.

Because there are already four viable exploits available. When those exploits are patched or no longer viable, then you use a new one.

You don't understand how this works do you? Unnecessarily burning new exploits only cripples the scene and slows future progress.

 

[fuyukaidesu]

Because there are already four viable exploits available

Cubic Ninja and Zelda OOT, that makes 2 for the N3DS, and these are not what could be called viable.

And even if an entry point would work on 9.5, you'll still never be able to get ARM11 kernel access on this.

 

[Kioku]

Cubic Ninja and Zelda OOT, that makes 2 for the N3DS, and these are not what could be called viable.

And even if an entry point would work on 9.5, you'll still never be able to get ARM11 kernel access on this.

Pretty viable to me.. Gives you access to more useless crap.