Hacking [WIP] KARL3DS - Kernel access on N3DS via Ninjhax + Loadcode

[sonic2756]

Trying to run anything from the arm9 branch on my N3DS just boots to a black screen (bit of pixels in the bottom left hand corner though)

 

[WulfyStylez]

This is what it looks like on my end. (3dsXL 4.5.0-9U)

lolwut? You seem to have an incredibly outdated version of our tools? From the looks of it, that's one of our builds from before we actually implemented half the features (including actually launching FIRM). You're also running an extreme risk of bricking your system and perma-locking your SD card too, since our SDMMC code had some severe bugs until recently.

Where the heck did you get that from?!

 

[zoogie]

lolwut? You seem to have an incredibly outdated version of our tools? From the looks of it, that's one of our builds from before we actually implemented half the features (including actually launching FIRM). You're also running an extreme risk of bricking your system and perma-locking your SD card too, since our SDMMC code had some severe bugs until recently.

Where the heck did you get that from?!

The arm9 branch shinyquagsire posted earlier this night? data/payload.bin appears to be your early cfw lol (i guess it was a mistake)

 

[filfat]

This is what I get (after enabling dbg ofc)

 

[WulfyStylez]

The arm9 branch shinyquagsire posted earlier this night? payload.bin appears to be your early cfw lol (i guess it was a mistake)

Weird, the only thing on the commit history for payload.bin is shiny's demo.
Ah well, either way have fun with your extremely high-stakes NAND dumper with bonus broken padgen. At that point, we were just getting to grips with firmlaunch-hax and even drawing text (and initializing SD) was a pretty big deal. We hadn't even begun porting firmloader over from 4.5 yet.

 

[Zidapi]

Okay, maybe I got off on the wrong foot. How about this instead, they released (at that point) 6 alphas - now 9. Each time with a reasonable amount of progress. The quote that everyone keeps grabbing and using against me, was to illustrate the fact that progress IS being made, and the project isn't in fact dead weight.

Sorry that reply was a bit of an incomplete train of thought.

This better addresses the subject of progress.

Ultimately the progress made between builds is what should be measured not the amount of builds itself.

Sorry we've been so quiet recently, we've all been up to a lot of different stuff.
Anyways, new feature! AM has been patched to allow downgrading of system modules and such. This has a lot of capability, but the most interesting parts are that it'll allow users to re-enable ninjhax on 9.5+, and also re-enabling browser-hax on 9.5.0-23. I'll test in a bit to see if these work on sysnand as well. If they do work on sysnand (they should, these tickets and tmds are still signed), you'll be able to re-enable ninjhax and browser hax on 9.5 as well, until you update at least.

Wow! This is huge.

Congratulations, this is a milestone worth celebrating!

 

[zoogie]

Weird, the only thing on the commit history for payload.bin is shiny's demo.
Ah well, either way have fun with your extremely high-stakes NAND dumper with bonus broken padgen. At that point, we were just getting to grips with firmlaunch-hax and even drawing text (and initializing SD) was a pretty big deal. We hadn't even begun porting firmloader over from 4.5 yet.

The timestamp on my download zip is 8:30pm (central time) and the internal file's timestamp's are 8:26. so I assume I got a copy of the branch before shiny realized his mistake and deleted it (i presume). Either way, thanks for the heads up on the dangers. I dumped my nand with it and noticed it really slowing down after 3AF00000 so I just killed it manually. Guess I was lucky to not get a brick

 

[WulfyStylez]

The timestamp on my download zip is 8:30pm (central time) and the internal file's timestamp's are 8:26. so I assume I got a copy of the branch before shiny realized his mistake and deleted it (i presume). Either way, thanks for the heads up on the dangers. I dumped my nand with it and noticed it really slowing down after 3AF00000 so I just killed it manually. Guess I was lucky to not get a brick

That's probably just shiny copying files around, but yeah. Those pre-2.2 builds were nightmares. Protip: Don't copy your SDMMC code from Gateway 2.0 just because it's the only thing you have on hand at the moment. Ours is based on how NATIVE_FIRM does it in current builds, and thus when we release we'll have a zero-percent chance of bricking. I swear to god I bricked my system like 5 times before we killed that bug, though.

 

[sanni]

I don't understand how payload.bin works. It's a super super tiny file and yet it makes white stripes on both screens, what is this sorcery
What if I want blue stripes? Can the payload also be C code?

Also when I compile with #define DEBUG_PROCESS it says:

bootstrap.o:c:/devkitPro/libctru/bootstrap/bootstrap.c:198: more undefined references to `dbg_log' follow
collect2.exe: error: ld returned 1 exit status
make[1]: *** [/c/devkitPro/libctru/bootstrap/bootstrap.elf] Error 1
make: *** [build] Error 2

 

[WulfyStylez]

I don't understand how payload.bin works. It's a super super tiny file and yet it makes white stripes on both screens, what is this sorcery
What if I want blue stripes? Can the payload also be C code?

payload.bin is the ARM9 binary that bootstrap will run. In this case, we wrote an example that messes with the framebuffer just to show that it works. Developers will write their own payloads to run whatever they want to, pretty much.

 

[Idaho]

Sorry we've been so quiet recently, we've all been up to a lot of different stuff.
Anyways, new feature! AM has been patched to allow downgrading of system modules and such. This has a lot of capability, but the most interesting parts are that it'll allow users to re-enable ninjhax on 9.5+, and also re-enabling browser-hax on 9.5.0-23. I'll test in a bit to see if these work on sysnand as well. If they do work on sysnand (they should, these tickets and tmds are still signed), you'll be able to re-enable ninjhax and browser hax on 9.5 as well, until you update at least.

So we can hack any 3DS by now? We'd only need CN or OoT to downgrade a module once and then install a permanent hack that doesn't require owning a game?

 

[WulfyStylez]

So we can hack any 3DS by now? We'd only need CN or OoT to downgrade a module once and then install a permanent hack that doesn't require owning a game?

No, you still need to start out on 9.2 to do anything.

 

[zoogie]

payload.bin is the ARM9 binary that bootstrap will run. In this case, we wrote an example that messes with the framebuffer just to show that it works. Developers will write their own payloads to run whatever they want to, pretty much.

What RAM address is the payload loaded at?

 

[Idaho]

No, you still need to start out on 9.2 to do anything.

Uh well I guess I didn't understand what you said then...

 

[WulfyStylez]

Uh well I guess I didn't understand what you said then...

You can get ninjhax and browserhax working on 9.5.0-23 emunand, and selectively update your system to get them working on 9.5 sysnand, as well.

 

[Idaho]

You can get ninjhax and browserhax working on 9.5.0-23 emunand, and selectively update your system to get them working on 9.5 sysnand, as well.

I see, could this allow browserhax on 9.2 n3DS ?

 

[WulfyStylez]

I see, could this allow browserhax on 9.2 n3DS ?

Nope. Not without a SKATER exploit.

 

[Idaho]

Nope. Not without a SKATER exploit.

Even if we've already reached Kernel access from somewhere else? If not for browserhax, could it be used to enable DS profile exploit on a 9.2 n3DS?

(Just trying to know if it can be used to enable some hax that wouldnt need a game)

 

[WulfyStylez]

Even if we've already reached Kernel access from somewhere else? If not for browserhax, could it be used to enable DS profile exploit on a 9.2 n3DS?

(Just trying to know if it can be used to enable some hax that wouldnt need a game)

As I mentioned a little while back, it may be possible to re-enable MSET hax on New 3DS, yes. We'll look into it once we're feature-complete and porting to other entrypoints, probably.

 

[Idaho]

I see thanks for the infos, keep up the good work dudes, I'm 100% hyped for a CFW made by some people of the community on my 3DS & n3DS, I'm a bit bored of GW lately...