Hacking [WIP] KARL3DS - Kernel access on N3DS via Ninjhax + Loadcode

[plasma]

he did say .....could be more hardware based

but still, i dont think any super easy exploits will be found released for a good while at this point

I can only see any more exploits to be found on future firmwares. It's Nintendo, they'll fuck up again somewhere,

 

[motezazer]

Well actually I was referring to all the crazy hardware exploits which popped up on 3dbrew as of late (I believe they were found by plutoo). You can get extremely early ARM9 access but the methods are a bit... insane to say the least.

And are console-unique !

 

[VinsCool]

Well actually I was referring to all the crazy hardware exploits which popped up on 3dbrew as of late (I believe they were found by plutoo). You can get extremely early ARM9 access but the methods are a bit... insane to say the least.

What are the hardware based exploits, if I can ask?

 

[daxtsu]

What are the hardware based exploits, if I can ask?

Apparently, this, if I understand correctly:

Starting with 9.6.0-X a new set of NAND-based keys were introduced. However, they forgot to add a verification block to verify that the new key read from NAND is correct. This was an issue from the very beginning with the original sector+0 keydata, however the below is only possible with the sector+0x10 keydata.
Thus, by writing an incorrect key to NAND you can make arm9loader decrypt ARM9 kernel as garbage and then jump to it.
This allows an hardware-based NAND-attack where you can boot into an older exploited firmware, fill all memory with NOP sleds/jump-instructions, and then reboot into executing garbage. By automating this process eventually you'll find some garbage that jumps to your code.
This should give you very early ARM9 code execution (pre-ARM9 kernel). For example, you can dump RSA keyslots with this and calculate the 6.x save, and 7.x NCCH keys.

http://3dbrew.org/wiki/3DS_System_Flaws#arm9loader

 

[VinsCool]

Apparently, this, if I understand correctly:



http://3dbrew.org/wiki/3DS_System_Flaws#arm9loader

Interesting... If I understand well, it may be, in theory, possible to have an arm9 control as soon the console boots, by a key creating 'garbage' decrypted data, which is read as correct data? So that could potentially be 'permanent' through an hardmod based nand write, similar to downgrade?

 

[michyprima]

Interesting... If I understand well, it may be, in theory, possible to have an arm9 control as soon the console boots, by a key creating 'garbage' decrypted data, which is read as correct data? So that could potentially be 'permanent' through an hardmod based nand write, similar to downgrade?

yes but generating a key that could do that would require an huge amount of tries, and as such an huge amount of time. and it would be console-specific.
the chance of finding the "right" key are like the one you have winning the lottery
you would probably fry your 3ds' cpu before finding it lol

 

[VinsCool]

yes but generating a key that could do that would require an huge amount of tries, and as such an huge amount of time. and it would be console-specific.
the chance of finding the "right" key are like the one you have winning the lottery
you would probably fry your 3ds' cpu before finding it lol

Yeah that's what rop is, tries and tries and maybe a success.
But that could possible. Basically, someone hardmods his nand, write a corrupted ket, flash the nand with modified keyslot. Enventually succeed, am I right?

 

[Oishikatta]

yes but generating a key that could do that would require an huge amount of tries, and as such an huge amount of time. and it would be console-specific.
the chance of finding the "right" key are like the one you have winning the lottery
you would probably fry your 3ds' cpu before finding it lol

I don't think it's quite that bad. With the nop sleds, all you need is garbage that jumps just about anywhere, isn't it?

Yeah that's what rop is, tries and tries and maybe a success.
But that could possible. Basically, someone hardmods his nand, write a corrupted ket, flash the nand with modified keyslot. Enventually succeed, am I right?

It seems more like you would need some sort of hardware setup to redirect the nand reads to an external device. Would take ages to rewrite an exploitable firm and setup the ram each time.

 

[motezazer]

Yeah that's what rop is, tries and tries and maybe a success.
But that could possible. Basically, someone hardmods his nand, write a corrupted ket, flash the nand with modified keyslot. Enventually succeed, am I right?

No. For each try, you must boot into 9.5 or less, fill all memory you can (via ninjhax and gspwn) with jumps to a piece of code which either payload or payload loader (which of course must also be loaded in memory), update to 9.6, pray, and, if it doesn't work, downgrade to 9.5 (via a NAND backup) and retry.

 

[VinsCool]

No. For each try, you must boot into 9.5 or less, fill all memory you can (via ninjhax and gspwn) with jumps to a piece of code which either payload or payload loader (which of course must also be loaded in memory), update to 9.6, pray, and, if it doesn't work, downgrade to 9.5 (via a NAND backup) and retry.

Oh so this is going to take much longer time to do
Complicated method indeed.

 

[shinyquagsire23]

Oh so this is going to take much longer time to do
Complicated method indeed.

Complicated and literally only useful for dumping a select number of keys.

 

[codychaosx]

believe me when I tell you that asking for etas is way more annoying than asking for favorite games.

May be so but at least it's not off topic

 

[VinsCool]

Please wait for more time

 

[Flayim]

Sorry but, what are the differences from this and NTR-CFW? Is it just an emunand? Or region-free, cause NTR already has that covered.

 

[:-infern:]

Sorry but, what are the differences from this and NTR-CFW? Is it just an emunand? Or region-free, cause NTR already has that covered.

Hmmmm

 

[Flayim]

Hmmmm

?

 

[plasma]

Sorry but, what are the differences from this and NTR-CFW? Is it just an emunand? Or region-free, cause NTR already has that covered.

Well NTR only works on N3DS, this will work on O3DS and N3DS. KARL offers more features iirc.

 

[motezazer]

What I dont understand is this emunand crap, Karl exploit having the freeboot option then whats the point of a emunand?

I think someone told me already but still whats does this emunand do and why its so requested???

Freeboot... That's an Xbox thing.
You cannot install an exploit permanently on a 3DS. emuNAND is a NAND installed on a SD card that you can update without updating sysNAND (and so without removing the flaw, needed each time you run the exploit)

 

[Nollog]

Freeboot... That's an Xbox thing.
You cannot install an exploit permanently on a 3DS. emuNAND is a NAND installed on a SD card that you can update without updating sysNAND (and so without removing the flaw, needed each time you run the exploit)

could you patch out signature checks, install mset 4.5 with version set to 9001 then update sysnand?

 

[Oishikatta]

could you patch out signature checks, install mset 4.5 with version set to 9001 then update sysnand?

Can't edit system titles on sysnand, can't maintain patches over a reboot.

MSET only gives ROP anyways.