Hacking Pastebin Posting/Discussion

[Psi-hate]

Eh, it's a bit more complicated than that. Nobody knows how the 7.x NCCH key was gotten, all that is known is that it was sitting in the Gateway FIRM code or whatever and it was taken from there. The main issue with the new N3DS keys (or I guess key, 0x1C-0x1F aren't used as of yet) is that they're based on a reseeded 0x11 key, which is based on a new area of OTP (a protected area with access removed after Kernel9 is loaded). Since we can't get at this new area of OTP, we can't get the 0x11 key, and thus we can't get at any of the other keys based on it (which includes the N3DS 9.6 FIRM encryption keys and the new NCCH key). The only real way to use the new NCCH key is through a new ARM9 exploit, which nobody has as of now.

On 3dbrew: "ARM9/ARM11 bootrom vectors point at unitialized RAM" claims there is a theory that will allow injecting custom code to dump the bootrom. With the ability to run code through this hardware exploit, will it be possible to dump the keys if this theory actually gets successfully proven? I remember Wulfy saying that if it works, that it won't be fixable without a new 3ds model without said exploit. Would that mean we'd always have the keys available?

 

[shinyquagsire23]

On 3dbrew: "ARM9/ARM11 bootrom vectors point at unitialized RAM" claims there is a theory that will allow injecting custom code to dump the bootrom. With the ability to run code through this hardware exploit, will it be possible to dump the keys if this theory actually gets successfully proven? I remember Wulfy saying that if it works, that it won't be fixable without a new 3ds model without said exploit. Would that mean we'd always have the keys available?

Well yeah, if you could pull that off you could get at literally every key since you'd know the ones set in bootrom (and have the entire OTP area, and other things). However like a lot of exploits on there, it's more of a theory and hasn't been tested (and for what it's worth, we haven't done it either, and others have tried). In theory, there's definitely a way. Actually executing it is near impossible though without extremely precise equipment.

 

[Psi-hate]

Well yeah, if you could pull that off you could get at literally every key since you'd know the ones set in bootrom (and have the entire OTP area, and other things). However like a lot of exploits on there, it's more of a theory and hasn't been tested (and for what it's worth, we haven't done it either, and others have tried). In theory, there's definitely a way. Actually executing it is near impossible though without extremely precise equipment.

Well I'll applaud those who try it. It could really help out with emunand. Plus if the bootrom was dumped, what else could we do with it? Would it allow coldbooting custom software or extra services?

 

[Nic333]

Well I'll applaud those who try it. It could really help out with emunand. Plus if the bootrom was dumped, what else could we do with it? Would it allow coldbooting custom software or extra services?

IF the bootrom was dumped we would understand better how the 3DS boot and how it handles the crypto and all these stuff, aside from dumping keys, i don't see how useful dumping the bootrom would be for unsigned software/homebrew/piracy. We would have the keys and know better how the console works, nothing more than that.

 

[Psi-hate]

IF the bootrom was dumped we would understand better how the 3DS boot and how it handles the crypto and all these stuff, aside from dumping keys, i don't see how useful dumping the bootrom would be for unsigned software/homebrew/piracy. We would have the keys and know better how the console works, nothing more than that.

Okay. That's good. I just wonder what you would need in order to be able to run custom software right off of cold boot. (Maybe the ability of signing things is needed.) I suppose the PSP's method of cold booting CFW won't apply here or is everything signed there too?

 

[Nic333]

Okay. That's good. I just wonder what you would need in order to be able to run custom software right off of cold boot. (Maybe the ability of signing things is needed.) I suppose the PSP's method of cold booting CFW won't apply here or is everything signed there too?

What happend on PSP is that Sony fucked up with the ECDSA on the PS3, and somehow someone got the private key of PSP using the PS3, so everybody have the ability to sign software for the PSP, now, with the 3DS, Nintendo are using RSA, with are not vunerable to the ECDSA shit from Sony, so we would need the Nintendo Private Key to sign software/containers/firms with means that an internal Nintendo leak would have to happen, if they didn't fucked up with anything on their signature checks, it's impossible to run any kind of custom firmware from cold boot

 

[Psi-hate]

What happend on PSP is that Sony fucked up with the ECDSA on the PS3, and somehow someone got the private key of PSP using the PS3, so everybody have the ability to sign software for the PSP, now, with the 3DS, Nintendo are using RSA, with are not vunerable to the ECDSA shit from Sony, so we would need the Nintendo Private Key to sign software/containers/firms with means that an internal Nintendo leak would have to happen, if they didn't fucked up with anything on their signature checks, it's impossible to run any kind of custom firmware from cold boot

Thanks for the info. I learned a ton! I just kinda now hope that someone who works on the signing part doesn't screw nintendo over by leaking it. Honestly that would be detrimental for the 3DS and honestly no matter how much you want homebrew or CFW, you don't want to risk destroying the whole economy of the console. I think I'd stick with regular exploits instead.

 

[WulfyStylez]

Thanks for the info. I learned a ton! I just kinda now hope that someone who works on the signing part doesn't screw nintendo over by leaking it. Honestly that would be detrimental for the 3DS and honestly no matter how much you want homebrew or CFW, you don't want to risk destroying the whole economy of the console. I think I'd stick with regular exploits instead.

The chance of that happening is so wildly low it's not even worth mentioning, imho.

 

[Psi-hate]

The chance of that happening is so wildly low it's not even worth mentioning, imho.

You do have a point.

 

[Syphurith]

Well yeah, if you could pull that off you could get at literally every key since you'd know the ones set in bootrom (and have the entire OTP area, and other things). However like a lot of exploits on there, it's more of a theory and hasn't been tested (and for what it's worth, we haven't done it either, and others have tried). In theory, there's definitely a way. Actually executing it is near impossible though without extremely precise equipment.

Sorry if i bother you. Where could the bootrom comes from? NAND/RAM/Inside-Chip?
If that involves RAM R/W, you might be able to trace all those commands issued to RAM chips.
If not.. Since it is said the console hardly halts due to clock/voltage glitches.. Quite unfortunately.
If you don't want to say about such thing, "Not so good to be talked about" would be a good reply for me.
Thanks for any polite replies you given.

 

[shinyquagsire23]

Sorry if i bother you. Where could the bootrom comes from? NAND/RAM/Inside-Chip?
If that involves RAM R/W, you might be able to trace all those commands issued to RAM chips.
If not.. Since it is said the console hardly halts due to clock/voltage glitches.. Quite unfortunately.
If you don't want to say about such thing, "Not so good to be talked about" would be a good reply for me.
Thanks for any polite replies you given.

It's its own unit within the processor SoC, hence bootROM (it's not in any r/w memory). Tracing calls to it would be impossible as far as I know.

 

[Syphurith]

It's its own unit within the processor SoC, hence bootROM (it's not in any r/w memory). Tracing calls to it would be impossible as far as I know.

Judge: So there is no known possible way to achieve bootrom dumping.. I see.
Wright: (Wait.. How does it know the key.. And what happened exactly, after the user updated 9.5 to 9.6, and before the 9.6 FIRM being loaded?)
Wright: Your honor, the defendant have a new theory to get those new keys. The point is...
1.The key is generated or set after update finished, so there must be clues within its packages.
2.The key is already produced in its factory default, however not used ever till updated.
3.There must be any other possible ways. (Other choices)

Hope you enjoy such a poorly scripted dialog. If feeling disturbed, sorry for that.

Which option is worse for nintendo?
>> 1. There must be some functions performed to let it generate and set the key.
>> 2. There must be some actions taken to write to somewhere serious so it knows there is a particular key to be used before FIRM totally loaded.
>> 3. Unknown, however i don't know how could it be performed. (Other choices)

@Reisyukaku @b1l1s @duke_srg Sorry for tagging you here, and i really want to hear about your choice of this question here.

 

[Reisyukaku]

Judge: So there is no way possible known to achieve bootrom dumping.. I see.
Wright: (Wait.. How does it know the key.. And what happened exactly, after the user updated 9.5 to 9.6, and before the 9.6 FIRM being loaded?)
Wright: Your honor, the defendant have a new theory to get those new keys. The point is...
1.The key is generated or set after update finished, so there must be clues within its packages.
2.The key is already produced in its factory default, however not used ever till updated.
3.There must be any other possible ways.

Hope you enjoy such a poorly scripted dialog. Which option is worse for nintendo?
>> 1. There must be some functions performed to let it generate and set the key.
>> 2. There must be some actions taken to write to somewhere serious so it knows there is a particular key to be used before FIRM totally loaded.
>> 3. Unknown, however i don't know how could it be performed. (Other choices)

@Reisyukaku @b1l1s @duke_srg Sorry for tagging you here, and i really want to hear about your choice of this question here.

If you're aking the feasibility of dumping bootrom, its not impossible, just not likely. I have half baked ideas on how it could be done but meh..

 

[Syphurith]

If you're aking the feasibility of dumping bootrom, its not impossible, just not likely. I have half baked ideas on how it could be done but meh..

Thanks for reply. Not for bootrom. but for new keys.
But i really would like to know which choice given is worst for nintendo.
And would like to hear about your progress.
>> pastebin.com still firmly blocked in China, no way to access it. pastebin.ca not blocked.. Orz.
EDIT: key0x16 get.

 

[Dazzozo]

This thread is adorable.

"Key 0x16" << Nintendo gives you that for free. Nothing was obtained, someone just figured out how to use what they already have.

 

[VinsCool]

This thread is adorable.

"Key 0x16" << Nintendo gives you that for free. Nothing was obtained, someone just figured out how to use what they already have.

because obviously everyone know that. Not eveyone are genuises. Keep your supperiority for yourself for a minure, thank you for clarifications.

 

[Dazzozo]

because obviously everyone know that. Not eveyone are genuises. Keep your supperiority for yourself for a minure, thank you for clarifications.

Not when it's literally described step by step on 3dbrew for months. No genius required, just reading.

Like sure, someone figured it out, but this is not worth making a fuss about..?

 

[Reisyukaku]

Not when it's literally described step by step on 3dbrew for months. No genius required, just reading.

Like sure, someone figured it out, but this is not worth making a fuss about..?

This is a site where they think 'Ryanrocks462' is actually smart.. you're only wasting your time and energy, lol. Like i've said to people before, the people that are able to make use of these keys most likely already have them, therefore it shouldn't hinder my (or anyone's) work too much, but i still was sucked into the drama which wasnt fun.. I'm not trying to claim im smart or what have you either, I just started to look into the FIRM layout like a few weeks ago and asked around a bit, then ended up figuring this out.. sure it isnt difficult in hind sight but im fairly new to this too.. so it's still exciting for me to be learning fairly fast and watching everything unfold before my eyes.

 

[Psi-hate]

It probably isn't a good idea to speak ill of eachother and their efforts. This thread is for discussing what we find on pastebin. Share knowledge please. Any of you all want to want to share anything?

 

[KashiToxicBlood]

http://pastebin.com/qRPRwKig here is some code, it's a process9 decryptor,

the thing that is patched w/ CFWs
aka ARM9 section
crypted on N3DS, goes along with the pretty keys that were leaked by someone yesterday

http://pastebin.com/i776rhWD also to go along with this here is an n3ds arm9 decryptor thanks to ryanrocks462 for posting on twatter