Hacking Captured Gateway Go Payload doesn't work

[Jogi173]

Hello guys,

i want to get the html payload from GW Go to host it on my android phone for offline exploit.
So i captured the traffic from my Router while i visited the offical Gateway Go Homepage. The exploit worked and started the Emunand sucessfully. Since the exploit worked i assume that i have received the correct Payload.
After that i extracted the index.html and frame.html with Wireshark and saved it to my local drive.
Then i hosted these files on my android web server (kWS) and tried to trigger the exploit by connecting to the android web server from the 3DS. But the Emunand doesn't load. The browser crashs and i get an error mesage saying that an error has occurred and that i have to restart the system.

Has anyone an idea what the problem is?

Thanks in advance.

Jogi173

 

[Xenon Hacks]

Wouldn't it be easier to just enable wifi tethering in your android wifi settings? Also to try and fix the crashing clear browser history and cookies in the 3DS browser.

 

[The Real Jdbye]

Hello guys,

i want to get the html payload from GW Go to host it on my android phone for offline exploit.
So i captured the traffic from my Router while i visited the offical Gateway Go Homepage. The exploit worked and started the Emunand sucessfully. Since the exploit worked i assume that i have received the correct Payload.
After that i extracted the index.html and frame.html with Wireshark and saved it to my local drive.
Then i hosted these files on my android web server (kWS) and tried to trigger the exploit by connecting to the android web server from the 3DS. But the Emunand doesn't load. The browser crashs and i get an error mesage saying that an error has occurred and that i have to restart the system.

Has anyone an idea what the problem is?

Thanks in advance.

Jogi173

There's already an app for that... Several of them, in fact.

https://gbatemp.net/threads/release-go-gateway-offline-exploit-host-on-android.378474/

 

[Queno138]

Hello guys,

i want to get the html payload from GW Go to host it on my android phone for offline exploit.
So i captured the traffic from my Router while i visited the offical Gateway Go Homepage. The exploit worked and started the Emunand sucessfully. Since the exploit worked i assume that i have received the correct Payload.
After that i extracted the index.html and frame.html with Wireshark and saved it to my local drive.
Then i hosted these files on my android web server (kWS) and tried to trigger the exploit by connecting to the android web server from the 3DS. But the Emunand doesn't load. The browser crashs and i get an error mesage saying that an error has occurred and that i have to restart the system.

Has anyone an idea what the problem is?

Thanks in advance.

Jogi173

Once you can get back into GW mode, I would advise that you..

1. Backup your SYSNAND (and name is as SYSNAND backup, because emunand into sysnand is a no no, or so I was told)

2. Downgrade to 4.5 for sysnand. (and don't attempt to upgrade this sysnand version. you made a backup at 1. for a reason)



This way, you could just use the blue cart to do the NDS profile entry, rather than worry about online payloads not working,
or not being able to use GW without a phone/internet such type of scenarios.

 

[Jogi173]

Wouldn't it be easier to just enable wifi tethering in your android wifi settings? Also to try and fix the crashing clear browser history and cookies in the 3DS browser.

I already enabled the mobile tethering to connect to the android web server. Also i cleared all cookies and the history.

There's already an app for that... Several of them, in fact.

https://gbatemp.net/threads/release-go-gateway-offline-exploit-host-on-android.378474/

I know that there are several apps. But i love to do and try things on my own

Once you can get back into GW mode, I would advise that you..

1. Backup your SYSNAND (and name is as SYSNAND backup, because emunand into sysnand is a no no, or so I was told)

2. Downgrade to 4.5 for sysnand. (and don't attempt to upgrade this sysnand version. you made a backup at 1. for a reason)



This way, you could just use the blue cart to do the NDS profile entry, rather than worry about online payloads not working,
or not being able to use GW without a phone/internet such type of scenarios.

I have a backup of my Sysnand. But i don't want do downgrade because of the savegame > 6.x (?) issue.


Also i have a working payload from this forum which works for me.
But it differs from the one i have extracted from my capturing. So i think Team Gateway changed something.
I'm just interested in the way how the actual exploit (payload) works.
What i have seen is that there is a cookie attached in the html answer (index.html) from the Gateway Go site. Maybe it doesn't work because of the missing cookie?

 

[Queno138]

But i don't want do downgrade because of the savegame > 6.x (?) issue.

If you aren't using retail carts,
you could always use savedatafiler to back up all the saves.

Savedatafiler backups are technically "raw"

So once you downgrade sysnand to 4.5 and continue on your Emunand, you could simply re-import the saves.


If you're using a retail cart,
Savedatafiler works but on a CFW (I forgot which one)
I managed to back up my retail carts that GW couldn't rip (cause their file size was lesser than 512 MB).


Well, since you got a payload working, it is all good I guess,
just increasing your options for you.

 

[Jogi173]

If you aren't using retail carts,
you could always use savedatafiler to back up all the saves.

Savedatafiler backups are technically "raw"

So once you downgrade sysnand to 4.5 and continue on your Emunand, you could simply re-import the saves.


If you're using a retail cart,
Savedatafiler works but on a CFW (I forgot which one)
I managed to back up my retail carts that GW couldn't rip (cause their file size was lesser than 512 MB).


Well, since you got a payload working, it is all good I guess,
just increasing your options for you.

Yes i use retail cards. Thanks for the hint with the CFW.

And yes, it's all good But i'm still interested in the way it works.

 

[Queno138]

Yes i use retail cards. Thanks for the hint with the CFW.

And yes, it's all good But i'm still interested in the way it works.

in that case, my this post might help you too

http://gbatemp.net/threads/cia-save-data-filer-pokemon-oras.397598/#post-5675570