Hacking Can 3DS downgrade to firmware 10.1 max?

[CeeDee]

That's right, I think it to sums up everything important

Awesome! I'm hyped now.

Also I think this means smea wasn't lying - there's no kernel code running and there's no >9.2 kernel but with SVC there is downgrading possible/legit CIAs. Is SVC "privileged code"?

 

[GoodCookie88]

>.<

 

[Woody8275]

But why only below 10.1 was there a security fix on 10.2

 

[smealum]

ok so as entertaining as this is, it doesn't seem nice to let people speculate and possibly get excited over nothing. so, i'll address the big thing i guess :

As seen twice in the 2.5 payload:

ROM:000054D8                 SVC             0x7B ; '{'

And 0x7B is for svcBackdoor
(and this is used)

if you open up any of the payloads in a hex editor, you will indeed find that code. this is apparently significant because this syscall lets processes that have access to it execute arbitrary code in kernel mode. sounds amazing right ? of course the thing is that no process actually has access to it, so you'd need some kind of exploit to use it. therefore, there has to be some kind of exploit hidden away that gives the current process access to it, right ? smea's a liar and thought noone would find his secret kernel exploit, right ?

as you've probably guessed by now, no, that's not what's going on. the truth of the matter is that unlike what Mrrraou claims, this code is not used by anything. sure, the svcBackdoor function exists, and it *is* called by another function... but the function in question is not called by anything, ever. this is just a remnant of some old debugging code in app_bootloader which only ran on 9.2.

here's a screenshot of the actual code, and how it's not called anymore :

and if you still don't believe me just ask anyone who knows how to read arm disassembly to take a look, and they'll be able to confirm that invalidate_icache isn't called anywhere in app_bootloader. another thing you could do for proof is modify the payload : just replace the svc 0x7b instruction with an undefined instruction (like 0xffffffff); this way, if the funciton *is* called, it'll crash. if it's not, it'll just keep working the way it always does.

 

[DiegitusXD]

ok so as entertaining as this is, it doesn't seem nice to let people speculate and possibly get excited over nothing. so, i'll address the big thing i guess :



if you open up any of the payloads in a hex editor, you will indeed find that code. this is apparently significant because this syscall lets processes that have access to it execute arbitrary code in kernel mode. sounds amazing right ? of course the thing is that no process actually has access to it, so you'd need some kind of exploit to use it. therefore, there has to be some kind of exploit hidden away that gives the current process access to it, right ? smea's a liar and thought noone would find his secret kernel exploit, right ?

as you've probably guessed by now, no, that's not what's going on. the truth of the matter is that unlike what Mrrraou claims, this code is not used by anything. sure, the svcBackdoor function exists, and it *is* called by another function... but the function in question is not called by anything, ever. this is just a remnant of some old debugging code in app_bootloader which only ran on 9.2.

here's a screenshot of the actual code, and how it's not called anymore :

View attachment 29721

View attachment 29722


and if you still don't believe me just ask anyone who knows how to read arm disassembly to take a look, and they'll be able to confirm that invalidate_icache isn't called anywhere in app_bootloader. another thing you could do for proof is modify the payload : just replace the svc 0x7b instruction with an undefined instruction (like 0xffffffff); this way, if the funciton *is* called, it'll crash. if it's not, it'll just keep working the way it always does.

Ok

 

[JustPingo]

In the great lord smea we trust.
That's exactly what we were looking for, thank you very much for your time.
I laughed at the secret kernel.

 

[Woody8275]

Nothing to be hyped about then

 

[GoodCookie88]

Yep hype killed...

 

[SomeGamer]

In the great lord smea we trust.
That's exactly what we were looking for, thank you very much for your time.
I laughed at the secret kernel.

Then, what next?

 

[JustPingo]

More research. We're not done yet.

 

[GoodCookie88]

10 years later xD

 

[CeeDee]

ok so as entertaining as this is, it doesn't seem nice to let people speculate and possibly get excited over nothing. so, i'll address the big thing i guess :



if you open up any of the payloads in a hex editor, you will indeed find that code. this is apparently significant because this syscall lets processes that have access to it execute arbitrary code in kernel mode. sounds amazing right ? of course the thing is that no process actually has access to it, so you'd need some kind of exploit to use it. therefore, there has to be some kind of exploit hidden away that gives the current process access to it, right ? smea's a liar and thought noone would find his secret kernel exploit, right ?

as you've probably guessed by now, no, that's not what's going on. the truth of the matter is that unlike what Mrrraou claims, this code is not used by anything. sure, the svcBackdoor function exists, and it *is* called by another function... but the function in question is not called by anything, ever. this is just a remnant of some old debugging code in app_bootloader which only ran on 9.2.

here's a screenshot of the actual code, and how it's not called anymore :

View attachment 29721

View attachment 29722


and if you still don't believe me just ask anyone who knows how to read arm disassembly to take a look, and they'll be able to confirm that invalidate_icache isn't called anywhere in app_bootloader. another thing you could do for proof is modify the payload : just replace the svc 0x7b instruction with an undefined instruction (like 0xffffffff); this way, if the funciton *is* called, it'll crash. if it's not, it'll just keep working the way it always does.

Hype train is over, I guess.

Wait, then what's the invalidate_icache in Hans while booting a game?

 

[DiegitusXD]

More research. We're not done yet.

!!!

 

[kingraa777]

Well that was a fun read lol

 

[Mrrraou]

-snip-

Thanks for the explanation. And I should have tried that.
Sorry for all this speculation. Now that it's clear, topic can be closed. And I'll learn more ARM disassembly.

 

[Lycan911]

So can @smealum confirm if a downgrade is even possible? A simple yes or no would be enough.

 

[TheCruel]

just replace the svc 0x7b instruction with an undefined instruction (like 0xffffffff);

CONFIRMED: Method of getting 11.x Kernel!

 

[JustPingo]

So can @smealum confirm if a downgrade is even possible? A simple yes or no would be enough.

At some point maybe. But certainly not right now.

 

[Pingu]

So nothing is happing or sorry I'm lost

 

[CeeDee]

So nothing is happing or sorry I'm lost

Short answer: not yet