Hacking Question for Marionumber1 and NWPlayer

[Kioku]

Did you actually read my previous posts? It explains exactly why the devs are doing this. Check out the first page, about 3 posts down I think.

That logic is still lazy. What you're saying is that we should hold out for the next FW to see if it's patched. If it isn't? Don't you think they'll wait UNTIL Nintendo patches it? Seriously, quit justifying this.

While, yes, it makes SOME sense? It's also a tired, played out excuse. What if Nintendo never patches it? Do you think we'll see it then? Doubtful, will have to wait until someone else figures it out or leaks what's already there.

 

[WulfyStylez]

Don't count on Nintendo magically knowing the exact vulns MN1 or anyone else has found and patching them without disclosures?? duh???
And, FWIW, nobody (including me/SALT) is going to disclose their 3DS/Wii vulnerabilities to Nintendo ever until they put up a bug bounty program or, at the very least start forwarding messages from security researchers like SALT, Marionumber1, yellows8 and friends, etc to their engineering teams.
This is old news and in the past for most Wii U researchers, but I literally DM'd a Nintendo engineer on Twitter with a description of the OSDriver race vuln once (don't ask, long heckin' story) and they took nine months to patch it. I.E. they completely blew it off for whatever reason until it was in the wild and actively affecting them.

Many of us actually want to see Nintendo have a more secure system, for Nintendo's sake! Believe it or not, most of us love Nintendo. That's where the whole anti-piracy perspective many people have comes from. But it's a pain in the fucking ass to help them when they won't ever listen to us.

 

[WeedZ]

don't bother. tried that countless times already in the past, but some people only read what they want to read

Trust me, I felt the same way about that last response by @lonemoonHD.

"Did you actually read my previous post" as if it's the final authority on the debate and my response disputing it doesn't exist.

But sense it's a new person entering the conversation I guess we can just ignore any faults that have been pointed out to our arguments and return our default stance on the subject.

--------------------- MERGED ---------------------------

Don't count on Nintendo magically knowing the exact vulns MN1 or anyone else has found and patching them without disclosures?? duh???
And, FWIW, nobody (including me/SALT) is going to disclose their 3DS/Wii vulnerabilities to Nintendo ever until they put up a bug bounty program or, at the very least start forwarding messages from security researchers like SALT, Marionumber1, yellows8 and friends, etc to their engineering teams.
This is old news and in the past for most Wii U researchers, but I literally DM'd a Nintendo engineer on Twitter with a description of the OSDriver race vuln once (don't ask, long heckin' story) and they took nine months to patch it. I.E. they completely blew it off for whatever reason until it was in the wild and actively affecting them.

Many of us actually want to see Nintendo have a more secure system, for Nintendo's sake! Believe it or not, most of us love Nintendo. That's where the whole anti-piracy perspective many people have comes from. But it's a pain in the fucking ass to help them when they won't ever listen to us.

so fuck 'em then

 

[WulfyStylez]

so fuck 'em then

Be nice! They brought you into this world... err, forum?

Honestly your guys' best bet for having public hax all the time is taking some effort to learn C++, PPC or ARM assembly (depending on what you want to attack), and how to use IDA. Also, some basics of security vulnerabilities like signed compare bugs, stack and heap overflows, data leaks, and so on. Create a public (i.e. open githubs i guess?) team or teams of maybe 5 people max that you know have these skills, and go from there. I picked up C++ and IDA together in about a month with very little programming experience. My understanding of security vulnerabilities comes from surprisingly little reading and no formal training (yet!)
IMHO this is also the best way for you all to re-earn the respect of private developers and even get them to want to contribute publicly again. Like, this is me being 100% sincere right now. Yall should try, and try really hard and genuinely!

 

[solitaire4eva]

You do realize all the games you listed beside two are all updated versions of games that been out?

Then you have different taste then most people.
Sm4sh, Sploot, MK8, Hyrule Warriors, Pikmin 3, Bayonetta 1 and 2, Zelda WW HD and Wonderful 101 just to name a few, are awesome.
Some people buy an XBOX just for halo, these numbers are better

 

[Dust2dust]

Be nice! They brought you into this world... err, forum?

Honestly your guys' best bet for having public hax all the time is taking some effort to learn C++, PPC or ARM assembly (depending on what you want to attack), and how to use IDA. Also, some basics of security vulnerabilities like signed compare bugs, stack and heap overflows, data leaks, and so on. Create a public (i.e. open githubs i guess?) team or teams of maybe 5 people max that you know have these skills, and go from there. I picked up C++ and IDA together in about a month with very little programming experience. My understanding of security vulnerabilities comes from surprisingly little reading and no formal training (yet!)
IMHO this is also the best way for you all to re-earn the respect of private developers and even get them to want to contribute publicly again. Like, this is me being 100% sincere right now. Yall should try, and try really hard and genuinely!

You may have unreasonable expectations, here! You can't really expect everyone to just suddenly pick up programming and try to find an exploit. Most people couldn't even code a Hello World program. It's kind of like telling someone who wants to play a japanese import to learn kanji. Sure, it can be done with a lot of work, but most people can't be bothered. The benefits do not outweigh the efforts.

 

[lonemoonHD]

Don't you think they'll wait UNTIL Nintendo patches it?

Then there'd obviously be a release, but things are looking differently right now

and my response disputing it doesn't exist.

It does exist, that's exactly why I responded that way, because I felt it was the most effective response to it

 

[Keylogger]

That logic is still lazy. What you're saying is that we should hold out for the next FW to see if it's patched. If it isn't? Don't you think they'll wait UNTIL Nintendo patches it? Seriously, quit justifying this.

Nintendo knows about this and will NEVER patch it ^^

 

[XDM]

Actually, it works like this.

There's a 5.5 kernel exploit working and ready for release. The developers are keeping it because Nintendo may not know about the entrypoint/vulnerability.

Now, if Nintendo releases a new firmware, and the entrypoint isn't patched, then the exploit automatically works for that firmware.

If we release it now and Nintendo finds out, they'll patch it. Then, the exploit works only for 5.5 and a new exploit must be found for the next firmware.

What is the best outcome here? If we had two exploits, one would be released and the second would be kept. Easy.

But we only have this one, and it's best to keep it compatible and reliable.

woh i never though about it like that before, so we are really waiting for nintendo? but one thing, if nintendo launches a update that dosent patch our exploit and then we launch our exploit nintendo will still throw a update anyway.
what is needed it 2 exploits to launch at the same time giving no response time for nintendo.

 

[Dust2dust]

If the theory that Nintendo doesn't patch the exploit to prevent a release of said exploit turns out to be true, then it's only logical that they will eventually patch it. When they feel that software sales are almost dead, they will patch the exploit, expecting a release soon after to the general public. A new exploit allowing piracy on any Wii U sold in stores would inevitably provoke a hardware sales spike. It's a win/win for Nintendo.

 

[DJ-Yoshiman]

You do realize all the games you listed beside two are all updated versions of games that been out?

Did you mean that the other way around? Wind Waker and Bayonetta 1 are the only games that were already out in his list.

 

[Deleted User]

i think they'll patch yellows8's mp4 exploit, that is a userspace exploit, but surely couldn't that be used to get kernel access

 

[solitaire4eva]

Did you mean that the other way around? Wind Waker and Bayonetta 1 are the only games that were already out in his list.

Those other games are like part 2 or 3 or even 4 of a previous release game: Smash, MK8, etc... Plays like the originals or the ones before them. All Nintendo is doing is repacking the same games over and over again.

 

[DJ-Yoshiman]

Those other games are like part 2 or 3 or even 4 of a previous release game: Smash, MK8, etc... Plays like the originals or the ones before them. All Nintendo is doing is repacking the same games over and over again.

Yep, that is Nintendo. Those are sequals, not technically updated versions of games already out.

 

[fukseliten]

Those other games are like part 2 or 3 or even 4 of a previous release game: Smash, MK8, etc... Plays like the originals or the ones before them. All Nintendo is doing is repacking the same games over and over again.

Do they ? And they are the only ones, you say?
I guess youve never played Fifa or any other sportsgame from EA ? Or any of the later BF or CODs?
Now thats blatant repacking of earlier titles...

 

[BORTZ]

This thread served no purpose other than to call certain individuals out and enrage others. The question could have been asked as a PM, but its worded in an inflammatory way.