Homebrew RAM editing glitch on any 3DS, might lead to an exploit?

[Coakie]

Is this digital only or is there a physical version of it?

 

[GalladeGuy]

Another primary exploit!

 

[zoogie]

Is this digital only or is there a physical version of it?

Digital only in JPN and USA regions only.

Better act now if you want to get in on it. It could be pulled before a release. The vuln has already been demonstrated in code.

 

[MartinDocNewland]

It did work, but you can't see what it did because you didn't offset the layer.
Try these inputs:

XSCREEN 2
BGSCREEN 0,134217728,16
BGOFS 0,6400*16,0

That sets the screen up, sets the glitch up, and then shows you an interesting bit. You can try other offsets in the third command if you want to explore.

Sorry was following what was on page 1. Maybe update that?

 

[GoodCookie88]

_Watches thread_

 

[epicmartin7]

So... from the information presented from this thread and a ROP being found (which means control is possible), does this pretty much mean that SmileBasic is exploitable. If we were to summarize what's going on?

 

[jimmyleen]

So... from the information presented from this thread and a ROP being found (which means control is possible), does this pretty much mean that SmileBasic is exploitable. If we were to summarize what's going on?

Yes and shit just got real.

 

[Pandaxclone2]

So... from the information presented from this thread and a ROP being found (which means control is possible), does this pretty much mean that SmileBasic is exploitable. If we were to summarize what's going on?

It's exploitable. "got rop" means they have control.

now lets just hope all this goes unnoticed by the powers that be until something is released

tl;dr yes.

 

[Roboman]

So... from the information presented from this thread and a ROP being found (which means control is possible), does this pretty much mean that SmileBasic is exploitable. If we were to summarize what's going on?

To summarize:

Smile basic let's you run arbitrary interpreted code in a sandbox. A glitch allows breaking out of the sandbox and directly editing ram. Doing this can allow for rop. Rop is the foundation for all userland exploits.

 

[zoogie]

The game has a (very) nice service access list

Spoiler

> $hioFIO
> $hostio0
> $hostio1
> cfg:u
> fs:USER
> gsp::Gpu
> hid:USER
> ndm:u
> pxi:dev
> APT:A
> ac:u
> act:u
> am:app
> boss:U
> cam:u
> cecd:u
> dlp:FKCL
> dlp:SRVR
> dsp:: DSP
> frd:u
> http:C
> ir:USER
> ldr:ro
> mic:u
> news:u
> nfc:u
> nim:aoc
> nwm::UDS
> ptm:u
> qtm:u
> soc:U
> ssl:C
> y2r:u

 

[MartinDocNewland]

This is what I get. Is that right?

 

[Trinitro21]

This is what I get. Is that right?

Yep. Those are some of the function names. I also linked an editor on the first page; if you want to use it, inject the file into your extdata.

 

[MartinDocNewland]

Well I would but I'm already running my N3DS on Luma3DS with A9HL with latest system firmware so I don't need to, was just testing it out for me and the people lol

 

[Khangaroo]

A9HL

Arm9HaxLoader?

 

[slackerSnail]

Excuse my language, but shit hell what have you done
I'm the guy who originally discovered that BGSCREEN can open RAM contents (though I didn't originally discover that the command was bugged, it goes further back than me). The bug was really fickle to work with so I never thought it would go anywhere and we decided to keep it a secret.
Until now, apparently.
The SMILEBASIC community is really small and indie, as is the software. I care about it very much, so I absolutely CANNOT risk that the software get pulled. We need to do some damage control, and fast. I don't know exactly WHAT is going on here, I just got here, so if someone could TLDR me that would be nice.

 

[Swiftloke]

Excuse my language, but shit hell what have you done
I'm the guy who originally discovered that BGSCREEN can open RAM contents (though I didn't originally discover that the command was bugged, it goes further back than me). The bug was really fickle to work with so I never thought it would go anywhere and we decided to keep it a secret.
Until now, apparently.
The SMILEBASIC community is really small and indie, as is the software. I care about it very much, so I absolutely CANNOT risk that the software get pulled. We need to do some damage control, and fast. I don't know exactly WHAT is going on here, I just got here, so if someone could TLDR me that would be nice.

We already got rop. Sorry man

 

[epicmartin7]

Excuse my language, but shit hell what have you done
I'm the guy who originally discovered that BGSCREEN can open RAM contents (though I didn't originally discover that the command was bugged, it goes further back than me). The bug was really fickle to work with so I never thought it would go anywhere and we decided to keep it a secret.
Until now, apparently.
The SMILEBASIC community is really small and indie, as is the software. I care about it very much, so I absolutely CANNOT risk that the software get pulled. We need to do some damage control, and fast. I don't know exactly WHAT is going on here, I just got here, so if someone could TLDR me that would be nice.

Basically, the RAM Contents are being used to modify the RAM in such a way in order to get out of the full sandbox and into userland. The exploit fully works apparently too...

EDIT: Here's a summary:

To summarize:

Smile basic let's you run arbitrary interpreted code in a sandbox. A glitch allows breaking out of the sandbox and directly editing ram. Doing this can allow for rop. Rop is the foundation for all userland exploits.

 

[ArcPh1r3]

Excuse my language, but shit hell what have you done
I'm the guy who originally discovered that BGSCREEN can open RAM contents (though I didn't originally discover that the command was bugged, it goes further back than me). The bug was really fickle to work with so I never thought it would go anywhere and we decided to keep it a secret.
Until now, apparently.
The SMILEBASIC community is really small and indie, as is the software. I care about it very much, so I absolutely CANNOT risk that the software get pulled. We need to do some damage control, and fast. I don't know exactly WHAT is going on here, I just got here, so if someone could TLDR me that would be nice.

M-muh damage control!!
Never change, Alex.
Edit: Quick warning guys

He's successfully contacted and talked to Smileboom before so I'm sure he'll get something done about this. If you're gonna exploit this do it quickly.

 

[zoogie]

Excuse my language, but shit hell what have you done
I'm the guy who originally discovered that BGSCREEN can open RAM contents (though I didn't originally discover that the command was bugged, it goes further back than me). The bug was really fickle to work with so I never thought it would go anywhere and we decided to keep it a secret.
Until now, apparently.
The SMILEBASIC community is really small and indie, as is the software. I care about it very much, so I absolutely CANNOT risk that the software get pulled. We need to do some damage control, and fast. I don't know exactly WHAT is going on here, I just got here, so if someone could TLDR me that would be nice.

Sorry, it's a forgone conclusion at this time that hbl for smilebasic is going to be released.
There's already plenty of issues to get it pulled. (editing system RAM in game? wtf)

You honestly should have thought of this before releasing a RAM editor, lol.

 

[slackerSnail]

I'm well aware of the how and why, I just want to know how tobgwt the exploit now tbh
It's too late to stop it so let's ride the train out bois
EDIT: the RAM editing was a bug, we just entirely avoided reporting it for this exact reason

--------------------- MERGED ---------------------------

The actual bug and tools have been floating around for months. Trin just couldn't help himself not to release it.
There also isn't a decent explanation of why the bug seems to trigger here either, which I've determined. On phone though so I really don't want to type

--------------------- MERGED ---------------------------

What I first saud when i came in here didn't go off how I wanted because I was in a rush
I don't want you to drop everything I want you to get this exploit done but as QUICKLY and QUIETLY as possible. If we dilly-dally it's too late. Get this done fam