- Joined
- Apr 19, 2015
- Messages
- 1,023
- Trophies
- 1
- Location
- Stuck in the PowerPC
- Website
- heyquark.com
- XP
- 3,909
- Country
Hey all!
Well, I've just finished watching the Nintendo Hacking segment at this year's 3c33 - naehrwert, derrek and nedwill presented an hour-long talk on all things Wii U and 3DS. Actually, not all things. In fact, the Wii U section was kinda disappointing. Very much so.
To start off, we got a recap of some exploits on the console. These include:
This is very cool, but there's one problem.
They were deliberately very vague about the specifics of the hardmod. Basically, all we know is that they used fault injection (an industry standard thing) to "glitch" boot0. I'm not simplifying - that's all they said. In fact someone asked for specifics and the response was "It's complicated, figure it out yourself".
Um.
Right after, the Wii U section ended. That's all they had to say on the matter; no "one more thing" or addendum. Unfortunately, the fact of the matter is that this is not enough information to perform the same exploit. While a pointer in the right direction, a hell of a lot of work is going to have to go into reverse-engineering the Wii U motherboard before we even have a vauge idea of how this would work in practice.
They did, however, imply that there was a bug in boot1.
Edit: formatting
(Original was on Reddit, but seems to have been AutoModeratored. Ouch.)
Read up about 3c33 on Reddit over here -> link
@Maschell also made a YouTube upload of the full talk, although it's unlisted so we'd have to wait on his input before linking it out.
Well, I've just finished watching the Nintendo Hacking segment at this year's 3c33 - naehrwert, derrek and nedwill presented an hour-long talk on all things Wii U and 3DS. Actually, not all things. In fact, the Wii U section was kinda disappointing. Very much so.
To start off, we got a recap of some exploits on the console. These include:
- ioctlvhax - Published back in the kernel days but never publicly implemented, this exploit functions as a PowerPC and IOSU userspace exploit. It's patched in firmwares newer than 5.2.0.
- mqhax - A bug in IOS_CreateMessageQueue allows getting control of the IOSU kernel. While this is a new exploit, we already have a bug in IOS_CreateThread that allows the same thing.
- coldboothax - Identical to the public coldboothax implementation.
- boot1 reads system.xml, but the code to do it is pretty solid.
- The only way to dump boot1 is to exploit boot0, but boot0 is also pretty solid.
- One solution to this is a hardmod. This can be used to introduce bugs into boot0! This is similar to how it worked on the XBox 360 with RGH.
- In this way, boot0 code execution was gained using a buffer overflow and a fake boot1.
- They dumped and decrypted boot1!
- They started looking for bugs in boot1, but "lost interest" and left it as-is. Quote:
This is very cool, but there's one problem.
They were deliberately very vague about the specifics of the hardmod. Basically, all we know is that they used fault injection (an industry standard thing) to "glitch" boot0. I'm not simplifying - that's all they said. In fact someone asked for specifics and the response was "It's complicated, figure it out yourself".
Um.
Right after, the Wii U section ended. That's all they had to say on the matter; no "one more thing" or addendum. Unfortunately, the fact of the matter is that this is not enough information to perform the same exploit. While a pointer in the right direction, a hell of a lot of work is going to have to go into reverse-engineering the Wii U motherboard before we even have a vauge idea of how this would work in practice.
They did, however, imply that there was a bug in boot1.
Edit: formatting
(Original was on Reddit, but seems to have been AutoModeratored. Ouch.)
Read up about 3c33 on Reddit over here -> link
@Maschell also made a YouTube upload of the full talk, although it's unlisted so we'd have to wait on his input before linking it out.
Last edited by QuarkTheAwesome,
