Homebrew Downgrading 11.0/11.1 3DSs without DSiWareHax is possible

[EthanAddict]

The only(known) way you can do this is by ether hardmod or an a9 exploit(one was discovered for 11.1, but not exploited)...

 

[Blue]

The only(known) way you can do this is by ether hardmod or an a9 exploit(one was discovered for 11.1, but not exploited)...

If you remember back in 11.0, Nintendo added an anti downgrade patch. When installing a title, the 3ds would check against a hardcoded version list stored in process9, and if the version was too low, it would fail. However, this method was imperfect, and is vulnerable to a type of race condition known as a TOCTTOU, or Time OfCheck To Time Of Use. A TOCTTOU is an exploit where the data is changed after the validity of the data is checked, but before the data is used. In short, the way the process should work is:

Application manager is asked to install newer version -> Version is checked against the process9 minimum version list -> Version is higher than minimum version -> Install

or

Application manager is asked to install older version -> Version is checked against the process9 minimum version list -> Version is lower than minimum version -> Abort

The way it can end up working though is:

Application manager is asked to install newer version -> Version is checked against the process9 minimum version list -> Version is higher than the minimum version -> Data is swapped out with older title -> Install older title

This would basically allow us to downgrade NATIVE_FIRM to 10.4 (kind of like a hardmod downgrade) using software only and no secondary 3ds and no DSiWare.

The reason I'm saying we only downgrade NATIVE_FIRM is because of the nature of the exploit. Although it would be perfectly possible to downgrade the entire system, the race condition would need to work for every single title you install, and due to the inherently unreliable nature of race conditions, it would be easier to downgrade NFIRM only and then downgrade normally.

As far as I know, no code has been written for this yet.

What happened in 11.2 was Nintendo prevented this race by doing a second version check. This effectively prevents the race

 

[TheOverseer]

You don't need ARM9 to do something like this, from what I know. All it should take is ARM11, and requires no backdoor. It's not a true exploit, but a security flaw that sets up a race condition. And you can use it w/ A11 access to downgrade, by validating the title then swapping it for the firmware you actually want to use.

That's what I understand of this bug.

 

[EthanAddict]

You don't need ARM9 to do something like this, from what I know. All it should take is ARM11, and requires no backdoor. It's not a true exploit, but a security flaw that sets up a race condition. And you can use it w/ A11 access to downgrade, by validating the title then swapping it for the firmware you actually want to use.

That's what I understand of this bug.

Yes, but still an ARM9 exploit would be better.

 

[TheOverseer]

Yes, but still an ARM9 exploit would be better.

Well, of course, But it's kinda semi-ARM9 if you can downgrade to an ARM9 version.

 

[Deleted User]

https://github.com/TiniVi/safehax

 

[TheOverseer]

https://github.com/TiniVi/safehax

Has anyone tested it yet?

 

[EthanAddict]

https://github.com/TiniVi/safehax

Wow, 'll try it when fasthax becomes available for me...

 

[handek]

This is huge am i wrong ? (or maybe it's juste a Poc)

 

[mehmeh11]

https://github.com/TiniVi/safehax

Can someone with only homebrew launcher access in 11.0 do this or do you need wait/fasthax?

 

[EthanAddict]

Can someone with only homebrew launcher access in 11.0 do this or do you need wait/fasthax?

With waithax, fasthax doesn't work on firmware<11.2(Wi r so laki)

 

[TheOverseer]

With waithax, fasthax doesn't work on firmware<11.2(Wi r so laki)

Fasthax works on 11.1 as well.

 

[EthanAddict]

Fasthax works on 11.1 as well.

Dunno

 

[TheOverseer]

Dunno

It doesn't use anything that is 11.2 exclusive. Whether the implementation works or not, the exploit should be usable on 11.1

 

[mehmeh11]

With waithax, fasthax doesn't work on firmware<11.2(Wi r so laki)

Oh, so I need waithax, what a bummer

 

[Somebody Whoisbored]

So is fasthax close to working? My o3DS freezes at UAF backdoor installed