Hacking Aaaand the bug is public. Wasn't us though! :D

[Onibi]

And because hacking is easy; the Tegra X1 Bug.

Tegra X1 RCM forgets to limit wLength field of 8 byte long Setup Packet in some USB control transfers. Standard Endpoint Request GET_STATUS (0x00) can be used to do arbitrary memcpy from malicious RCM command and smash the Boot ROM stack before signature checks and after Boot ROM sends UID. Need USB connection and way to enter RCM (Switch needs volume up press and JoyCon pin shorted).

To:
ReSwitched
fail0verflow
SwitchBrew
BBB
Team Xecuter
Team SALT

Reminder: Real hackers hack in silence. You all suck.


"Game Over."


F8001BE1190CAED74BBDDAD78667877C84D1A128

Via: https://twitter.com/q3k/status/988425824138342402
Source: https://pastebin.com/4ykNxzU5

 

[Stoned]

And Thead 999999999999999999 whit the same Content.

 

[Nevermore]

And Thead 999999999999999999 whit the same Content.

reeeeeeeeeeeee, reposts!

 

[yardie]

aaaaaaaaaaaaaaaaaaaaaaaaaaand duplicate thread

 

[Onibi]

If you mean this: https://gbatemp.net/threads/bootrom-exploit-leaked.501822/ it does not correctly source or reproduce the news and seems a bit biast. So I think it makes sense to post this. Same for it getting posted in some threads post somewhere. Makes it hard to find, so seemed ok to me.

 

[thekarter104]

Ok, expect duplicates like this, time to not visit GBATemp for a few days to avoid being annoyed by duplicate threads I guess.

 

[Deleted User]

Reicht gibt es schon 5 mal

 

[garyopa]

where is the mods, to clean up this section, we have like 5 threads with posts flying by.

 

[Onibi]

Show me where.

If you search the bug description you will find no post reproducing the message accurately.