Hacking 3DS Hacking Ideas: Post Your Ideas Here!

[Reisyukaku]

well you wont be able to execute code in regions that are protected by NX, but if I remember correctly, the current working exploit used a buffer overflow with something else.. it was a 2 part process.

 

[mr. fancypants]

yeah NevereXecute so like the name says... but can they not find like the 3ds a gamesave-hack?

 

[Reisyukaku]

Hmm? like editing the save files? I think those have a pretty hefty encryption on them
http://3dbrew.org/wiki/Savegames

 

[mr. fancypants]

hmm so they learned from the ds era...

 

[Crisp Cookie]

Would it be handy if I post a video from the freeze or is it not worth

 

[Reisyukaku]

go for it, i'm curious myself

 

[Crisp Cookie]

Here is the video

 

[boomario]

Isn't possible to load a corrupted picture in 3ds camera or one with a HUUUGGE resolution to make system freeze and crash? Just a idea.

 

[Abcdfv]

Isn't possible to load a corrupted picture in 3ds camera or one with a HUUUGGE resolution to make system freeze and crash? Just a idea.

That's what they did with a few of the earlier PSP versions, so I'm sure Nintendo's thought of it already.

 

[NoSmokingBandit]

I modded a psp with that exploit. Its pretty basic security, but Sony often overlooks the simplest things.

 

[xakota]

Does the Datel Powersave have any implications? It has the ability to rewrite saves even on games with NAND saving.

 

[Duo8]

Does the Datel Powersave have any implications? It has the ability to rewrite saves even on games with NAND saving.

They cracked 6.x save encryption and figured out how to write to CARD2 games. That's all.

 

[xakota]

They cracked 6.x save encryption and figured out how to write to CARD2 games. That's all.

Isn't that sort of a big deal though? Save editing is what lead to things like the Twilight hack, no?

 

[gamesquest1]

yeah but the older games saves had already been hacked so any save game entry points could be looked into on older games using the older encryption methods, this is all also closed, i doubt datel will be dropping by to release a save game hack any time soon, so untill its public the method its not going to lead to anything except modded saves, and even if the method is released it would probs only lead to being able to use 6.x saves in emunand, so you can play newer games between retail and emunand

 

[bkifft]

yeah but the older games saves had already been hacked so any save game entry points could be looked into on older games using the older encryption methods, this is all also closed, i doubt datel will be dropping by to release a save game hack any time soon, so untill its public the method its not going to lead to anything except modded saves, and even if the method is released it would probs only lead to being able to use 6.x saves in emunand, so you can play newer games between retail and emunand

i only see two possible scenarios on how they do it:

a) they achieved unsigned code execution on 6.x+ and have a 3DS farm running to de-/encrypt the saves

or b) they managed to extract the 6.x key (either prescrambled or the init and the scrambler logic).

both scenarios would have a great impact: exploit for >4.5 or the ability to extract all AES keys (unless the 6.x save key is stored/generated less secure).

 

[gamesquest1]

Yeah but they are both dependant on the method being released, right now it's for datel's eyes only, for all we know they could of just made a very lucky guess on the 6.x key, or knew someone who has access to some sensitive info inside nintendo, until something is made public (or atleast in the hands of developers) this doesn't really count for anything, and doesn't help in any way

 

[bkifft]

Yeah but they are both dependant on the method being released, right now it's for datel's eyes only, for all we know they could of just made a very lucky guess on the 6.x key, or knew someone who has access to some sensitive info inside nintendo, until something is made public (or atleast in the hands of developers) this doesn't really count for anything, and doesn't help in any way

Right, for now its datel only.

And my best guess is they went with alternative b) and simply threw a huge amount of money at the problem (decap/microprobing).

It at least shows that more/deeper exploitation is still possible.

 

[cloud1250000]

well you wont be able to execute code in regions that are protected by NX, but if I remember correctly, the current working exploit used a buffer overflow with something else.. it was a 2 part process.

wasn't the point of the ropchain exploit??? to bypass NX?

 

[Duo8]

wasn't the point of the ropchain exploit??? to bypass NX?

Yes. The ROP chain then triggers a kernel exploit.

 

[cloud1250000]

so technically, if some people made their own rop chain loader, it can be adapted to all the future exploit no? (if any)