Hacking 3DS Hacking Ideas: Post Your Ideas Here!

[Devrim]

Okay, and would it be possible to modify a small part of the firmware to f.e. disable a rom decryptor/legitimacy check jump? Would this allow running homebrew/hacks/fan translations (maybe even from the sd card)?

I think the real problem is, is that no one really is interested in hacking the 3DS. Best case scenario some gateway/r4/supercard-like company will take the exploit and sell cards and make money out of it.

 

[Deleted User]

Okay, and would it be possible to modify a small part of the firmware to f.e. disable a rom decryptor/legitimacy check jump? Would this allow running homebrew/hacks/fan translations (maybe even from the sd card)?

But how would n00bs do this?

 

[profi200]

But how would n00bs do this?

Learn ARM ASM and reverse engineer the firmware.

But it doesn't matter here, because just editing some things on the running firmware doesn't fix the problems caused by the exploit.

 

[Deleted User]

Learn ARM ASM and reverse engineer the firmware.

But it doesn't matter here, because just editing some things on the running firmware doesn't fix the problems caused by the exploit.

You make it sound so easy

 

[pokefan92]

You make it sound so easy

Nothing it's impossible. You think it's really difficult and it isn't. It's as easy as you know how things work and what you have to do.

The matter is... how many people invest their time in that? Most people don't know how to program a simple calculator... I'm surprised that the thing that surprises you most is that someone hacks something made by other person...

Maybe you don't know persons like Leibniz because he didn't make a flashcart or similar.

 

[Deleted User]

Nothing it's impossible. You think it's really difficult and it isn't. It's as easy as you know how things work and what you have to do.

The matter is... how many people invest their time in that? Most people don't know how to program a simple calculator... I'm surprised that the thing that surprises you most is that someone hacks something made by other person...

Maybe you don't know persons like Leibniz because he didn't make a flashcart or similar.

All I am saying is i dont want a flashcart i dont want something which sounds impossible or i have to put my final 2 brain cells together just to do it XD

 

[X_Frost]

DLCs are as secure as normal titles. And normal titles are very secure.

Understood, thanks for clarifying.

How about using patches for games, to run code, instead of standalone DLC.

I think the real problem is, is that no one really is interested in hacking the 3DS. Best case scenario some gateway/r4/supercard-like company will take the exploit and sell cards and make money out of it.

This thread couldn't exist if that was true, though. And many of us wish we could but are severely limited skill wise.

The matter is... how many people invest their time in that?

Not many can, it's the reason we rely on the people here, instead of doing this ourselves.

 

[X_Frost]

Sorry for double posting, didn't realize it was the same thread. Please delete this post if possible.

 

[daniilS]

I think there are enough people who are enthusiastic about this, but not many of them are skilled. I myself have some experience with arm7 assembly, and would give this a try if I had an idea how. Modifying a part of the firmware run-time may work, but will need to be repeated every time and I don't know how and where the firmware is stored after decryption. My guess is if we want something like this, we'd either need to modify the bios to decrypt and redirect the firmware to an accessible and known place, (hard without the chip being decapped), or find a way to modify the firmware right before it gets re-encrypted, like during a software update. Would that be possible?

 

[UraKn0x]

Hello, another hack idea (sorry if it was already posted) : do you think title banners/icons are encrypted with the same security level as the titles themselves? If it is not the case, maybe we could attack it by, for example, not putting the image end byte and write awesome homebrew code here. I know smealum played with the banners and icons, but I don't know if he tried to attack it.

@daniiilS : It would not be possible, firmware is never decrypted then re-encrypted by the console, it just gets decrypted with an asymetric key; if you modify the bios, (I don't know how, but maybe it could be possible), you could eventually run code before any other code is loaded, then you could do whatever you want, as I think the bios is not encrypted (there must be any thing that is not encrypted, as I think the decryption is done softwareside and not hardware-side)

PS : Feel free to tell me if I'm doing any error (I'm not very experimented)
(And if you just don't understand what I'm trying to say, don't worry, I'm French and my English is relatively bad, feel free to correct me again )

 

[profi200]

They are stored in the ExeFS which is located in the NCCH container. The entire NCCH is encrypted, so forget about it.

http://3dbrew.org/wiki/NCCH#CXI

 

[Duo8]

Understood, thanks for clarifying.

How about using patches for games, to run code, instead of standalone DLC.

Patches are DLCs IIRC.

Okay, and would it be possible to modify a small part of the firmware to f.e. disable a rom decryptor/legitimacy check jump? Would this allow running homebrew/hacks/fan translations (maybe even from the sd card)?

Yeah. But not permanently.

 

[X_Frost]

Patches are DLCs IIRC.

I meant insert code through the vulnerabilities that required patching in the first place.
Use the patch to introduce code when the original game loads.

 

[Foxi4]

I meant insert code through the vulnerabilities that required patching in the first place.
Use the patch to introduce code when the original game loads.

Just because something requires patching doesn't mean that it's a vulnerability, not to mention that not all bugs and crashes can be used to load anything, especially not code. On top of that, there's a whole spectrum of obstacles to get through just to get the loaded code to actually work.

 

[Kargaroc]

The boot-rom (BIOS) is stored in mask-ROM on the CPU die. It would be easier to just get the private key than it would be to change it in any way that's usable for homebrew.

 

[daniilS]

The boot-rom (BIOS) is stored in mask-ROM on the CPU die. It would be easier to just get the private key than it would be to change it in any way that's usable for homebrew.

Yes, I know. My idea was if it's maybe to keep the original bios in its place, but block the signals and send a modified custom version instead. But so far we don't know enough about the 1048 0H to do that, sadly.

 

[Arsen Tufankjian]

Has anyone gotten a successful RAM dump working? If so could I have a link to a blog post or something?
Maybe someone has had this idea already but I'm still working through all the pages of this thread.
I was thinking maybe there's something we can snatch up from RAM when the system goes to create a save game backup.

 

[migles]

it is not possible to packet inject the pokebank app, or another game?

 

[lambstone]

it is not possible to packet inject the pokebank app, or another game?

And even then pokebank will be useless because of the new 7.x keys used. The only way pokebank would work is if you were on 7.x and injecting it then would be pointless because well... eshop.

 

[migles]

And even then pokebank will be useless because of the new 7.x keys used. The only way pokebank would work is if you were on 7.x and injecting it then would be pointless because well... eshop.

and i forgot about eshop.. it is not possible to packet inject it? or edit packets which are sent to the 3ds? i am aware about probably having something like SSL protection but come on, how it is not possible to manipulate messages if we are the courier who delivered letters from the beggining...

i mean, let's say, all your communication to your friend goes through me, if you send crypted letters, your friend will not be able to read it, unless you send him the keys and that keys must go through me...