Homebrew AES key scrambler

[Immaculate]

Some known, some unknown. ( ͡° ͜ʖ ͡°)

so I'm guessing there's a work around for when new firmwares get released? it would be weird if a new firmware like 10.4 gets released or when nintendo introduces their new account system in march

 

[Syphurith]

It's a 10.3 sysNAND.

That's quite a relief to see your team has done that on a latest SysNAND.
I still can remember the low possibility i've calculated for this arm9loaderhax.
Besides this, have you get something special out of that?
I assume there could only be the arm9loader in RAM when this triggered.
--After I've just get a ladder to across the firewall.

 

[motezazer]

Some known, some unknown. ( ͡° ͜ʖ ͡°)

Known: memchunkhax2 (but perhaps not with svcControlMemory)
Unknown: random exploit in ARM9/possibly random entrypoint

 

[hippy dave]

( :3c )

3/10 no sexy nail varnish.

 

[RednaxelaNnamtra]

Known: memchunkhax2 (but perhaps not with svcControlMemory)
Unknown: random exploit in ARM9/possibly random entrypoint

I think they use the arm9 loader exploit from the 32c3 presentation to get arm9 and firmlaunch to the systemnand after that. Also they seem to have the keys to load the newest firm. This is why they could load it on boot.
I could be wrong(maybe they got something better working), but I think that's what they are showing in the video.

 

[motezazer]

I think they use the arm9 loader exploit from the 32c3 presentation to get arm9 and so firmlaunch to the systemnand after that. Also they seem to have the keys to load the newest firm. This is why they could load it on boot.
I could be wrong(maybe they got something better working), but that's what I think they showed in the video.

Yes, that could work.
And if this is indeed right...

It's their usual "lol we did it and u didnt lolololololo".

First hash of https://salthax.org/ is the sha256 of the decrypted N3DS key sector.

 

[SciresM]

Since DLLs are gross, some C# code for the Key Scrambler: https://github.com/SciresM/CTRKeyScrambler

Doesn't include C because of legality reasons, but it should be trivial for anyone interested in using it to acquire C.

 

[WhoAmI?]

lol
https://whois.icann.org/en/lookup?name=gbatemp.net

Leeell xD https://geoiptool.com/en/?ip=gbatemp.net

The domain was registered under a US business but the servers are having frog legs in France

 

[motezazer]

Leeell xD https://geoiptool.com/en/?ip=gbatemp.net

The domain was registered under a US business but the servers are having frog legs in France

The EU signed the WCT, so...

 

[WhoAmI?]

The EU signed the WCT, so...

God dang it xD At least I got "fame" for over an hour.

 

[75mak]

This thread made an interesting read... will look forward to te day emunand 9.5+ arrives and it becomes game, set and match for n3ds and o3ds dor that matter... no more cat and mouse

 

[Shadowtrance]

This thread made an interesting read... will look forward to te day emunand 9.5+ arrives and it becomes game, set and match for n3ds and o3ds dor that matter... no more cat and mouse

Until nintendo throws another spanner in the works. haha

 

[plushifoxed]

Out of curiosity, why is the Salthax video private now? What was contained/shown in it, anyway?

 

[Suiginou]

Out of curiosity, why is the Salthax video private now? What was contained/shown in it, anyway?

Why? Probably butthurt over the dislikes.

Contained: Coldboot into sysNAND CFW on actual 10.3 (system update tried, just said the console was up to date) and a menu that would pop up at the push of a button.

Until nintendo throws another spanner in the works. haha

9.6+ FIRM keys are pretty much the final frontier. There's nowhere else to go for another layer of crypto.

 

[motezazer]

9.6+ FIRM keys are pretty much the final frontier. There's nowhere else to go for another layer of crypto.

While the secret NAND sector is not decrypted, they can change the keys everytime they want to.

 

[Suiginou]

While the secret NAND sector is not decrypted, they can change the keys everytime they want to.

The NAND sector 0x12c00 can be decrypted from what I know. I just don't know how people do it.

 

[motezazer]

The NAND sector 0x12c00 can be decrypted from what I know. I just don't know how people do it.

Yes it can, SALT did it.

 

[Ekaitz]

If SALT did it, it made be public a day. Let's hope for it.

 

[Dazzozo]

If SALT did it, it made be public a day. Let's hope for it.

Good luck: we did it 9 months ago. Not long after K9L2 release.

 

[guitarheroknight]

If SALT did it, it made be public a day. Let's hope for it.

GW is realistically our only hope. But hey, who says that they don't have it, maybe they're holding onto it until it's absolutely needed since most of the CFW'S will rip their work off anyway. But all in all, F "leet" devism. Also, potatoes.