Homebrew [ANNOUNCE] Yellows8 has updated the 3ds_browserhax_common to support >=9.9 O3DS, n3DS

[Intronaut]

I dont' think gateway work for become his linker compatible with all 3DS et firmware possible and make more money ://

Gateway don't like money :/

It's not about Gateway doesn't like money. It's about Nintendo hates piracy

 

[djbrianz]

Doubt it, but they need to step up their game to compete with the CFW's slowly taking over their grounds. I guess time will tell.

Gatewait.....

--------------------- MERGED ---------------------------

It's not about Gateway doesn't like money. It's about Nintendo hates piracy

Fuck nintendo

 

[NeoSlyde]

Nintendo

 

[Dyshonest]

Doubt it, but they need to step up their game to compete with the CFW's slowly taking over their grounds. I guess time will tell.

Slowly? What the hell do those Chinese scammers have that CFW users don't?

Pretty sure both can play backups.

 

[BurningDesire]

This thread is very interesting.

 

[djbrianz]

Usage with seperate exploits
With php, this repo can be used with the following:

• Include config based on browserhax_cfg_example.php, see that file for details. Include 3dsbrowserhax_common.php.
• Set the global $ROPHEAP variable to an address under the process which the ROP-chain can use for storing arbitrary data(for example, this could be memory where data was sprayed for non-ROP-chain data, since that data isn't needed anymore at this point).
• Call generate_ropchain(). This generates a ROP-chain which can be included in JS via the $ROPCHAIN global variable. To generate a binary-only ROP-chain instead, set the $generatebinrop global variable to value 1 before calling generate_ropchain().
• The ROP-chain data can now be used for generating the final html/js, for example: "var ropchain = unescape($ROPCHAIN);"
• This can be used before the above ROP-chain data, for use as a ROP NOP-sled: "unescape($NOPSLEDROP);"
• This can be used for spraying the stack-pivot gadget address, like for vtable funcptrs: "unescape($STACKPIVOT);"
• This can be used when the exploit requires using the "pop {pc}" gadget: "$somestr.= genu32_unicode($POPPC);"

Yellows8 said that there won't be exploits in HIS webhax but he's giving us an opportunity to exploit it our self....wonder where this will lead...
Kernel Exploit???Since we are modding the 3ds browser WebKit??

 

[Pecrow]

Usage with seperate exploits
With php, this repo can be used with the following:

• Include config based on browserhax_cfg_example.php, see that file for details. Include 3dsbrowserhax_common.php.
• Set the global $ROPHEAP variable to an address under the process which the ROP-chain can use for storing arbitrary data(for example, this could be memory where data was sprayed for non-ROP-chain data, since that data isn't needed anymore at this point).
• Call generate_ropchain(). This generates a ROP-chain which can be included in JS via the $ROPCHAIN global variable. To generate a binary-only ROP-chain instead, set the $generatebinrop global variable to value 1 before calling generate_ropchain().
• The ROP-chain data can now be used for generating the final html/js, for example: "var ropchain = unescape($ROPCHAIN);"
• This can be used before the above ROP-chain data, for use as a ROP NOP-sled: "unescape($NOPSLEDROP);"
• This can be used for spraying the stack-pivot gadget address, like for vtable funcptrs: "unescape($STACKPIVOT);"
• This can be used when the exploit requires using the "pop {pc}" gadget: "$somestr.= genu32_unicode($POPPC);"

Yellows8 said that there won't be exploits in HIS webhax but he's giving us an opportunity to exploit it our self....wonder where this will lead...
Kernel Exploit???Since we are modding the 3ds browser WebKit??

SO the question is, who will take on the challenge?

 

[djbrianz]

• 0: This "ROP-chain" is just an address for THROW_FATALERR. Hence, throw_fatalerr() will be triggered when the above browserhaxcfg_handledefault() path is executed when browserhaxcfg_handledefault() doesn't initialize $ropchainselect.
• 1: <=v4.x arm9hax also implemented by oot3dhax(https://github.com/yellows8/oot3dhax) under EXECHAX=3, see 3dsbrowserhax_common.php generateropchain_type1().
• 2: ARM11-code loading via gspwn, see $arm11code_loadfromsd below. The payload should be position-independent-code without any GOT, since the payload is loaded to R-X memory where the address varies per title version. The payload is called with r0 set to an address of a structure mainly containing funcptrs for various functions in the process, see generateropchain_type2(). At the start of this ROP-chain, the sub-screen colorfill is set to display yellow, at the end it's set to display white.

Arm9 access with oot?

 

[teampleb]

SO the question is, who will take on the challenge?

**grabs popcorn**

 

[djbrianz]

SO the question is, who will take on the challenge?

**grabs popcorn**

Ohh yeah

--------------------- MERGED ---------------------------

Things are looking goodddd!!

--------------------- MERGED ---------------------------

We have to wait and see...

SO the question is, who will take on the challenge?

.

 

[Bubsy Bobcat]

Hyped. As. Fuck.

 

[Sr. G]

so... WTF it's happening here?

 

[djbrianz]

Now there's a legit hype train that will actually bring you somewhere........

 

[SomeGamer]

Now there's a legit hype train that will actually bring you somewhere........

Is there?

 

[Dyshonest]

Would any of this work on 10.0.whatever, or did things change after 9.9?

 

[Sr. G]

Now there's a legit hype train that will actually bring you somewhere........

alright... all aboard! (?)

..

i was asking for this new things, what we can do with all of this?

 

[SomeGamer]

10.0?

 

[djbrianz]

10.0?

I don't think so

--------------------- MERGED ---------------------------

We depend on the browser version

I don't think so

 

[VegaRoXas]

I don't get it, why is there a hype train? He is just trying and is saying himself that he dosn't know if he can do it...
@^wwqjbrians

 

[SomeGamer]

I don't think so

--------------------- MERGED ---------------------------

We depend on the browser version

10.0 didn't change browser. Also, just read it's supported.