Hacking Can someone help me with this?

Boogieboo6

@realDonaldTrump
Member
Joined
Jul 30, 2015
Messages
965
Trophies
0
Age
22
XP
775
Country
United States
My feels
hqdefault.jpg
 

olec04

Working on Project Heaven!
OP
Banned
Joined
Apr 10, 2015
Messages
851
Trophies
0
Location
Trying to downgrade on 11.0 via AM services
XP
75
Country
United States
"it's unknown if anyone actually exploited this successfully at the time of writing"
ARM9's and ARM11's exception vectors are hardcoded to point at the CPU's internal memory (0x08000000 region for ARM9, AXIWRAM for ARM11). While the bootrom does set them up to point to an endless loop at some point during boot, it does not do so immediately. As such, a carefully-timed fault injection (via hardware) to trigger an exception (such as an invalid instruction) will cause execution to fall into ARM9 RAM.

Since RAM isn't cleared on boot (see below), one can immediately start execution of their own code here to dump bootrom, OTP, etc. The ARM9 bootrom does the following at reset: reset vector branches to another instruction, then branches to bootrom+0x8000. Hence, there's no way to know for certain when exactly the ARM9 exception-vector data stored in memory gets initialized.
 

Swiftloke

Hwaaaa!
Member
Joined
Jan 26, 2015
Messages
1,770
Trophies
0
Location
Nowhere
XP
1,335
Country
United States
Thing is that's not going to lead to an exploit most (if any) people would use because A. It needs existing access to arm9 RAM (which would probably turn into an exploit in itself) and B. It's a hardware exploit, which means practically nobody will use it, and an extremely timing-sensitive one at that. The only thing it would be useful for is dumping the bootrom.
 
  • Like
Reactions: olec04

You may also like...

General chit-chat
Help Users
  • K3N1 @ K3N1:
    Dr.Phil?
  • Psionic Roshambo @ Psionic Roshambo:
    Repeated child hood trauma
    +2
  • Psionic Roshambo @ Psionic Roshambo:
    Even Dr Phil says there is no fix for her disorder
  • K3N1 @ K3N1:
    It didn't work for bam margera
  • Psionic Roshambo @ Psionic Roshambo:
    He has some videos on narcessistic personality disorder
  • Psionic Roshambo @ Psionic Roshambo:
    It's heart breaking that a person can go through an entire life and never know true peace or happiness
    +2
  • Psionic Roshambo @ Psionic Roshambo:
    Literally robbed of life
  • AncientBoi @ AncientBoi:
    Oh :shit: gotta get ready for my doctors appmnt. Gastro again. :sad: bye guys
    +1
  • M4x1mumReZ @ M4x1mumReZ:
    See ya later
    +1
  • M4x1mumReZ @ M4x1mumReZ:
    Get better soon
  • K3N1 @ K3N1:
    Remember to tell him to use lube this time
    +1
  • captainbob321 @ captainbob321:
    Hello!
  • captainbob321 @ captainbob321:
    What's so Funny, @M4x1mumReZ
    ?
    +1
  • M4x1mumReZ @ M4x1mumReZ:
    Welcome new user
  • trepp0 @ trepp0:
    Just got the notice that school is being released 2 hours early cause of the winter storm
  • trepp0 @ trepp0:
    lets go
  • Psionic Roshambo @ Psionic Roshambo:
    Better than 3 hours late from a lockdown lol
    +1
  • FAST6191 @ FAST6191:
    While I know you mean in case of someone confusing schooling establishment from shooting establishment (many of the same letters) I am still going to read that as lockdown (also known as lock in) for a pub
  • FAST6191 @ FAST6191:
    where if you were in the club you could be invited to be there as a guest of the landlords after things are supposed to stop being served
  • FAST6191 @ FAST6191:
    Have technically done that in a school but it was the sports centre associated with the school more than the school itself
  • FAST6191 @ FAST6191:
    being drunk in school was either because drunk on playing field or could not be arsed with one particular Thursday afternoon so went and had some beers and played some games instead before returning for an ill advised last lesson/period
  • K3N1 @ K3N1:
    Being drunk and high in school was cool
  • K3N1 @ K3N1:
    It was high school
    K3N1 @ K3N1: It was high school