Hacking cubic ninja best hope for n3ds =<9.2 (kernel access)

bsod

Member
OP
Newcomer
Joined
Feb 19, 2015
Messages
12
Trophies
0
Age
51
XP
55
Country
THIS IS NOT NINJHAX
Some (all?) n3ds are shipping at 9.0, because of the new browser we cannot use it for ROP, but we can still use cubic ninja! "Oh this is a homebrew post, wrong forum." Nope, this is about using CN for kernel (privileged) code execution, complete control. This is not MSET, it works beyond 4.5 to my knowledge it was patched in 9.2.

I'm not going to say what others have said better http://yifan.lu/ <this man has worked with yellows8 or at least been in contact with him, and is a known vita hacker. Yifan Lu contacts sema on sema's writeup of ninjhax commenting on the GPU vulnerability (stage 2 of sema's writeup,also mentioned in Yifan's writeup), sema's reply is in relation to ninjhax and irrelevant for our exploit (except that cubic ninja hasnt been patched!) http://smealum.net/?p=517. We also learn a little from an Anon comment in response to sema, we learn that gateway uses stage 2 of the exploit but not sema's stage 3 or stage 4. Something quick to note is gateway uses the browser for ROP, (stage 1) which is no longer an option on the n3ds. It's my guess the people at gateway are trying to find a new way to get ROP capability and thats why we haven't seen a n3ds model/update yet. BUT WE HAVE CUBIC NINJA!!

If this is possible why hasn't sema done it already? Because sema does not want to give us kernel access. He is worried it will cause the spread of piracy, a noble stance but your homebrew is mainly emulators. I guess old ROMs are okay huh?

With Yifan's work and NInjhax now being open source this should be done.
 

Apache Thunder

I have cameras in your head!
Member
Joined
Oct 7, 2007
Messages
4,462
Trophies
3
Age
36
Location
Levelland, Texas
Website
www.mariopc.co.nr
XP
6,893
Country
United States
Gateway's current "Launcher" isn't setup to be launched from Cubic Ninja currently. The entry point isn't the same so you'd have to build a new rop chain pretty much. Ninjhax rop chain isn't setup to get kernel access in it's current form and if you did, the memory environment might not be the same so Gateway's current payloads for other stages of the exploit might not work correctly or needs retweaking.


Gateway will release their N3DS exploit by the time someone reverses engineers Ninjhax for kernal access. You're pretty much doing a full on CFW at this point and we all know the track record for that is. The only reason the old 4.5 CFW even exists was due to a leak... :(
 

WulfyStylez

SALT/Bemani Princess
Member
Joined
Nov 3, 2013
Messages
1,149
Trophies
0
XP
2,877
Country
United States
With Yifan's work and NInjhax now being open source this should be done.

Like others have said, it's more than possible and it's already been done by some people. If you're actually capable of doing this though, gateway is completely useless. Counterproductive even.
 
  • Like
Reactions: Margen67

Rokkubro

Well-Known Member
Member
Joined
Apr 4, 2014
Messages
115
Trophies
0
Age
35
XP
238
Country
Technically it's possible to inject a modified version of Yifan's LoadCode(which is much easier to use than gateway's method) into the Thread 0 ROP of Ninjhax and use it to load the rest of the exploit now that you have userland.
There are a couple of issues though, mainly that LoadCode is a Spider 4096(old3ds 9.x) ROP chain, which means you'd have to port it to Skater(N3DS), which is difficult unless you know what you're doing (you might be able to work out the values by inspecting the code of Ninjhax). Also, the Gateway exploit loads some specific addresses into memory during the first stage (ROP) to be used by the second stage (ARM11). You'd need to load these addresses during your custom LoadCode AND you'd need to use memory locations that work for N3DS. In the first place though, you'd need to be able to change Smealum's Ninjhax code, and to do this you need(at the very least) the proprietary Blowfish key, which is somewhere within the code of Cubic Ninja(which is difficult to decrypt if you only have a N3DS). Additionally, the version of ctrulib Smealum lists as a dependency for Ninjhax doesn't work, unless you manually add some functions yourself. On top of all this once you actually DO get kernel access, you'll have to learn how to do everything yourself, as ctrulib and devkitarm only support userland code.

Wow, I wrote a lot... Sort of became a rant in the end :P
TL;DR - It's a #@%#ing pain to do and I've been working on it for over a week. Wait for Gateway, they'll probably be faster.
 
  • Like
Reactions: Azel

Kracken

Well-Known Member
Member
Joined
Jan 12, 2015
Messages
257
Trophies
0
Age
42
XP
134
Country
United States
Wow, I wrote a lot... Sort of became a rant in the end :P
TL;DR - It's a #@%#ing pain to do and I've been working on it for over a week. Wait for Gateway, they'll probably be faster.


The more people working on this the better. If people have the technical know-how and the ambition to help push things forward on N3DS than I'd say go for it. Some of the best work in the various console scenes has been done by ambitious people who never received much financial compensation, if any. It's thanks to people like them that any scene even exists.
 
  • Like
Reactions: Margen67 and SLiV3R

Rokkubro

Well-Known Member
Member
Joined
Apr 4, 2014
Messages
115
Trophies
0
Age
35
XP
238
Country
The more people working on this the better. If people have the technical know-how and the ambition to help push things forward on N3DS than I'd say go for it. Some of the best work in the various console scenes has been done by ambitious people who never received much financial compensation, if any. It's thanks to people like them that any scene even exists.
Thanks, I'm still working on it! I don't have much free time during the week, but this weekend I'll have time to work on it (almost) full time. Hopefully I'll have something to show off soon... Probably just the basic UVLoader from Spider3DS tools on N3DS
 

Kracken

Well-Known Member
Member
Joined
Jan 12, 2015
Messages
257
Trophies
0
Age
42
XP
134
Country
United States
Thanks, I'm still working on it! I don't have much free time during the week, but this weekend I'll have time to work on it (almost) full time. Hopefully I'll have something to show off soon... Probably just the basic UVLoader from Spider3DS tools on N3DS

I have no idea what you are talking about, but thank you for doing it.
 
  • Like
Reactions: Margen67

Rokkubro

Well-Known Member
Member
Joined
Apr 4, 2014
Messages
115
Trophies
0
Age
35
XP
238
Country
I have no idea what you are talking about, but thank you for doing it.
Oh, it's just the point at which I know I have userland code execution. More importantly though, it's the first point at which I'll be able to see that I've made any progress.
 
  • Like
Reactions: Margen67

bsod

Member
OP
Newcomer
Joined
Feb 19, 2015
Messages
12
Trophies
0
Age
51
XP
55
Country
Well hop to it! What are you waiting for? Sorry that was @ bsod and not you Apache, heh.
This was acutally my plan but I first cast out a net to see who else may be doing the same thing. No need to start at page 1 if i can help someone in progress.

In my post i focused mainly on the n3ds, this is also a gateway free solution for the old 3ds as-well. The actual exploits would be slightly different, mem locations, spider/slater etc.

Apache Thunder
I am aware this would not work "out-of-the-box" merely referencing gateway and ninjhax as a proof of concept
Deathracelord
You make a VERY good point about a possible new memory configuration, I wasn't thinking about that at the time of post. Perhaps it would be easier to first create the exploit for the old 3ds then modify it for th n3ds? I was laid off recently and would like to offer any help I can to you, currently I have some free time.

I may begin work on the old 3ds first. more is known about it. I have both a 9.2 old 3ds and a 9.0 n3ds
 
  • Like
Reactions: Margen67

bsod

Member
OP
Newcomer
Joined
Feb 19, 2015
Messages
12
Trophies
0
Age
51
XP
55
Country
and if this happened the price of cubic ninja would sky-rocket again....or everyone would buy sky3ds cards
Kernel by ways of Cubic Ninja will happen.
Like others have said, it's more than possible and it's already been done by some people. If you're actually capable of doing this though, gateway is completely useless. Counterproductive even.
I guess it HAS happened.
I will be working on this and others (Deathracelord). It seems like private efforts are completed and functioning. Gateway or CB whichever is cheaper I'd say. Does sky have privileged mode? From what I ha gathered gateway>sky, I own neither.

edit: every time I try to link deathracelord it links DeaTh instead :glare:
 
  • Like
Reactions: Margen67

Slushie3DS

Cold Beverage Lover
Member
Joined
Jan 9, 2015
Messages
707
Trophies
0
Age
29
XP
420
Country
United States
Tfw spiderhax can have its offsets changed to work with SKATER, making this post useless.

CWgMf.gif
 

Slushie3DS

Cold Beverage Lover
Member
Joined
Jan 9, 2015
Messages
707
Trophies
0
Age
29
XP
420
Country
United States
Then why hasn't it been done? Kernel mode has yet to be achieved publicly by use of cubic ninja. YOUR post was useless. Thanks.

It's already been confirmed as possible directly in Smea's Regionthree readme, which, again uses spiderhax. No one has really cared to do it yet because a lot of REs are are waiting until the N3DS is more matured.
 

bsod

Member
OP
Newcomer
Joined
Feb 19, 2015
Messages
12
Trophies
0
Age
51
XP
55
Country
It's already been confirmed as possible directly in Smea's Regionthree readme, which, again uses spiderhax. No one has really cared to do it yet because a lot of REs are are waiting until the N3DS is more matured.
I did not read Regionthree because I do not need region free, I will go read it after posting. What about the old 3ds then? the same exploit can be used on it, all the information is there, why is there no kernel access for it? (no gateway, no sky talking only cubic ninja)
 
  • Like
Reactions: Margen67

Slushie3DS

Cold Beverage Lover
Member
Joined
Jan 9, 2015
Messages
707
Trophies
0
Age
29
XP
420
Country
United States
I did not read Regionthree because I do not need region free, I will go read it after posting. What about the old 3ds then? the same exploit can be used on it, all the information is there, why is there no kernel access for it? (no gateway, no sky talking only cubic ninja)

Spiderhax, otherwise known as WebKit exploiting, is possible without the game. It is used in Yifan Lu's spider3DStools to gain ARM11 kernel access, and I believe it was used in another exploit system to gain ARM9. It crashes the browser into a panic while injecting a binary. Yifan Lu is already working on a way to open the Homebrew Launcher's boot.3DSX via the browser in his exploit dubbed spiderninja, which you can see below, and was only shown for a bit before removed. In the Regionthree Readme, Smea states that the exploit will not work with SKATER, but the code is there, and he hinted that anyone can do it. I haven't looked much into SKATER, as I do not own an N3DS, but it's pretty safe to assume that it still uses WebKit, meaning it should still be possible, with a bit of rewriting. You seem to be very dependent on a game, which ultimately, is not something a long term exploit should depend on.




I was under the impression that skater was not vulnerable to the same overflow as spider. Is it just not being "overflown" enough by the current exploit?
Why wouldn't it be? If SKATER is still relying on WebKit, which I am pretty sure it is, I don't see why it wouldn't work on it. Again, I'm just working off of what Smea hinted at in his Readme.

 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • OctoAori20 @ OctoAori20:
    I stopped believing or caring about that dude when I found out about some of the more questionable nonsense he did in his life.
  • BigOnYa @ BigOnYa:
    Like what? I didn't know or hear.
  • K3Nv2 @ K3Nv2:
    You mean like every famous person that ever existed
    +1
  • K3Nv2 @ K3Nv2:
    I get so tired of hearing oh I liked him until...
  • OctoAori20 @ OctoAori20:
    I just know dude was a chronic alcoholic and such.
  • BigOnYa @ BigOnYa:
    I've been to his chicken restaurant he started in his 2nd movie, Holy Chicken, was pretty good. It is only 15-20 miles from me in Ohio. It only lasted 1 yr or so then closed tho.
  • OctoAori20 @ OctoAori20:
    There are very few people I just have just an immense dislike of and he's one of those very few people, the only other example is Gene Simmons. My musician uncle on my mother's side of the family actually met Gene once during some event and said he was the most unpleasant person to be around.
  • K3Nv2 @ K3Nv2:
    I met myself once turns out that guy is a giant piece of shit that doesn't deserve any of my respect
  • BigOnYa @ BigOnYa:
    Damn alcoholics! (Sshhh- Opens another beer)
  • OctoAori20 @ OctoAori20:
    Agreed, Ken
  • OctoAori20 @ OctoAori20:
    I can't say I've ever tried even a sip of beer tbh-
  • K3Nv2 @ K3Nv2:
    You met yourself also and is a giant piece of shit?
    +1
  • OctoAori20 @ OctoAori20:
    Then again, I don't think I'd really enjoy it //shrug
  • OctoAori20 @ OctoAori20:
    I'm sure it's an acquired taste :P
  • K3Nv2 @ K3Nv2:
    Poor lad can never enjoy the amazing taste of four loko
    +1
  • BigOnYa @ BigOnYa:
    Root beer is a gateway drink, don't ever try it either.
  • K3Nv2 @ K3Nv2:
    @BigOnYa, don't you love how smooth MD20 is
  • BigOnYa @ BigOnYa:
    Mad dog 20 20? Oh yea fixed the typo. I haven't seen that or had forever. Do they still make it?
  • K3Nv2 @ K3Nv2:
    I think it's why I'm alive
    +1
  • BigOnYa @ BigOnYa:
    What happens if when playing Paper Mario, you start a fire in-game?
  • Psionic Roshambo @ Psionic Roshambo:
    Paper Mario is a drug dealer and he is all about the paper yo lol
    +2
  • OctoAori20 @ OctoAori20:
    Ffft
  • OctoAori20 @ OctoAori20:
    On another note, I love how folks are drawing Callie in that suit that Splatoon NA dropped on Twitter
    OctoAori20 @ OctoAori20: On another note, I love how folks are drawing Callie in that suit that Splatoon NA dropped on...