Developing for 4.4

Discussion in '3DS - Flashcards & Custom Firmwares' started by gudenau, May 17, 2014.

  1. gudenau
    OP

    gudenau Never a unique idea

    Member
    3,243
    1,216
    Jul 7, 2010
    United States
    /dev/random
    So at the moment this is mainly just some questions and me checking my information.

    The current exploit relies on the user's ds profile being crafted in such a way that the user name reads past the name portion. It the smashes the stack and uses ROP to take control of the system. In order to get to the NATIVE_FIRM processor it replaces interrupts to take control.

    So, how does this stack up against how it realy works?
     
  2. YoshiInAVoid

    YoshiInAVoid GBAtemp Advanced Fan

    Banned
    560
    336
    Jan 10, 2011
    You are missing a few points, there is an open source ROP loader available here:

    https://github.com/ctnieves/ROP-Loader

    It's much more buggy than the alternate ROP loader and GW's but it should help you learn more about the exploit if you really want.

    Namely, one detail you missed is that there are two sections to the DS profile data (to prevent corruption). The unicode username string in the second profile is the exact thing that is overflowed. The 1'st profile section is where most of the exploit is stored, the PC jumps to this.
     
  3. gudenau
    OP

    gudenau Never a unique idea

    Member
    3,243
    1,216
    Jul 7, 2010
    United States
    /dev/random

    Ok, thanks. I will start tinkering with this soon.
     
  4. gudenau
    OP

    gudenau Never a unique idea

    Member
    3,243
    1,216
    Jul 7, 2010
    United States
    /dev/random
    So, the ROP loaders load more rop chains?
     
  5. Foxi4

    Foxi4 On the hunt...

    pip Reporter
    23,529
    21,457
    Sep 13, 2009
    Poland
    Gaming Grotto
    Is there any particular reason as to why you'd like to develop for 4.4 rather than 4.5 like everybody else?
     
  6. gudenau
    OP

    gudenau Never a unique idea

    Member
    3,243
    1,216
    Jul 7, 2010
    United States
    /dev/random
    The one I have.
     
  7. Snailface

    Snailface My frothing demand for 3ds homebrew is increasing

    Member
    4,324
    1,983
    Sep 20, 2010
    Engine Room with Cyan, watching him learn.
    Play with this one instead, its more stable.
    https://github.com/Drienn/3DS-ROPLoader
    (this is the recommended installer that most people actually use)

    or...

    This one doesn't compile yet, but the rop commands are well commented in patches.S:
    https://github.com/WinterMute/ROPInstaller
    (this is from the guy who made devkitpro)
     
  8. gudenau
    OP

    gudenau Never a unique idea

    Member
    3,243
    1,216
    Jul 7, 2010
    United States
    /dev/random

    I found Wintermutes last night.

    Looked at the source, looks like it will be great when it is done.