Hacking Developing for 4.4

[gudenau]

So at the moment this is mainly just some questions and me checking my information.

The current exploit relies on the user's ds profile being crafted in such a way that the user name reads past the name portion. It the smashes the stack and uses ROP to take control of the system. In order to get to the NATIVE_FIRM processor it replaces interrupts to take control.

So, how does this stack up against how it realy works?

 

[YoshiInAVoid]

You are missing a few points, there is an open source ROP loader available here:

https://github.com/ctnieves/ROP-Loader

It's much more buggy than the alternate ROP loader and GW's but it should help you learn more about the exploit if you really want.

Namely, one detail you missed is that there are two sections to the DS profile data (to prevent corruption). The unicode username string in the second profile is the exact thing that is overflowed. The 1'st profile section is where most of the exploit is stored, the PC jumps to this.

 

[gudenau]

You are missing a few points, there is an open source ROP loader available here:

https://github.com/ctnieves/ROP-Loader

It's much more buggy than the alternate ROP loader and GW's but it should help you learn more about the exploit if you really want.

Namely, one detail you missed is that there are two sections to the DS profile data (to prevent corruption). The unicode username string in the second profile is the exact thing that is overflowed. The 1'st profile section is where most of the exploit is stored, the PC jumps to this.

Ok, thanks. I will start tinkering with this soon.

 

[gudenau]

So, the ROP loaders load more rop chains?

 

[Foxi4]

Is there any particular reason as to why you'd like to develop for 4.4 rather than 4.5 like everybody else?

 

[gudenau]

The one I have.

 

[Snailface]

Ok, thanks. I will start tinkering with this soon.

Play with this one instead, its more stable.
https://github.com/Drienn/3DS-ROPLoader
(this is the recommended installer that most people actually use)

or...

This one doesn't compile yet, but the rop commands are well commented in patches.S:
https://github.com/WinterMute/ROPInstaller
(this is from the guy who made devkitpro)

 

[gudenau]

Play with this one instead, its more stable.
https://github.com/Drienn/3DS-ROPLoader
(this is the recommended installer that most people actually use)

or...

This one doesn't compile yet, but the rop commands are well commented in patches.S:
https://github.com/WinterMute/ROPInstaller
(this is from the guy who made devkitpro)

I found Wintermutes last night.

Looked at the source, looks like it will be great when it is done.