Homebrew Downgrading 11.0/11.1 3DSs without DSiWareHax is possible

[Salamencizer]

Now that waithax is here, a reminder:

If you remember back in 11.0, Nintendo added an anti downgrade patch. When installing a title, the 3ds would check against a hardcoded version list stored in process9, and if the version was too low, it would fail. However, this method was imperfect, and is vulnerable to a type of race condition known as a TOCTTOU, or Time Of Check To Time Of Use. A TOCTTOU is an exploit where the data is changed after the validity of the data is checked, but before the data is used. In short, the way the process should work is:

Application manager is asked to install newer version -> Version is checked against the process9 minimum version list -> Version is higher than minimum version -> Install

or

Application manager is asked to install older version -> Version is checked against the process9 minimum version list -> Version is lower than minimum version -> Abort

The way it can end up working though is:

Application manager is asked to install newer version -> Version is checked against the process9 minimum version list -> Version is higher than the minimum version -> Data is swapped out with older title -> Install older title

This would basically allow us to downgrade NATIVE_FIRM to 10.4 (kind of like a hardmod downgrade) using software only and no secondary 3ds and no DSiWare.

The reason I'm saying we only downgrade NATIVE_FIRM is because of the nature of the exploit. Although it would be perfectly possible to downgrade the entire system, the race condition would need to work for every single title you install, and due to the inherently unreliable nature of race conditions, it would be easier to downgrade NFIRM only and then downgrade normally.

As far as I know, no code has been written for this yet.

What happened in 11.2 was Nintendo prevented this race by doing a second version check. This effectively prevents the race

If Someone manages to combine this vuln and waithax into a new version of sysUpdater, it would first be used to downgrade the NFirm, and then the whole console. BAM.
This will not require any special DSiWare.
Someone start working on this imo

 

[Arubaro]

I'm not sure if this is entirely needed, because once you downgrade your NATIVE_FIRM to the 10.4's one, you can downgrade to 9.2 "just as if you were on 10.4"
using sysDowngrader etc

 

[Salamencizer]

I'm not sure if this is entirely needed, because once you downgrade your NATIVE_FIRM to the 10.4's one, you can downgrade to 9.2 "just as if you were on 10.4"
using sysDowngrader etc

This is how you downgrade the NATIVE_FIRM to 10.4's

 

[RamTheSecond]

Is this a Dream ?

 

[The Catboy]

We already have enough threads about this
http://gbatemp.net/threads/working-dsiwarehax-installer-with-waithax-slowhax.452780/
http://gbatemp.net/threads/dsiwarehax-w-waithax-untested.452751

 

[Salamencizer]

Is this a Dream ?

No, it's an overdose of Nintendo's stability™

--------------------- MERGED ---------------------------

We already have enough threads about this
http://gbatemp.net/threads/working-dsiwarehax-installer-with-waithax-slowhax.452780/
http://gbatemp.net/threads/dsiwarehax-w-waithax-untested.452751

This thread is about how a NFirm downgrade is possible without DSiWareHax

 

[Tenshi_Okami]

We already have enough threads about this
http://gbatemp.net/threads/working-dsiwarehax-installer-with-waithax-slowhax.452780/
http://gbatemp.net/threads/dsiwarehax-w-waithax-untested.452751

This one is different, OP is showing a vulnerability that could help us downgrade NATIVE_FIRM without DSIWarehax

 

[The Catboy]

No, it's an overdose of Nintendo's stability™

--------------------- MERGED ---------------------------

This thread is about how a NFirm downgrade is possible without DSiWareHax

Wait, really?

 

[Lotoonlink]

Wait, really?
View attachment 71843

Yep, looks like christmas came early!

 

[ih8ih8sn0w]

When kids still haven't learned from the early builds of sysdowngrader back in the memechunkhax2 days...

 

[mehmeh11]

When kids still haven't learned from the early builds of sysdowngrader back in the memechunkhax2 days...

???

 

[ih8ih8sn0w]

???

the ancient sysdowngrader builds downgraded nfirm first and led to bricks...

 

[Soulsilve2010]

If something like that is possible it would be very interesting.

 

[mehmeh11]

the ancient sysdowngrader builds downgraded nfirm first and led to bricks...

yikes, hopefully there can be a way around that

 

[BARNWEY]

When kids still haven't learned from the early builds of sysdowngrader back in the memechunkhax2 days...

LOLOLOLOLOLOLOL, I MEMBER........

 

[Raugo]

When kids still haven't learned from the early builds of sysdowngrader back in the memechunkhax2 days...

Is not the same case, you can't downgrade the native_firm to 9.2 first because the rest of the system isn't compatible with it but you can downgrade the native_firm to 9.6-10.7 without problem.

 

[Somebody Whoisbored]

I believe that wait/slowhax only gives ARM11 kernel privileges, which would not have the sufficient permissions to install titles (or updates as they are the same thing)

 

[maikeh]

And I just bought Rytmik Rock Edition to downgrade 2 3DSes... $1.99 wasted, fuck. (I know it isn't a lot so I shouldn't care about it)

Aside from that, this downgrade method looks interesting. Hope somebody releases this soon.

 

[DocKlokMan]

I believe that wait/slowhax only gives ARM11 kernel privileges, which would not have the sufficient permissions to install titles (or updates as they are the same thing)

ARM11 is all we've ever had when downgrading to 9.2 (if we had ARM9 then we could install CFW and A9LH without downgrading).

 

[N7Kopper]

I believe that wait/slowhax only gives ARM11 kernel privileges, which would not have the sufficient permissions to install titles (or updates as they are the same thing)

ARM11 kernel handles all installations after they pass an ARM9 security check. ARM9 actually can't install stuff at all. This is why Decrypt9 can't install a game direct from cartridge.

The problem with 11.0 and up is that ARM9 checks the version information in a way not easily bypassable just by deleting the "old" data before installing the "new". And worse, 11.2 fixed the TOCTTOU. But for 11.2 to fix it means that 11.0 and 11.1 had it, and are therefore vulnerable outside of TWL_FIRM. The only reason that TWL_FIRM is still vulnerable is that FIRMs need to remain unencrypted in order to load, and the essential software that NATIVE_FIRM loads doesn't check for a version above the one that came with 9.6 yet. So don't update all willy-nilly even if you have everything ready. But why would you? Shouldn't you be downgrading if you do?