Download Play modification?

Discussion in '3DS - Homebrew Development and Emulators' started by CeeDee, May 30, 2016.

  1. CeeDee
    OP

    CeeDee hm?

    Member
    3,803
    5,307
    May 4, 2014
    United States
    somewhere
    Is there any way to modify and send CIAs temporarily to other users or something of the like, via Download Play? I know modification is possible, like CTGP-7 for example, which works fine on sstems without signature patches, but I'm unsure just how much can be changed.
     
  2. Khangaroo

    Khangaroo $ORIGINALTITLE

    Member
    429
    189
    Feb 27, 2016
    United States
    192.168.1.3 (don't ddos me!)
    Better yet, a Homebrew Launcher exploit through download play.
     
    Quantumcat, CeeDee and Xandrid like this.
  3. LinkSoraZelda

    LinkSoraZelda GBAtemp Advanced Maniac

    Member
    1,974
    617
    Aug 12, 2015
    United States
    Land of the Rising Orange
    The only reason CTGP works is because it clones certain files to the child 3DS, the integrity of it doesn't really matter. Either way, the answer is yes, it's definitely possible to send modified data to a user's 3DS, the question is, to what extent.
     
    CeeDee likes this.
  4. endoverend

    endoverend AKA zooksman

    pip Contributor
    GBAtemp Patron
    endoverend is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    2,844
    3,549
    Jun 6, 2013
    United States
    The possible size of a download play title is waaaayyy too small to fit a CIA or anything of the sort. It gets temporarily stored in the 3DS NAND.
     
  5. CeeDee
    OP

    CeeDee hm?

    Member
    3,803
    5,307
    May 4, 2014
    United States
    somewhere
    Yeah, most files (all but the actual course data, it seems) aren't modified whatsoever in CTGP, so I don't know how much you can do with it.
    Not even a fairly small one? I'm not thinking "full 1GB game" but rather "30MB-ish 3D classic/virtual console game"
    That'd be cool! If it's even possible...
     
  6. endoverend

    endoverend AKA zooksman

    pip Contributor
    GBAtemp Patron
    endoverend is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    2,844
    3,549
    Jun 6, 2013
    United States
    It was possible to load homebrew on the DS via setting up a download play beacon with a very specific model of Wi-Fi adapter chipset, and even then you had to first patch the DS firmware via a GBA flash cart, and games didn't work because it had to be copied to the DS internal memory. We'd have to figure out how to set up a similar beacon for the 3DS, or to reverse engineer the download play app and figure out how to patch the 3DS firmware to accept an unsigned package as download play, AND it would all have to be small enough to fit in the 3DS nand.
     
    SirBeethoven likes this.
  7. CeeDee
    OP

    CeeDee hm?

    Member
    3,803
    5,307
    May 4, 2014
    United States
    somewhere
    If it needs to be signed, then how does stuff like CTGP work?
     
  8. dpad_5678

    dpad_5678 GBAtemp's Memelord

    Member
    1,624
    1,169
    Nov 19, 2015
    United States
    The 3DS has an RSA Sig check for material received via DL Play. Same thing as DS / Lite / i / i XL
     
    endoverend likes this.
  9. endoverend

    endoverend AKA zooksman

    pip Contributor
    GBAtemp Patron
    endoverend is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    2,844
    3,549
    Jun 6, 2013
    United States
    Different kind of signature. All CTGP is is a game mod, meaning it just patches the game's file structure to load certain files from the SD card. Nothing needs to be signed.
     
  10. BruceJackieJetLeeLiChan

    BruceJackieJetLeeLiChan Advanced Member

    Newcomer
    70
    8
    May 20, 2016
    Antigua and Barbuda
    Even if this were possible. I've tried a download play of Mario Kart 7 and it took about 10 minutes just to finish downloading just for the multiplayer part, it doesn't download the whole game. Actually downloading a full game would take a really long time through Download Play.

    — Posts automatically merged - Please don't double post! —
     
  11. ultramario1998

    ultramario1998 no woof tipsic

    Member
    389
    291
    May 7, 2014
    United States
    Not Here
    (Just throwing out ideas here) could we then just patch Mario Kart 7 in a similar fashion so that it runs a payload instead of the game?
     
  12. endoverend

    endoverend AKA zooksman

    pip Contributor
    GBAtemp Patron
    endoverend is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    2,844
    3,549
    Jun 6, 2013
    United States
    Well considering you have to run a payload to be able to patch the game in the first place, that wouldn't really make sense.
     
  13. LinkSoraZelda

    LinkSoraZelda GBAtemp Advanced Maniac

    Member
    1,974
    617
    Aug 12, 2015
    United States
    Land of the Rising Orange
    -snip-
     
  14. CeeDee
    OP

    CeeDee hm?

    Member
    3,803
    5,307
    May 4, 2014
    United States
    somewhere
    But the CTGP download play still works even without CTGP files on the receiver's SD card.
     
  15. endoverend

    endoverend AKA zooksman

    pip Contributor
    GBAtemp Patron
    endoverend is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    2,844
    3,549
    Jun 6, 2013
    United States
    All ctgp has to do is save the downloaded files, not run them. To run a binary through download play it has to be signed.
     
  16. PabloMK7

    PabloMK7 Red Yoshi! ^ω^

    Member
    1,755
    1,030
    Feb 21, 2014
    Spain
    Yoshi's Island
    Mario Kart 7 sends the course files (szs) from its main romfs when they are needed to the child, instead of the download play cfa. CFA is signed, so it won't work if modified, but courses are just data files, which are sent each time a course is loaded. It may be possible to make an exploit by sending corrupted szs files with a payload. They use yaz0 and sarc compression. You would need to use another 3DS with modded MK7 in order to make it work.
     
    Orangy57 likes this.