Hacking GW multirom demo

[Huntereb]

What flashcard are you using?

Why?

 

[escherbach]

Not to kill your optimism, but it's actually there, they hid it cleverly by running it as MIPS instructions running on top of a CPU emulator, itself running from an ARM9 payload.

It is triggered when any of many specific checksums fail. The code itself uses various undocumented eMMC commands in conjunction to the AES hw engine. There is no practical use for these commands in the gateway firmware, other than to trigger the brick.

I could just paste the assembly here but:

1. You wouldn't understand any of it
2. I don't care nearly enough
3. There is going to be a "new" 3dslink/r4i 3ds gold/orange3DS... firmware within the next 24 hours of me doing it and I am certainly not going to do their work for them.
4. Anything that puts a halt to piracy can't be such a bad thing as far as I am concerned.
5. I would probably post it anyway just to shut people up if it wasn't for points 3 and 4

Constant childish defensive replies like "we could post it but you wouldn't understand it" from yourself, profi200 and others entirely undermine your credibility.

There doesn't seem to be enough bricked consoles reported for a deterministic bricking algorithm to be present (ok a rand number test on 4 bits would still mean 1 in 16 consoles bricked - still far too large compared to reports)

Much more likely (I won't post the details you wouldn't understand) that specific emunand code to do with preventing real system updates is causing bricks in rare corner cases.

The (slightly) larger number of clone bricks is probably due to the larger number clone cards around (compared to gateway originals)

 

[escherbach]

Lol, and where do they say anything about the code? You missed the context.


You not even was able to do anything, i told you. I said you should check the CPU ID, instead you claim to know better. If everyone say it's ARM9, then it is. Even well known scene members would tell you it's ARM9. Do they all lie because of a such unimportant thing?

That's not just plaintext ARM disassembly, it's obfuscated MIPS similar code running in a CPU emulator. I know already, what comes now. How have we done it then? Maybe we have something to emulate the code and output, what the code doe's on the hardware/registers? (and to the other reader's: No, it's not a real 3DS emulator. It's made to emulate ARM9 code, but it will never be a real 3DS emulator).

You claim to understand things, but you don't. I put you on my ignore list and everything is fine.

€:
We run the entire code in the emulator, not just the MIPS code. That would be dumb.

see above

and I've already told you a ARM11 is backward compatible with an ARM9 - nintendo may have it switch compatibility modes but there is physically ONE dual-core ARM11 in the 3DS

 

[the_randomizer]

I wish people would stop trying to defend (see: worship) Gateway or their half-assed excuses.

 

[escherbach]

I wish people would stop trying to defend (see: worship) Gateway or their half-assed excuses.

Yeah, all the worshipping in this thread is ridiculous

 

[the_randomizer]

Yeah, all the worshipping in this thread is ridiculous

You should have seen earlier this week, people are in a sense, deep-throating the GW, praising how great they are despite their stupidity

 

[Armadillo]

You should have seen earlier this week, people are in a sense, deep-throating the GW, praising how great they are despite their stupidity

Well it balances it out with people like you bashing them from the day they appeared because you updated past 4.5.

 

[Habbert]

You should have seen earlier this week, people are in a sense, deep-throating the GW, praising how great they are despite their stupidity

I agree with you but I think the clone makers share the blame too for releasing copied code without fully inspecting it... R4i deserves just as much flak as gateway...
Just counting down the days until we wont need a flash cart at all and can run roms from the SD card with some homebrew... We should call it "BetterWay"

 

[weatMod]

Why every sentence you make is to talk bad about Gateway? What flashcard are you using?

i remember waiting ages for the dstwo team to release the video player plugin for their card, they broke their promises and deadlines many many times, the only thing is that when that steaming pile of shit was released nobody gave a fuck , but when GW team releases their multirom it is going to be epic in comparison to the dstwo video player plugin
they also delayed their snes smulator plugin a fukton of times ,and everyone loves scdstwo team today

 

[the_randomizer]

Well it balances it out with people like you bashing them from the day they appeared because you updated past 4.5.

I still stand by the fact Gateway deserves all the flak it's been getting.

 

[Normmatt]

see above

and I've already told you a ARM11 is backward compatible with an ARM9 - nintendo may have it switch compatibility modes but there is physically ONE dual-core ARM11 in the 3DS

No. There is a separate ARM9 possibly even an ARM7 as well. Obviously you know nothing so stop spreading crap.

 

[Habbert]

Dude, don't dig up that past please, that's so uncool, I don't appreciate it all. But I still stand by the fact Gateway deserves all the flak it's been getting.

Wow.... man that sucks... hate to say it, but why are you even here?
what version are you on? give me your cell ill text you when/if an exploit is ever discovered. lol

 

[Huntereb]

No. There is a separate ARM9 possibly even an ARM7 as well. Obviously you know nothing so stop spreading crap.

OH SHIT, JUST GOT WRECKED!

 

[Punkonjunk]

still wouldn't poke it with a ten foot stylus. Brick code, still closed, no homebrew capacity. Gateway can eat me.

 

[gamefan5]

No. There is a separate ARM9 possibly even an ARM7 as well. Obviously you know nothing so stop spreading crap.

http://3dbrew.org/wiki/Hardware

So what this page says is wrong?

 

[Normmatt]

http://3dbrew.org/wiki/Hardware

So what this page says is wrong?

Yes it is wrong.

 

[gamefan5]

Yes it is wrong.

So far I'm researching everywhere, and I do not see any page confirming your statement.
Think I'm willing to believe what iFixit and other teardown pages have shown me.

 

[Mr_Pichu]

I was once a lonely level 40 wizard, but now I can get all the Men & Women I want. And yes, I do experience full release orgasms. Thank you Gateway 2.0 w/multirom support, you have changed my life.


Gateway asks: So, are you experienced? Have you ever been experienced?

Well, I have

 

[mathieulh]

Constant childish defensive replies like "we could post it but you wouldn't understand it" from yourself, profi200 and others entirely undermine your credibility.

There doesn't seem to be enough bricked consoles reported for a deterministic bricking algorithm to be present (ok a rand number test on 4 bits would still mean 1 in 16 consoles bricked - still far too large compared to reports)

Much more likely (I won't post the details you wouldn't understand) that specific emunand code to do with preventing real system updates is causing bricks in rare corner cases.

The (slightly) larger number of clone bricks is probably due to the larger number clone cards around (compared to gateway originals)

Don't take pseudo code for it's full value. No one fully understood the whole triggering factor yet. Especially the RNG part. I am pretty sure that one in the pseudo code is wrong even though it's involved I do think it's not initialized with time/date and that the actual RTC is used at some point.

If it was code to simply prevent system updates, there wouldn't be a need to hide it the way they did, there wouldn't be a need to trigger it whenever (and only ever) the ARM9 payload is modified

Just seeing that bricks happen because the eMMC gets locked and that no actual corruption of data occurs should be enough to tell you the bricks are engineered even if you don't have the code.
The eMMC get read/write protected after the bricks rather than just suffering from data corruption and gateway folks conveniently don't need a nand dump to restore your console...

When you see that the code makes use of data it captured from the eMMC commands along with the AES hardware, things start to make a lot more sense then.

 

[Mr_Pichu]

3DS SoC chip die image (ARM Cores in Red):
http://m.eet.com/media/1114759/nintendo_3ds_teardown8.jpg

Nintendo 3DS Hardware Concept:
http://iwataasks.nintendo.com/interviews/#/3ds/how-nintendo-3ds-made/1/0

3DS BOM:
http://www.gamesetwatch.com/3dsteardown.php