Hacking Hack SXOS

[agpixel]

Nope sorry

 

[CompSciOrBust]

Looks fake, the gane card is pushed in and that why it appears on the main screen and it just a nro that looks like sx that has a license

That's what I'm thinking. I'm not saying it 100% is but it seems like it. The rom menu doesn't actually do anything to verify if the license is valid, it uses IPC with the tx sys-module using command 26. Also if the version he's launching from hb menu is ripped and modded from the boot.dat why doesn't it have an icon? It had one when Pragma ripped it, unless it has since been removed.

Maybe op could give more details about how it works, I could be wrong. @Reacher17

Edit: agpixel claims to have tested it so I'm probably wrong.

 

[Reacher17]

That's what I'm thinking. I'm not saying it 100% is but it seems like it. The rom menu doesn't actually do anything to verify if the license is valid, it uses IPC with the tx sys-module using command 26. Also if the version he's launching from hb menu is ripped and modded from the boot.dat why doesn't it have an icon? It had one when Pragma ripped it, unless it has since been removed.

Maybe op could give more details about how it works, I could be wrong. @Reacher17

Edit: agpixel claims to have tested it so I'm probably wrong.

no he tested well. no icon needed I put it back in the boot.dat file

--------------------- MERGED ---------------------------

 

[agpixel]

Yes it seems to work, but currently it's not the last version, very cool though ! It need some trials to launch but it launch
I need to downgrade to test all features

 

[Reacher17]

https://mega.nz/file/wk5QGZDS#dmZFECYKQhQIxH4I4wCuak_jazGZ-P80CqdUO4JzM-0

--------------------- MERGED ---------------------------

https://mega.nz/file/lxhGiJZD#EpMS4qbCiqNFDn011UmW3K42hV8ujPp4Q4Aou8g1r7Y

--------------------- MERGED ---------------------------

here are the files for the boot.dat modifications

 

[mrdude]

https://mega.nz/file/wk5QGZDS#dmZFECYKQhQIxH4I4wCuak_jazGZ-P80CqdUO4JzM-0

--------------------- MERGED ---------------------------

https://mega.nz/file/lxhGiJZD#EpMS4qbCiqNFDn011UmW3K42hV8ujPp4Q4Aou8g1r7Y

--------------------- MERGED ---------------------------

here are the files for the boot.dat modifications

What version boot.dat is this for?

 

[Reacher17]

I will improve the code.

 

[mikefor20]

https://mega.nz/file/wk5QGZDS#dmZFECYKQhQIxH4I4wCuak_jazGZ-P80CqdUO4JzM-0

--------------------- MERGED ---------------------------

https://mega.nz/file/lxhGiJZD#EpMS4qbCiqNFDn011UmW3K42hV8ujPp4Q4Aou8g1r7Y

--------------------- MERGED ---------------------------

here are the files for the boot.dat modifications

Excellent.

 

[Reacher17]

What version boot.dat is this for?

V2.9.5

 

[Reacher17]

Up code

https://mega.nz/file/VsRRWagZ#mF7hrbQlGRRO8ewIprQvUVrhwzjUTHplUOGyANFwoO8

--------------------- MERGED ---------------------------

the code has been changed to be easier to install

 

[mrdude]

Up code

https://mega.nz/file/VsRRWagZ#mF7hrbQlGRRO8ewIprQvUVrhwzjUTHplUOGyANFwoO8

--------------------- MERGED ---------------------------

the code has been changed to be easier to install

What version rommenu are you patching?

 

[Reacher17]

that of the boot.dat

 

[mrdude]

that of the boot.dat

I'm having trouble finding that nro version, I've got the boot.dat unpacker script, but the packer file from pragma shows 404 error.

 

[Reacher17]

pragma the person who believed hacked the sxos just with the rommenu?

 

[mrdude]

pragma the person who believed hacked the sxos just with the rommenu?

I've managed to find the python script to unpack boot.dat now, renamed ROMMENU.bin to nro and opened that in IDApro - patched those sub routines. So now I have payload_80000000.bin still to patch, how are you opening this in IDA (what loader are you using?), also do you have a link for the script to repack all the files once they are patched?

 

[Reacher17]

Hxd

--------------------- MERGED ---------------------------

use hxd and not ida

 

[mrdude]

Hxd

--------------------- MERGED ---------------------------

use hxd and not ida

OK, I've done that - patched both files now. So how do I repack back into dat file?

 

[Reacher17]

Patch rommenu sxos v3.1.0
0x7690. 000080D2C0035FD6
0x7730. 000080D2C0035FD6
0x144D0. C0CC80D2C0035FD6

 

[mrdude]

Patch rommenu sxos v3.1.0
0x7690. 000080D2C0035FD6
0x7730. 000080D2C0035FD6
0x144D0. C0CC80D2C0035FD6

What about payload80000000.bin ?

 

[Reacher17]

get sha256 from payload80000000.bin and paste it into stage2 at address 0x126A0

--------------------- MERGED ---------------------------

then get the sha256 from stage2 and paste it into the boot.dat file at address 0x10

--------------------- MERGED ---------------------------

select in the boot.dat the code from 0x0 to 0xDF size 0xE0 and recover the sha256

--------------------- MERGED ---------------------------

and pasted the sha256 at address 0xE0 in the boot.dat file

--------------------- MERGED ---------------------------

you still need to re-encrypt the payload80000000.bin and stage2 and put them back in the boot.dat file