Tutorial  Updated

Hacking the latest firmware of 3DS - ARM9 Hack

Notice
You may know that I do NOT intend to promote piracy. I believe PSP hacking scene was so successful because less people regarded piracy as their goal.

What is ARM9
3DS has two CPU and they have different architectures. I'll call them with the name of their architecture: ARM9 and ARM11.
The main reason why it has two CPU is compatibility; ARM9 is compatible with DS while ARM11 is used to improve the performance. However, the design also improves the security by letting ARM9 play the role related to the security.

Vulnerability on ARM9
ARM9 has all permissions on 3DS and it can do most things. For example, ARM9 can make ARM11 execute arbitrary code. It means ARM9 is always the target for hacking.

Practice
ARM9 has several interfaces and you'll hack it with them. The most largest part is PXI.

PXI
PXI is the interface for Process9, a process running on ARM9. Process9 has services which executes commands sent by ARM11. 3dbrew.org has the list for those services.
http://3dbrew.org/wiki/PXI_Services/

The protocol is also explained on the site.
http://3dbrew.org/wiki/PXI_Registers/

The site also has descriptions for commands, but they are incomplete.
http://www.3dbrew.org/wiki/Services_API/

As you can see, it doesn't have so many commands. That's the advantage of the design. You must hack those commands, which are the most secure part.
But it doesn't mean 3DS can't be hacked. It depends on who does.

Debugging
Unfortunately, we don't have a debugger working "well". The largest reason is that few people tried to do that. But I don't recommend you to make a new debugger. As I said, the system is divided into ARM9 and ARM11 and ARM9 plays only the security-related role. It's nearly impossible to communicate with PC via Wi-Fi or IR.
However you don't have to abandon. I developed an exception handler for ARM9 on rxTools which displays exceptions on the display. I recommend to use this.

rxTools
It hooks SWI on ARM11 because it needs ARM11 to handle LCD. So something must call SVC on ARM11. Anyway, "something" should always call SVC even if you don't.

When an exception occurred, the handler sets the address of the framebuffer to the top of the VRAM (0x18000000) and it writes exception information to VRAM. You can change the color of the background by clearing VRAM before an exception occurred because the rest is left as it is. Otherwise it shows garbage on VRAM.

2015-07-31-exception.jpg

You can see what is the "garbage". In the next, I'll explain the information described on the display.

Type
The document by ARM is good for this.
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ihi0014q/I84795.html

If you have "Data Abort" with a writing instruction, it may be exploitable.
If you have "Prefetch Abort", it may be exploitable.
If you have "Data Abort" with a reading instruction, disassemble and study well. If you can't figure out, try to input some valid value, or ask someone skillful.

Registers
ARM provides documentation.
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0337h/Chdedegj.html

If you got LR control, you are likely to exploit it. The final goal is to control PC (and execute your own code) .
 
Last edited by 173210, , Reason: Fix URLs

DarkFlare69

Well-Known Member
Member
Joined
Dec 8, 2014
Messages
5,147
Trophies
2
Location
Chicago
XP
4,750
Country
United States
He's not announcing an exploit, he's just discussing how to approach developing a new arm9 exploit.
My bad, I clicked on the EoF and it redirected me to this forum. It looked legit but I was wondering why it was in the EoF. Then i saw it was in the proper forum.
 

motezazer

Well-Known Member
Member
Joined
Feb 6, 2015
Messages
1,214
Trophies
0
Age
24
XP
1,442
Country
France
The problem is that, without an ARM11 kernel exploit, we can't send arbitrary PXI commands to ARM9...
And yellows8 said ARM11 kernel was now pretty airtight. Hacking new firmwares that way is terribly difficult, I warn you.
 

173210

Well-Known Member
OP
Member
Joined
Jan 22, 2014
Messages
245
Trophies
0
Age
26
Location
Japan
Website
173210.github.io
XP
683
Country
The problem is that, without an ARM11 kernel exploit, we can't send arbitrary PXI commands to ARM9...
And yellows8 said ARM11 kernel was now pretty airtight. Hacking new firmwares that way is terribly difficult, I warn you.
I don't know what yellows8 said, but unless they enable ASLR, it can't be tighter than PSP.
And, in my assumption, ninjhax2 may have ARM11 kernel exploit. But it's just an assumption.
 
  • Like
Reactions: Margen67

Bug_Checker_

Well-Known Member
Member
Joined
Jun 10, 2006
Messages
950
Trophies
0
XP
664
Country
United States
Notice
You may know that I do NOT intend to promote piracy. I believe PSP hacking scene was so successful because less people regarded piracy as their goal.

What is ARM9
3DS has two CPU and they have different architectures. I'll call them with the name of their architecture: ARM9 and ARM11.
The main reason why it has two CPU is compatibility; ARM9 is compatible with DS while ARM11 is used to improve the performance. However, the design also improves the security by letting ARM9 play the role related to the security.

Vulnerability on ARM9
ARM9 has all permissions on 3DS and it can do most things. For example, ARM9 can make ARM11 execute arbitrary code. It means ARM9 is always the target for hacking.

Practice
ARM9 has several interfaces and you'll hack it with them. The most largest part is PXI.

PXI
PXI is the interface for Process9, a process running on ARM9. Process9 has services which executes commands sent by ARM11. 3dbrew.org has the list for those services.
http://3dbrew.org/wiki/PXI_Services/

The protocol is also explained on the site.
http://3dbrew.org/wiki/PXI_Registers/

The site also has descriptions for commands, but they are incomplete.
http://www.3dbrew.org/wiki/Services_API/

As you can see, it doesn't have so many commands. That's the advantage of the design. You must hack those commands, which are the most secure part.
But it doesn't mean 3DS can't be hacked. It depends on who does.

Debugging
Unfortunately, we don't have a debugger working "well". The largest reason is that few people tried to do that. But I don't recommend you to make a new debugger. As I said, the system is divided into ARM9 and ARM11 and ARM9 plays only the security-related role. It's nearly impossible to communicate with PC via Wi-Fi or IR.
However you don't have to abandon. I developed an exception handler for ARM9 on rxTools which displays exceptions on the display. I recommend to use this.

rxTools
It hooks SWI on ARM11 because it needs ARM11 to handle LCD. So something must call SVC on ARM11. Anyway, "something" should always call SVC even if you don't.

When an exception occurred, the handler sets the address of the framebuffer to the top of the VRAM (0x18000000) and it writes exception information to VRAM. You can change the color of the background by clearing VRAM before an exception occurred because the rest is left as it is. Otherwise it shows garbage on VRAM.

View attachment 22445
You can see what is the "garbage". In the next, I'll explain the information described on the display.

Type
The document by ARM is good for this.
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ihi0014q/I84795.html

If you have "Data Abort" with a writing instruction, it may be exploitable.
If you have "Prefetch Abort", it may be exploitable.
If you have "Data Abort" with a reading instruction, disassemble and study well. If you can't figure out, try to input some valid value, or ask someone skillful.

Registers
ARM provides documentation.
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0337h/Chdedegj.html

If you got LR control, you are likely to exploit it. The final goal is to control PC (and execute your own code) .

Can you edit out the trailing '/' on the PXI/ 3Dbrew links? (otherwise they link to invalid pages)
 

motezazer

Well-Known Member
Member
Joined
Feb 6, 2015
Messages
1,214
Trophies
0
Age
24
XP
1,442
Country
France
I don't know what yellows8 said, but unless they enable ASLR, it can't be tighter than PSP.
And, in my assumption, ninjhax2 may have ARM11 kernel exploit. But it's just an assumption.
ninjhax2 doesn't have access to any services. It doesn't have a kernel exploit.

Anyway, ASLR isn't needed to make a secure kernel.
1) We don't have that much interfaces with the kernel (if we except syscalls). The kernel don't do a lot and the services are filtering.
2) Syscalls were secured from buffer overflows in 5.0
3) SlabHeap was secured in 8.0
4) Memory chuncks were secured in 9.3

There isn't really a lot of things left for attacking.
 
  • Like
Reactions: Arcanuskun

173210

Well-Known Member
OP
Member
Joined
Jan 22, 2014
Messages
245
Trophies
0
Age
26
Location
Japan
Website
173210.github.io
XP
683
Country

Intronaut

A star maker
Member
Joined
Nov 18, 2014
Messages
772
Trophies
0
Age
30
XP
1,005
Country
Chile
I don't know if it's technically possible, but maybe we can hack newer firmwares trying to get control to AM service and downgrade (or a kind of) to 9.2 with legit CIAs.

Yeah, but we have to get access to AM service first :cry:
 

motezazer

Well-Known Member
Member
Joined
Feb 6, 2015
Messages
1,214
Trophies
0
Age
24
XP
1,442
Country
France
I don't know if it's technically possible, but maybe we can hack newer firmwares trying to get control to AM service and downgrade (or a kind of) to 9.2 with legit CIAs.

Yeah, but we have to get access to AM service first :cry:
And how do you install a downgraded NATIVE_FIRM?

--------------------- MERGED ---------------------------

How about jtag or modchip, I think if the software based hack is blocked, we can switch to hardware based :D
Hint : JTAG is disabled on the New 3DS!
And modchips are very difficult, because:
-you can't mod ARM9 RAM or ARM11 kernel RAM
-FCRAM is difficult to mod, and a tech would have to spend hours to do that. Not consumer-friendly.
 

WateredFire19

Banned!
Banned
Joined
Aug 23, 2014
Messages
642
Trophies
0
Age
39
XP
291
Country
United States
I think gaining access to the AM service should be the priority. Because 4.0 - 9.2 has the most amount of hacks, it be easier to create one for 9.3+ to go to lower firmwares then recreating all the 4.0 - 9.2 stuff for 9.3+.
 

motezazer

Well-Known Member
Member
Joined
Feb 6, 2015
Messages
1,214
Trophies
0
Age
24
XP
1,442
Country
France
I think gaining access to the AM service should be the priority. Because 4.0 - 9.2 has the most amount of hacks, it be easier to create one for 9.3+ to go to lower firmwares then recreating all the 4.0 - 9.2 stuff for 9.3+.
Only NIM has access to AM:NET
 

WateredFire19

Banned!
Banned
Joined
Aug 23, 2014
Messages
642
Trophies
0
Age
39
XP
291
Country
United States
I know that, but if we find an exploit that will let us access the AM service and getting FBI to work will be easier then going right to unsigned CIA's. I think unsigned CIA's should never be what we are aiming for in 9.3 and up. Getting a way to install legit CIA's would be better and allow downgrading.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • TwoSpikedHands @ TwoSpikedHands:
    @Sicklyboy I am wanting to fully change the game and bend it to my will lol. I would like to eventually have the ability to add more characters, enemies, even have a completely different story if i wanted. I already have the ability to change the tilemaps in the US version, so I can basically make my own map and warp to it in game - so I'm pretty far into it!
  • TwoSpikedHands @ TwoSpikedHands:
    I really would like to make a hack that I would enjoy playing, and maybe other people would too. swapping to the EU version would also mean my US friends could not legally play it
  • TwoSpikedHands @ TwoSpikedHands:
    I am definitely considering porting over some of the EU features without using the actual ROM itself, tbh that would probably be the best way to go about it... but i'm sad that the voice acting is so.... not good on the US version. May not be a way around that though
  • TwoSpikedHands @ TwoSpikedHands:
    I appreciate the insight!
  • The Real Jdbye @ The Real Jdbye:
    @TwoSpikedHands just switch, all the knowledge you learned still applies and most of the code and assets should be the same anyway
  • The Real Jdbye @ The Real Jdbye:
    and realistically they wouldn't

    be able to play it legally anyway since they need a ROM and they probably don't have the means to dump it themselves
  • The Real Jdbye @ The Real Jdbye:
    why the shit does the shitbox randomly insert newlines in my messages
  • Veho @ Veho:
    It does that when I edit a post.
  • Veho @ Veho:
    It inserts a newline in a random spot.
  • The Real Jdbye @ The Real Jdbye:
    never had that i don't think
  • Karma177 @ Karma177:
    do y'all think having an sd card that has a write speed of 700kb/s is a bad idea?
    trying to restore emunand rn but it's taking ages... (also when I finished the first time hekate decided to delete all my fucking files :wacko:)
  • The Real Jdbye @ The Real Jdbye:
    @Karma177 that sd card is 100% faulty so yes, its a bad idea
  • The Real Jdbye @ The Real Jdbye:
    even the slowest non-sdhc sd cards are a few MB/s
  • Karma177 @ Karma177:
    @The Real Jdbye it hasn't given me any error trying to write things on it so I don't really think it's faulty (pasted 40/50gb+ folders and no write errors)
  • DinohScene @ DinohScene:
    run h2testw on it
    +1
  • DinohScene @ DinohScene:
    when SD cards/microSD write speeds drop below a meg a sec, they're usually on the verge of dying
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    Samsung SD format can sometimes fix them too
  • Purple_Heart @ Purple_Heart:
    yes looks like an faulty sd
  • Purple_Heart @ Purple_Heart:
    @Psionic Roshambo i may try that with my dead sd cards
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    It's always worth a shot
  • TwoSpikedHands @ TwoSpikedHands:
    @The Real Jdbye, I considered that, but i'll have to wait until i can get the eu version in the mail lol
  • I @ I-need-help-with-wup-wiiu:
    i need help with nusspli failed downloads, can someone respond to my thread? pretty please:wub:
  • Sheeba- @ Sheeba-:
    I can't wait to hack my 11.00 PS4 pro
    Sheeba- @ Sheeba-: I can't wait to hack my 11.00 PS4 pro