Homebrew Has anyone tried to unlock ARM7 by exploiting the running binary?

[Deleted User]

It seems like there could be vulnerabilities in Nintendo's ARM7 IPC code. Has anyone investigated this?

 

[DRAGONBALLVINTAGE]

Uhh the eof is that way sir

 

[Deleted User]

Uhh the eof is that way sir

huh? this is a legitimate idea

 

[DRAGONBALLVINTAGE]

huh? this is a legitimate idea

oh well go on...

--------------------- MERGED ---------------------------

See what @Apache Thunder has to say about it

 

[Billy Acuña]

Humm...
IIRC @Apache Thunder stated that the arm7's SCFG is always locked unless you boot a cart, so I don't think so, without and bootrom exploit RocketLauncher is the only way to have full control over the system.

 

[MassExplosion213]

Even when booting a cart, SCFG is locked. The only thing that has unlocked SCFG is Launcher, hence RocketLauncher exploiting the launcher. Before booting a game (cart or otherwise), Launcher locks SCFG.

 

[Apache Thunder]

Yeah you have to exploit Launcher or the stage2 bootloader on NAND (equivalent to FIRM partitions of 3DS....sorta). No official software besides Launcher runs with unlocked SCFG. Not even a few of the system Dev apps had it. twlNmenu has a few other things unlocked (a dev app that has both slot-1 and nand enabled), but even that app doesn't have unlocked SCFG. That app only is signed for dev hardware anyways so you can't use that one on retail hardware.