Hacking Haxing 3DS using Row Hammer?

[AtlanticBit]

If you haven't heared of Row Hammer a basic bit hax looks like this:

code1a:
mov (X), %eax // Read from address X
mov (Y), %ebx // Read from address Y
clflush (X) // Flush cache for address X
clflush (Y) // Flush cache for address Y
jmp code1a

Is there any chance to make a spiderhax on the go ram editor/thing?

 

[shinyquagsire23]

If you haven't heared of Row Hammer a basic bit hax looks like this:

code1a:
mov (X), %eax // Read from address X
mov (Y), %ebx // Read from address Y
clflush (X) // Flush cache for address X
clflush (Y) // Flush cache for address Y
jmp code1a

Is there any chance to make a spiderhax on the go ram editor/thing?

That looks like an x86 specific exploit vector tbh, and it wouldn't work on the 3DS because you cannot flush the cache for a specific address from usermode, needs kernel.

 

[yifan_lu]

Harder to exploit on arm than x86 because no unpriviledged cache flushing. Not impossible but very hard. Much easier to exploit the kernel through the usual means.