HaxxStation: DS Download Station exploit

Discussion in 'NDS - Emulation and Homebrew' started by shutterbug2000, Jun 9, 2017.

  1. tozevleal

    tozevleal Probably the last VinsCool lonk clone :P

    Member
    5
    Jul 14, 2011
    Portugal
    Somewhere
    Well i test it on TWLoader and it doesn't work unfortunaly :(
     
  2. DinohScene

    DinohScene Feed Dino to the Sharks

    Moderator
    23
    GBAtemp Patron
    DinohScene is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Oct 11, 2011
    Antarctica
    Восторг
    I'd love to see a write up.
     
  3. sks316

    sks316 Professional Shitposter (also I help sometimes)

    Member
    11
    Nov 28, 2013
    United States
    Windows XP background
    Does this work with TWLoader or is a flashcard REQUIRED?
     
  4. tozevleal

    tozevleal Probably the last VinsCool lonk clone :P

    Member
    5
    Jul 14, 2011
    Portugal
    Somewhere
    For now its flashcard required
     
  5. sks316

    sks316 Professional Shitposter (also I help sometimes)

    Member
    11
    Nov 28, 2013
    United States
    Windows XP background
    Shit. Let me know when TWLoader is possible.
     
  6. Oleboy555

    Oleboy555 Wie dit leest is een zemmel

    Member
    7
    Feb 8, 2017
    Netherlands
    Amsterdam
    YESSS Now I can run my M3DS Real!!!
     
    THYPLEX likes this.
  7. epickid37

    epickid37 ( ͡° ͜ʖ ͡°)

    Member
    10
    Jan 4, 2017
    United States
    Mt. Celeste
    this is awesome!
     
  8. megahunter

    megahunter Advanced Member

    Newcomer
    2
    Mar 10, 2008
    sweden
    So judging from the video this seems to be something in the style of how you could use the wifi usb connector and linux to send game demos to the ds back in the day or am i way off?
     
    tozevleal likes this.
  9. Oleboy555

    Oleboy555 Wie dit leest is een zemmel

    Member
    7
    Feb 8, 2017
    Netherlands
    Amsterdam
    Image
    Its stuck at 0%

    does it not support full game roms?
     
  10. Van28

    Van28 Member

    Newcomer
    1
    May 25, 2017
    Italy
    Naples
    Are you planning on making it twloader compatible?
     
  11. THYPLEX

    THYPLEX GBAtemp Advanced Fan

    Member
    5
    May 20, 2017
    Italy
    Rome
    That exploit is useful with my old DS lite ?
    And how ?
     
  12. tozevleal

    tozevleal Probably the last VinsCool lonk clone :P

    Member
    5
    Jul 14, 2011
    Portugal
    Somewhere
    Only works with small NDS files (like homebrew games like textris, or this grand dad remake )
     
  13. Oleboy555

    Oleboy555 Wie dit leest is een zemmel

    Member
    7
    Feb 8, 2017
    Netherlands
    Amsterdam
    thats a shame :(
     
  14. tozevleal

    tozevleal Probably the last VinsCool lonk clone :P

    Member
    5
    Jul 14, 2011
    Portugal
    Somewhere
    Its because of the NDS ram ... its only 8mb of ram!
     
    Oleboy555 likes this.
  15. Gericom

    Gericom GBAtemp Maniac

    Member
    11
    Jun 30, 2011
    Netherlands
    Well, tbh, there is not very much to say about it.

    I first researched the firmware and dsi downloader and I found a semi-exploit there regarding the arm9 size. It checks the start and start + size, so you can overflow the second one with a very big value. I first thought we could overwrite memory that way, but that turned out not to be the case because each chunk of data is checked individually too. It however caused a crash during the sha1 calculation which for unknown reasons lead to code execution on dsi and 3ds (in ntr mode of course), but not on dslite. So that was not a good way to do it.

    I then checked out the download station. By disassembling I found out barely any checks are done on load addresses and stuff, allowing to overwrite arbitrary memory. The best thing was that it loaded the arm9 to the right place before doing the rsa stuff, so by changing the arm9 load address to the rsa check function, I could overwrite it with my code that did the actual arm9 loading and jumped over the rsa checks. This yielded a very small payload that could be patched into every rom I'd like to run it though that download station client.

    No, it does not work. Those games use NitroFS; files on the ds cartridge. This is not possible by simply sending over the rom (would need patches and a special parent on the other ds to send over the data when needed). Besides the ds only has 4 MB of ram, which it uses to execute code too.
    *4 MB
     
    tozevleal likes this.
  16. SoslanVanWieren

    SoslanVanWieren Banned

    Banned
    5
    Feb 6, 2017
    Australia
    Could you send over a GBA ROM dumper that dumps over wifi is there one?

    — Posts automatically merged - Please don't double post! —

    Did you try the bootstrap 0.2.0
     
    tozevleal likes this.
  17. tozevleal

    tozevleal Probably the last VinsCool lonk clone :P

    Member
    5
    Jul 14, 2011
    Portugal
    Somewhere
    Thanks for the protip!
    I selected the unoficial bootstrap and now it works! (with the bonus Rainbow notification LED ^_^)
     
  18. sks316

    sks316 Professional Shitposter (also I help sometimes)

    Member
    11
    Nov 28, 2013
    United States
    Windows XP background
    So if I get a legit demo or game ROM under 8 MB, I can use it with HaxxStation? Cool!

    — Posts automatically merged - Please don't double post! —

    So does it work with TWLoader or not? I'm confused now. :wacko:
     
  19. tozevleal

    tozevleal Probably the last VinsCool lonk clone :P

    Member
    5
    Jul 14, 2011
    Portugal
    Somewhere
    Its 4Mb (my mistake)
    But yeah... probably you can boot any NDS rom with 4mb or less (most of them is homebrew and demos)

    Edit: YES IT WORKS! But remember go to the settings menu (on twloader) and set the bootstrap has unofficial
     
    sks316 likes this.
  20. migles

    migles All my gbatemp friends are now mods, except for me

    Member
    14
    GBAtemp Patron
    migles is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Sep 19, 2013
    China
    Earth-chan
    *4 MB
     
Quick Reply
Draft saved Draft deleted
Loading...