Homebrew Homebrew Development

[CalebW]

Me not yet. I scanned some parts of IO register memory, but at the moment I found only the 3D slider state register at 0x1014470C.

Still trying to figure out what are the other non zero values i found, in the hope to be able to swap framebuffers.

In the range I scanned (0x1012DFA0 - 0x10146BD6) nothing has values changing upon CPAD or touchscreen state.

I know smea read the C-Pad state in his ctr HID.h, perhaps you could take a look at it...

 

[Kane49]

The best thing right now would actually be to find out which sections of memory we are able to access
I mean we know we can access things around:

0x10000000-0x11500000 (or so)
0x20000000-0x28000000

But i suspect we have access to even more regions we just don't know about yet ^^
Too bad it immediately crashes once try to access non accessible memory :/

 

[nop90]

I know smea read the C-Pad state in his ctr HID.h, perhaps you could take a look at it...

Smea in his HID.c module get the HID registers addresses, maps it to 0x1000000 and then initialize the HID. With the mapped handle he does exactly the same we do with the HID phisical address to check keys pressed.

In his code the CPAD is at 0x10000034 (i.e. Mapped HID address + 0xD*4) and Touchpad is at 0x100000C8 (i.e. Mapped HID address + 0x32 *4). Interesting but not usefull as long as we can't replicate his system calls. I'm making some experiment to make it work (yes I know: smea said it won't work, and Kane said it too - I'm stubborn as a mule) but I have very few time and can't go any faster.

 

[Kane49]

Smea in his HID.c module get the HID registers addresses, maps it to 0x1000000 and then initialize the HID. With the mapped handle he does exactly the same we do with the HID phisical address to check keys pressed.

In his code the CPAD is at 0x10000034 (i.e. Mapped HID address + 0xD*4) and Touchpad is at 0x100000C8 (i.e. Mapped HID address + 0x32 *4). Interesting but not usefull as long as we can't replicate his system calls. I'm making some experiment to make it work (yes I know: smea said it won't work, and Kane said it too - I'm stubborn as a mule) but I have very few time and can't go any faster.

Thats why we need to find more accessible memory regions, there have to be some hints in there somewhere

 

[CalebW]

About the 3D in Pong... the greater the offset the deeper the depth?

 

[nop90]

Yes. You can experiment with positive and negative offsets.

 

[kyogre123]

Hi. I was wondering if there's a launcher that is able to dump the whole 128MB of RAM or if it is even possible via software.

 

[Huntereb]

Hi. I was wondering if there's a launcher that is able to dump the whole 128MB of RAM or if it is even possible via software.

Nerp, not yet. It's more than possible, though.

WHY WOULD THEY RELEASE SOMETHING LIKE THAT?! IT WOULD BE THE BEGINNING OF CHEATS, AND THAT'S BAD!!

 

[PewnyPL]

Nerp, not yet. It's more than possible, though.

WHY WOULD THEY RELEASE SOMETHING LIKE THAT?! IT WOULD BE THE BEGINNING OF CHEATS, AND THAT'S BAD!!

Well, with emuNAND and redNAND it could be possible to find an exploit for newer firmwares. Maybe...

 

[Huntereb]

Well, with emuNAND and redNAND it could be possible to find an exploit for newer firmwares. Maybe...

True, this would be a great tool if anyone has the smarts to make one. Oh, and better yet, make a launcher that lets you replace specific lines of the RAM with your own modifications.

 

[Kane49]

Hi. I was wondering if there's a launcher that is able to dump the whole 128MB of RAM or if it is even possible via software.

I'll make one when I get home

 

[bkifft]

I'll make one when I get home

so you've already mapped out the good and bad memory regions? or have you found a way to catch the illegal memory access interrupt?

 

[PewnyPL]

so you've already mapped out the good and bad memory regions? or have you found a way to catch the illegal memory access interrupt?

Smealum found a way to modify other processes RAM (to modify list of channels and such), so if it's possible to write to RAM, using a similair method it should be possible to read it too. Unless the HOME screen's RAM region is not protected (which is doubtful)

 

[Kane49]

The

so you've already mapped out the good and bad memory regions? or have you found a way to catch the illegal memory access interrupt?

The 128mb of fcram isn't protected at all ^^
But yeah I found out they are all bad except the few mentioned ones

 

[bkifft]

The

The 128mb of fcram isn't protected at all ^^

yeah, but i was under the impression that it wasn't addressed as a continuous block in physical address space but segmented.

if that's not the case after all: yay!


edit: i could/should have RTFM and checked the wiki *innocent whistle*

 

[kalimero]

Hi. I was wondering if there's a launcher that is able to dump the whole 128MB of RAM or if it is even possible via software.

Kane49 released the tools:
http://gbatemp.net/threads/homebrew-development.360646/page-14#post-4895832


Code to do:

pf_mount(..)
pf_open("/file")
 
// loop from FCRAM_BASE to FCRAM_BASE+0x8000000
pf_write(address,..)

 

[Kane49]

https://www.dropbox.com/s/zuaj8nfjyeonivx/FCRamDump.rar

Contains two Launchers, one for GW and one for Waffles Loader, dumps the whole FCRAM to SDCard, might take a few tries to boot.
Needs about 30 Minutes for the entire dump.

 

[profi200]

Pfff, 1 or 2 minutes and i have the entire RAM.

What's the write speed of the fs stuff used here?

 

[greyneon]

The slower the safer

 

[Kane49]

Pfff, 1 or 2 minutes and i have the entire RAM.

from usermode arm9 with the publicly available loader?