Homebrew How to find exploits in DsiWare?

[jacob1223]

I only have 2 dsiware on my O3ds on 11.1. I want to know what people do to find exploits in these games so I could try to do it.

 

[dubbz82]

If you have to ask, you don't have the skill to do so.

 

[Jayro]

I'm also wondering why nobody can find more save file overflows... Like, can't someone make a MaskHax using Majora's Mask 3D, similar to OoT3DHax? Or how about LeafHax using Animal Crossing? Surely there can be more cart-based games to exploit. And PowerSaves is only $15 if you know where to look, got mine from Amazon for $15 and $5 shipping.

 

[jacob1223]

If you have to ask, you don't have the skill to do so.

I just wanna know like what to look for when doing this.

 

[xtheman]

You don't

 

[dubbz82]

If you have to ask, you don't have the skill to do so.

 

[LongDongSilver]

I only have 2 dsiware on my O3ds on 11.1. I want to know what people do to find exploits in these games so I could try to do it.

if you're asking forget about ever finding one yourself.If we knew what we could exploit in every game and what it looked like the 3ds would be hacked 15 minutes after every
new update

 

[The Catboy]

First: Know what you are doing
Second: If you have to ask, you don't know what you are doing
Third: ????
4: No profit because you have no idea what you are doing

 

[darklordrs]

First: Know what you are doing
Second: If you have to ask, you don't know what you are doing
Third: ????
4: No profit because you have no idea what you are doing

first second third 4

hnng inconsistency

 

[nl255]

I just wanna know like what to look for when doing this.

You have to look for places where user controlled data (such as the character's name in a saved game) is loaded into memory but the length of the data is not checked before putting it into a pointer. However doing so requires knowing assembly language programming so that you can go step by step through the game code in a debugger/emulator to find it.

So the first step is for you to learn ARM assembly which can take quite a while especially if you don't have any programming experience.

 

[jacob1223]

You have to look for places where user controlled data (such as the character's name in a saved game) is loaded into memory but the length of the data is not checked before putting it into a pointer. However doing so requires knowing assembly language programming so that you can go step by step through the game code in a debugger/emulator to find it.

So the first step is for you to learn ARM assembly which can take quite a while especially if you don't have any programming experience.

thanks

 

[Giodude]

I'm also wondering why nobody can find more save file overflows... Like, can't someone make a MaskHax using Majora's Mask 3D, similar to OoT3DHax? Or how about LeafHax using Animal Crossing? Surely there can be more cart-based games to exploit. And PowerSaves is only $15 if you know where to look, got mine from Amazon for $15 and $5 shipping.

Majoras mask was looked through, and no exploit could be found. Animal crossing I'm pretty sure is also stable as all hell.

 

[Quantumcat]

So the first step is for you to learn ARM assembly which can take quite a while especially if you don't have any programming experience.

Yeah this - start with an easy language like Java or Python to get used to how to think programmatically, then after a year or two learn something a bit harder and bare metal like C++, then take a computer science course and learn all about how memory is laid out, the instruction set, stack vs. heap, the whole architecture of the thing, then learn assembly, then study previous exploits to learn how they work, then debug games with current exploits and see if you can find the vulnerabilities yourself independently, then do the same with other games and be prepared to spend many months hunting red herrings before you find something new.

 

[nooby89]

The list of DSiWares game with exploit :

• Legends Of Exidia (buy it right now if you want to downgrade)
  
• Fieldrunners
• Guitar Rock Tour
• The Legend Of Zelda - Four Sword
• Sudoku Arts

 

[Logan Pockrus]

I'm also wondering why nobody can find more save file overflows... Like, can't someone make a MaskHax using Majora's Mask 3D, similar to OoT3DHax? Or how about LeafHax using Animal Crossing? Surely there can be more cart-based games to exploit. And PowerSaves is only $15 if you know where to look, got mine from Amazon for $15 and $5 shipping.

Well, if the game in question has bounds checking for the length of the string you're examining, then you can't use it in a buffer over exploit. I'm no security expert, but I think it's a pretty safe assumption that most, but not all (looking at you LoZ: OOT), 3ds games (specifically ACNL) have bounds checking on something like the name of the profile. And by the way, "save file overflows" do exist...and they're everywhere (OOT3DHax, maybe stickerhax, (v*)hax, perhaps even more).

 

[Jayro]

Well, if the game in question has bounds checking for the length of the string you're examining, then you can't use it in a buffer over exploit. I'm no security expert, but I think it's a pretty safe assumption that most, but not all (looking at you LoZ: OOT), 3ds games (specifically ACNL) have bounds checking on something like the name of the profile. And by the way, "save file overflows" do exist...and they're everywhere (OOT3DHax, maybe stickerhax, (v*)hax, perhaps even more).

Well I have BaseHax and OoTHax, but they don't launch 100% of the time... I'd say roughly 65% to 75%. Sometimes it just hangs on the white screen, or it will error out of the game, rebooting the console.

 

[Adryel]

The list of DSiWares game with exploit :

• Legends Of Exidia (buy it right now if you want to downgrade)
  
• Fieldrunners
• Guitar Rock Tour
• The Legend Of Zelda - Four Sword
• Sudoku Arts

It can be physical right? because if I remember correctly there's a store over here that still sells Guitar Rock Tour.

 

[Quantumcat]

It can be physical right? because if I remember correctly there's a store over here that still sells Guitar Rock Tour.

No, the whole point is it is intalled to your NAND and can access said NAND. Physical carts can't access the NAND.