I might have a theory on how to send the Homebrew Launcher via download play.

Discussion in '3DS - Homebrew Development and Emulators' started by epicmartin7, Jun 4, 2016.

  1. epicmartin7
    OP

    epicmartin7 GBAtemp Fan

    Member
    371
    242
    Aug 5, 2015
    United States
    So... I've been recently datamining Mario Kart 7 in order to get CTGP-7 working. Throughout the file structure, I found the "ExtractedDownloadPlay" folder and found another CIA inside it. All the CIA is really is the download play version of MK7 that's sent to another 3DS's limited RAM. That then gave kind of an idea.

    Yellow8's Homebrew Launcher CIA is WAY smaller than that CIA. So it kinda begs the question if it would be theoretically possible to send someone HBL by modding a game with DownloadPlay.

    Now, I can't really test it out considering I don't have another 3DS, but I'm just presenting it out there just in case someone else wants to.

    Of course, there's no guarantee that it'll work in the first place, but this was just some observations I had.

    If it does work though, we could use this method to install other exploits on other people's 3DS's.

    Anyways, what do you guys think about this? Do you think it's possible at all?

    Not saying I found an exploit at all or even if this will work. Just giving my opinion on it.
     
    SirBeethoven likes this.
  2. Filo97

    Filo97 Zelda's totally my sister! Not lying!

    Member
    3,724
    1,230
    Oct 8, 2015
    Italy
    Hyrule Castle
    2 words: Signature check
     
  3. solress

    solress Not a dev

    Member
    579
    306
    May 12, 2016
    Netherlands
    Between here and there
    You can't send games over DLP without then having the correct sigs
     
  4. epicmartin7
    OP

    epicmartin7 GBAtemp Fan

    Member
    371
    242
    Aug 5, 2015
    United States
    Does Download Play have signature checks at all? Just curious if it does.
     
  5. Filo97

    Filo97 Zelda's totally my sister! Not lying!

    Member
    3,724
    1,230
    Oct 8, 2015
    Italy
    Hyrule Castle
    yes
     
    Subtle Demise likes this.
  6. ihaveamac

    ihaveamac GBAtemp Guru

    Member
    5,481
    6,052
    Apr 20, 2015
    United States
    Tigard, OR
    inside the "download play child container" (which is a CFA) is a CIA. this CIA is installed to NAND and so it needs to pass signature checks like everything else. you can't send a modified CIA to a console with no signature patches.
     
  7. Ermelber

    Ermelber GBAtemp Regular

    Member
    133
    82
    Sep 21, 2012
    Italy
    Como, Lombardia
    I don't think it would... IDK if Download Play checks signatures or something, I can't say for sure
     
  8. epicmartin7
    OP

    epicmartin7 GBAtemp Fan

    Member
    371
    242
    Aug 5, 2015
    United States
    Gotcha... well... made a mistake then lol. Ah well. At least we got Freakyhax which just came out. Thanks for the info!
     
  9. DarkFlare69

    DarkFlare69 GBAtemp Psycho!

    Member
    4,744
    2,602
    Dec 8, 2014
    United States
    Ohio
    i said this in like 2015 and people said no.
     
  10. PabloMK7

    PabloMK7 Red Yoshi! ^ω^

    Member
    1,807
    1,113
    Feb 21, 2014
    Spain
    Yoshi's Island
    There is already a thread about this. CTGP-7 doesn't send a modified dlp cia, it works because MK7 sends the course files from the main game romfs, instead of the dlp cia, which doesn't have to pass any sig checks. An exploit may be possible by sending corrupted szs files, or corrupted tracks. (Karthax hype :P)
     
    WeedZ, I pwned U!, Xiphiidae and 5 others like this.
  11. Filo97
    This message by Filo97 has been removed from public view by raulpica, Jun 5, 2016, Reason: Not EoF -rp.
    Jun 4, 2016
  12. Shadowxp13

    Shadowxp13 *don't have anything to put here*

    Member
    122
    29
    Sep 28, 2015
    Brazil
    In middle of nowhere
    Can this work if we replace the original cia with any legit cia?
     
    Aether Lion likes this.
  13. Aether Lion

    Aether Lion GBATemp's Pet Lion

    Member
    412
    186
    May 1, 2016
    United States
    Penisylvania
    AKA Everyone gets a free "backup" of SSB, any Pokemon game, and most Mario games. Don't forget TLoZ. ;p
     
    Subtle Demise likes this.
  14. solress

    solress Not a dev

    Member
    579
    306
    May 12, 2016
    Netherlands
    Between here and there
    It'd be installed to the NAND,which wouldn't be able to hold that much information.
     
  15. Conn0r

    Conn0r GBAtemp Fan

    Member
    327
    187
    Jan 10, 2016
    United States
    What about using download play to send a signed cubic ninja game?
     
  16. Aether Lion

    Aether Lion GBATemp's Pet Lion

    Member
    412
    186
    May 1, 2016
    United States
    Penisylvania
     
    Subtle Demise likes this.
  17. Conn0r

    Conn0r GBAtemp Fan

    Member
    327
    187
    Jan 10, 2016
    United States
    The nand on some N3DSs are like ~2GB
     
  18. solress

    solress Not a dev

    Member
    579
    306
    May 12, 2016
    Netherlands
    Between here and there
    And how much do you think is free
     
    Ricken and Aether Lion like this.
  19. Conn0r

    Conn0r GBAtemp Fan

    Member
    327
    187
    Jan 10, 2016
    United States
    At least 0.63GB
     
  20. Aether Lion

    Aether Lion GBATemp's Pet Lion

    Member
    412
    186
    May 1, 2016
    United States
    Penisylvania
    ~2kb :yay3ds: lolol
     
  21. Ricken

    Ricken And you must keep your soul

    Member
    2,245
    2,485
    Jan 19, 2016
    United States
    Shibuya, The small one from Vegas
    All N3DS Nands are over 1GB iirc. lol
    Isnt Cubic smaller? Freaky as well for that matter
     
    Last edited by Ricken, Jun 4, 2016