Homebrew Idea: SSL exploit, Flipnote, and the DSi system updater

[Deleted User]

Is the DSI's updater XML/SOAP request signature not checked apart from HTTPS/the installed title signatures?
If it is NOT, could we use the SSL constraint exploit to add Flipnote studio as an "updated title" and install it without the shop? Because it would be the untouched tmd/ticket/app it wouldn't fail the "inner" sig check

 

[Deleted User]

Update:
It isn't!

https://yls8.mtheall.com/ninupdates/titlelist.php?date=12-11-12_07-30-09&sys=twl&reg=E&soapreply=1

 

[Deleted User]

I was trying to find more information about the update requests and, hilariously, the #1 hit on Google for "dsi updater soap" is this literal thread

 

[edo9300]

There's shutterbug that is already working on an exploit using the SSL flaw

 

[SCOTT0852]

There's shutterbug that is already working on an exploit using the SSL flaw

That's different from this though. Shutter's flaw is to run code to install unlaunch whenever any DSi app connects to the network, this is trying to use the system update feature to install Flipnote Studio, which we can exploit.

 

[Deleted User]

That's different from this though. Shutter's flaw is to run code to install unlaunch whenever any DSi app connects to the network, this is trying to use the system update feature to install Flipnote Studio, which we can exploit.

This, if it works, would also be an order of magnitude easier to actually make.

 

[Crimson Cuttlefish]

Could this mean installation of DSiWare like FNS without hardmodding? Huge if so, unknown size if not because I am not well-versed

 

[Deleted User]

Could this mean installation of DSiWare like FNS without hardmodding? Huge if so, unknown size if not because I am not well-versed

Yes, because once flipnote is installed you can use Lenny to install unlaunch

 

[edo9300]

Had this idea, instead of downloading an exploitable dsiware, once you can download anything you want, you should be able to directly install an homebrew that let's you mod the ds without performing any exploit

 

[Deleted User]

Had this idea, instead of downloading an exploitable dsiware, once you can download anything you want, you should be able to directly install an homebrew that let's you mod the ds without performing any exploit

That is not possible.

The updater downloads a list of official, signed titles and installs them. HOWEVER, that list can be edited to include anything that is/was free on the eShop (like Flipnote and the browser, and maybe 4SAE). Not just any code from anywhere

 

[bendevnull]

That is not possible.

The updater downloads a list of official, signed titles and installs them. HOWEVER, that list can be edited to include anything that is/was free on the eShop (like Flipnote and the browser, and maybe 4SAE). Not just any code from anywhere

Okie. Now how do you propose we edit this list?

 

[Deleted User]

Okie. Now how do you propose we edit this list?

Creating a fake update server using NDS constraint (previously not possible because we couldn't bypass SSL certificate checks)

 

[Flashed]

This point is really interesting. I have been reading a lot about DNS Spoofing, and knowing that now we can bypass SSL, we should have acces to the updater tool.
Nevertheless, this will require reverse engineering. Tools like wireshark may help a lot.

 

[ableto288]

So its possible create it?

(Sorry 4 bad english)

 

[b0br]

hello all ()
b0br here
I'm new

its there a rogue app store? can we run a httpdssl server, dns resolve locally, recreate the shop and put up our own downloads then?

 

[gudenau]

Would be really cool if that would work. Imagine managing to make it so the DSi could install homebrew from the eShop as though it was signed.

 

[Deleted User]

Would be really cool if that would work. Imagine managing to make it so the DSi could install homebrew from the eShop as though it was signed.

It's possible if you were to delete the old eShop and make a patched one without RSA checks, but not directly without unlaunch

 

[gudenau]

It's possible if you were to delete the old eShop and make a patched one without RSA checks, but not directly without unlaunch

I don't know, maybe a bug in that could be found one day.

 

[ableto288]

This, if it works, would also be an order of magnitude easier to actually make.

Its possible do that?