1. dark_samus3

    OP dark_samus3 GBAtemp Addict
    Member

    Joined:
    May 30, 2015
    Messages:
    2,372
    Country:
    United States
    Today we were able to successfully execute code on the iQue player! This is the first publically known code execution.

    Technical details: we were able to implement a known attack on the encryption scheme used with the iQue (AES-CBC) to inject custom data into the game data stored on the iQue NAND. This data is unchecked (but encrypted with keys we don't know) once it has been converted to ".rec" format. We also took advantage of a save file; they're unchecked and mapped to a certain region of RAM, so it's basically free space for us.

    The CBC attack: AES-CBC uses the previous encrypted block and XORs it against the next block, after it has been decrypted, to produce the final plaintext decryption. XOR is deterministically modifiable, if you know the plaintext (which we do, thankfully :) ). This attack does sacrifice a block of data (which will decrypt to random garbage) but it gains us control over arbitrary sections of code in the next block, and ultimately doesn't matter; we were able to sacrifice an unused section to control exactly the code we wanted. (see here for AES-CBC decryption procedure: image)

    very first successful result: ACE.JPG

    In action:


    Shoutouts: Marshallh, Normmatt, and Riley/ROL :D
     
    Last edited: Apr 29, 2018
  2. Jayro

    Jayro MediCat USB and Mini Windows 10 Developer
    Member

    Joined:
    Jul 23, 2012
    Messages:
    7,371
    Country:
    United States
    VERY exciting stuff, good job! (I'm guessing a ROM loader is out of the question?)
     
    KiiWii likes this.
  3. Searinox

    Searinox Dances with Dragons
    Member

    Joined:
    Dec 16, 2007
    Messages:
    2,016
    Country:
    Romania
    Woohoo! Homebrew on a new console. Or close to that? So this is what a padding oracle attack?
     
  4. Jhynjhiruu

    Jhynjhiruu GBAtemp Advanced Fan
    Member

    Joined:
    Dec 31, 2016
    Messages:
    814
    Country:
    Still quite a long way off from proper homebrew, or a ROM loader. But we're working on it, as quickly as we can!
     
    TotalInsanity4 and Jayro like this.
  5. EdTheNerd

    EdTheNerd Newbie
    Newcomer

    Joined:
    Aug 5, 2017
    Messages:
    8
    Country:
    United States
    Woo! I've been eyeing iQue's for years. Time to import one.
     
    TotalInsanity4, KiiWii and DarthDub like this.
  6. Kevinpuerta

    Kevinpuerta GBAtemp Advanced Fan
    Member

    Joined:
    Mar 6, 2016
    Messages:
    519
    Country:
    United States
    Less than 5 mins later. You actually bought one lol
     
    EdTheNerd likes this.
  7. EdTheNerd

    EdTheNerd Newbie
    Newcomer

    Joined:
    Aug 5, 2017
    Messages:
    8
    Country:
    United States
    It was overdue :)
     
    Kevinpuerta likes this.
  8. asper

    asper GBAtemp Advanced Fan
    Member

    Joined:
    May 14, 2010
    Messages:
    866
    Country:
    United States
    Tested and working ! Thanks to Jynji for all the support :)
     
  9. DarthDub

    DarthDub Amateur Hacker
    Member

    Joined:
    Jan 26, 2016
    Messages:
    2,712
    Country:
    United States
    Brb buying an iQue.
     
  10. KiiWii

    KiiWii Contributor
    Contributor

    Joined:
    Nov 17, 2008
    Messages:
    9,837
    Country:
    United Kingdom
    Amazing, I definitely need to invest....
     
  11. zoogie

    zoogie playing around in the dsiware
    Developer

    Joined:
    Nov 30, 2014
    Messages:
    7,971
    Country:
    Micronesia, Federated States of
    Very interesting direction to take console hacking! I didn't even know about this until yesterday.
    These aren't to badly priced online either, thinking about snagging one.

    (SUXXORS is credited too? Isn't that a warez group? Not complaining, just a little bit of an unusual greet :P)
     
  12. dark_samus3

    OP dark_samus3 GBAtemp Addict
    Member

    Joined:
    May 30, 2015
    Messages:
    2,372
    Country:
    United States
    It wouldn't have been possible without them; the AES-CBC attack we used required knowing the plaintext of a game, so they indirectly helped us ¯\_(ツ)_/¯
     
  13. Psi-hate

    Psi-hate GBATemp's Official Psi-Hater
    Member

    Joined:
    Dec 14, 2014
    Messages:
    1,697
    Country:
    United States
    Congrats! I've always wanted to import an iQue to get my OoT Romhacks working if there'd be a ROM loader, and it looks like that's now something I can feasibly hope for! Great job, I'm beyond excited to see what you guys manage to pull off.
     
    DarthDub likes this.
  14. MockyLock

    MockyLock GBAtemp Regular
    Member

    Joined:
    Apr 21, 2011
    Messages:
    187
    Country:
    France
    I'm very intrested by this iQue scene revival.
    Congratulations !
     
    TotalInsanity4 likes this.
  15. Nintendrew

    Nintendrew Newbie
    Newcomer

    Joined:
    Apr 30, 2018
    Messages:
    1
    Country:
    United States
    Great work, guys. Really hoping we'll eventually see a homebrew replacement for the defunct iQue download service to inject the retail roms back onto iQue hardware (whether by rom loader or other means). Thanks for the update!
     
    bennyman123abc likes this.
  16. Jhynjhiruu

    Jhynjhiruu GBAtemp Advanced Fan
    Member

    Joined:
    Dec 31, 2016
    Messages:
    814
    Country:
    Well, for that, we would have to figure out how to sign tickets... or get psychic paper working. Something more akin to USB Loader GX is more likely, short-term.
     
    Nintendrew likes this.
  17. leon315

    leon315 POWERLIFTER
    Member

    Joined:
    Nov 27, 2013
    Messages:
    3,014
    Country:
    Italy
    i vener heard of that iQue thing, what is it?? and what you can do with it??
     
  18. Jhynjhiruu

    Jhynjhiruu GBAtemp Advanced Fan
    Member

    Joined:
    Dec 31, 2016
    Messages:
    814
    Country:
    Check the Wikipedia page for 'iQue Player'
     
  19. leon315

    leon315 POWERLIFTER
    Member

    Joined:
    Nov 27, 2013
    Messages:
    3,014
    Country:
    Italy
    wow interesting indeed! then what has tc done so far?? did he manage to crack it?
     
  20. Jhynjhiruu

    Jhynjhiruu GBAtemp Advanced Fan
    Member

    Joined:
    Dec 31, 2016
    Messages:
    814
    Country:
    tc?
     
Draft saved Draft deleted
Loading...

Hide similar threads Similar threads with keywords - Execution, achieved, Player