iQue Player Code Execution achieved!

Discussion in 'Other Consoles & Oldies' started by dark_samus3, Apr 29, 2018.

  1. dark_samus3
    OP

    dark_samus3 GBAtemp Addict

    Member
    10
    May 30, 2015
    United States
    Today we were able to successfully execute code on the iQue player! This is the first publically known code execution.

    Technical details: we were able to implement a known attack on the encryption scheme used with the iQue (AES-CBC) to inject custom data into the game data stored on the iQue NAND. This data is unchecked (but encrypted with keys we don't know) once it has been converted to ".rec" format. We also took advantage of a save file; they're unchecked and mapped to a certain region of RAM, so it's basically free space for us.

    The CBC attack: AES-CBC uses the previous encrypted block and XORs it against the next block, after it has been decrypted, to produce the final plaintext decryption. XOR is deterministically modifiable, if you know the plaintext (which we do, thankfully :) ). This attack does sacrifice a block of data (which will decrypt to random garbage) but it gains us control over arbitrary sections of code in the next block, and ultimately doesn't matter; we were able to sacrifice an unused section to control exactly the code we wanted. (see here for AES-CBC decryption procedure: image)

    very first successful result: ACE.JPG

    In action:


    Shoutouts: Marshallh, Normmatt, and Riley/ROL :D
     
    Last edited by dark_samus3, Apr 29, 2018
  2. Jayro

    Jayro MediCat USB and Mini Windows 10 Developer

    Member
    15
    GBAtemp Patron
    Jayro is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    Jul 23, 2012
    United States
    Octo Canyon
    VERY exciting stuff, good job! (I'm guessing a ROM loader is out of the question?)
     
    KiiWii likes this.
  3. Searinox

    Searinox Dances with Dragons

    Member
    8
    Dec 16, 2007
    Romania
    Bucharest
    Woohoo! Homebrew on a new console. Or close to that? So this is what a padding oracle attack?
     
  4. Jhynjhiruu

    Jhynjhiruu GBAtemp Advanced Fan

    Member
    6
    Dec 31, 2016
    Still quite a long way off from proper homebrew, or a ROM loader. But we're working on it, as quickly as we can!
     
    TotalInsanity4 and Jayro like this.
  5. EdTheNerd

    EdTheNerd Newbie

    Newcomer
    1
    Aug 5, 2017
    United States
    USA
    Woo! I've been eyeing iQue's for years. Time to import one.
     
    TotalInsanity4, KiiWii and DarthDub like this.
  6. Kevinpuerta

    Kevinpuerta GBAtemp Advanced Fan

    Member
    5
    Mar 6, 2016
    United States
    Less than 5 mins later. You actually bought one lol
     
    EdTheNerd likes this.
  7. EdTheNerd

    EdTheNerd Newbie

    Newcomer
    1
    Aug 5, 2017
    United States
    USA
    It was overdue :)
     
    Kevinpuerta likes this.
  8. asper

    asper GBAtemp Advanced Fan

    Member
    7
    May 14, 2010
    United States
    Tested and working ! Thanks to Jynji for all the support :)
     
  9. DarthDub

    DarthDub Amateur Hacker

    Member
    11
    Jan 26, 2016
    United States
    Your mom's basement.
    Brb buying an iQue.
     
  10. KiiWii

    KiiWii Contributor

    pip Contributor
    18
    Nov 17, 2008
    United Kingdom
    Amazing, I definitely need to invest....
     
  11. zoogie

    zoogie playing around in the dsiware

    pip Developer
    21
    Nov 30, 2014
    Micronesia, Federated States of
    Very interesting direction to take console hacking! I didn't even know about this until yesterday.
    These aren't to badly priced online either, thinking about snagging one.

    (SUXXORS is credited too? Isn't that a warez group? Not complaining, just a little bit of an unusual greet :P)
     
  12. dark_samus3
    OP

    dark_samus3 GBAtemp Addict

    Member
    10
    May 30, 2015
    United States
    It wouldn't have been possible without them; the AES-CBC attack we used required knowing the plaintext of a game, so they indirectly helped us ¯\_(ツ)_/¯
     
  13. Psi-hate

    Psi-hate GBATemp's Official Psi-Hater

    Member
    9
    Dec 14, 2014
    United States
    Houston
    Congrats! I've always wanted to import an iQue to get my OoT Romhacks working if there'd be a ROM loader, and it looks like that's now something I can feasibly hope for! Great job, I'm beyond excited to see what you guys manage to pull off.
     
    DarthDub likes this.
  14. MockyLock

    MockyLock GBAtemp Regular

    Member
    5
    Apr 21, 2011
    France
    I'm very intrested by this iQue scene revival.
    Congratulations !
     
    TotalInsanity4 likes this.
  15. Nintendrew

    Nintendrew Newbie

    Newcomer
    1
    Apr 30, 2018
    United States
    Great work, guys. Really hoping we'll eventually see a homebrew replacement for the defunct iQue download service to inject the retail roms back onto iQue hardware (whether by rom loader or other means). Thanks for the update!
     
    bennyman123abc likes this.
  16. Jhynjhiruu

    Jhynjhiruu GBAtemp Advanced Fan

    Member
    6
    Dec 31, 2016
    Well, for that, we would have to figure out how to sign tickets... or get psychic paper working. Something more akin to USB Loader GX is more likely, short-term.
     
    Nintendrew likes this.
  17. leon315

    leon315 POWERLIFTER

    Member
    10
    Nov 27, 2013
    Italy
    i vener heard of that iQue thing, what is it?? and what you can do with it??
     
  18. Jhynjhiruu

    Jhynjhiruu GBAtemp Advanced Fan

    Member
    6
    Dec 31, 2016
    Check the Wikipedia page for 'iQue Player'
     
  19. leon315

    leon315 POWERLIFTER

    Member
    10
    Nov 27, 2013
    Italy
    wow interesting indeed! then what has tc done so far?? did he manage to crack it?
     
  20. Jhynjhiruu

    Jhynjhiruu GBAtemp Advanced Fan

    Member
    6
    Dec 31, 2016
    tc?
     
Quick Reply
Draft saved Draft deleted
Loading...