ROM Hack Loading the DS profile exploit (or other launchers) using Gateway Go

[Falo]

Because there's no code for older firmwares, am I right?

Yes, 0x0 - 0x19FFF is empty, if the browser or ds exploit trys to decrypt it, it will produce junk code and then crash.

But there is also dlplay, his patch may only work on 9.X, not 7.1-8.1, i would need a ram dump from 7.X and 9.X to verify this.

 

[Subtle Demise]

Instead of jumping straight into the web browser exploit, why not perfect your tools for the existing rop loaders first?

 

[night_hawk]

You know what, I'm so sick of all the 3DS scene elitists that say "Yeah, we have full kernel access. No, we're not going to release it to anyone outside of our circle. I'll make a deal to everyone here:

If someone can point me in the right direction (IE what languages/programs to learn, and even the basics on how the internal structure of the 3DS works so I don't have to reinvent the wheel), I will drop everything I am currently doing and dedicate all of my time, and yes, ALL OF IT, to creating, reverse engineering, whatever it takes to create a public, fully accessible userland exploit that will allow you to run any and all 3DS launchers. I will make it free and fully available to everyone. Hell, if it gets enough support, I'll even develop a toolkit filled with everything you could ever dream of.

No, I'm not joking. This shit has gotten me fucking heated.

It looks like there are some really intelligent people here, so I'm sure I can depend on their support.

After I have all of the necessary information to start, leave the rest to me. Again, all I need is the basic workings of the 3DS, and if the reversing of the go exploit is successful and made fully public, I'll build on that, too, and create something even better.

Is not so easy, would take years to aquire the knowledge, not weeks or months, you are too optimistic.
Anyway, you can start looking at 3dbrew, you can see how the system works, it's all documented very well by yellows8 (you know who he is right?).
Then if you understand what you read on 3dbrew, you could start to study C# and C++, but for this kind of job, for RE, you must know Assembly.
Good luck.

 

[DSoryu]

So here we have one of the guys the ol' school scene had. yifan_lu is also one of them, but he only does this in order to mantain the knowledge public, and he did an amazing work on RE the gateway launcher.dat, but left it right now, and his main interest is to make his own code or maybe RE the next gateway release.

His work is amazing, I feel a little envious, but the good envy. Man, I wish I have that time to understand every bit, even determine wich code is just obfuscation and such, atm I only can determine the start of an encryption stage lol.
http://yifan.lu/2015/01/17/reversing-gateway-ultra-stage-3-owning-arm9-kernel/Maybe you should contact him instead of asking for help here.
http://yifan.lu/2015/01/17/reversing-gateway-ultra-stage-3-owning-arm9-kernel/

 

[WateredFire19]

I have the top multiloader on my R4i Gold card. How can I load MT Card's launcher.DAT using the top multiloader? I can't figure it out

 

[gudenau]

I hate this stuff, I am working on a project and as soon as it is something I will release the sources. Why is it so hard?

 

[WateredFire19]

Now, we also know that you can run ANY launcher using the ROP loader .nds file on a flash cart. However flashcarts are not always an option for people, or people prefer a softmod over buying a flashcart (like me). The ROP loader has a couple different loading options, one of which being able to load encrypted files, and the other being to load unencrypted files. The one on the web loads encrypted files only, which means that if you want to load a CFW, be it the original or Palantine, you can't do it.

Answers are appreciated greatly.

Can someone explain THIS to me please? I have a R4i flashcart so does that mean I can run any launcher.DAT through the go web exploit if I use/install rop loader?

 

[nop90]

I have the top multiloader on my R4i Gold card. How can I load MT Card's launcher.DAT using the top multiloader? I can't figure it out

MT uses GW code, so you can select the GW option (#1).

 

[TheHomesk1llet]

http://yifan.lu/2015/01/17/reversing-gateway-ultra-stage-3-owning-arm9-kernel/

http://yifan.lu/2015/01/17/reversing-gateway-ultra-stage-3-owning-arm9-kernel/
You're probably not going to believe this, but this final explanation of the exploit almost completely makes sense to me (gateway's obfuscation of the code being the exception). With this knowledge and a bit of research, I can definitely make an exploit based on this one.

Just gonna make sure it doesn't write anywhere important, heh.

 

[WateredFire19]

MT uses GW code, so you can select the GW option (#1).

Thanks!!! I'll try it now

 

[WateredFire19]

MT uses GW code, so you can select the GW option (#1).

And will it work on 7.2.0?

 

[nop90]

And will it work on 7.2.0?

Does MT launcher work for boting 7.2.0 emunand? Yes.

Does DS profile hack work on 7.2.0 sysnand? try and tell .

Can someone explain THIS to me please? I have a R4i flashcart so does that mean I can run any launcher.DAT through the go web exploit if I use/install rop loader?

Through the web exploit you can load only sw created to be load with this exploit (at the moment GW 3.0 launcher.dat and Smealum regionthree).

With the DS profile exploit (installable with the one of the DS program ROP loader only on a 4.X FW) you can launch only the old format launcher.dat.

The GW 3.0 launcher.dat can be loaded with both ways only because it's made with a trick, i.e. glueing two different programs. The Explorer exploit simply skips the first part and load the second. I suppose that smealum placed a bunch of unused values (maybe all zeros) at the beginning of the file before his region free hack in ordert to be loaded with the web exploit.

 

[WateredFire19]

Does MT launcher work for boting 7.2.0 emunand? Yes.

Does DS profile hack work on 7.2.0 sysnand? .

I dont mean the MSET exploit, i mean the web explot. Can you loader any launcher.dat using the web exploit if you install ROP Loader .nds first is my question, because that's what it seems to be saying at the beginning of this thread.

 

[nop90]

I dont mean the MSET exploit, i mean the web explot. Can you loader any launcher.dat using the web exploit if you install ROP Loader .nds first is my question, because that's what it seems to be saying at the beginning of this thread.

I don't understand well what you're asking. My english is not very good, but I espect that a sentence starting with "Can you" shoud have somwhere an ending "?". (please understand, I'm a C developer, I can not ignore the syntax )

Anyway from what I can figure out of what you're are asking, the answer is in the second part of the message you quoted.

 

[WateredFire19]

I don't understand well what you're asking. My english is not very good, but I espect that a sentence starting with "Can you" shoud have somwhere an ending "?". (please understand, I'm a C developer, I can not ignore the syntax )

Anyway from what I can figure out of what you're are asking, the answer is in the second part of the message you quoted.

Ok, ill try to explain it better. The only Launcher.dat's you can use with the Gateway Go exploit are GW 3.0, GW 3.0.1, and Regionthree. Using ROP Installer, can i force the Go exploit to load any other Launcher.dat? I have an R4i Gold, and SysNAND 7.2.0-17u.

 

[nop90]

No you can't.

A ROP is a way to run existing piece of sw to make your own program when you can't execute the code you could write on memory.

"DS rop loader" loads a rop chain using an expolit in the ds profile. This rop loads in a specific memory location a file named launcher.dat and tryes to execute it. But this file has to be linked to run in it's specific location.

The web expoits load a ROP chain too, using an exploit in the IE browser. This ROP loads a file named launcher.dat, but in a different memory location, and this file has to be compiled and linked to run in this memory location.

So the two kind of files can't be exchanged.

Is it possible to convert an older launcher.dat (e..g. the CFW one) to work with the new exploit? theoretically yes if you have the source and you know how to do it.

Gateway did it. Smealum did it with his region spoofer. Some others can do it. No one will do it for the CFW.

 

[WateredFire19]

Ok.. But look at the beginning of the thread. It says we can use any Launcher.dat with Go exploit as long as we have a DS mode flashcart. Look back at the post i quoted in bold. And one other question: I have a 2DS on 7.2.0-17u so can i use EmuNAND 7.2.0 on it without a flashcart?

 

[Sizednochi]

Just gonna make sure it doesn't write anywhere important, heh.

You are a great human being.

 

[mid-kid]

What if - just bear with me - you could send the DS profile exploit via download play, using Gateway Go and regionthree code to skip any download play checks?

 

[TheHomesk1llet]

You are a great human being.

Heh heh...it's nothing, really c:

I just want to give back to the community that's given so much to me. I believe that information should be free and open, so I'm just putting the pieces together for everyone.

Keep in mind that I don't know how long exactly it'll take, but it shouldn't be more than a month. In addition to myself, I know a few people who are very proficient with C and C++, and one person who knows ASM and ARM. I'm gonna figure out assembly and disassembly and then I'll get right to work.