Homebrew [maybe a new haxx idea?] Tomodachi life

[Deleted User]

What've we learned today, class?
We learned that any QR code reader is able to be exploited because Smea exploited one from a single game. That clearly means that all can!

 

[MsMidnight]

What've we learned today, class?
We learned that not any QR code reader is able to be exploited!

fixed

 

[dankzegriefer]

What've we learned today, class?
We learned that any QR code reader is able to be exploited!

No. Barely any can.

 

[Deleted User]

fixed

No. Barely any can.

I was trying to be sarcastic or something, but I clearly messed up.
I just edited my post to make it sound a bit more sarcastic.

 

[Ricken]

LifeHax has been brought up so many times its not even funny anymore. I am tired of seeing threads like this...

Want something more cancerous?

Look for Browserhax in replies to Smealums twitter tweets

 

[Conn0r]

In the slight chance that it is possible, it would be even harder to do than cubic ninja on 11.0.0. Because we lost access to downloading larger payloads from HTTP:C we would have to fit the entire web browser takeover code in one qr code. Mii QR codes are smaller than CN QR codes so that would be almost impossible.

 

[Khangaroo]

In the slight chance that it is possible, it would be even harder to do than cubic ninja on 11.0.0. Because we lost access to downloading larger payloads from HTTP:C we would have to fit the entire web browser takeover code in one qr code. Mii QR codes are smaller than CN QR codes so that would be almost impossible.

Why not require the user to download a payload and put it on the sd card, so the exploit can just jump to it?

 

[Conn0r]

Why not require the user to download a payload and put it on the sd card, so the exploit can just jump to it?

The web browser takeover is required to use the sd card. :/

 

[Ricken]

The web browser takeover is required to use the sd card. :/

Wait, so the exploit uses something like Spider?

 

[dankzegriefer]

Wait, so the exploit uses something like Spider?

It gains ROP under spider to take control.

 

[Conn0r]

From Smea's devblog:
"Stage 3 : getting access to more services and SDMC by taking over spider/SKATER (aka spiderto/SKATERto)
Description : the 3DS runs a fully multitasking OS which is able to execute applets simultaneously to the main application. These applets include the home menu and the web browser (aka spider on the 3DS, and SKATER on the New 3DS). It is possible to launch such an applet from any usermode app through APT commands.

Problem : while system applets such as spider usually keep their .text in the 0×26800000+ region, they use a heap to store information, including stacks for secondary threads. This heap is below the cutoff for FCRAM GPU DMA access. This allows us to takeover that thread using GPU DMA and some neat timing tricks. From there we can takeover spider’s main thread, and use that to run the next stage, all through ROP. From there, we use NS:SendParameter to give Cubic Ninja spider’s ro and fs session handles.

Limitations : this only gives us ROP execution under spider/SKATER, not actual code execution."

 

[Logan Pockrus]

From Smea's devblog:
"Stage 3 : getting access to more services and SDMC by taking over spider/SKATER (aka spiderto/SKATERto)
Description : the 3DS runs a fully multitasking OS which is able to execute applets simultaneously to the main application. These applets include the home menu and the web browser (aka spider on the 3DS, and SKATER on the New 3DS). It is possible to launch such an applet from any usermode app through APT commands.

Problem : while system applets such as spider usually keep their .text in the 0×26800000+ region, they use a heap to store information, including stacks for secondary threads. This heap is below the cutoff for FCRAM GPU DMA access. This allows us to takeover that thread using GPU DMA and some neat timing tricks. From there we can takeover spider’s main thread, and use that to run the next stage, all through ROP. From there, we use NS:SendParameter to give Cubic Ninja spider’s ro and fs session handles.

Limitations : this only gives us ROP execution under spider/SKATER, not actual code execution."

I'm glad people actually pay attention to my posts!

Anyway, yes, Ninjhax gets ROP execution under SPIDER, because it has access to the SD card and has some other nice advantages (read the dev blog!).

 

[Conn0r]

I'm glad people actually pay attention to my posts!

Anyway, yes, Ninjhax gets ROP execution under SPIDER, because it has access to the SD card and has some other nice advantages (read the dev blog!).

Just say'n I've read Smea's blog before ninjhax was released.
Me = hipster

 

[Logan Pockrus]

Just say'n I've read Smea's blog before ninjhax was released.
Me = hipster

So my post means nothing?

If you want an idea of how complex an exploit is, take a look at this: http://smealum.net/?p=517

NOOOOOO!

 

[Pikasack]

Honestly, I could only see, if any, an exploit if you use an Overflow is a Mii's name, their details, or Overflowing the save files with Miis in general.
Just going out on a limb by saying this, but it sounds the most logical at least.

 

[Khangaroo]

Honestly, I could only see, if any, an exploit if you use an Overflow is a Mii's name, their details, or Overflowing the save files with Miis in general.
Just going out on a limb by saying this, but it sounds the most logical at least.

I named my Mii "Delete System32" and my 3DS disappeared!!!!!!!!11111

EDIT: Oh, I thought your post was a joke about naming a Mii "Overflow".

 

[Pokéidiot]

Overflowing a Mii name. It would destroy the Mii Maker save data but... buffer overflows are normally exploitable... am I wrong?

 

[Ricken]

That doesnt necessarily mean you can gain ROP

 

[Swiftloke]

Overflowing a Mii name. It would destroy the Mii Maker save data but... buffer overflows are normally exploitable... am I wrong?

Yeah you are. Buffer overflows, for one, need to be functional, and not protected by the game. Then, it depends entirely on what you can overflow into. The supermysterychunkhax writeup would be ideal for an explanation, go read it.

 

[Selim873]

So does Animal Crossing, but there's no CrossingHax.