I've written an alternative memchunkhax2 exploit implementation that does not depend on version specific information like svchax does (svchax has dumps of the thread local page for each FW).
The only version-dependent information mch2t uses is the paddr-vaddr delta for the kernel slabheap (which has not changed since 9.0), and the structures of KThread and KProcess (which have not changed either). Therefore this exploit should work on all kernels 9.0 and newer.
This exploit also tries to corrupt as little used kernel memory as possible. You can look at how it tries to do this by staring at the source for a while.
The code is available here.
Please help me test if it works using this test binary. Do report your results. If you see "Checking am access... OK", it worked. Note that pressing B to exit to launcher does not work, just like in the other two memchunkhax2 implementations. I don't know why.
This uses the same exploit as aliaspider's svchax and delebile's libsu (the exploit known as memchunkhax2); it is just exploited differently.
Thanks to aliaspider for helping me in understanding his svchax code and for many suggestions here and there and for putting up with my ignorance about the 3DS platform in general.
The only version-dependent information mch2t uses is the paddr-vaddr delta for the kernel slabheap (which has not changed since 9.0), and the structures of KThread and KProcess (which have not changed either). Therefore this exploit should work on all kernels 9.0 and newer.
This exploit also tries to corrupt as little used kernel memory as possible. You can look at how it tries to do this by staring at the source for a while.
The code is available here.
Please help me test if it works using this test binary. Do report your results. If you see "Checking am access... OK", it worked. Note that pressing B to exit to launcher does not work, just like in the other two memchunkhax2 implementations. I don't know why.
This uses the same exploit as aliaspider's svchax and delebile's libsu (the exploit known as memchunkhax2); it is just exploited differently.
Thanks to aliaspider for helping me in understanding his svchax code and for many suggestions here and there and for putting up with my ignorance about the 3DS platform in general.
Last edited by AngelSL,
