mch2t - alternative memchunkhax2 implementation

Discussion in '3DS - Homebrew Development and Emulators' started by AngelSL, Apr 2, 2016.

  1. AngelSL
    OP

    AngelSL Member

    Newcomer
    18
    12
    Dec 29, 2008
    Singapore
    I've written an alternative memchunkhax2 exploit implementation that does not depend on version specific information like svchax does (svchax has dumps of the thread local page for each FW).

    The only version-dependent information mch2t uses is the paddr-vaddr delta for the kernel slabheap (which has not changed since 9.0), and the structures of KThread and KProcess (which have not changed either). Therefore this exploit should work on all kernels 9.0 and newer.

    This exploit also tries to corrupt as little used kernel memory as possible. You can look at how it tries to do this by staring at the source for a while.

    The code is available here.

    Please help me test if it works using this test binary. Do report your results. If you see "Checking am access... OK", it worked. Note that pressing B to exit to launcher does not work, just like in the other two memchunkhax2 implementations. I don't know why.

    This uses the same exploit as aliaspider's svchax and delebile's libsu (the exploit known as memchunkhax2); it is just exploited differently.

    Thanks to aliaspider for helping me in understanding his svchax code and for many suggestions here and there and for putting up with my ignorance about the 3DS platform in general.
     
    Last edited by AngelSL, Apr 2, 2016
    Xenon Hacks, Minnow, mungry and 4 others like this.
  2. icecream
    This message by icecream has been removed from public view by shaunj66, Apr 4, 2016, Reason: Off topic.
    Apr 2, 2016
  3. MajinCubyan

    MajinCubyan The Funky Super Saiyan

    Member
    588
    943
    Nov 24, 2014
    United States
    Orre
    I'll give it a try when I get home! Thanks for sharin!
     
  4. iCEQB

    iCEQB GBAtemp Advanced Fan

    Member
    682
    447
    Nov 2, 2013
    United States
    Was this built on reliability ? I mean, is the probability for a success higher than the other 2 implementations?
     
  5. liomajor

    liomajor GBAtemp Maniac

    Member
    1,463
    1,065
    Jun 10, 2008
    United States
    S01E02 E0A01839 failed to start deleay thread
     
  6. Joom

    Joom  ❤❤❤

    Member
    4,030
    2,734
    Jan 8, 2016
    United States
    Not sure if trolling.
     
    PaiiNSteven likes this.
  7. SirBeethoven

    SirBeethoven 3.145.... something. E=mc2

    Member
    1,808
    552
    Nov 26, 2015
    United States
    Well, you can play any 3ds games with a 3ds- make sure it's not a game out of your region though :)
     
  8. BothyBhoy

    BothyBhoy GBAtemp Advanced Fan

    Member
    836
    245
    Nov 27, 2015
    Just don't answer that cretin........
     
    SirBeethoven likes this.