NDS profile ROP payload as .3ds?

Discussion in '3DS - Homebrew Development and Emulators' started by Searinox, Jan 11, 2015.

  1. Searinox
    OP

    Searinox <3

    Member
    1,734
    160
    Dec 16, 2007
    Romania
    DISCLAIMER: I normally would post this in the flashcart board, but since it deals more with flashcart issues than software development, and since homebrew users rely on it too to some extent, I will ask here.

    I also normally wouldn't ask for this because I normally don't make requests since well, nobody has to honor them anyway.

    I also normally don't have a use myself for this, but I know someone who could use it, and I imagine both people here and back on the flashcart board could have some use for it.

    Now then...

    I'd like to ask if anyone kindly could make a 3DS file that writes the DS mode exploit used to trigger everything from CFWs to flashcarts and whatnot.

    The reason I'm asking this is for a few scenarios, where the new 4.5-9.2 exploit is launched and the person in question has either the CFW package or a Gateway/MT card but does not own an NDS flashcart. Rebooting into enhanced sysNAND mode after downgrade and then running that file would entirely remove the need for a DS card.

    I realize that yes, people can either go to an exploit site or host one on a smartphone and use it everytime, but a 3DS file that writes the data to profile removes the need for both website hassle and a secondary card and I think could benefit a lot of people. The exploit source already exists so I'd imagine it's not too a hassle. Thank you.
     


  2. loco365

    loco365 GBAtemp Guru

    Member
    5,458
    2,673
    Sep 1, 2010
    But how do you run a .3ds file if you don't have a flashcard? All 3DS flashcards come with a DS-mode card anyways, so if you run the 3DS to install the file, you'll probably have a DS card to use with it.
     
  3. Searinox
    OP

    Searinox <3

    Member
    1,734
    160
    Dec 16, 2007
    Romania
    You launch the web exploit and use GW's launcher.dat to downgrade, and then to boot enhanced sysnand mode. Red Card isn't needed for that. Then you simply replace the launcher with say, the CFW one, and you've set up CFW with zero flashcards.
     
  4. Rinnegatamante

    Rinnegatamante GBAtemp Psycho!

    Member
    3,127
    3,260
    Nov 24, 2014
    Italy
    Bologna
    Post sourcecodes.
     
  5. CalebW

    CalebW Fellow Temper

    Member
    634
    154
    Jun 29, 2012
    United States
    I don't think that the browser exploit write to the nds profile, so, the CFW launcher would not work.
     
  6. Searinox
    OP

    Searinox <3

    Member
    1,734
    160
    Dec 16, 2007
    Romania
    The browser exploit doesn't write to the DS profile. It launches the GW launcher, which can then launch ehnanced sysnand mode. From there, the Red GW could launch a 3ds file that writes the DS profile exploit. Basically a .3ds version of GW_INSTALLER.NDS.
     
  7. gudenau

    gudenau Never a unique idea

    Member
    3,236
    1,216
    Jul 7, 2010
    United States
    /dev/random
    I suppose this would be possible, but not really worth it. If you kill the profile by mistake it would become a problem.
     
  8. Korin

    Korin GBAtemp Regular

    Member
    127
    149
    Jan 10, 2015
    Would formatting not restore a broken DS mode profile?
     
  9. gudenau

    gudenau Never a unique idea

    Member
    3,236
    1,216
    Jul 7, 2010
    United States
    /dev/random
    It *should*.
     
  10. JustPingo

    JustPingo GBAtemp Fan

    Member
    497
    996
    Jan 11, 2015
    France
    I would love to see that happenning though since my Blue Card is not working on my 4.5 3DS to install DS Profile exploit, but Browser Exploit does.
     
  11. Korin

    Korin GBAtemp Regular

    Member
    127
    149
    Jan 10, 2015
    If you have another DS mode flash cart (I use my DsTwo) you can usually install it through that, though I would try and find information on specific flashcards first.
     
  12. JustPingo

    JustPingo GBAtemp Fan

    Member
    497
    996
    Jan 11, 2015
    France

    The fact is that the only other one I own doesn't work, even with flashcardtimewarp xD
     
  13. Korin

    Korin GBAtemp Regular

    Member
    127
    149
    Jan 10, 2015
    Just to make sure you're doing this all right, you've got the launcher.dat on your SD card (Internal), the gateway installer on your blue card's micro sd right?
    Then you're starting the blue card, running the installer (It completes?)
    Then going to the settings on your 3ds and selecting "DS Profile"?

    I haven't heard of that not working before.
     
  14. JustPingo

    JustPingo GBAtemp Fan

    Member
    497
    996
    Jan 11, 2015
    France

    No, the blue card just doesn't work.

    On booting Deep Labyrinth:
    [​IMG]

    Same with crappy R4i clone.

    Oh, and I haven't mentioned that I use a downgraded console.
     
  15. iwasaperson

    iwasaperson Advanced Member

    Newcomer
    81
    51
    Aug 1, 2013
    United States
    You could try installing the cia to run all DS carts to SysNAND (BACKUP YOUR NAND)
     
  16. cearp

    cearp the ticket master

    Member
    7,391
    4,639
    May 26, 2008
    Tuvalu
    Launcher.dat programs can have 100% nand access, so sure, it is possible to install the ds exploit via one of those (unless i am overlooking something) - but at the moment people have not figured how to get their own code working with GW's new web exploit. and even so, i don't think there is enough need for it for someone to go to the effort of creating it.
    but sure it's a nice idea
     
  17. lemanuel

    lemanuel Maxconsole's All-Knowing Lurker

    Member
    2,095
    1,092
    Dec 11, 2014
    Portugal
    he already said that he did

     
  18. The Real Jdbye

    The Real Jdbye Always Remember 30/07/08

    Member
    GBAtemp Patron
    The Real Jdbye is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    11,396
    4,730
    Mar 17, 2010
    Norway
    Alola
    The red card is needed to run the .3ds though. :unsure:
     
  19. Aurora Wright

    Aurora Wright GBAtemp Advanced Maniac

    Member
    1,542
    4,095
    Aug 13, 2006
    Italy
    The Rop chain isn't on nand, but on the ds-mode nvram.
    I think it's technically doable since the 4.5 exploits achieve full control over arm9 and arm11, but no code for writing to nvram has been released (I think).
     
    cearp likes this.
  20. Vappy

    Vappy GBAtemp Advanced Maniac

    Member
    1,506
    1,153
    May 23, 2012
    Yifanlu has reversed it least as far as getting usermode exec with gspwn, and has done a writeup of most of it on his blog. If ssspwn as a whole doesn't give access to cfg:nor then gspwn by itself won't, but if he continues to make progress, it might be possible.
     
    cearp likes this.