New Super Mario Bros 2 crash. Could an exploit would be possible

Discussion in '3DS - Homebrew Development and Emulators' started by Ordim3n, Jul 10, 2016.

  1. Ordim3n
    OP

    Ordim3n GBAtemp Fan

    Member
    402
    109
    Dec 14, 2015
    Canada
    Planet earth
    So i was messing with NSMB2's save and i encountered a crash.
    Things that i know:
    There is no checksums in the save
    I changed the streetpass tags to get the crash
    The game will still accept the save even if the Streetpass section of the save is filled with FF and will look like this
    [​IMG]
    Video of the crash happening on both a N3ds and a O3ds

    I know that a crash doesn't always lead to an exploit
     


  2. Nyap

    Nyap HTML Noob

    Banned
    973
    344
    Jan 13, 2016
    That Chaos Site
    incoming hate
     
  3. Ordim3n
    OP

    Ordim3n GBAtemp Fan

    Member
    402
    109
    Dec 14, 2015
    Canada
    Planet earth
    That is a risk that need to be taken
     
    FrozenDragon150, Kyouken and Koko-Kun like this.
  4. vb_encryption_vb

    vb_encryption_vb That hardmod guy....

    Member
    1,866
    896
    Nov 21, 2015
    United States
    Acworth, GA
    There should be a separate sub section for "crashed games" so devs can investigate if they want.
     
  5. Ordim3n
    OP

    Ordim3n GBAtemp Fan

    Member
    402
    109
    Dec 14, 2015
    Canada
    Planet earth
    So... i'll probably upload some "docs"
     
  6. Swiftloke

    Swiftloke Hwaaaa!

    Member
    1,770
    1,520
    Jan 26, 2015
    United States
    Nowhere
    Not quite SMILEBasic in terms of actual reasoning but at least there's some period.
     
  7. DKB

    DKB FUCK OFF

    Member
    1,250
    1,188
    May 29, 2015
    United States
    New York City, Manhattan
    Unlike the Fateshax..there's something here. Ugh.
     
  8. DarkFlare69

    DarkFlare69 GBAtemp Psycho!

    Member
    4,710
    2,563
    Dec 8, 2014
    United States
    Ohio
    I don't see a way to get any code execution through this
     
    verifyvenuz, Ricken and Wafflepaint like this.
  9. Ordim3n
    OP

    Ordim3n GBAtemp Fan

    Member
    402
    109
    Dec 14, 2015
    Canada
    Planet earth
    Well, the game has access to the shell
     
  10. Swiftloke

    Swiftloke Hwaaaa!

    Member
    1,770
    1,520
    Jan 26, 2015
    United States
    Nowhere
    Well, clearly there are no checks whatsoever in the actual Streetpass data. First we need to find out what we can potentially overflow into, and if the game checks for overflows.

    — Posts automatically merged - Please don't double post! —

    What shell? NS? Isn't that an extremely interesting target, enough to be in the 32c3 conference?
    Either way, it doesn't help with code execution. It just gives us access to a very nice service if we do get code execution.
     
    DarkFlare69 likes this.
  11. Ordim3n
    OP

    Ordim3n GBAtemp Fan

    Member
    402
    109
    Dec 14, 2015
    Canada
    Planet earth
    Yeah, i think the NS. Because when i did the rsf gen, it had - shell iirc
     
  12. Swiftloke

    Swiftloke Hwaaaa!

    Member
    1,770
    1,520
    Jan 26, 2015
    United States
    Nowhere
    Look into it a bit more, please. At that, overflow Streetpass data and check the results in Citra debugging.
     
  13. dubbz82

    dubbz82 GBAtemp Advanced Maniac

    Member
    1,507
    814
    Feb 2, 2014
    United States
    No. For the love of god, just stop while you're ahead.
     
    Kourin likes this.
  14. Ordim3n
    OP

    Ordim3n GBAtemp Fan

    Member
    402
    109
    Dec 14, 2015
    Canada
    Planet earth
    ok, i just need to redump my game
     
  15. Nba_Yoh

    Nba_Yoh GBAtemp Fan

    Member
    312
    293
    Jan 5, 2015
    France
    Yep a cool crash, but hey people are not going to create a thread everytime a crash occurs.
    Please investigate that before posting anything, a bunch of games are crashing when fuzzing the save file.
     
    DKB, Wafflepaint, Xiphiidae and 3 others like this.
  16. dubbz82

    dubbz82 GBAtemp Advanced Maniac

    Member
    1,507
    814
    Feb 2, 2014
    United States
    As a matter of fact, almost NEVER leads to an exploit.
     
    WeedZ likes this.
  17. Swiftloke

    Swiftloke Hwaaaa!

    Member
    1,770
    1,520
    Jan 26, 2015
    United States
    Nowhere
    He did, actually. He found out the Streetpass data content isn't checked.
    Your fears are well founded, however. Things like Fateshax understandably erode trust in potentially legitimate hacks. Checking the early pages of BasicSploit are full of skeptical users crying out 'Fateshaxx 2.0'.
     
    Last edited by Swiftloke, Jul 10, 2016
  18. Nba_Yoh

    Nba_Yoh GBAtemp Fan

    Member
    312
    293
    Jan 5, 2015
    France
    He don't know what's going on actually.
     
    Ordim3n likes this.
  19. DarkFlare69

    DarkFlare69 GBAtemp Psycho!

    Member
    4,710
    2,563
    Dec 8, 2014
    United States
    Ohio
    But this one's actually real.
     
  20. Swiftloke

    Swiftloke Hwaaaa!

    Member
    1,770
    1,520
    Jan 26, 2015
    United States
    Nowhere
    Precisely. Just because there is a crash, ironically, doesn't mean there won't be an exploit.