Hacking New userland exploit found with ORAS?

[Deleted User]

Not to mention all the strings in the QR are length checked, and the QR itself is highly limited in size (QR reading rejects QRs not at a specified size).

You seems to be informed about that, so the strings are checked while the QR code is read ?

 

[shinyquagsire23]

You seems to be informed about that, so the strings are checked while the QR code is read ?

I was the first to successfully decrypt the QRs, so naturally I checked for vulns. They're checked after decrypt, but the size of the QR is static.

 

[Deleted User]

I was the first to successfully decrypt the QRs, so naturally I checked for vulns. They're checked after decrypt, but the size of the QR is static.

Wow, good work . Thanks for the answer.

 

[aos10]

Now let's imagine they do prevent the game from running without any update with, let's say, FW 11.2. For most people, it wouldn't be a "problem", since they are connected to the Internet and configured theit NNID account. But now, let's imagine that in some months, when new 3DSes come with this FW installed, a random guy bought one + a copy of AS. The guy doesn't have an Internet connection. When he tries to use the game, the console won't let him. And not only many people will be angry about this, but Nintendo also broke its own TOS, since it would force the guy to accept the NNID TOS and not only the console's TOS.
I'm not sure I was really clear, but you probably get what I'm trying to say

If that's man buy n3ds on that FW,and also buy that game,he simply can update the game from the eshop,you state he bought new device,why should he care about hombrews if he is buying new device?
People will get angry at 2 years old game? Yah,Nintendo doesn't care about that,because only the people will get angry is the people who want hombrews
Beside,we are in 2016,internet is every where,and beside,you can't install the hombrew channel without "internet",did you forgot about that?

 

[Coffee Prosecutor]

I don't wanna be that guy, but the video looks kinda butchered at the part, where he is about to enter the secret base.

 

[Ev1l0rd]

If that's man buy n3ds on that FW,and also buy that game,he simply can update the game from the eshop,you state he bought new device,why should he care about hombrews if he is buying new device?
People will get angry at 2 years old game? Yah,Nintendo doesn't care about that,because only the people will get angry is the people who want hombrews
Beside,we are in 2016,internet is every where,and beside,you can't install the hombrew channel without "internet",did you forgot about that?

You can install the HBC without internet. Browserhax (the most commonly used entrypoint) requires internet, but many secondary entrypoints don't (smashax being the sole exception). And there may be various reasons why you wouldn't use the internet on your 3DS, e.g. you have data caps or your connection is already slow enough that you don't want to bog it down even further.

 

[Deleted member 370671]

If that's man buy n3ds on that FW,and also buy that game,he simply can update the game from the eshop,you state he bought new device,why should he care about hombrews if he is buying new device?
People will get angry at 2 years old game? Yah,Nintendo doesn't care about that,because only the people will get angry is the people who want hombrews
Beside,we are in 2016,internet is every where,and beside,you can't install the hombrew channel without "internet",did you forgot about that?

1) What if that man CAN'T connect to the internet? Or doesn't want to accept eshop / NNID TOS?
2) When did I say the guy cares about Homebrew? Actually, I said quite the opposite, as I was stating that EVERYONE (including "normal" users) are going to get blocked by that restriction.
3) Nintendo can't break their own TOS. If they do, they'll be in big trouble.
4) While you may think everyone has an Internet connection, that's not the case. I know many people that don't, that have *really* crappy speed, or just don't want their kids to use it.
5) No, you don't need an Internet connection to use the HBL anymore, since you can put the payload on the SD card. And, also, that was only for Ninjhax 1, on Cubic Ninja.

 

[aos10]

1) What if that man CAN'T connect to the internet? Or doesn't want to accept eshop / NNID TOS?
2) When did I say the guy cares about Homebrew? Actually, I said quite the opposite, as I was stating that EVERYONE (including "normal" users) are going to get blocked by that restriction.
3) Nintendo can't break their own TOS. If they do, they'll be in big trouble.
4) While you may think everyone has an Internet connection, that's not the case. I know many people that don't, that have *really* crappy speed, or just don't want their kids to use it.
5) No, you don't need an Internet connection to use the HBL anymore, since you can put the payload on the SD card. And, also, that was only for Ninjhax 1, on Cubic Ninja.

1. Why he won't accept the NNID?
2. If a normal person,why he wants not to update? if i remember correctly,when the update screen appears they ask you if you want to update by entering the eshop or download the update directly,so the person won't need NNID to download the update.
I understand some people can't get decent internet,i am living on 2mb DSL speed with constant break several times in the day,hell i didn't play any online game from over 3 years,but no person have no internet.
You bought a $200 device with $40 game,and you say he can't access to internet?
If a kid can't use the game because there is no internet,the father will ask the support and they will tell him just update the game.

 

[Ev1l0rd]

1. Why he won't accept the NNID?

Various reasons, the first and foremost one, not needing it. As long as you don't play online/want to buy games, you don't need an NNID.

 

[Deleted member 370671]

1. Why he won't accept the NNID?
2. If a normal person,why he wants not to update? if i remember correctly,when the update screen appears they ask you if you want to update by entering the eshop or download the update directly,so the person won't need NNID to download the update.
I understand some people can't get decent internet,i am living on 2mb DSL speed with constant break several times in the day,hell i didn't play any online game from over 3 years,but no person have no internet.
You bought a $200 device with $40 game,and you say he can't access to internet?
If a kid can't use the game because there is no internet,the father will ask the support and they will tell him just update the game.

1) Any reason. Nintendo Privacy Policy for example. That's not the important thing here. Just imagine that, on earth, there's some people that doesn't want to.
2) You still need to accept the eshop TOS.
3) "No person have no Internet"? I don't now if you're playing dumb, but seriously, you need to look at things globally. While, in your town, everyone may have an Internet connexion, that doesn't mean everyone on earth does.
4) Yes, some people buy a 200$ device and 40$ and don't have an Internet connexion. For example, where I live, having an Internet connection is not cheap, and buying a game console is way cheaper than having one in the long term.
5) And, we're back at our initial problem. Nintendo CAN'T prevent you from playing the game. By accepting the console's TOS, (basically) Nintendo agrees to let you play games that you buy. If you can't play games if you DON'T agree to another TOS (in this case, the eshop), then Nintendo breaks the 3DS TOS and could face legal suits.

 

[Quantumcat]

1. Why he won't accept the NNID?
2. If a normal person,why he wants not to update? if i remember correctly,when the update screen appears they ask you if you want to update by entering the eshop or download the update directly,so the person won't need NNID to download the update.
I understand some people can't get decent internet,i am living on 2mb DSL speed with constant break several times in the day,hell i didn't play any online game from over 3 years,but no person have no internet.
You bought a $200 device with $40 game,and you say he can't access to internet?
If a kid can't use the game because there is no internet,the father will ask the support and they will tell him just update the game.

2. I didn't have an internet connection where I live now for about six months due to there not being a phone line installed and I had to fight Telstra continuously to get one. I had mobile internet but no way would I use most of my 500MB/month allowance on an update I didn't want! Anyway, it doesn't matter if 99.9% of 3DS users have the internet, it just matters that there MIGHT be somebody without it. And you can't tell him, oh sorry you've just spent $250 on this stuff. You're too backwards and we won't let you play your game. The whole benefit (in my eyes) of the 3DS is that you don't need internet to play, not like those Xbox and Playstation suckers who have to download 50GB+ updates on the day of release.

 

[aos10]

2. I didn't have an internet connection where I live now for about six months due to there not being a phone line installed and I had to fight Telstra continuously to get one. I had mobile internet but no way would I use most of my 500MB/month allowance on an update I didn't want! Anyway, it doesn't matter if 99.9% of 3DS users have the internet, it just matters that there MIGHT be somebody without it. And you can't tell him, oh sorry you've just spent $250 on this stuff. You're too backwards and we won't let you play your game. The whole benefit (in my eyes) of the 3DS is that you don't need internet to play, not like those Xbox and Playstation suckers who have to download 50GB+ updates on the day of release.

well,tell that to nintendo
the game is now 2 years old and wont care about that and they can force people to update the game.
anyway,this explote is like a 2nd/3rd/4th/5th...etc chance foe people who missed installing the homebrew channel.

 

[Quantumcat]

well,tell that to nintendo
the game is now 2 years old and wont care about that and they can force people to update the game.
anyway,this explote is like a 2nd/3rd/4th/5th...etc chance foe people who missed installing the homebrew channel.

You don't just suddenly stop caring about your TOS.

 

[aos10]

You don't just suddenly stop caring about your TOS.

and what is their TOS says?

 

[Deleted member 370671]

well,tell that to nintendo
the game is now 2 years old and wont care about that and they can force people to update the game.
anyway,this explote is like a 2nd/3rd/4th/5th...etc chance foe people who missed installing the homebrew channel.

Seriously, are you understanding what I'm saying?
NINTENDO. CAN'T. FORCE YOU. TO USE. THE. BLOODY. ESHOP. Period. No eshop = no game update. If they force you to use it, they'll be breaking their own TOS, which is illegal, whether the game came out yesterday or 5 years ago.

and what is their TOS says?

Their TOS says that they give you the unrestricted right to play the games you bought.

Anyway, I'm done arguing with you.

 

[aos10]

Seriously, are you understanding what I'm saying?
NINTENDO. CAN'T. FORCE YOU. TO USE. THE. BLOODY. ESHOP. Period. No eshop = no game update. If they force you to use it, they'll be breaking their own TOS, which is illegal, whether the game came out yesterday or 5 years ago.
Anyway, I'm done arguing with you.

ok,i think i get it now.

 

[RednaxelaNnamtra]

Here is the Video I recorded with the test save I got for my n3DS:

 

[Ev1l0rd]

Here is the Video I recorded with the test save I got for my n3DS:

I believe you! Now to wait for the release... if it ever gets released that is.

 

[The Catboy]

Here is the Video I recorded with the test save I got for my n3DS:

There's the buggy as fuck screen I was claiming about! Alright, I retract my statement, looks pretty legit to me.
Sorry I got on you guys earlier this morning, it's nothing personal towards you two nor your creditably, it's just hard to not be sceptical when you've seen as much as I have recently. Still, I am glad to see more entry points!

 

[TuxSH]

I've been able to crash OR/AS in a similar, exploitable, way too.