FenrirWolf said:
So they didn't even patch whatever exploit the TBR uses to enable IOS15 to be downgraded? That's pretty silly on their part.
The TBR update took so long, because i didn't expect them to fail that much. It's not one exploit, it's well:
- Installation can be started with the version that is already installed(ok, not really a bug, maybe handy to repair broken installations)
- When the installation is started, all installed files are copied to (collected in) /tmp/ until the installation is finished, the files have the correct rights attributes, you are not allowed to read/write these files. But you can delete them! And of course create a new file with the same name...
- The newly created file has the wrong attributes, it would be easy to check if it's the orginal or the newly created file.
- When starting the installation the signature is checked(that's the only part where nintendo is not failing). But it's not checked when finishing the installation.
- The signature is not checked either when running an IOS
- There's no check if ticket and tmd version match(maybe there's one on installation start...)
To summarize if nintendo:
would fix their rights management to disallow to delete a file you can't write
or would check file attributes(owner id for example)
or would check the signature on finishing installations
or would check the signature on running IOS
or would check if version of tmd and ticket match
then TBR would stop working.