Hacking OSDriver kernel exploit - a technical description

[Mathew_Wi]

so ive got a question
ive found a working kernel exploit for firmware 5.5.1 through the process of brute forcing

my intentions are to either release it with a working emulator
or release it alone and let someone finish it

the thing is that I am fairly new to the community(was a microsoft guy)
and i would hate to release something that has already been discovered?
could I check @DeVS your exploit and compare
if they are different
there is no reason for holding back if it turns out mine is different

btw I AM open for donations

How about you show us yours?

 

[codychaosx]

btw I AM open for donations

 

[Don Jon]

How about you show us yours?

no need
it has been confirmed already

 

[ScarletDreamz]

no need
it has been confirmed already

What has been confirmed, is it the same? s not the same? are you gonna release it? yes no? lol

 

[Net-KILLER]

gameboy color
pls stop spam threads -.-

I guess thats robertorpg94s new account

 

[shaneod]

How about you show us yours?

I'm surprised you bothered to reply.
He thinks that if he pretends to have an exploit, you'll release yours.

 

[davetheshrew]

so ive got a question
ive found a working kernel exploit for firmware 5.5.1 through the process of brute forcing

my intentions are to either release it with a working emulator
or release it alone and let someone finish it

the thing is that I am fairly new to the community(was a microsoft guy)
and i would hate to release something that has already been discovered?
could I check @DeVS your exploit and compare
if they are different
there is no reason for holding back if it turns out mine is different

btw I AM open for donations

I remember you saying recently that you modified 5.3.2 kernel to work on 5.5.1, now you're saying you 'bruteforced' the system to give up the kernel. Cmon man, stop lying all the time and admit it, you cant code for skittles.

 

[Mathew_Wi]

no need
it has been confirmed already

By who?

 

[oumoumad]

By who?

This is the same guy who said last time he managed to make loadiine work on 5.5.1 using yellows8 exploit you can use the time of replying to him in something more productive Mathew .

 

[NexoCube]

How did you find that the spinlock were sometimes unlocked ? @Marionumber1

 

[Deleted User]

How did you find that the spinlock were sometimes unlocked ? @Marionumber1

I just found out he's probably not going to get the time to reply to you until the end of Sunday night due to his CTF, Nexo...

 

[NWPlayer123]

How did you find that the spinlock were sometimes unlocked ? @Marionumber1

Um, I don't remember how we started, I think either someone told us it existed and we tried to replicate it (I still remember it first working in February last year, "Race attack succeeded" and MN1 was shocked that it finally worked to some degree), and shortly after Bean and chadderz showed off that they had made their own using the userspace bug we released for 4.0 to 5.1, that's how chadderz originally made TCPGecko dotNet and Cafiine. I'm not actually sure they ever disclosed what their bug was. I also remember chadderz having some fun with MN1 to blindly get userspace working on 5.1, and we just kept using it up until it got patched in 5.5.0 (MN1 made the second one before this cause the OSDriver one was so unreliable)

 

[NexoCube]

Um, I don't remember how we started, I think either someone told us it existed and we tried to replicate it (I still remember it first working in February last year, "Race attack succeeded" and MN1 was shocked that it finally worked to some degree), and shortly after Bean and chadderz showed off that they had made their own using the userspace bug we released for 4.0 to 5.1, that's how chadderz originally made TCPGecko dotNet and Cafiine. I'm not actually sure they ever disclosed what their bug was. I also remember chadderz having some fun with MN1 to blindly get userspace working on 5.1, and we just kept using it up until it got patched in 5.5.0 (MN1 made the second one before this cause the OSDriver one was so unreliable)

Okay ^^ But now how to find another bug that can exploit the kernel :c ?

 

[NWPlayer123]

Okay ^^ But now how to find another bug that can exploit the kernel :c ?

I gave several options here
http://gbatemp.net/threads/firmware-reverse-engineering-info-dump.421827/page-6#post-6256883

 

[NexoCube]

So, if i understand everything, the ROP Chains's are just here to says to Core 0 and 2 to start, and freeing one of your "Driver" (The B one) ?

And kern_read and kern_write syscalls are installed in DRVHAX (C) ?

 

[Droyd]

Why you do this lol, i thought something was released...

 

[MisterJohnson87]

i am wondering what is it.https://mega.nz/#!7NJmCICC!xd4rp56slARpHJEvjqcQQfjEfyVcfDoC_9zYowUkvdY
as i think it is the kernel exploit for 5.5.1....anyone can try this and make sure what is it

Nope, this is existing stuff for 5.4.0 / 5.3.2

 

[Timthegangsta]

i am wondering what is it.https://mega.nz/#!7NJmCICC!xd4rp56slARpHJEvjqcQQfjEfyVcfDoC_9zYowUkvdY
as i think it is the kernel exploit for 5.5.1....anyone can try this and make sure what is it

For the love of god dont run random code on your wiiu even if it looks legit. wait for the release

-EDIT damn ninjas

 

[Cava]

i am wondering what is it.https://mega.nz/#!7NJmCICC!xd4rp56slARpHJEvjqcQQfjEfyVcfDoC_9zYowUkvdY
as i think it is the kernel exploit for 5.5.1....anyone can try this and make sure what is it

It's not. It's just the Homebrew launcher package and its exploit but not for 5.5.x

 

[Cava]

Masterwin said it work in 5.5.1/he gives me this link after asking a lot.anyone should try it.https://mega.nz/#!7NJmCICC!xd4rp56slARpHJEvjqcQQfjEfyVcfDoC_9zYowUkvdY

I mean it doesn't contain the 5.5.x exploit.