Homebrew Possible CaveStory Exploit

[Deleted member 370283]

I AM NOT SAYING IN ANY WAY THAT THERE IS A DEFINITE EXPLOIT.

Okay, now that I got that out of the way, allow me to explain myself.

Back in the VVVVVV exploit release thread, someone mentioned about other Nicalis games possibly containing exploits (as a joke, I assume) so I decided that for my first very technical 3DS project I'd try to pick apart one of the games and see if they could actually be exploited.

CaveStory, I think, can be. But I don't really know, because I've come to a slight roadstop. Allow me to explain my case thus far.

CaveStory's save slots contain a date and time that the slot was updated. This is stored in plaintext within the save file.

There seemed to be no save protection or checksum at all upon inspecting multiple files, so for kicks and giggles, I edited the date to be something... not a date. To my surprise:

IT WORKED! So, considering that the date and time is a string, and that the end of this string seems to be symbolized by a $00 hexadecimal character, there already seemed to be a clear overflow at hand here. Upon continually lengthening the string, the game did crash. However, here is my roadblock...
​

I'm just starting off, so I've got no idea of any good way that I can debug the game and see what is happening in real time order to pinpoint things and be able to formulate proper ROP (if at all possible in this case).
I understand the basic concept of an exploit (getting a way to manipulate the stack, using ROP gadgets to load our code, and then running it) but, once again, I don't know of the right tools to get this off of the ground and allow me to continue what little research I've put into CaveStory.

Any help would be greatly appreciated here. Thank you!

inb4 "another one of these threads hur hur"

 

[UraKn0x]

another one of these threads hur hur

 

[CeeDee]

Overflows don't always mean some type of exploit can be made from it... but it'd be cool if Cave Story could get one!

 

[Froster]

oh my god I love these threads

 

[Link_of_Hyrule]

Looks like we just put another game on Nintendo's Indie game chopping block. Although honestly now that you posted this they could just update it before you even get the exploit working and released.

 

[Deleted member 370283]

Looks like we just put another game on Nintendo's Indie game chopping block. Although honestly now that you posted this they could just update it before you even get the exploit working and released.

It's not guaranteed that there's an exploit though...
I'm just speculating based on what I've documented so far, and I can't really go further because I don't really know of the proper tools to debug.

 

[UraKn0x]

It's not guaranteed that there's an exploit though...
I'm just speculating based on what I've documented so far, and I can't really go further because I don't really know of the proper tools to debug.

Well, you could use NTR debugger... I never used it though, so I can't tell how good it is.

 

[Deleted member 370283]

NTR debugger

From the looks of it, that is New3DS only. I have an Old3DS, sadly.

 

[UraKn0x]

From the looks of it, that is New3DS only. I have an Old3DS, sadly.

It's not. The previous NTR versions works on both O3DS and N3DS.
https://github.com/44670/BootNTR/releases/tag/3.2

 

[catlover007]

This thread isn't pointless, there is indeed something which could may be exploited(not a my game crashed, this is the new exploit! Or why isn't letterbox exploit already ported to 3DS!?! thread)

 

[shinyquagsire23]

String-based exploits (for the most part) are only useful if it overflows into the stack or you can overflow a significant part or portion of the heap. If it's like Pokemon where it buffers the entire save in RAM then it's probably not exploitable, unless the date is copied somewhere. If the string is utf-16 based it's nicer because then you can start overwriting pointers, otherwise once there's a 00 it stops reading, which makes things difficult. I'd say probably not exploitable in that particular spot unless you can get it to crash.

EDIT: The thing with VVVVVV though was that VVVVVV was ported by someone else to C++, everyone seems to be forgetting that.

 

[CeeDee]

I'd say probably not exploitable in that particular spot unless you can get it to crash.

Upon continually lengthening the string, the game did crash.​

 

[shinyquagsire23]

...

Missed that I guess. Either way it also depends on what data it's running into, it has to run into something which can cause a bad write or a bad jump in execution, crashing something is relatively easy when it's just reading data.

 

[undertaletrash]

that would be cool.

 

[Temarile]

Awesome. Good job! Unfortunately I'm not experienced with this stuff but the more exploits the merrier I'd say

 

[loco365]

The best way to check if it's exploitable is to do a disassembly on the main executable and see what's happening in code when this string is read. From there, you can do lots of memory manipulation to obtain *hax.

 

[Roboman]

find out what exactly is in memory when the string is loaded, see what you can overwrite.

 

[GalladeGuy]

Interesting...

 

[ChampionLeake]

I tried to do the same thing but I didn't seem to get a crash yet. If you can, can you send me your save file of this bug so I can debug it?

 

[AllenHirai]

ooo nice