Hacking Post your ideas regarding how to hack the 3DS, here

[rondoh70]

go away troll

 

[Queno138]

@Queno138 you should take some time and read the previous "theories". everything downloaded to the 3ds is encrypted with public and private keys, also even if the demo is downloaded to sdcard data like the counter is saved in the 3ds memory also encrypted. wifi sniffing seems unlikely but maybe a nintendo usb wifi dongle "might" help which i actually doubt. best case scenario, hardware mod seems best choice and we have been over this lots of times.

No problem, just trying to help

 

[thealeks]

how does encryption in 3ds carts differ from 3dsware? as i understand it only the 3ds that downloaded the 3dsware can unencrypt it, since its ticketed and what-not so you download a specific file for your 3ds. but carts work on any 3ds, so is the encryption different? are there more than one unencryption key?

 

[McHaggis]

how does encryption in 3ds carts differ from 3dsware? as i understand it only the 3ds that downloaded the 3dsware can unencrypt it, since its ticketed and what-not so you download a specific file for your 3ds. but carts work on any 3ds, so is the encryption different? are there more than one unencryption key?

Yes, there will be several keys, like on the Wii or PS3. A cart's ROM will be encrypted with a private key, which is decrypted by a public key common to all 3DS consoles. eShop downloads are encrypted with a per-console key so that they can only be decrypted by the same console.

 

[Rat.2]

Okay.
Let's start with free games off E-shop.

The games are downloaded, then encrypted on the 3DS right?
Or at least it has a second level encryption because of how copying and pasting the same game onto a memory card onto a second 3DS, and it won't play,
If you catch my flow.

Hence,
1. Have a program/come up with a program that monitor data sent and received on computer network (make sure nothing else uses the internet)
2. Have the Computer connected through LAN, then set up ad-hoc network for 3DS to connect to.
3. Use 3DS to download a free game off E-shop, then monitor the data through the program.
4. Do the same with another 3DS, compare differences.

Do you think this is feasible?

Also, is there a way to bypass the 30 limit on Demo games
(For example, copy the folder on Desktop, have 30 tries, replace files with the backup on desktop?)

Just trying to contribute

Both your theories have already been brought up. Communications between the 3DS and eShop are encrypted, so you can't analyse the data sent back and forth. Also, backing up the demo before playing it was one of the first things people tried when demos were released.

if you can see everything cant you see the handshake and all that stuff then use that data from when it was establishing the connection to decrypt it?

 

[McHaggis]

if you can see everything cant you see the handshake and all that stuff then use that data from when it was establishing the connection to decrypt it?

Read up on Transport Layer Security. Endpoint authentication is an integral part of SSL/TLS (used by HTTPS, the protocol for secure transfer of web pages). What you're talking about is very similar to a Man in the Middle privacy attack, which involves an attacker intercepting communication between the client and the server, potentially forging some of the data or copying it for his own misdeeds. TLS is not susceptible to these kinds of attack.

 

[Janthran]

Just so you guys know, it's not just that only the 3DS that downloaded things can play them; formatting it gives it a new encryption that it can't read too.
This is very annoying, since my 3DS didn't even delete all the old data off the SD and now I have no space left..

 

[NickMagliaro]

I assume there isn't any way to send packets from a 3rd party?
Maybe something with the IR sensor?
Even so....I guess there is no way of running unsigned code....I did see someone got hello world working on 3ds.....

 

[NickMagliaro]

Maybe take a look at the battery and see if there is data transmission from it kind of like the psp?

 

[rondoh70]

there are already 3rd party batteries so no

 

[T3GZdev]

what about sniffing packets?

 

[Janthran]

I assume there isn't any way to send packets from a 3rd party?
Maybe something with the IR sensor?
Even so....I guess there is no way of running unsigned code....I did see someone got hello world working on 3ds.....

The IR sensor isn't always active. As far as I know, there could be a hack used with a MGS:SE demo, but I don't think anyone has a way to do that yet.
You would need some extra hardware of some sort for that anyway.
The hello world that guy got running was on a developer 3DS, so that doesn't help much.

 

[alphamule]

if you can see everything cant you see the handshake and all that stuff then use that data from when it was establishing the connection to decrypt it?

Read up on Transport Layer Security. Endpoint authentication is an integral part of SSL/TLS (used by HTTPS, the protocol for secure transfer of web pages). What you're talking about is very similar to a Man in the Middle privacy attack, which involves an attacker intercepting communication between the client and the server, potentially forging some of the data or copying it for his own misdeeds. TLS is not susceptible to these kinds of attack.

Unless you have an instant-fact-o-rama.
RSA-1024 isn't safe, BTW. If Nintendo used anything less than 1024 bits, then it's pretty much a done deal. Note that this is for the key exchange and not the actual encryption which is fully secure even at 'just' 256 bits. In practice, the key exchange is the weakness of anything like SSL. I wouldn't even be sure that 2048-bit public keys will survive the decade. Steganography even has it's limits.

Even if someone made a 'RSA-1024-quick-breaker-on-a-chip' that just somehow magically gave the right factors in less than a few weeks on average, the encryption key is only good for that session and system. Or at least I'd hope it'd be. Hehe, hint hint, *cough*HDCP*cough*ouch ouch. It's beyond our means, but there is this company called D-wave that is making some interesting analog processors. They sell it as 'quantum computing' but it's more like 'probablist tunneling' for those that have a physics background and can see the subtle distinction. If you've worked with neural nets, it's kind of familar. You run a program on the processor many, many times and then use the most common result. This is a pretty clever way to get around the errors, but that's for another discussion and this is already "TL;DR" and OT as it is!

 

[Codename]

I don't know much about hacking and that kinda stuff but maybe we can duplicate the files on a 3DS cartridge and onto an empty cartridge then play the previously empty cartridge on a 3DS. Wait...are the phsyical 3DS games encrypted?

 

[SifJar]

I don't know much about hacking and that kinda stuff but maybe we can duplicate the files on a 3DS cartridge and onto an empty cartridge then play the previously empty cartridge on a 3DS. Wait...are the phsyical 3DS games encrypted?

Where are you going to get this "previously empty cartridge"? Nintendo don't just hand them out y'know...

And yeah, all 3DS games are encrypted, including those on cartridges.

 

[PsyBlade]

An empty cart could be build by replacing the rom with ram or nor-flash.
Neither encryption nor singning would matter in that case.
Only a active crypto chip custom to a title would.

I assume the dump groups use this to verify.

 

[alphamule]

I don't know much about hacking and that kinda stuff but maybe we can duplicate the files on a 3DS cartridge and onto an empty cartridge then play the previously empty cartridge on a 3DS. Wait...are the phsyical 3DS games encrypted?

Bingo! Yeah, the encryption isn't broken. If it was this easy, we'd already have a mod chip and DRAM on a cart that lets us use the SD slot. From a hardware point of view, it's actually quite simple if you have the key. It's literally as simple as you suggest. Luckily for Nintendo and sadly for us, the keys to the system aren't publically known. Even if they are, it's possible for Nintendo to roll out a new firmware with a white list of games allowed to use the old key and a different key for new games. This is what happened on the DSi?

An empty cart could be build by replacing the rom with ram or nor-flash.
Neither encryption nor singning would matter in that case.
Only a active crypto chip custom to a title would.

I assume the dump groups use this to verify.

But it wouldn't run. You have to both sign the content and communicate with the 3DS CPU. Don't real carts have the encryption and Mask ROM inside the same chip?

 

[SifJar]

An empty cart could be build by replacing the rom with ram or nor-flash.
Neither encryption nor singning would matter in that case.
Only a active crypto chip custom to a title would.

I assume the dump groups use this to verify.

But it wouldn't run. You have to both sign the content and communicate with the 3DS CPU. Don't real carts have the encryption and Mask ROM inside the same chip?

3DS ROMs are already signed and encrypted.

 

[alphamule]

But aren't they inside some black box that does the interfacing to the Mask ROM? If it was just as simple as copying the encrypted data and parroting the contents, the protection would be useless against anything but homebrew...

To be more clear by what I mean: There's got to be more than 2-3 layers of encryption.

 

[Rat.2]

To be more clear by what I mean: There's got to be more than 2-3 layers of encryption.

You can't be sure until you have tried