Hacking Post your ideas regarding how to hack the 3DS, here

[Parasite X]

If the 3DS does get hacked it will most likely be through a save game exploit that causes the game to crash and boot unsigned code but it will probably have to be on a flashcart for it to work. If you plan to be rude just don't say anything to me this is a thread where everyone's idea's are excepted.

 

[Gabelvampir]

i think he means the update files

Oh that. Should not work, everything is signed.
I think he does not know what a packet sniffer is.
Maybe he means changing the update data in network packets while it is downloaded. But that should not work, wonder why it worked on the PS3 apparently.

 

[nukeboy95]

can people PLEASE READ THIS before posting here

 

[Mickey7Seven]

Why don't hackers just hack the game? I mean, like PC games you know? Hackers DID HACK THE GAME not THE CONSOLE.

Well maybe this sounds dumb since i have no idea of hacking any console. But since "anyone's idea are expected here" i just..can't resist.


Why don't hackers try add something on the game files, like, bypass code or something that could affect the 3DS system? There are many 3DS rom, who are still waited to be played (in pirate mode of course) that has potention to be hacked, to be played by 3DS gamers all around the world.

Dear great hackers you guys are just..our hero​

 

[medoli900]

Why don't hackers just hack the game? I mean, like PC games you know? Hackers DID HACK THE GAME not THE CONSOLE.

Well maybe this sounds dumb since i have no idea of hacking any console. But since "anyone's idea are expected here" i just..can't resist.


Why don't hackers try add something on the game files, like, bypass code or something that could affect the 3DS system? There are many 3DS rom, who are still waited to be played (in pirate mode of course) that has potention to be hacked, to be played by 3DS gamers all around the world.

Dear great hackers you guys are just..our hero

can people PLEASE READ THIS before posting here

"Why don't we just hex-edit one of the games?"
"Hey guys, let's send it a faked update file with a hack in it!"
"Let's just hack a game on an SD card to hack the system."
"We can edit one of the ambassador games to swap ROMs with a hack, right?"

• Games and programs on the 3DS are signed, so if you manually change the program code (without re-signing it) the signatures become invalid and the 3DS will refuse to run whatever you edited.

Edit:In short,PC software isn't signed (except maybe mac) because there are multiple OS.The 3DS software can be only lauched on the 3DS,creating the possibility to sign the software.

 

[Jean Karlo]

Maybe someone already said this, man, I don't have time to go through 87 pages, but as the 3ds just runs signed code, and as we dont have the code, Why not using something that the 3ds do run, come on, i guess someone had already thought of this and maybe is working on it, but (if you had been in psp scene you'll know what im talkin 'bout) making a crash happens with a image, a song or a video, (jus like chick-HEN) we might do the same, is just an idea, i'm pretty sure the 3ds is very secure and it will still take some time to get to its deep secrets, but... just an idea.

 

[Rydian]

Maybe someone already said this, man, I don't have time to go through 87 pages, but as the 3ds just runs signed code, and as we dont have the code, Why not using something that the 3ds do run, come on, i guess someone had already thought of this and maybe is working on it, but (if you had been in psp scene you'll know what im talkin 'bout) making a crash happens with a image, a song or a video, (jus like chick-HEN) we might do the same, is just an idea, i'm pretty sure the 3ds is very secure and it will still take some time to get to its deep secrets, but... just an idea.

The crashes allow us to stick program code into data areas and then tell the unit to run them.

http://en.wikipedia.org/wiki/NX_bit
But NX means that the CPU won't run code in data portions, only in the existing code portions.

So it's not nearly as simple as overflowing code into data and pointing at it.

 

[evilboys1996]

Gateway FC can run game through microSD card right?
So how about we make a game that can run another game on that microSD card OR SD card slot?
sorry for my bad English

 

[Rydian]

Gateway FC can run game through microSD card right?
So how about we make a game that can run another game on that microSD card OR SD card slot?
sorry for my bad English

You can't run any custom code, only official 3DS games.

 

[GoldenSun3DS]

I've searched this thread, but nobody has pointed out what I'm about to suggest.
I've seen people talk about Netflix, but everyone gives the same idea of using a server or something to connect to the 3DS to send custom code through WiFi.

Here's my idea:
I've noticed several peculiar freezes with Netflix on my 3DS:

1. It sometimes freezes while searching for something. By this, I mean it constantly shows it loading yet nothing ever comes up (nor does it say that there's nothing to match the search terms).
1A. When this happens, I can usually load any show on the main screen (usually I just go to one of the "Recently Watched" shows) by backing out of the search, but the HOME Button does nothing.

2. If I suspend Netflix and try to go to the internet browser, the system will just sit on the loading screen for the web browser and I have to hold the power button down and turn the system off to undo this.
2A. Turning off the wireless switch before suspending Netflix ALWAYS fixes this problem though.
2B. After some time of browsing the web, upon returning to Netflix it acts as if wireless is still disabled and says that the wireless is disabled (even with wireless on), but it quickly reconnects and stops this error message.
2C. My guess is that while you browse the web with Netflix suspended, Netflix is cut off from the 3DS's WiFi. The internet browser also probably can't launch when Netflix is using the 3DS's WiFi.

What I'm wondering is, can one of these 2 crashes be used to create an exploit for unsigned code to run?

I've also noticed these glitches:
Sometimes I will try to load a show/movie and it'll say it's unavailable, yet it works when I reboot Netflix.
Also, sometimes I will select a show only to have it immediately return to the main menu and the show's icon vanishes from the screen. After this happens, that show won't show up in a search.

 

[Gabelvampir]

Can't say anything about the Netflix application (or Netflix at all), it is unfortunately not available in my region. But it sound like nothing exploitable, only pretty shitty coding.
From the sound of it it blocks the WiFi somehow, maybe getting the WiFi driver in a bad state or something like that. Probably at shutdown/suspension of Netflix it does not release the control on WiFi correctly, that would explain why shutting down WiFi before fixes it.
But it is very unlikely for that to be exploitable, apart from killing the WiFi for the session.

 

[GoldenSun3DS]

What's different with my idea is that the encryption is the same, but only one/a few address values are changing, so the file will be different. Because you know what values are changing, then you know that the file as a whole will look different, but will in fact be the same.



Here is an example equation:

Y = x(o+z)

Y is the data/file that appears on the SD card (encrypted)
o is the original data/file (unencrypted)
x is the encryption method
z is either any part of the whole process that may or may not exist. Hopefully the latter.


If you have two sets of "Y", know that their respective "o" values are the same, and figure out the "z", then you can set them equal to each other to find the x

What if you took that same method but applied it to an update to a game instead of spotpass downloads?
Like you compare the difference between Mario game v1.0 and Mario game v1.1

 

[Rydian]

~
What I'm wondering is, can one of these 2 crashes be used to create an exploit for unsigned code to run?

(Assumed) ASLR and NX mean that you cannot just inject code through a crash like on older systems.

 

[Syphurith]

-sniff-.

Very sorry to disapoint you, dear.
1.Netflix "freeze" and "it stopped explorer from wifi connecting" is most likely to be a web connection failure. The top amount of the connections of your device is somehow limited to fix that to the device's power itself. When setting up servers, someone would know, how many connections can be active extremely, and how much time it would delay for any users.
so i assume the freeze is just abuse of those connections (like cost your customer's browser fetch pics for each one good you sell) or program problems(server too lagy or many scripts fetched and excuted as "Taobao" does everyday). once it reached the limit the other programs would not be able to create connection to remote in time. so "it stopped explorer from connecting".
But to my opinion 3ds isn't this limited somehow, as devices holding more than 20 threads fetch remote resources is really common. (To test this, make a 3ds compatiable page - very simple one - with many <img> tags forcing it to load pics, also force it to bypass your built proxy server to trace this result - not very difficult).

But if you find any other things very suspicious i recommend you to communicate with those on efnet.org #3dsdev directly. i'm not well experenced and often make mistakes. So if you find it can let you run some music / album that you haven't purchased or you can never run more than 10 games at the same time or such confusing things, you can try communicate with them and some of them (if familiar) would help you test if that can ever be a bug or exploit.
BTW. Thanks to reply. many of us even don't think of it lol.

 

[SuzieJoeBob]

What if you took that same method but applied it to an update to a game instead of spotpass downloads?
Like you compare the difference between Mario game v1.0 and Mario game v1.1

The problem with that is the possibility that encryption algorithms can change, especially if the previous algorithm was cracked. Also, we do not know what is "original" data and what is "add-on/patched" data. Is the new data after the old data address-wise or before the old data??? Are there little data "pockets" for pre-planned ideas that were filled??? Are there things that were already programmed in the game's data, but required an "unlock key" (Ex: on-disc DLC)??? Even a simple change from a Boolean "true" to "false" can create an entirely different scenario.

 

[KingBlank]

Might be able to find some useful crashes in 3DS demos like Kingdom Hearts 3D, That demo is sooooo buggy, I was gliding round forever and went thru tha top of the skybox lol.

 

[GoldenSun3DS]

I've noticed that the more pictures you have on your 3DS, the longer it takes to load Nintendo 3DS Camera, so I thought that maybe you could overload the 3DS Camera app with tons of pics to make it take hours to load.

I decided to use my computer fill 4GB of data in pictures* and videos* into my "DCIM" folder on my SD Card (appropriately named of course so the 3DS would recognize them). After doing this, it took a very long time to load and then it took a very long time updating the "management file". It also said I reached the limit for pics and vids (even though I have 1GB of free space) and wouldn't let me take any more pics on the SD Card.

*I actually just copied the same 1GB of pics and vids over and over until it reached 4GB. My SD Card only holds 8GB, so maybe somebody with a 64GB SD Card could see what would happen if you loaded 63GB of pics into the SD Card.



I also remember seeing the 3DS Sound/Music app saying you couldn't have a long filepath on the SD Card (forgot the exact number).
For (a random) example, you won't be able to have SD : files > media > Music > NonOrchestral > videogameMusic > Console > Nintendo > Wii> MarioGames > 3D > Platforming > MarioGalaxy > LevelMusic > etc > etc > etc > etc > etc > etc > etc > etc > etc > etc > etc > etc > etc > SpacejunkGalaxy.mp3

Because at some point in the file path (theoretically), it'll ignore the rest of the folders. If the limit was 10, it'd (theoretically) only show up to the "3D" folder in the above example.

 

[GoldenSun3DS]

When setting up servers, someone would know, how many connections can be active extremely, and how much time it would delay for any users.

Except the internet I was using was my home WiFi, and nobody had put in any restrictions like that.

EDIT:
What if somebody used a DS-mode flash card and changed the flash card's icon settings so the name would be too long?

 

[SifJar]

What if somebody used a DS-mode flash card and changed the flash card's icon settings so the name would be too long?

Any banner not on the DS mode whitelist (i.e. official games released prior to DSi) or else properly signed (i.e. post-DSi-release DS games, as well as 3DS games) will simply cause an error. It is not possible to show any sort of custom banner, so that idea can't be tried.

 

[LulzCop]

Is it possible for someone to simply delete the entire OS and write binary straight to the processor?