Hacking Official [Release] CakesFW

[dark_samus3]

O.O Themehax may be the thing that pushes me to upgrade my 4.2 3ds to 9.0.... Yellows8 is awesome if it ends up working out then autoboot CFW FTW!

@mid-kid good luck with the new entrypoint, hope it works out

 

[powersaver]

Browserhax only gains userland code execution. We need a kernel exploit, something that isn't public yet for firmwares higher than 9.2.

Thx for the info!

 

[puss2puss]

Well..the main reason why yell and smea are against piracy, is because of their personal life jobs.. so peeps can expect a kernal exploit hiding deep in one of his released candy..

 

[Zidapi]

Well..the main reason why yell and smea are against piracy, is because of their personal life jobs.. so peeps can expect a kernal exploit hiding deep in one of his released candy..

I think yellows8 is a professional security vuln/penetration tester, not sure what Smea does.

Either way, they're both far too intelligent to "hide" a kernel exploit in one of their userland hacks if it would impact their respective careers.

Look at themehax, yellows8 discovered it on the 24th of December last year. Yet he only releases it now, 9 months later.

Why? Perhaps to ensure it couldn't be used to gain kernel access directly, or indirectly using other vulnerabilities. eg. he waited until other vulns that could be used with themehax to gain kernel access were patched.

 

[puss2puss]

Look at themehax, yellows8 discovered it on the 24th of December last year. Yet he only releases it now, 9 months later.

Why?

because some official firmware updates where innevitable

 

[cearp]

because some official firmware updates where innevitable

why do you write so small?
it is a bit annoying and hard to read when everyone else has the same size apart from you

 

[Arcanuskun]

why do you write so small?

because he's a puss?

 

[puss2puss]

why do you write so small?
it is a bit annoying and hard to read when everyone else has the same size apart from you

Well to be fair, its one of the only times i wrote small
and yes, its annoying to read, wich is the point, since its not for everyone's eyes to read this..so writing small may avoid too many people reading it..
..well, that was the last time

 

[Ripper00420]

Well to be fair, its one of the only times i wrote small
and yes, its annoying to read, wich is the point, since its not for everyone's eyes to read this..so writing small may avoid too many people reading it..
..well, that was the last time

How would one go about educating themselves on the whole breakdown of how each exploit captures what permissions or causes the error enabling the pushing of files to 9.9, because I'm a father of 4 with plenty of time to read and advance this process?

 

[dark_samus3]

How would one go about educating themselves on the whole breakdown of how each exploit captures what permissions or causes the error enabling the pushing of files to 9.9, because I'm a father of 4 with plenty of time to read and advance this process?

I'd start with smea's writeup of ninjhax on his website, after that check out github, you can find cakes, rxTools, and ReiNAND source on there

 

[Ripper00420]

I'd start with smea's writeup of ninjhax on his website, after that check out github, you can find cakes, rxTools, and ReiNAND source on there

What would I use to sift through code and find what I need? I really have the time to research the rest after that. Thank you for the advice as well. It brings me much joy to tinker with new toys

 

[dark_samus3]

What would I use to sift through code and find what I need? I really have the time to research the rest after that. Thank you for the advice as well. It brings me much joy to tinker with new toys

You can sift through the code on github... I do it all of the time, it's really nice because it shows you what was changed between versions so you can understand what made something work or the code specific to the new features or whatever that were put in

 

[Ripper00420]

Quick question since most of these devices run off of a Samsung chip, couldn't you hard mod and flash with Odin flashware and unlock security as well? Possible copy of NID and full downgrade without loss of data... Maybe?? Just curious sorry

 

[dark_samus3]

Quick question since most of these devices run off of a Samsung chip, couldn't you hard mod and flash with Odin flashware and unlock security as well? Possible copy of NID and full downgrade without loss of data... Maybe?? Just curious sorry

Haha well sorry, Odin isn't a hardware specific feature... The Samsung chip is just flash memory, Odin is a boatloader for Android devices (you're lucky you're talking to an android fan )

 

[Ripper00420]

Haha well sorry, Odin isn't a hardware specific feature... The Samsung chip is just flash memory, Odin is a boatloader for Android devices

Confusion of sdk...lol would be nice to pull full img or tar from system and pick apart... Lol

 

[dark_samus3]

Confusion of sdk...lol would be nice to pull full img or tar from system and pick apart... Lol

It's already been done... No tars or anything, this works a lot differently than an android device, if you want to look at a raw NAND image, use decypt9 get your fat16 xorpad and dump your NAND with gateway or something else and decypt it then you can look at it

 

[Ripper00420]

It's already been done... No tars or anything, this works a lot differently than an android device, if you want to look at a raw NAND image, use decypt9 get your fat16 xorpad and dump your NAND with gateway or something else and decypt it then you can look at it

9.9 not gonna happen bro.
No Gateway either

 

[dark_samus3]

9.9 not gonna happen bro.
No Gateway either

Oh you're researching 9.3+ hmm... Well no way to decypt your NAND but I believe you could probably get someone to get you a decypted NAND image or you can grab the CIAs on 3dnus and since they use public keys I believe you can decypt those

EDIT: also no need to have gateway to run the gateway launcher (I don't own gateway and run the menu all of the time)

 

[zoogie]

Cakebrah can now support ninjhax2 to and, as a result, themehax. I can confirm coldboot works by renaming Cakes.3dsx to boot.3dsx and putting it in the root. Does not work every time though!

Special thanks to delebile, patois, and of course Cakes team.
Tested on old3ds 9.2.

 

[Vappy]

Cakebrah can now support ninjhax2 to and, as a result, themehax. I can confirm coldboot works by renaming Cakes.3dsx to boot.3dsx and putting it in the root. Does not work every time though!

Special thanks to delebile, patois, and of course Cakes team.
Tested on old3ds 9.2.

Sweet! Should make a PR to the main repo, make it official.