[Release] Custom ROP loader HTML

Discussion in '3DS - Homebrew Development and Emulators' started by duke_srg, Jan 23, 2015.

  1. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    Since Spider3DSTools have been recently released by yifan_lu I believe this html will be handy while debugging.
    It eliminates the need of frame.html and browserify convertion. Just place LoadROP.dat with index.html on the server. LoadROP.dat must be 768 long or less (it will be padded with zeroes in JavaScript to run the exploit).
    screen1.jpg screen2.jpg screen3.jpg screen4.jpg
    It is possible to specify ROP file name with HTTP GET parameter, like
    http://dukesrg.no-ip.org/3ds/rop?MemoryDump.dat

    It is also possible to patch filename or binary data inside ROP data
    http://dukesrg.no-ip.org/3ds/rop?MemoryDump.dat&memdump.bin
    in this case dmc:/memody.bin will be changed to dmc:/memdump.bin
    The patching parameter may be one one of the following:
    1. HEX (string with only 0-9,a-f,A-F characters used) - patch data bytes at offset 0x220 with this data
    2. string (not HEX) - patch first filename found by "dmc:/" prefix (original string in ROP must be aligned to 2 bytes to be found)
    3. HEX=HEX same as 1. but offset is specified before "="
    4. HEX=string - patch string data bytes at offset specified before "=" character (offset will be alignet to 2 bytes)

    ROP files available at the server:
    MemoryDump
    LoadROP
    LoadCode
    RegionThree
    Gateway Launcher
    DownloadCode
    Virtual Console ROM injector
    Action Replay cheat code engine
    FCRAM dumper
    Animal Crossing: New Leaf RAM editor
    Spoof firmware


    All those ROP chains proved to work on firmware 9.0-9.4 (the latest for the moment) if version is not noticed, but several may partly or fully working on 3DS browser version 1.7567 (i.e. firmware 7.1 and above). Can be easily launched on 3DS from 3DS Online Tools.
    ROP chain sources is available at Spider3DSTools fork: https://github.com/dukesrg/Spider3DSTools

    To do:
    - multiple parameters
     


  2. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    Changed default ROP filename to LoadROP.dat to avoid confusion. Implemented filename parameter substitution feature and also published html with ROPs on my site. Happy debugging! :)
     
    Margen67 likes this.
  3. 0xFFFF

    0xFFFF Advanced Member

    Newcomer
    63
    43
    Jan 17, 2015
    Saint Kitts and Nevis
    From the end-user point of view, what does this allows?
     
    Margen67 and leerpsp like this.
  4. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    This is mostly for developers. Nothing worthy for users, at least for now.
     
  5. liomajor

    liomajor GBAtemp Maniac

    Member
    1,463
    1,065
    Jun 10, 2008
    United States
    It would be brillant if this can allow to create xorpads on 9.2.0
     
    Margen67 likes this.
  6. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    This will launch it if one of 3DS devs will make it
     
    Margen67, Xenon Hacks and Korin like this.
  7. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    Added precompiled RegionThree.dat ROP file to load RegionThree without any additional files on SD. All credits to yifan_lu
     
    Margen67 and Shubshub like this.
  8. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    GB/GBC VC injector ROP added
     
    Margen67 likes this.
  9. Broadway

    Broadway Member

    Newcomer
    25
    5
    Jan 28, 2015
    Bahrain
    Page not found or the web server is currently unavailable. Please contact the website administrator for help.
     
  10. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    Oops, sorry, it supposed to be http but not https, just fixed
     
    Broadway likes this.
  11. ProNiteBite

    ProNiteBite Member

    Newcomer
    33
    2
    Jan 27, 2015
    United States
    I'm just really glad that this kind of stuff is more public now (I could have possibly taken it earlier, but it's easier with the HTML file in your hands), because several projects in the past are no longer available because the website they were hosted on were very secretive and didn't share any of the code. I'm glad that if anything fails, there will always be someone with a backup!
     
    Margen67 likes this.
  12. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    Updated VC injector -eliminated the need of custom code.bin and SD card file parameter pass
    Added RegionThree ROP for firmware 4.x, based on smealum and yifanlu works
     
    Margen67 likes this.
  13. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    Optimized RegionThree ROP payloads and native Gateway Ultra ROP payloads added
     
    Margen67 likes this.
  14. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    Added LoadCode and LoadROP converted for firmware 4.x and 5.x/6.x (browser versions 1.7492 and 1.7552).
    ROP.dat and code.bin must be for the same version, compiled for 9.x won't work!
     
    Margen67 likes this.
  15. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    Added Spider3DSTools fork link
     
    Margen67 likes this.
  16. Raugo

    Raugo GBAtemp Fan

    Member
    302
    118
    Nov 22, 2014
    Hello, I,m trying to load the spider_rop_5x_6x.bin with the LoadCode5 but doesn't work I get the "An error has occured" message. I have the firmware 6.1. Does it work with this version?
     
  17. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    First, spider_rop is a ROP code, so LoadROP must be used. LoadCode is for ARM code. Second, it is already transferred to RegionThree5.dat, so no need to use another loader. Though 5/6 version was not tested, I just converted smea's version.
     
  18. Raugo

    Raugo GBAtemp Fan

    Member
    302
    118
    Nov 22, 2014
    I also tried to load the RegionThree5.dat but not work, gives the same error. Also I tried with LoadRop but neither worked. Can there be a problem with my version of firmware?
     
  19. duke_srg
    OP

    duke_srg GBAtemp Advanced Maniac

    Member
    1,865
    587
    Mar 1, 2011
    Serbia, Republic of
    Moscow
    Not sure for what version the original version 5x/6x was made by smea
     
  20. marc_max

    marc_max GBAtemp Advanced Fan

    Member
    978
    626
    Jun 19, 2008
    I have coded a simple universal VC loader HTML code where the user can specify the ROM name, and it seems it's working flawlessly :-)

    <input type="text" value="romname.gbc" id="customvc" /> <input type="button" value="Accept" onclick="window.location='roploader.html?VC.dat&gbc/'+document.getElementById('customvc').value"/>
     
    Margen67, Februarysn0w and Manito like this.