Hacking [Research] Block the 3DS from updating - permanently

[cearp]

the answer (i believe) - stub out NIM

 

[liomajor]

What i've learned from messing with update files is, for each update, it takes only a few files bringing 3DS to actual used version.

Messing with spoofing is safe as long its high enough to never receive files, but if you spoof as example to 10.0.0-XXX and 10.1.0-XXX
comes out, it would only attempt to load the files from 10.0.0-XXX to 10.1.0-XXX and might end up in bricking your console because there
are files missing (still on very old version) if they are needed to work.

As for Gateway users, if its tested, it could help not to update sysNAND by accident.

For emuNAND it is necessary to update sooner or later depending on games/eshop(DLC)/online gaming and needs fixing emuNAND to correct version.

Spoof is as always a double edged sword.

 

[cearp]

NIM is the module that does this - http://3dbrew.org/wiki/Automatic_System_Update_Download
i really think if we b0rk it it will be ok.
but we need to test since maybe it won't simply make it so updates are autodownloaded, but maybe make updating impossible.

 

[liomajor]

but maybe make updating impossible.

That would be bad as i mentioned above.

 

[cearp]

That would be bad as i mentioned above.

sure, that is why i want to test it, to see if that 'maybe' is correct

 

[kamesenin888]

and if they spoof the firmware to something like in earlier posts 63.63.63 i dont think nintendo will ever get to that firmware update so you will never update the sysnand ever

 

[loco365]

That would be bad as i mentioned above.

As long as it's stubbed on the sysnand, the emunand will run just fine. However, make the emunand before we installing the stub. Or else you can't update your emunand ever.

 

[Kylecito]

Making it undoable is pretty harsh. I mean, really, how can anyone accept the EULA by mistake? Just use the buttons and not the touchscreen and you're set

 

[liomajor]

As long as it's stubbed on the sysnand, the emunand will run just fine. However, make the emunand before we installing the stub. Or else you can't update your emunand ever.

Otherwise you have to undo it afterwards in emuNAND

PS: Gateway spoofs emuNAND too.

This i said weeks ago, emulate your own update server would bring new options

 

[Searinox]

<wrong thread, please delete>

 

[cearp]

Otherwise you have to undo it afterwards in emuNAND

PS: Gateway spoofs emuNAND too.

This i said weeks ago, emulate your own update server would bring new options

finding out exactly how the 3ds communicates with nintendo's server would be a lot of work, i am sure!

 

[Duo8]

NIM is the module that does this - http://3dbrew.org/wiki/Automatic_System_Update_Download
i really think if we b0rk it it will be ok.
but we need to test since maybe it won't simply make it so updates are autodownloaded, but maybe make updating impossible.

Break CheckSystemUpdateAvailable lol.
Anw breaking titles like that will cause issues.

 

[cearp]

Break CheckSystemUpdateAvailable lol.
Anw breaking titles like that will cause issues.

well that really is exactly what we want to break

 

[Duo8]

well that really is exactly what we want to break

How exactly are you going to "stub" a title?

Also it does several other things as well. http://www.3dbrew.org/wiki/NIM_Services

 

[cearp]

How exactly are you going to "stub" a title?

Also it does several other things as well. http://www.3dbrew.org/wiki/NIM_Services

that's what i'm working on now i haven't succeeded yet, but i haven't failed either.
what i am wondering though is, i guess the title would install to sysnand when in gw mode, due to the patches - but since the cia is not legit, i want to know what would happen when not in gw mode...
the title would be stubbed and broken either way... so, nothing would be there in practice, so, it might be ok.
if it was a game for example, yeah, it wouldn't load up, but if it is a system thing, it might black screen... who knows. i doubt NIM is SUPER important, not like home menu, we will see when we test it.

 

[Inaki]

that's what i'm working on now i haven't succeeded yet, but i haven't failed either.
what i am wondering though is, i guess the title would install to sysnand when in gw mode, due to the patches - but since the cia is not legit, i want to know what would happen when not in gw mode...
the title would be stubbed and broken either way... so, nothing would be there in practice, so, it might be ok.
if it was a game for example, yeah, it wouldn't load up, but if it is a system thing, it might black screen... who knows. i doubt NIM is SUPER important, not like home menu, we will see when we test it.

I have a hardmoded 3ds xl ( wired nand ), I could try with a patched CheckSysupdateAvailableSOAP ( which I believe is the one we need to patch ), making it return index 2=0. But, is this an executable module ? does it need to be signed ? reencrypted ? what ?

 

[Inaki]

I have a hardmoded 3ds xl ( wired nand ), I could try with a patched CheckSysupdateAvailableSOAP ( which I believe is the one we need to patch ), making it return index 2=0. But, is this an executable module ? does it need to be signed ? reencrypted ? what ?

I can use IDA ( more an x86 guy, but I know some ARM too, enough to understand the function -if we know where that is- and change some opcodes and do the patch ) but I have no idea about 3ds modules etc. Any info available for that ? 3dbrew ?

 

[cearp]

I can use IDA ( more an x86 guy, but I know some ARM too, enough to understand the function -if we know where that is- and changei some opcodes and do the patch ) but I have no idea about 3ds modules etc. Any info available for that ? 3dbrew ?

if you can use IDA and comfortable, then please by all means go ahead and patch stuff out, that is far beyond my abilities good luck
it does need to be signed, well, hashes need to be correct i believe, even in GW mode.
but - fix that problem when you get to it

 

[Dramamine!]

You mention that it's possible to stop the 3ds from seeing an available update through this modification. Would this work for system transfer, and other "lite" update checks?

For example.
I have two 3ds consoles both on 9.2.x. Same region. I want to transfer between the two. Of course, this is impossible because 9.4.x is available which would prevent it from transferring and possibly force an update.
By using this spoof to set both 3ds consoles to the same version, would it be possible to fool the 3ds and update server into thinking it's the latest version?

As in, take these steps.

1. Prepare both 3ds consoles for system transfer, but remain on 9.2.x.
2. Load up the (upcoming) Gateway exploit and do the relevant changes to spoof version number to the highest available. (65535? x.x.x?)
3. Remove Gateway and begin System transfer.
4. Connect 3ds to the network, 3ds should report as being on the latest version.
5. Successfully transfer.
6. Remove previous version patches.

That should give two 3ds consoles on 9.2.x but with a successful transfer, right? Or would the update check simply fail and the transfer not progress?


I've considered other routes such as using a proxy application to spoof the update server, although I imagine more investigation has gone into this and come up fruitless.

 

[Duo8]

I have a hardmoded 3ds xl ( wired nand ), I could try with a patched CheckSysupdateAvailableSOAP ( which I believe is the one we need to patch ), making it return index 2=0. But, is this an executable module ? does it need to be signed ? reencrypted ? what ?

I can use IDA ( more an x86 guy, but I know some ARM too, enough to understand the function -if we know where that is- and change some opcodes and do the patch ) but I have no idea about 3ds modules etc. Any info available for that ? 3dbrew ?

It's a service/system module. And of course it needs to be signed. If you modify it you will also have to re encrypt it.
You could try patching it out. Just remember it'll only work in emuNAND if you install it.

I've considered other routes such as using a proxy application to spoof the update server, although I imagine more investigation has gone into this and come up fruitless.

It should work. However a "update proxy" is difficult to create because updates use ssl.