Homebrew safecerthax - Remote ARM9 & ARM11 Kernel Exploit for the Original Nintendo 3DS

[Alexander1970]

@MrNbaYoh

Released safecerthx

safecerthax is a remote ARM9 & ARM 11 kernel exploit for the Original Nintendo 3DS (O3DS-only) SAFE_FIRM.
For more Information on safecerthax, please visit the safecerthax website.

How does it work?
In this section, we only provide summarized information on how safecerthax works, if you are looking for more details, please take a look at the exploit code and check out the write-up on the website.

safecerthax is based on SSLoth, a SSL/TLS certificate verification bypass exploit for the 3DS SSL system module. While SSLoth has been patched on NATIVE_FIRM with firmware update 11.14, it is still exploitable on SAFE_FIRM.


Source

 

[tfocosta]

Thank you, sir!

 

[fmkid]

Whoa! Awesome! And it's extremely simple! (A shame that not works on NEW models)

This (and universal-otherapp) will mean a possible goodbye to USM? Let's see

 

[zurgeg]

Oooh, so it's like str2hax but for the 3DS?

 

[oilxx]

Thank you

 

[Mikitok]

ok

 

[Deleted User]

https://hackerone.com/reports/894922
Woah! Nintendo paid $12,168 for this exploit.

 

[techmuse]

Oooh, so it's like str2hax but for the 3DS?

I wouldn't say its like str2hax since str involves an EULA page, safecerthax involves the SSL system module.

 

[Deleted member 466238]

Sweet! Another exploit!

But why is SAFE_FIRM so outdated on O3DS though? Could Nintendo fix it in a future update if the wanted to?

 

[fmkid]

https://hackerone.com/reports/894922
Woah! Nintendo paid $12,168 for this exploit.

Incoming a next (and strong) 11.15(?) firmware update, possibly then (not only that "system stability" usual update)

 

[lilyuwuu]

Whoa! Awesome! And it's extremely simple! (A shame that not works on NEW models)

This (and universal-otherapp) will mean a possible goodbye to USM? Let's see

These are the potential guide paths, depending on what gets released or not. Since safecerthax is unlikely to be patched, it'd likely be better and more permanent than any potential old-browserhax-xl. Unfortunately this would involve splitting the get started page into old3ds and new3ds, like in the a9lh days.

 

[techmuse]

Something I realized but correct me if I'm wrong, with SSLoth could you use this to install CFW on consoles in a frankenfirmware state that are unable to update if a user attempted to hack it by CTRTransferring to 2.1.0 and cart updated (of course on an old console) without having to spend money and wait for an NTRBoot cart to arrive? (yes I know there is Mii Mining but that is slow as molasses)

 

[Kartik]

https://hackerone.com/reports/894922
Woah! Nintendo paid $12,168 for this exploit.

Two more exploits were submitted along with this, the total amounts to somewhere close to 18K usd.