Homebrew SigHax Updates and Discussion Thread

[KevinX8]

so essentially only system patches are achievable (aka things like luma3ds) using otp? but the bootrom key would be like actual firmware (all the way down to arm9 arm7 arm11) anything it can handle?

--------------------- MERGED ---------------------------


so we could technically patch the boot0 to load our otp automatically?

bootrom is basically the bootloader in other devices, the 3ds arm9 process is then started after bootrom verifies boot0 is signed(its basically the OS you have installed booting up). The otp is used to sign the arm9loader and what a9lh is is overwriting it to something more useful lol. More info here: https://www.3dbrew.org/wiki/OTP_Registers

 

[MarioMasta64]

bootrom is basically the bootloader in other devices, the 3ds arm9 process is then started after bootrom verifies boot0 is signed(its basically the OS you have installed booting up). The otp is used to sign the arm9loader and what a9lh is is overwriting it to something more useful lol

understood. so itll be like having a wii with boot1

 

[Mr.ButtButt]

This is already doable right now with A9LH. No one has stepped up and done it yet, though.

I would, if i knew, in the slightest, about 3ds coding

 

[adrifcastr]

I would, if i knew, in the slightest, about 3ds coding

I´d recommend starting with C , if you do any coding related 3ds, start with C.

 

[MarioMasta64]

I´d recommend starting with C , if you do any coding related 3ds, start with C.

indeed

 

[Zan']

A9LH can be used for a full OS replacement. It hasn't been done yet (besides the Linux PoC) because no one has bothered.

The only real difference here is you can use the FIRM partitions to store custom stuff, whereas A9LH requires original Nintendo FIRM partitions.

Mind telling my how a patch based OS replacement should work?

I mean TECHNICALLY it would be possible to load up a different OS from A9LH, but that would require you to do a whole shit ton of reversing of the current system fw, patching calls to get certain methods to run. And most of that would have to be done assembly based at some point.
Have fun creating bytecode patches that let you turn the 3DS OS into i.e. a Linux OS. It's near impossible.

The Linux PoC you're talking about is running an OS from the 3DS OS. it's not a replacement. It's more comparable to a VM.

To make this easier to understand.
It's TECHNICALLY possible to turn your webbrowser into a game, by patching the program (with for example a Debugger), but noone would even attempt it because it doesn't make a lot of sense and is a lot of work to get done.
Running a game in your webbrowser however is not that difficult, you just need to adapt whatever you run to whatever the Browser can run.

 

[adrifcastr]

Mind telling my how a patch based OS replacement should work?

I mean TECHNICALLY it would be possible to load up a different OS from A9LH, but that would require you to do a whole shit ton of reversing of the current system fw, patching calls to get certain methods to run. And most of that would have to be done assembly based at some point.
Have fun creating bytecode patches that let you turn the 3DS OS into i.e. a Linux OS. It's near impossible.

The Linux PoC you're talking about is running an OS from the 3DS OS. it's not a replacement. It's more comparable to a VM.

To make this easier to understand.
It's TECHNICALLY possible to turn your webbrowser into a game, by patching the program (with for example a Debugger), but noone would even attempt it because it doesn't make a lot of sense and is a lot of work to get done.
Running a game in your webbrowser however is not that difficult, you just need to adapt whatever you run to whatever the Browser can run.

is your custom title actually the bootrom key:
2F88744FEED717856386400A44BBA4B9CA62E76A32C715D4F ???!

 

[laharl22]

when it will be released ,

 

[adrifcastr]

when it will be released ,

what?

 

[laharl22]

what?

sighax

 

[adrifcastr]

sighax

For Now:
We are not yet able to do any of this.
Derrek did dump the bootrom and provided a simple explanation of how he did it.
He did not make the bootrom public though. Nor any of the code he used.

This means someone would have to develop code that exploits the Bootrom pointers and leads them to dumper code to dump the bootrom. Which is unstable and likely needs you to have a hardmod to trigger this very early exception without the chance of killing your device.

Thanks to @Zan' for Correcting my OP

reading helps

 

[Alex658]

sighax

bootrom hasn't even been successfully dumped by normal developers. Only derrekk who found the exploit has. He only gave scarce information on how to dump it with no hashes or anything to compare it to.

 

[adrifcastr]

bootrom hasn't even been successfully dumped by normal developers. Only derrekk who found the exploit has. He only gave scarce information on how to dump it with no hashes or anything to compare it to.

youve got ninja´d xd

 

[MarioMasta64]

bootrom hasn't even been successfully dumped by normal developers. Only derrekk who found the exploit has. He only gave scarce information on how to dump it with no hashes or anything to compare it to.

what about the number on his slide? wasnt that a hash?

 

[FR0ZN]

bootrom hasn't even been successfully dumped by normal developers. Only derrekk who found the exploit has. He only gave scarce information on how to dump it with no hashes or anything to compare it to.

He did give hashes

 

[Alex658]

youve got ninja´d xd

oh, sorry. I'm on mobile so that's why slowpoke.
ninja'd

EDIT: Sorry, what he didn't give was the full dump, right? What i do know is that what he gave was a bit more of stage1 as to where to even begin to exploit the bug. (as in devs still got to RE a lot to get to his hashes)

 

[adrifcastr]

what about the number on his slide? wasnt that a hash?

2F88744FEED717856386400A44BBA4B9CA62E76A32C715D4F is the key

 

[MarioMasta64]

2F88744FEED717856386400A44BBA4B9CA62E76A32C715D4F is the key

i see but which key? to what?

 

[adrifcastr]

i see but which key? to what?

arm9 bootrom if I´m not mistaken

 

[MarioMasta64]

arm9 bootrom if I´m not mistaken

fancy