Homebrew SigHax Updates and Discussion Thread

[adrifcastr]

Alright thanks but there is no release (e.g. for the installer) yet, since I cannot see anything under the section "Releases"?

(I do not want to be annoying, I am just a noob I guess and I do not want to miss anything before it is taken down or something.)

run make and compile it. thats also what I did it's a simple arm9 payload which can be executed

 

[Deleted User]

Wrong. You should think before posting.
We also need some SigHaxed firms or even the bruteforced signature. So please stop being the new bakawun. Thanks.

Thanks for your answer about the installers, though. I didn't realize that the brute forcer actually exists (nobody seems to talk about it, ever), but it's good to know that there will actually be an extra step between the bootrom dump and sighax.

Not to sound like an asshole, but did you even read the post literally right above yours? Or did you just want to be right? I mean like, come on, nobody's perfect, man.

EDIT BECAUSE I DON'T WANNA DOUBLE POST:

Alright thanks but there is no release (e.g. for the installer) yet, since I cannot see anything under the section "Releases"?

(I do not want to be annoying, I am just a noob I guess and I do not want to miss anything before it is taken down or something.)

Woah there friendo, you shouldn't be messing around with those yet. We don't even have sighax, so those installers might mess up your 3DS (because as far as I know, we haven't tested it without sighax yet). The other tools probably won't work either, since they piggyback off of sighax too. Besides, those current versions might not work, since we don't have working sighax implementations yet.

 

[adrifcastr]

Not to sound like an asshole, but did you even read the post literally right above yours? Or did you just want to be right? I mean like, come on, nobody's perfect, man.

EDIT BECAUSE I DON'T WANNA DOUBLE POST:



Woah there friendo, you shouldn't be messing around with those yet. We don't even have sighax, so those installers might mess up your 3DS (because as far as I know, we haven't tested it without sighax yet). The other tools probably won't work either, since they piggyback off of sighax too. Besides, those current versions might not work, since we don't have working sighax implementations yet.

You are officially the new @bakawun

 

[Deleted User]

You are officially the new @bakawun

i have literally no idea what that means, if it means anything.

 

[hurrz]

Woah there friendo, you shouldn't be messing around with those yet. We don't even have sighax, so those installers might mess up your 3DS (because as far as I know, we haven't tested it without sighax yet). The other tools probably won't work either, since they piggyback off of sighax too. Besides, those current versions might not work, since we don't have working sighax implementations yet.

Thanks for informing me about being careful! I did not plan to use these files (yet) but having them before links are taken down or so because somewhen, you might be able to turn your console into a helicopter after everything has been finished and released. I just do not want to miss the chance to fly with my future helicopter only because a certain company will make the links / files unavailable (just me being a bit paranoid ).

 

[zero318]

I haven't been keeping up with the scene for awhile, so I'm not up to date on all this. Reading the beginning of this thread, it sounds like there isn't anything available to install yet. But some of these recent posts are talking about installers and such. It doesn't sound like sighax is ready yet, but has there been progress since the first post was last edited?

 

[proflayton123]

I haven't been keeping up with the scene for awhile, so I'm not up to date on all this. Reading the beginning of this thread, it sounds like there isn't anything available to install yet. But some of these recent posts are talking about installers and such. It doesn't sound like sighax is ready yet, but has there been progress since the first post was last edited?

an installer for once it has been released, has been made so thats good work beforehand~~

 

[Selver]

Here's the million dollar question, though: How will a dumper tool actually run properly without essentially getting a bunch of greg clones floating around?

I figured the software Hedge was referring to would be similar to that of dumping the OTP.bin. That's how I took Hedge's statement at least.

Seems a bit of misunderstanding exists relating to SigHax...

SigHax will still require the ability to write to the system's NAND. This can be via HardMod, or via kernel exploit. It might(*) also be available from some user-mode programs.

Having the bootrom will answer the question: What magic size is required, so that instead of pointing to its own last few bytes, it instead points to the memory location the bootrom is using to temporarily store the hash of the current boot sector?

This magic size is used by the bruteforce engine to find "random" data that decrypts into a structure having the magic offset. This "random" data will be SigHax, and as a result, the bootrom will believe that any firmware with this header is properly signed. This occurs before any use of the OTP.

This means that SigHax can be used to bootstrap ANY 3DS device, again because setting it up does not depend on the OTP... it's a single, global failure of the 3DS security system.

 

[goldensun87]

The main advantage of SigHax, is that downgrading will no longer be required, right?

 

[Deleted member 350372]

Wait. But Hedgeberg is on it since something like 6 months. So it means that we'll have to go through these 8-9 months of work if we wanna hack our 3DSes in the future?

Do you know by any chance when exactly or approximately hedge has started this whole process? I'm just curious, not because I want to not wait for sighax and complain about it.

BTW: If anyone here exactly knows, that would be okay as well.

 

[The Catboy]

Wait. But Hedgeberg is on it since something like 6 months. So it means that we'll have to go through these 8-9 months of work if we wanna hack our 3DSes in the future?

Actually it most likely won't take that long after the actual bootROM is dumped. She is actually going to be posting the entire process once it's done. Right now it's just working to re-create the process used by Derrek in order to actually document the process.
This is actually how long it takes for these kinds of exploits. We just happen to never see it happen and only end up with the end results.

 

[BL4Z3D247]

Seems a bit of misunderstanding exists relating to SigHax...

SigHax will still require the ability to write to the system's NAND. This can be via HardMod, or via kernel exploit. It might(*) also be available from some user-mode programs.

Having the bootrom will answer the question: What magic size is required, so that instead of pointing to its own last few bytes, it instead points to the memory location the bootrom is using to temporarily store the hash of the current boot sector?

This magic size is used by the bruteforce engine to find "random" data that decrypts into a structure having the magic offset. This "random" data will be SigHax, and as a result, the bootrom will believe that any firmware with this header is properly signed. This occurs before any use of the OTP.

This means that SigHax can be used to bootstrap ANY 3DS device, again because setting it up does not depend on the OTP... it's a single, global failure of the 3DS security system.

I wasn't saying that installing SigHax was dependant on the OTP, I know that it isn't. Hegde said once they dump the bootrom a software will be made and released and not the actual bootrom(they made it clear they weren't releasing the actual bootrom, they said a good friend would make a software to dump the bootrom and that's what will be released). I was just using the process of dumping the the OTP as an example to the what the software will do that Hegde was referring to.

Now, I don't know if that software is intended for other devs to dump the bootrom or for users to dump the bootrom themselves, that wasn't mentioned. You can go back and watch Thursday night's Twitch to hear what Hedge said though.

 

[adrifcastr]

I wasn't saying that installing SigHax was dependant on the OTP, I know that it isn't. Hegde said once they dump the bootrom a software will be made and released and not the actual bootrom(they made it clear they weren't releasing the actual bootrom, they said a good friend would make a software to dump the bootrom and that's what will be released). I was just using the process of dumping the the OTP as an example to the what the software will do that Hegde was referring to.

Now, I don't know if that software is intended for other devs to dump the bootrom or for users to dump the bootrom themselves, that wasn't mentioned. You can go back and watch Thursday night's Twitch to hear what Hedge said though.

there is no way in dumping the bootrom just with software you would have tp recreate hedge's process

 

[BL4Z3D247]

there is no way in dumping the bootrom just with software you would have tp recreate hedge's process

I may have misinterpreted what they meant, my apologies for that but Hedge says that they won't release the bootrom it's self but there will be "software developed to finish SigHax and make it work". Honest mistake.

What I'm referring to can be heard for yourselves if you watch the Thursday night Twitch stream and listen to 2:52:55-2:53:30

 

[Deleted User]

I may have misinterpreted what they meant, my apologies for that but Hedge says that they won't release the bootrom it's self but there will be "software developed to finish SigHax and make it work". Honest mistake.

What I'm referring to can be heard for yourselves if you watch the Thursday night Twitch stream and listen to 2:52:55-2:53:30

The software developed to finish sighax sounds like it'll probably be the bruteforcer, because (according to my current information) that's the only other piece of the puzzle that's not necessarily solved quite yet. This makes sense when you line it up with other things, because she said that the software is gonna be made by a friend of hers (which myriachan is), and to "finish sighax and make it work", we need to force out the signature using the bruteforcer.

 

[BL4Z3D247]

The software developed to finish sighax sounds like it'll probably be the bruteforcer, because (according to my current information) that's the only other piece of the puzzle that's not necessarily solved quite yet. This makes sense when you line it up with other things, because she said that the software is gonna be made by a friend of hers (which myriachan is), and to "finish sighax and make it work", we need to force out the signature using the bruteforcer.

Right, that makes sense. I took "finish SigHax and make it work" as the bootrom being dumped because that still needs to happen before anything else. Like I said, it was an honest mistake. I was going from memory on something I watched days before, late at night, after a long day at work.

 

[pixelmasher]

The software developed to finish sighax sounds like it'll probably be the bruteforcer, because (according to my current information) that's the only other piece of the puzzle that's not necessarily solved quite yet. This makes sense when you line it up with other things, because she said that the software is gonna be made by a friend of hers (which myriachan is), and to "finish sighax and make it work", we need to force out the signature using the bruteforcer.

A program for brute-forcing the signature for the "sighax" exploit of a certain device's boot ROM.
NOTE: This program isn't known to actually find valid signatures!

 

[zoogie]

Please don't let the 3rd one win, it has nothing to do with getting the bootrom dumped! Teachberg can come after bootrom

So, no stream tonight unless im feeling late-night surprise. We'll see. I'll give 1 hr of heads up. Till then, what should next stream be?

— hedge (@hedgeberg) May 15, 2017

 

[Deleted User]

blank

The reason it says that is because we don't have the bootrom , meaning we can't properly test the bruteforcer yet, and since we don't have the bootrom, we also cant test it on other code, because the bootrom tells us what hash and length to try and find the sig with.

Or at least, thats the info that's circulating.

 

[jt_1258]

been awhile since I was in here, hows staying on topic going?