[Unconfirmed] ARM11 Kernel Vulnerability under 10.0.0-X

Status
Not open for further replies.
173210

173210

Well-Known Member
OP
Member
Level 5
Joined
Jan 22, 2014
Messages
245
Trophies
0
Age
26
Location
Japan
Website
173210.github.io
XP
683
Country
Hello, I found something. I just found something and it may not be useful. Anyway, I'll post this because I don't know SVC handler well and have no idea where the function is. If you know how to find the actual code of SVC, please tell me. I'm a noob for 3DS. ;)

3DS System Flaws - 3dbrew
http://www.3dbrew.org/wiki/3DS_System_Flaws

Usually 3dbrew writers don't provide actual unknown vulnerabilities, so I'm still wondering the following description is correct.
Yellows8 said:
The svcCreateThread changes with 10.0.0-Xdefinitely did fix a security issue.

  • Original code: "if(s32_processorid > <total_cores>)return 0xd8e007fd;"
  • New code: "if(s32_processorid >= <total_cores> || s32_processorid <= -4)return 0xd8e007fd;"
This fixed an off-by-one issue: if one would use processorid=total_cores, which isn't actually a valid value, svcCreateThread would accept that value on <10.0.0-X. This results in data being written out-of-bounds(baseaddr = arrayaddr + entrysize*processorid), which has the following result:

  • Old3DS: Useless kernel-mode crash due to accessing unmapped memory.
  • New3DS: uncontrolled data write into a kernel-mode L1 MMU-table. This isn't really useful: the data can't be controlled, and the data which gets overwritten is all-zero anyway(this isn't anywhere near MMU L1 entries for actually mapped memory).
Click to expand...
Yellows8 doesn't mention about the possibility of the case that s32_processorid is negative. It can result in kernel memory corruption, and eventually kernel code execution.

So, I wrote this simple PoC by modifying an example included in ctrulib.
Code: 
diff --git a/examples/threads/event/source/main.c b/examples/threads/event/source/main.c
index 1fcec86..dbe1d9e 100644
--- a/examples/threads/event/source/main.c
+++ b/examples/threads/event/source/main.c
@@ -36,7 +36,7 @@ int main(int argc, char** argv) {

        svcCreateEvent(&threadRequest,0);
        u32 *threadStack = memalign(32, STACKSIZE);
-       Result ret = svcCreateThread(&threadHandle, threadMain, 0, &threadStack[STACKSIZE/4], 0x3f, 0);
+       Result ret = svcCreateThread(&threadHandle, threadMain, 0, &threadStack[STACKSIZE/4], 0x3f, -2147483647);

        printf("thread create returned %x\n", ret);
svcCreateThread actually returned 0 and the created thread didn't seem to work. So, my experiment is successful, probably. :P

Anyway, notice the following things.
  • It has so many limitations and is not so easy to exploit.
  • It's just an ARM11 kernel vulnerability, not ARM9.
Status:
KTR 9.2: Confirmed it accepts a negative value.
CTR 9.9: Confirmed it has the vulnerable code at 0xfff079b4.
CTR 4.5: Confirmed it has the vulnerable code at 0xfff07b2c.

Update on 3dbrew.org
The previous version also allowed large negative s32_processorid values(negative processorid values are special values not actual procids), but it appears using values like that won't actually do anything(meaning no crash) besides the thread not running / thread not running for a while(besides triggering a kernelpanic with certain s32_processorid value(s)).
Click to expand...
According to 3dbrew.org, s32_processorid should be larger than -4, which is the code-reversed value of the number of n3ds core.
So I carried out another experiment. It crashed when it took -4 as processorid on n3ds. So it may write the data in the same place as it does when it took 4 as processorid. It's still not clear whether it's exploitable or not.

I may have to develop ARM11 debugger...
 
Last edited by 173210, , Reason: Add "Update on 3dbrew.org"
  • Like
Reactions: ShinkoNet, Tony_93, randomdev and 19 others
OctopusRift

OctopusRift

GBATemp's Local Octopus, Open 9am-2am. "Not Yet"
Member
Level 6
Joined
Nov 19, 2014
Messages
1,460
Trophies
0
XP
947
Country
Saint Kitts and Nevis
zoogie said:
"It's just ARM11 kernel vulnerability, not ARM9."
but with arm11 kernel you could downgrade and gain arm9.
Click to expand...
Really? That's fucking amazing. Today is a good day. But. One question... when we had 9.5.0 why did no-one write a downgrader.
 
  • Like
Reactions: Margen67
D

Deleted User

Guest
FUUUUUUUUUUUUUUUUUUUUUUUUUUUUUCKKKKKKKKKKKKKKKKKK THHHIIIIIIIIIIISSSSSSSSSSSSS
I LITERALLY POSTED A THREAD YESTERDAY WHETHER OR NOT I SHOULD UPDATE AND EVERYONE SAID I SHOULD
LOOK GUYS NEW KERNAL VULNERABILITY
FUCK
 
  • Like
Reactions: ShinkoNet, randomdev, WeedZ and 9 others
D

Deleted User

Guest
Could someone explain why this wouldnt work on 10.0+? It might be in the OP but looking at that stuff makes my normie head hurt
 
  • Like
Reactions: Margen67
Status
Not open for further replies.

Site & Scene News

Go to forum More news

Popular threads in this forum

OFFICIAL : Nintendo Unveils Revolutionary Hybrid Console: Switch U! Brings Wii U Back to Life

Anyone else think the world inside Conspiracy theorists heads sounds like a lot of fun?

So guys what is your reactions if we ship Luke94 and LeoTCK together 😂?

It's 420

I buy souls for big bucks...

eof

Test  Guess what

SylverRez wants to ban Luke94 and all conspiracy theorists

General chit-chat
Help Users
  • No one is chatting at the moment.
  • Xdqwerty @ Xdqwerty:
  • K3Nv2 @ K3Nv2:
    https://youtu.be/_sJ79aDQTeQ?si=dCPYbyGhZ8OFK8nb
  • Psionic Roshambo @ Psionic Roshambo:
    https://www.youtube.com/watch?v=HlxH_Th3-LI
  • Xdqwerty @ Xdqwerty:
    good night
  • BakerMan @ BakerMan:
    as to you
  • K3Nv2 @ K3Nv2:
    How do you know if the night will be good when you're asleep
  • BakerMan @ BakerMan:
    because i didn't say i was asleep
  • BakerMan @ BakerMan:
    i said i was sleeping...
  • BakerMan @ BakerMan:
    sleeping with uremum
  • K3Nv2 @ K3Nv2:
    Even my mum slept on that uremum
  • TwoSpikedHands @ TwoSpikedHands:
    yall im torn... ive been hacking away at tales of phantasia GBA (the USA version) and have so many documents of reverse engineering i've done
  • TwoSpikedHands @ TwoSpikedHands:
    I just found out that the EU version is better in literally every way, better sound quality, better lighting, and there's even a patch someone made to make the text look nicer
  • TwoSpikedHands @ TwoSpikedHands:
    Do I restart now using what i've learned on the EU version since it's a better overall experience? or do I continue with the US version since that is what ive been using, and if someone decides to play my hack, it would most likely be that version?
  • Sicklyboy @ Sicklyboy:
    @TwoSpikedHands, I'll preface this with the fact that I know nothing about the game, but, I think it depends on what your goals are. Are you trying to make a definitive version of the game? You may want to refocus your efforts on the EU version then. Or, are you trying to make a better US version? In which case, the only way to make a better US version is to keep on plugging away at that one ;)
  • Sicklyboy @ Sicklyboy:
    I'm not familiar with the technicalities of the differences between the two versions, but I'm wondering if at least some of those differences are things that you could port over to the US version in your patch without having to include copyrighted assets from the EU version
  • TwoSpikedHands @ TwoSpikedHands:
    @Sicklyboy I am wanting to fully change the game and bend it to my will lol. I would like to eventually have the ability to add more characters, enemies, even have a completely different story if i wanted. I already have the ability to change the tilemaps in the US version, so I can basically make my own map and warp to it in game - so I'm pretty far into it!
  • TwoSpikedHands @ TwoSpikedHands:
    I really would like to make a hack that I would enjoy playing, and maybe other people would too. swapping to the EU version would also mean my US friends could not legally play it
  • TwoSpikedHands @ TwoSpikedHands:
    I am definitely considering porting over some of the EU features without using the actual ROM itself, tbh that would probably be the best way to go about it... but i'm sad that the voice acting is so.... not good on the US version. May not be a way around that though
  • TwoSpikedHands @ TwoSpikedHands:
    I appreciate the insight!
  • The Real Jdbye @ The Real Jdbye:
    @TwoSpikedHands just switch, all the knowledge you learned still applies and most of the code and assets should be the same anyway
  • The Real Jdbye @ The Real Jdbye:
    and realistically they wouldn't

    be able to play it legally anyway since they need a ROM and they probably don't have the means to dump it themselves
  • The Real Jdbye @ The Real Jdbye:
    why the shit does the shitbox randomly insert newlines in my messages
  • Veho @ Veho:
    It does that when I edit a post.
  • Veho @ Veho:
    It inserts a newline in a random spot.
  • The Real Jdbye @ The Real Jdbye:
    never had that i don't think
    The Real Jdbye @ The Real Jdbye: never had that i don't think