Hacking Updating 3ds and Exploits

[GamerzHell9137]

yup
DS Settings now boots SAFE_FIRM instead of NATIVE_FIRM now

Which means they need to find another way to hack it on 7.0?

 

[lambstone]

6.3.0 still has a Arm11 MSET exploit avilable

4.5.0 had Arm9 & Arm11 MSET exploit

the Arm11 exploit was patched in 7.0.0

Wait what?

So there's still an exploit available on 6.3.0 but just that there has been no progress in making use of it?

 

[Kakkoii]

Wait what?

So there's still an exploit available on 6.3.0 but just that there has been no progress in making use of it?

No. There is a user level exploit still available, but you can't do much with it. The other exploit was kernel level. So you'd use the userlevel one to get your foot in the door, then the kernel level to take control of the system. We can only get our foot in the door on 5.0+, until hopefully a new kernel exploit is found...

NATIVE_FIRM confirmed updated on 3DBrew, in 7.0.
http://3dbrew.org/wiki/7.0.0-13
So yeah, seems like that last standing vulnerability was patched.

 

[mathieulh]

yup
DS Settings now boots SAFE_FIRM instead of NATIVE_FIRM now

So what ? Whatever firmware mset runs on top of has nothing to do with mset itself, the question is: Is mset still exploitable ?

A lot of people claim the mset vulnerability hasn't been fixed in 6.3.x presumably because changing the lenght value still makes it crash, but a crash doesn't necessarily mean an exploit.
There are plenty of ways Nintendo could have fixed the vulnerability itself while still letting mset crash. In fact, if I were them, I'd call the panic function as soon as I detect a lenght that's set too large. I am not them though, so who knows what they did ? Until someone posts actual assembly of the 6.3.x mset or test more than just the fact that it "crashes" I will assume the vulnerability might have been fixed already.

Also should someone exploit SAFE_FIRM, he would most likely gain enough privileges to softload a patched version of NATIVE_FIRM. (though it would require changing the base addresses and so on, so it would be more of a pain, but doable)

That said, there is little hope of someone finding a new NATIVE_FIRM exploitable vulnerability considering how limited people are while using ROP chains in the first place.