Using custom launcher.dat with Gateway Go

Discussion in '3DS - Flashcards & Custom Firmwares' started by AtlanticBit, Jan 16, 2015.

  1. AtlanticBit
    OP

    AtlanticBit Yeh, fuck this

    Member
    365
    189
    Jan 15, 2015
    Poland
    DEEP IN SPACE
    The title is self-explanatory. I have read a little bit about this and I thought that we just could try to remake GW's launcher and then change it's code to reflect what we want to do.
     
    Margen67 likes this.


  2. Pestilence204

    Pestilence204 GBAtemp Fan

    Member
    308
    162
    Mar 15, 2014
    Canada
    No, title is misleading. I thought for a second that you actually had something useful to contribute.
     
  3. AtlanticBit
    OP

    AtlanticBit Yeh, fuck this

    Member
    365
    189
    Jan 15, 2015
    Poland
    DEEP IN SPACE
    Why not just try? With some work we may RE it. Someday...
     
    Margen67 likes this.
  4. AtlanticBit
    OP

    AtlanticBit Yeh, fuck this

    Member
    365
    189
    Jan 15, 2015
    Poland
    DEEP IN SPACE
    Sorry, I suck at titling my posts.
    <-------Look here: Newcomer
     
  5. Pestilence204

    Pestilence204 GBAtemp Fan

    Member
    308
    162
    Mar 15, 2014
    Canada
    By "we may RE it", you mean other people will do the work for you, right?
     
    ztoben, SLiV3R, Ra1d and 4 others like this.
  6. Reisyukaku

    Reisyukaku Onii-sama~

    Member
    1,184
    2,301
    Feb 11, 2014
    United States
    I already tried that days ago, lol.. you're better off writting a custom ROP
     
    Slushie3DS likes this.
  7. Nollog

    Nollog GBAtemp Addict

    Member
    2,703
    472
    Oct 10, 2008
    the new launcher has already been understood, someone just has to use it properly.
     
  8. AtlanticBit
    OP

    AtlanticBit Yeh, fuck this

    Member
    365
    189
    Jan 15, 2015
    Poland
    DEEP IN SPACE
    Damn, I would love to contribute but the problem is that I don't know anything about 3DS hacking and I am very basic at C/C++ programming...
     
  9. AtlanticBit
    OP

    AtlanticBit Yeh, fuck this

    Member
    365
    189
    Jan 15, 2015
    Poland
    DEEP IN SPACE
    Nah, I meant the 3DS community. (I'm just guessing and asking if something like this is <semienglish>doable</semienglish>)
     
  10. AtlanticBit
    OP

    AtlanticBit Yeh, fuck this

    Member
    365
    189
    Jan 15, 2015
    Poland
    DEEP IN SPACE
    I think that I should try wgetting it with a 3ds 4.5(my version) client. Then I will try to understand the code in there(i mean the JS). I actually want to buy a ds mode flashcart but I just want to save 9$ for something I will use just to boot the exploit.
     
  11. AtlanticBit
    OP

    AtlanticBit Yeh, fuck this

    Member
    365
    189
    Jan 15, 2015
    Poland
    DEEP IN SPACE
    heh i actually thought it didn't exist xdd
     
  12. AtlanticBit
    OP

    AtlanticBit Yeh, fuck this

    Member
    365
    189
    Jan 15, 2015
    Poland
    DEEP IN SPACE
    I am n00b to forums and I don't know what jk means(Yes, I'm socially awkward).
     
  13. AtlanticBit
    OP

    AtlanticBit Yeh, fuck this

    Member
    365
    189
    Jan 15, 2015
    Poland
    DEEP IN SPACE
    Well, it seems that it's time to order a DS flashcart....
     
  14. st4rk

    st4rk nah

    Member
    545
    672
    Feb 11, 2014
    Brazil
    The structure was changed , the first stage is just a ROP which load the Launcher.dat + Fseek(0x1200), with total of 0x4000(~= 16kb), it will be loaded in "Heap" region(http://3dbrew.org/wiki/Memory_layout#NATIVE_FIRM.2FSAFE_MODE_FIRM_Userland_Memory), after it, it will do a FOR and de-obfuscate it, and jump to this new rop, which do some checking and get ARM11 user-land code execution and after it kernel-code execution, to get a "Custom Launcher.dat", you will need edit the ROP Chain's.
     
    ground, CydoniaDS and Nic333 like this.
  15. MRJPGames

    MRJPGames Pretty great guy

    Member
    1,108
    716
    Aug 17, 2013
    Netherlands
    The Netherlands
    The webkit exploit used by Gateway has been RE'd which means that in theory someone smart enough to rewrite it to launch "unsigned" launcher.dat's could do it!
    http://yifan.lu/2015/01/10/reversing-gateway-ultra-first-stage-part-1/
    http://yifan.lu/2015/01/12/reversing-gateway-ultra-first-stage-part-2/
    http://yifan.lu/2015/01/15/reversing-gateway-ultra-stage-2-owning-arm11-kernel/
    Also useful: http://smealum.net/?p=517 (As gpuhax/gspwn is used by both NINJHAX and GW (both have it as their second stage))
     
  16. st4rk

    st4rk nah

    Member
    545
    672
    Feb 11, 2014
    Brazil

    Not much(ARM11 user-land/Kernel-Code), probably will be hard REing the ROP(the second ;-) )

    Ah, there is just 9kb if i am not mistaken to code, but it can be fixed i think.
     
  17. yifan_lu

    yifan_lu @yifanlu

    Member
    660
    1,373
    Apr 28, 2007
    United States
    It's pretty easy actually. Compile your ARM11 userland code (make sure it starts with a NOP), encrypt it with the shitty stream cipher described in my first post (along with the original part 2). Find the offset to the encrypted payload for your FW version (diff my annotated ROP payload with the go hax for your FW version, the gadgets are the same) and replace it with part 2 + your custom ARM code. and it will run.

    Or what I did was replace two words in the first stage to skip the decryption. Then you don't have to bother encrypting/decrypting each time you make a change.
     
  18. st4rk

    st4rk nah

    Member
    545
    672
    Feb 11, 2014
    Brazil

    Is not necessary the code start with "NOP" ?
     
  19. yifan_lu

    yifan_lu @yifanlu

    Member
    660
    1,373
    Apr 28, 2007
    United States
    Well, the second part verifies that the code is copied correctly by checking for the NOP.
     
    st4rk likes this.
  20. shutterbug2000

    shutterbug2000 Cubic NINJHAX!

    Member
    1,079
    2,102
    Oct 11, 2014
    United States

    Would it be possible to make a "tool" to automatically do this? Like, supply the homebrew and the GW launcher.dat, and it automatically make it? I don't really understand this, and if you don't want to make that(understandable), could you assist me in converting homebrew into this?