Hacking Using CVE-2016-4657 to dump Browser Binary

chilliam

New Member
OP
Newbie
Joined
Mar 17, 2017
Messages
1
Trophies
0
Age
26
XP
34
Country
United States
Long time lurker here ever since I became interested in r4 cards for my old DS and I feel like I finally have something to contribute (literally created an account today to post this info).

I got a Switch recently and became extremely interested when I heard news that a WebKit exploit still exists in the browser of the console. I watched LiveOverflow's video on this subject like 15 times and studied his code and the code he derived his from (the iOS jailbreak code) and I think I've finally managed to dump some interesting binary data from the browser.

I first tried adapting LiveOverflow's code but after much testing I figured that he cut out a key piece of the exploit. So referencing the original code from qwertyoruiop, I was able to strip out the part that loaded the iOS binary loader, used some of the code from the Phrack article to find memory addresses, and found the exploit can work the exact same way. If we had shellcode to execute to gain root privileges of the Switch, we could do it here and run our arbitrary code in the same way it does for iOS. But, since we don't have shellcode to operate (yet) on the Switch, I just decided to try to dump the browser's executable binary from memory.

I need to take a break from this but I wanted to post my 16 hours of straight research before I did that and post what I believe to be the first 2(1024^2) bytes (~9 MB of data) of the browser's binary (searching through I can find the source code to my webpage in plaintext, too bad I have no general idea of how WebKit looks in binary). Since I'm generally naive when it comes to how WebKit stores executable and JITcompiler code in memory, this could be more than the browser's binary (though I highly doubt it) and is really just the first 2(1024^2) bytes in memory after the calculated executable's address.

It's only the first two parts because the Switch crashes before it can finish reading all of the data. Probably needs some more refining on finding the length of the executable.

TL;DR: I have dumped the beginnings of what I believe to be the Switch's browser binary from memory using the WebKit exploit.

The code and binary parts are on my GitHub:
https://github.com/weelcheel/Switch-Exploit

Feel free to discuss and/or tell me I'm wrong about this (seriously, I'm not 100% sure on what the data I found is).

Edit: Math is hard.
 
Last edited by chilliam,

Jhynjhiruu

Well-Known Member
Member
Joined
Dec 31, 2016
Messages
817
Trophies
0
Age
18
XP
1,609
Country
I'm confused as to how to make this work. I put all the files I downloaded from the GitHub in C:/inetpub/wwwroot, got my Switch to go to that page, ran the exploit... and then...?
 

thomasnet

Well-Known Member
Member
Joined
Mar 6, 2016
Messages
175
Trophies
0
XP
549
Country
France
Did you start the nodejs server ?
You don't need to have a webserver like IIS or Apache HTTPd.
Just modify the switchhax0r.html (search in it 192.168.1.1 and replace that with your PC's IP), start the server using the command nodejs switchtest.js, make your switch go to your PC's IP:5001 and done.
Also make sure you have put the js and the html in the same directory (it can be anywhere).
 
Last edited by thomasnet,
General chit-chat
Help Users
  • No one is chatting at the moment.
  • The Real Jdbye @ The Real Jdbye:
    very dark scenes are more common than very bright scenes so i think i made the right choice
    Gift
  • The Real Jdbye @ The Real Jdbye:
    there was also a sony with worse local dimming and the glow was really apparent
    Gift
  • SG854 @ SG854:
    Human vision is non linear anyway. 100 nits is about 50% of the peak output of a 10,000 nit display.
    Gift
  • Julie_Pilgrim @ Julie_Pilgrim:
    "very dark scenes are more common than very bright scenes" not in the games i play
    Gift
  • The Real Jdbye @ The Real Jdbye:
    really have to buy the top end model to get a tv that doesnt have any of those compromises and that would've had more dimming zones too but i am not made o money
    Gift
  • The Real Jdbye @ The Real Jdbye:
    @Julie_Pilgrim "very bright" is essentially pure white
    Gift
  • The Real Jdbye @ The Real Jdbye:
    pure white doesn't show up all that much it's mainly when looking at a bright sky
    Gift
  • The Real Jdbye @ The Real Jdbye:
    and if the clouds in the sky have slightly less definition to them because i turned on the contrast enhancer who cares
    Gift
  • The Real Jdbye @ The Real Jdbye:
    that's not important
    Gift
  • The Real Jdbye @ The Real Jdbye:
    i can't tell the difference
    Gift
  • The Real Jdbye @ The Real Jdbye:
    but i can certainly tell the difference with black crush if i'm watching a scifi movie and i can't see wtf is going on
    Gift
  • SG854 @ SG854:
    Human vision is logarithmic, it's not linear. And nits doesn't tell the whole story of perceived brightness. OLED'S look brighter then LCD's even when both are set to the same nit values because of the higher contrast ratio on OLED's
    Gift
  • SG854 @ SG854:
    OLED's have a 3D look
    Gift
  • kenenthk @ kenenthk:
    Charging port is more likely to fry up or battery fail before the display tbh lol
    Gift
  • The Real Jdbye @ The Real Jdbye:
    "And nits doesn't tell the whole story of perceived brightness" it's not about perceived brightness it's about all HDR content in TV and movies being mastered for 1000 nits so it doesn't look right with anything lower, it's also about dynamic range
    Gift
  • The Real Jdbye @ The Real Jdbye:
    "OLED's have a 3D look" no they don't lol
    Gift
  • SG854 @ SG854:
    As an owner of a OLED and you saying that you never seen an OLED I think I know what I'm talking about lol. I'm not talking about 3D as in 3D glasses. I'm talking about depth and pop in the picture
    Gift
  • kenenthk @ kenenthk:
    I mean to be fair og vitas are still kicking and not many have suffered from pixel bleed and they're going on nearly 10 years
    Gift
  • SG854 @ SG854:
    OLED's can get away with a lower peak brightness and still provide punchy HDR because of their contrast ratio. Like I said human vision is logarithmic. The higher the peak brightness the diminishing returns in perceived brightness.
    Gift
  • kenenthk @ kenenthk:
    Just get 5 years enjoyment out of it until Nintendy releases something and everyone forgets about switch games lol
    Gift
  • SG854 @ SG854:
    @The Real Jdbye Oleds hit around 750 nits nowadays. The difference between a 1000 nit and a 750 nit isn't huge. It's only about a 4% increase in perceived brightness. Not huge at all. You'll need at least 2000 nit displays to notice a bigger difference.
    Gift
  • SG854 @ SG854:
    Read this thread it explains it. 1000 nits is not a huge jump from 750 the LG OLEDs can hit. As I said human vision is non linear.
    +2
    Gift
  • Gift
  • mr_switch @ mr_switch:
    Not exactly 3D but the colors does pops out more
    Gift
  • mr_switch @ mr_switch:
    I just want a true dark mode theme
    for OLED Switch
    Gift
    mr_switch @ mr_switch: I just want a true dark mode theme for OLED Switch