Hacking [WIP] KARL3DS - Kernel access on N3DS via Ninjhax + Loadcode

[VinsCool]

Wow! This is something I will follow
I have Cubic Ninja, N3ds 9.0

I'm in if you need testers

 

[Kracken]

They are currently using Cubic Ninja as the entry point...So yes....maybe. Depends on what stage of the Cubic Ninja exploit they are using. I don't recall how much of the web browser the original Ninjhax depended on or not...You might still need the web browser.

I have little technical knowledge of what is going on here, but this is what made me wonder.

OK, did a ton of code cleanup, you can check out the new source over athttps://github.com/shinyquagsire23/bootstrap. If you want to incorperate it into your own project, there is now a bootstrap.c and bootstrap.h which contain easy to call methods which will patch your kernel for SVC 0x7B access. At the moment it only works on N3DS kernel 9.0-9.2, but more offsets will be added once I get the chance.

 

[Kracken]

Double.

 

[tony_2018]

I have little technical knowledge of what is going on here, but this is what made me wonder.

What is it you're wondering about? They are using cubic ninja ninjax exploit to accomplish there goal.

 

[Kracken]

What is it you're wondering about? They are using cubic ninja ninjax exploit to accomplish there goal.

If their method/complete process to accomplish the end goal requires exploits only found in 9.0-9.2.

 

[WulfyStylez]

If their method/complete process to accomplish the end goal requires exploits only found in 9.0-9.2.

Err no, it's just currently set up for 9.0-9.2. We'll update it for other versions less than 9.0 when we're done or whatever, it doesn't take much work.

 

[Kracken]

Err no, it's just currently set up for 9.0-9.2. We'll update it for other versions less than 9.0 when we're done or whatever, it doesn't take much work.

Thanks for the clarification.

 

[Rokkubro]

Holy crap, this exploded while I was at work!
shiny, you should have checked earlier, I found the 9.0-9.2 patch offset earlier by flawed logic, wulfy corrected me, but still, it worked, you saw the picture... I like your new code, It's so sexy .
As I said, I'm making a little widget now, probably something simple with I2C just to see what we can do, then we can move onto arm9!

 

[shinyquagsire23]

Holy crap, this exploded while I was at work!
shiny, you should have checked earlier, I found the 9.0-9.2 patch offset earlier by flawed logic, wulfy corrected me, but still, it worked, you saw the picture... I like your new code, It's so sexy .
As I said, I'm making a little widget now, probably something simple with I2C just to see what we can do, then we can move onto arm9!

Actually the offset for the N3DS was just a teeny bit different than the one for the old 3DS. The kernel in the New 3DS does a few more things to handle cores, and as a result the offsets are only slightly different. Either way I have that offset, just need to grab a few more in order to patch the svc handler for usermode apps on all versions (lets us use svc 0x7B so we can have ARM11 kernel whenever we want), cleanup code in the ARM11 setup for usermode apps so it doesn't collide with existing memory, and once ARM11 kernel is perfect, we escalate into ARM9.

 

[Rokkubro]

Actually the offset for the N3DS was just a teeny bit different than the one for the old 3DS. The kernel in the New 3DS does a few more things to handle cores, and as a result the offsets are only slightly different. Either way I have that offset, just need to grab a few more in order to patch the svc handler for usermode apps on all versions (lets us use svc 0x7B so we can have ARM11 kernel whenever we want), cleanup code in the ARM11 setup for usermode apps so it doesn't collide with existing memory, and once ARM11 kernel is perfect, we escalate into ARM9.

Ah right, gotcha, that's how wulfy explained it too... I'm guessing we'll never be able to get full kernel access with the old3ds's values then huh? Well, I keep getting schooled here, I'm glad I brought the 2 of you together I guess .

 

[shinyquagsire23]

Ah right, gotcha, that's how wulfy explained it too... I'm guessing we'll never be able to get full kernel access with the old3ds's values then huh? Well, I keep getting schooled here, I'm glad I brought the 2 of you together I guess .

With the old values no, however I found the single value (well, I guess one of two if you count the 8.1 JPN N3DSs, but I'm not sure if the kernel on those is different from the normal 3DS or not) which will work on all N3DS's which can run ninjhax (or Gateway for that matter I guess). Basically I had to grab the N3DS kernel from the CDN, decrypt it with it's decrypted title key, then grab the kernel out of the decrypted binary. From there it was just searching for similar bytes at known offsets.

 

[Click This]

If I'm reading this correctly, this will all be compatible with 8.1.0-0J N3DSs, then?

 

[cearp]

If I'm reading this correctly, this will all be compatible with 8.1.0-0J N3DSs, then?

sure, it is possible because it uses cubic ninja

 

[daxtsu]

sure, it is possible because it uses cubic ninja

This raises a critical question then: Will their adaptation of ninjhax require any internet browser functionality whatsoever? Because if so, 8.1.0-0J users are still out of luck.

 

[Kioku]

This raises a critical question then: Will their adaptation of ninjhax require any internet browser functionality whatsoever? Because if so, 8.1.0-0J users are still out of luck.

If it's using the same entry point that Ninjhax did? Then the web browser won't oven be open..

 

[WulfyStylez]

This raises a critical question then: Will their adaptation of ninjhax require any internet browser functionality whatsoever? Because if so, 8.1.0-0J users are still out of luck.

No. We're launching from ninjhax. Normal ninjhax works on 8.1.0-new3ds, right?

 

[daxtsu]

I don't believe so, no. 8.1.0-0 has no browser. I don't have a copy of Japanese Cubic Ninja though.

 

[cearp]

This raises a critical question then: Will their adaptation of ninjhax require any internet browser functionality whatsoever? Because if so, 8.1.0-0J users are still out of luck.

yeah, cubic ninja exploit thing needs internet access, but not the 'internet browser', right?
i never used it. even though 8.1 doesn't have the internet browser, naturally the internet still works on it... (otherwise how would you update via wifi etc)

 

[daxtsu]

yeah, cubic ninja exploit thing needs internet access, but not the 'internet browser', right?
i never used it. even though 8.1 doesn't have the internet browser, naturally the internet still works on it... (otherwise how would you update via wifi etc)

Right, you can still wifi update, but notice how on Smealum's website no firmwares with -0 are supported (i.e. ones with no browsers), so this won't help those of us stuck on a New 3DS with no browser run homebrew, unfortunately (unless they've found an alternate entrypoint I guess?).

 

[cearp]

Right, you can still wifi update, but notice how on Smealum's website no firmwares with -0 are supported (i.e. ones with no browsers), so this won't help those of us stuck on a New 3DS with no browser run homebrew, unfortunately (unless they've found an alternate entrypoint I guess?).

hmm yeah you might be right i hope not though - or that there will be some other way etc