Hacking [WIP] KARL3DS - Kernel access on N3DS via Ninjhax + Loadcode

[Katsumi San]

Sorry to derail thread a little but how exactly to contribute?
I have retail copy of cubic ninja, and launcher.dat(RegionThree)/bootstrap.3dsx files in my SD.

This is set up:

 

[NyaakoXD]

bootstrap.3dsx should be in the "3ds" folder.

 

[Katsumi San]

Actually nevermind... I see NinjHax does not work past 9.2 update... I cannot run it anymore becuase 3DS is on 9.4 FW. I did install NinjHax when it was on 9.2, but when go to create QR Code in Cubic Ninja, exploit is run only to 40% then is go to browser(it crash?) and touchscreen/buttons do not work. Only option is to force turn off system. I will check my RegionThree just in case!

 

[Oishikatta]

Actually nevermind... I see NinjHax does not work past 9.2 update... I cannot run it anymore becuase 3DS is on 9.4 FW. I did install NinjHax when it was on 9.2, but when go to create QR Code in Cubic Ninja, exploit is run only to 40% then is go to browser(it crash?) and touchscreen/buttons do not work. Only option is to force turn off system. I will check my RegionThree just in case!

One of the required exploits was patched in 9.3. You can run regionfree, but you can't get kernel access.

 

[shinyquagsire23]

It says

Testing nop slide
Exited nop slide
Loaded adr eff83c97 for kernel 2220000
Overwriting free pointer 141a0000
Triggered kernel write
Exited nop slide
Kernel exploit set up
Executing code under ARM11 Kernel...
Testing SVC 0x7B
ARM11 Kernel Code Executed

what now, senpai?

My guess is that was a heap error or something, atm the heap is incredibly unstable. However, it passed all the tests so that would probably be an faaffaaf. Just never got to display it.

 

[shinyquagsire23]

One of the required exploits was patched in 9.3. You can run regionfree, but you can't get kernel access.

In particular, the actual ARM11 kernel vuln was patched in 9.3. gspwn is still in the later versions and firmlaunch hax is still in 9.4, but we can't get ARM11 kernel so no go after 9.2 for this. For ninjhax, they also patched rohax so that was also needed on the ninjhax side. So even if we didn't use ninjhax, we couldn't get ARM11 kernel which is kinda needed right now.

 

[Katsumi San]

In particular, the actual ARM11 kernel vuln was patched in 9.3. gspwn is still in the later versions and firmlaunch hax is still in 9.4, but we can't get ARM11 kernel so no go after 9.2 for this. For ninjhax, they also patched rohax so that was also needed on the ninjhax side. So even if we didn't use ninjhax, we couldn't get ARM11 kernel which is kinda needed right now.

So this $7 dollar investment(retail CubicNinja) I made from amazon is worthless? Well folks all I can say that the ride was fun.. I guess I'll throw it away now. And the only reason I upgraded to 9.4 FW was because I wanted the Pikachu theme...

Oh well, folks carry on, just another passerby moving on.

 

[NyaakoXD]

So this $7 dollar investment(retail CubicNinja) I made from amazon is worthless? Well folks all I can say that the ride was fun.. I guess I'll throw it away now. And the only reason I upgraded to 9.4 FW was because I wanted the Pikachu theme...

Oh well, folks carry on, just another passerby moving on.

You know you could just sell it instead of throwing it away. You may be able to get more than $7 depending on whoever wants it.

 

[KidIce]

Is more testing needed? Time, just today, became extremely limited to me, but I may have some of the sample set you're looking for (if running on emuNAND is useful anyway)... I'd like to help if I can provide something others can not. If my sample set isn't helpful or can't do anything someone else can I'd rather use my spare time on other things... In no way am I trying to be a jerk, I'm VERY excited about this project, but I expect I'm going to be at work 10-12 hours a day for the next 2-3 weeks. :-/

Anyway, what I have at my disposal:

I have a launch 3DS on 4.5 and emuNAND backups of 6.3, 7.1, 8.1, 9.2 and 9.4. Its current emuNAND is 9.5.

I have a 3DSXL on 9.2, emuNAND on 9.4. I can backup 9.4 and update to 9.5 emuNAND.

And last a N3DS on 9.0. No emuNAND for obvious reasons.

If I can help, let me know. Also, please prioritize which unit and FW you'd like me test on.

 

[Rokkubro]

Is more testing needed? Time, just today, became extremely limited to me, but I may have some of the sample set you're looking for (if running on emuNAND is useful anyway)... I'd like to help if I can provide something others can not. If my sample set isn't helpful or can't do anything someone else can I'd rather use my spare time on other things... In no way am I trying to be a jerk, I'm VERY excited about this project, but I expect I'm going to be at work 10-12 hours a day for the next 2-3 weeks. :-/

Anyway, what I have at my disposal:

I have a launch 3DS on 4.5 and emuNAND backups of 6.3, 7.1, 8.1, 9.2 and 9.4. Its current emuNAND is 9.5.

I have a 3DSXL on 9.2, emuNAND on 9.4. I can backup 9.4 and update to 9.5 emuNAND.

And last a N3DS on 9.0. No emuNAND for obvious reasons.

If I can help, let me know. Also, please prioritize which unit and FW you'd like me test on.

We have no info on firmware 6.3 at the moment, so that would be helpful, and the one user who tested on 7.1 didn't really provide any information at all. Thank you for being willing to do so much to help out

 

[Click This]

So this $7 dollar investment(retail CubicNinja) I made from amazon is worthless? Well folks all I can say that the ride was fun.. I guess I'll throw it away now. And the only reason I upgraded to 9.4 FW was because I wanted the Pikachu theme...

Oh well, folks carry on, just another passerby moving on.

If it's a copy of JP Cubic Ninja, I'll buy it from you!

 

[smealum]

So this $7 dollar investment(retail CubicNinja) I made from amazon is worthless? Well folks all I can say that the ride was fun.. I guess I'll throw it away now. And the only reason I upgraded to 9.4 FW was because I wanted the Pikachu theme...

Oh well, folks carry on, just another passerby moving on.

well, CN *is* still the only public n3ds entrypoint so you know there's that...

 

[overlord00]

With the corrupt letters, where exactly did it get corrupted at? It could just be it freezing after ARM11 kernel entry in which case the success rate getting into ARM9 could be better (assuming that ARM9 doesn't present another set of difficulty getting in, although this one isn't as hard to mess up since it just patches functions directly).

I'm usually getting something like the top half of this:

Single letters every now and again.
The bottom half where the text is readable happens less often.
It appears to pass all the checks, but becomes corrupt for some reason and doesn't show the hex debug output. You mentioned something about an unstable stack, so maybe that?

 

[vingt-2]

So this $7 dollar investment(retail CubicNinja) I made from amazon is worthless? Well folks all I can say that the ride was fun.. I guess I'll throw it away now. And the only reason I upgraded to 9.4 FW was because I wanted the Pikachu theme...

Oh well, folks carry on, just another passerby moving on.

Is it Japanese ? Would you send it to me for the price of shipping a letter ?

 

[Myria]

We have no info on firmware 6.3 at the moment, so that would be helpful, and the one user who tested on 7.1 didn't really provide any information at all. Thank you for being willing to do so much to help out

7.1.0 is Majora's Mask, so that's trivial for us to get, provided we have a 3DS that doesn't have -9 as its online version due to a Ninjhax bug. I would have already tried 7.1.0-9U if Ninjhax worked on it.

 

[kelroy]

Do you have much experiencing developing for the 3DS? Or do you have any other experience coding/REing? If not that's OK, one thing that would be helpful would be if someone could deobfuscate gateway's laucher and make some notes on it (and Yifan's write-up) on on how it applies to N3DS, to make it easier when we get to that stage. Is that something you'd be interested in doing? Anyhow, thanks for you help!

I dont got so much experience. Just the things that i do in my carreer. I know to programing into java, c++, xml, web sockets...

But i want to learn, so if you need me to test. Learn articles or other things i want to start with all of it.

This weekend i gonna make the hardmod so i will be more usefull.

 

[JustPingo]

My brother own an old 6.1 3DS. I'm gonna ask him if I can try with my Gateway.

EDIT: Trying right now...
(can't find any emuNAND-free SD card, so it may take a some time xD)

 

[Zidapi]

I only tried it once, I should properly run it some more.

It occurred to me after I posted that you may have only run it once or twice.

I don't know why I didn't realise that immediately, it seems obvious in hindsight.

 

[PeepersCreepers]

Wow you guys have it pretty stable. I still don't know what this will do, but here are my results:

9.2 US New 3DS XL - 9/10 successes.

 

[julian20]

can i test it with a gateway card???