Thread Status:
Not open for further replies.
  1. julian20

    OP julian20 GBAtemp Fan
    Member

    Joined:
    Jan 10, 2015
    Messages:
    352
    Country:
    Germany
    In the 32c3 derrek showed us a new ARM 11 Kernel exploit. It´s basically memchunkhax2. I started this thread to focus the new exploit. People in this forum who knows well about exploitation and want to make code to get ARM 11 Kernel code execution can help, so that this project will suceed.

    Github Page: https://github.com/julian-20/Memchunkhax2

    recording of the talk:


    Supported firmwares: 10.3 and all lower firmwares, N3DS + O3DS

    How does the exploit works:
    The svc ControlMemory() can allocate and free memory pages in the FCRAM. Each memory region in the FCRAM has a memchunkheader. The memchunkheader contains the size of the memory region(in pages), a pointer to the previos free memory region and a pointer to the next free memory region. The svc ControlMemory() uses these headers.
    The exploit(s) are the facts, that the memchunkheaders are stored in the FCRAM and a problem inside the ControlMemory() svc.
    ControlMemory() maps the header to user-space before it reads the next pointer. In a small period of time, we can change the next pointer with the help of a second thread.
    With the help of svcCreateAddressArbiter, we can check, that the next pointer is user-space accessable, because it returns an error if it´s not user-space accessable. So we can overwrite the next pointer, before it get reads by ControlMemory().
    We use this possibility to let the next pointer points to AXI WRAM.
    We need there also a memchunkheader for the ControlMemory(), but we can´t write there. So we use much KObjects, which are stored inside AXI WRAM. Than we write the size into one of the atributes and a pointer to itself. ControlMemory() will then map the kobjects to user-space. Now we are able to overwrite the *vtable(a pointer, which points to a list, which cointains a list with pointer pointing to virtual functions).

    From here it´s only speculation:
    Then we override the pointer to change one of the functions(as an example the destructor function). Then we call svc CloseHandler and "BOOM"

    sry for my bad english
     
    Last edited by julian20, Dec 28, 2015
  2. TLOZmaster

    TLOZmaster GBAtemp Fan
    Member

    Joined:
    Feb 21, 2015
    Messages:
    330
    Country:
    United States
    So a community kexploit? Kind of? xD
     
  3. julian20

    OP julian20 GBAtemp Fan
    Member

    Joined:
    Jan 10, 2015
    Messages:
    352
    Country:
    Germany
    Not really community. Only a few people here now how expoiting works(i was earlier also a noob, now i am much better. I am now also able to create exploiting code)
     
    Coleman_C18 and TLOZmaster like this.
  4. Otelo2

    Otelo2 Member
    Newcomer

    Joined:
    Oct 7, 2015
    Messages:
    24
    Country:
    Mexico
    Off topic: Does someone know where I can find a recording of the stream? I just managed to watch the first part and silly computer ran out of battery
     
  5. Josephvb10

    Josephvb10 GBAtemp Advanced Fan
    Member

    Joined:
    Aug 26, 2009
    Messages:
    650
    Country:
    Costa Rica
    What does exactly ARM11 Kernel allows? Will this also require additional hardware?
     
    The9thBit likes this.
  6. Naked_Snake

    Naked_Snake Constant Miscreant
    Member

    Joined:
    Oct 6, 2013
    Messages:
    1,757
    Country:
    Australia
    is this even possible? be pretty awesome if so
     
  7. julian20

    OP julian20 GBAtemp Fan
    Member

    Joined:
    Jan 10, 2015
    Messages:
    352
    Country:
    Germany
    This exploits only needs arm 11 userland mode. With ARM11K you can nice things like title installing or downgrading. So you would be able to downgrade your 3ds/N3ds
     
    Games&Stuff likes this.
  8. thaikhoa

    thaikhoa GBAtemp Addict
    Member

    Joined:
    Sep 16, 2008
    Messages:
    2,143
    Country:
    Australia
    NTR CFW.
     
  9. TLOZmaster

    TLOZmaster GBAtemp Fan
    Member

    Joined:
    Feb 21, 2015
    Messages:
    330
    Country:
    United States
    ARM11 will add us downgrading, without a backup nand. In theroy, this will also give us ARM9, IIRC.
     
    Last edited by TLOZmaster, Dec 28, 2015
    Games&Stuff likes this.
  10. ShadowOne333

    ShadowOne333 QVID PRO QVO
    Member

    Joined:
    Jan 17, 2013
    Messages:
    10,082
    Country:
    Mexico
    Sorry about my ignorance, but what exactly is Memchunkhax?
     
    Games&Stuff likes this.
  11. julian20

    OP julian20 GBAtemp Fan
    Member

    Joined:
    Jan 10, 2015
    Messages:
    352
    Country:
    Germany
    Yeah we got information about this exploit from derrek.
     
  12. DarkRioru

    DarkRioru reach for the stars
    Member

    Joined:
    Aug 29, 2015
    Messages:
    2,104
    Country:
    United States
    what do I need for this? I have a n3dsxl on 10.3
     
  13. julian20

    OP julian20 GBAtemp Fan
    Member

    Joined:
    Jan 10, 2015
    Messages:
    352
    Country:
    Germany
    memchunkhax is an exploit by yellows8 which was fixed in version 9.3. Memchunkhax2 is basically the same, but it works also with the fix

    — Posts automatically merged - Please don't double post! —

    You just need ARM11 userlandmode which the homebrewlauncher has
     
  14. ac3ds

    ac3ds PlayStation Addict
    Member

    Joined:
    Sep 2, 2015
    Messages:
    169
    Country:
    United States
    inb4!11!11!!!
    Sorry had to but this would be really nice for the 9.3+ users. Hopefully it works on the N3DS.
     
    The9thBit likes this.
  15. DarkRioru

    DarkRioru reach for the stars
    Member

    Joined:
    Aug 29, 2015
    Messages:
    2,104
    Country:
    United States
    I am waiting for the github page as we speak:creep:
     
    The9thBit likes this.
  16. julian20

    OP julian20 GBAtemp Fan
    Member

    Joined:
    Jan 10, 2015
    Messages:
    352
    Country:
    Germany
    Check, but there is nothing inside at the moment
     
  17. Otelo2

    Otelo2 Member
    Newcomer

    Joined:
    Oct 7, 2015
    Messages:
    24
    Country:
    Mexico
    I'm wishing for someone to upload derreks talk, inb4 it's not going to work at all
     
  18. mungry

    mungry GBAtemp Fan
    Member

    Joined:
    Jul 29, 2015
    Messages:
    322
    Country:
    United States
  19. julian20

    OP julian20 GBAtemp Fan
    Member

    Joined:
    Jan 10, 2015
    Messages:
    352
    Country:
    Germany
    mungry likes this.
  20. dankzegriefer

    dankzegriefer Banned
    Banned

    Joined:
    Aug 19, 2015
    Messages:
    896
    Country:
    United States
    I thought the hax was done tho.
     
Loading...

Hide similar threads Similar threads with keywords - Memchunkhax, [WIP],

Thread Status:
Not open for further replies.