Homebrew [WIP] Memchunkhax 2

Status
Not open for further replies.

julian20

Well-Known Member
OP
Member
Joined
Jan 10, 2015
Messages
352
Trophies
0
XP
648
Country
Germany
In the 32c3 derrek showed us a new ARM 11 Kernel exploit. It´s basically memchunkhax2. I started this thread to focus the new exploit. People in this forum who knows well about exploitation and want to make code to get ARM 11 Kernel code execution can help, so that this project will suceed.

Github Page: https://github.com/julian-20/Memchunkhax2

recording of the talk:


Supported firmwares: 10.3 and all lower firmwares, N3DS + O3DS

How does the exploit works:
The svc ControlMemory() can allocate and free memory pages in the FCRAM. Each memory region in the FCRAM has a memchunkheader. The memchunkheader contains the size of the memory region(in pages), a pointer to the previos free memory region and a pointer to the next free memory region. The svc ControlMemory() uses these headers.
The exploit(s) are the facts, that the memchunkheaders are stored in the FCRAM and a problem inside the ControlMemory() svc.
ControlMemory() maps the header to user-space before it reads the next pointer. In a small period of time, we can change the next pointer with the help of a second thread.
With the help of svcCreateAddressArbiter, we can check, that the next pointer is user-space accessable, because it returns an error if it´s not user-space accessable. So we can overwrite the next pointer, before it get reads by ControlMemory().
We use this possibility to let the next pointer points to AXI WRAM.
We need there also a memchunkheader for the ControlMemory(), but we can´t write there. So we use much KObjects, which are stored inside AXI WRAM. Than we write the size into one of the atributes and a pointer to itself. ControlMemory() will then map the kobjects to user-space. Now we are able to overwrite the *vtable(a pointer, which points to a list, which cointains a list with pointer pointing to virtual functions).

From here it´s only speculation:
Then we override the pointer to change one of the functions(as an example the destructor function). Then we call svc CloseHandler and "BOOM"

sry for my bad english
 
Last edited by julian20,

Otelo2

Member
Newcomer
Joined
Oct 7, 2015
Messages
24
Trophies
0
Age
53
XP
86
Country
Mexico
Off topic: Does someone know where I can find a recording of the stream? I just managed to watch the first part and silly computer ran out of battery
 

julian20

Well-Known Member
OP
Member
Joined
Jan 10, 2015
Messages
352
Trophies
0
XP
648
Country
Germany
What does exactly ARM11 Kernel allows? Will this also require additional hardware?
This exploits only needs arm 11 userland mode. With ARM11K you can nice things like title installing or downgrading. So you would be able to downgrade your 3ds/N3ds
 
  • Like
Reactions: Games&Stuff

julian20

Well-Known Member
OP
Member
Joined
Jan 10, 2015
Messages
352
Trophies
0
XP
648
Country
Germany
Sorry about my ignorance, but what exactly is Memchunkhax?
memchunkhax is an exploit by yellows8 which was fixed in version 9.3. Memchunkhax2 is basically the same, but it works also with the fix

--------------------- MERGED ---------------------------

what do I need for this? I have a n3dsxl on 10.3
You just need ARM11 userlandmode which the homebrewlauncher has
 

DarkRioru

reach for the stars
Member
Joined
Aug 29, 2015
Messages
2,114
Trophies
0
Age
25
Location
looking up at the stars
Website
steamcommunity.com
XP
1,872
Country
United States
memchunkhax is an exploit by yellows8 which was fixed in version 9.3. Memchunkhax2 is basically the same, but it works also with the fix

--------------------- MERGED ---------------------------


You just need ARM11 userlandmode which the homebrewlauncher has
I am waiting for the github page as we speak:creep:
 
  • Like
Reactions: The9thBit

Otelo2

Member
Newcomer
Joined
Oct 7, 2015
Messages
24
Trophies
0
Age
53
XP
86
Country
Mexico
I'm wishing for someone to upload derreks talk, inb4 it's not going to work at all
 
Status
Not open for further replies.

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Sicklyboy @ Sicklyboy: *teleports behind you* "Nothing personnel, kiddo"