Hacking [WIP] open source Kernel access on 3DS

[173210]

I just now finished reading what yifan.lu said about the ARM9 Kernel exploit.
Quite the interesting read...

But it's pseudocode; easy to understand, but not enough to implement the exploit.

 

[williamcesar2]

aliak11 said ''StapleButter You could come help on OSKA''

No man Choose another person he has chosen KARL

 

[ody81]

StapleButter ''You could come help on OSKA'' no man Choose another person

Saaayy Whhhhaaat?

 

[WulfyStylez]

StapleButter ''You could come help on OSKA'' no man Choose another person

They're on the KARL team anyways.

 

[VinsCool]

Saaayy Whhhhaaat?

Useless post as he usually do. StapleButter asked if he could join KARL3DS team.

 

[williamcesar2]

Saaayy Whhhhaaat?

aliak11 said ''StapleButter You could come help on OSKA''

 

[173210]

I think we should make it easier for others to join the development.
GitHub has Pull-Request feature.
We can advertise developer who sent pull-request has a chance to join the development.

 

[pidoubt]

Hi,
Not sure that I will be around too long but just to keep you informed.

You don't need cubic ninja, zelda etc... to execute what you want.
I have actually (3) 3DS exploit that can be useful and help.

One use the browser (up to 9.5, including N3DS, doesn't include Jap one)
One use a redirection (up to 9.5 including N3DS, doesn't include Jap one)
One use Mii (up to 9.5 and even higher, including N3DS)
I'm ready to share the browser one but only in certain condition.

I'm not going to argue on a need of hardware or not but actually all the hardware available are software related.
To be honest, you don't need any hardware but just time to look around.

So.
Let me ask few stuff.
Anyone in here have a kind of unicode HW that use the N3DS entrypoint ?
Who know where it start and where it end ?
Can I trust someone in here to not share anything in public yet ?
I saw the OSKA N3DS offset, look like have a lot of missing piece right ?

I'm not going to talk about the locked alternative, since I don't care what people do with their product
Piracy or not, this is not my problem. So I don't think like them.

Helping Gateway 3DS to find a way is even worse, because you let them to make profit from piracy and sorry
to say that but this is clearly stupid.

Anyway, Don't pm me for nothing, don't ask me for the exploit, I will not share it yet until i'm sure that every entry point
work properly and wait a little to check If N fix the problem.

I need somebody that know exactly what is doing and can make something of it, not just somebody to test.
Let me know.

Thank you

 

[itsamario2015]

Exciting times for 3DS

 

[williamcesar2]

Hi,
Not sure that I will be around too long but just to keep you informed.

You don't need cubic ninja, zelda etc... to execute what you want.
I have actually (3) 3DS exploit that can be useful and help.

open 1 thread !! it sounds interesting

 

[Apache Thunder]

Yes, lets all get hyped and believe a guy who pops out of nowhere with only one post and been registered for less then a day who claims to have multiple entry points for the 3DS on 9.5...... ***End of Sarcasm***

 

[173210]

Hi,
Not sure that I will be around too long but just to keep you informed.

You don't need cubic ninja, zelda etc... to execute what you want.
I have actually (3) 3DS exploit that can be useful and help.

One use the browser (up to 9.5, including N3DS, doesn't include Jap one)
One use a redirection (up to 9.5 including N3DS, doesn't include Jap one)
One use Mii (up to 9.5 and even higher, including N3DS)
I'm ready to share the browser one but only in certain condition.

I'm not going to argue on a need of hardware or not but actually all the hardware available are software related.
To be honest, you don't need any hardware but just time to look around.

So.
Let me ask few stuff.
Anyone in here have a kind of unicode HW that use the N3DS entrypoint ?
Who know where it start and where it end ?
Can I trust someone in here to not share anything in public yet ?
I saw the OSKA N3DS offset, look like have a lot of missing piece right ?

I'm not going to talk about the locked alternative, since I don't care what people do with their product
Piracy or not, this is not my problem. So I don't think like them.

Helping Gateway 3DS to find a way is even worse, because you let them to make profit from piracy and sorry
to say that but this is clearly stupid.

Anyway, Don't pm me for nothing, don't ask me for the exploit, I will not share it yet until i'm sure that every entry point
work properly and wait a little to check If N fix the problem.

I need somebody that know exactly what is doing and can make something of it, not just somebody to test.
Let me know.

Thank you

Can you tell me what kind of the exploit is?
EDIT: Oh, it's an entry point. Well, wololo.net/talk has a system to utilize exploits. wololo wil help you.

 

[pidoubt]

I need to give some explanation to complet Yifan Lu research.
Here an example (Payload 4.0) and how to unicode one.
0x08B47400: 0x0010FFFD ; (nop) POP {PC} = \udb6c\u0010
0x08B47404: 0x0010FFFD ; (nop) POP {PC} = \udb6c\u0010
0x08B47408: 0x0010FFFD ; (nop) POP {PC} = \udb6c\u0010
0x08B4740C: 0x0010FFFD ; (nop) POP {PC} = \udb6c\u0010
0x08B47410: 0x002AD574 ; LDMFD SP!, {R0,PC}=\ud574\u002a

0x08B47430: 0x08B47630 ; R1 = L"dmc:/Launcher.dat" = \u7630\u08b4\

This is just an example but as you can see the unicode is inversed : 0x08B47630=763008B4
Now you know how to make your own unicode program.

I needed to add this information since Yifan Lu didn't show an example of how unicode work.

 

[pidoubt]

Yes, lets all get hyped and believe a guy who pops out of nowhere with only post and been registered for less then a day who claims to have multiple entry points for the 3DS on 9.5...... ***End of Sarcasm***

Well keep telling stuff like will not help you to know about the exploit.
So If you think like that, I guess bye bye.

 

[pidoubt]

Can you tell me what kind of the exploit is?

I said, I would not tell yet in public what it is exactly.
I already said what I use for it and that I worked on 3 of them.

 

[cearp]

Well keep telling stuff like will not help you to know about the exploit.
So If you think like that, I guess bye bye.

some people seem to think the higher the post count, the more exploits you have found...
good luck

 

[VinsCool]

Well keep telling stuff like will not help you to know about the exploit.
So If you think like that, I guess bye bye.

there was a lot of people claiming having exploits in the past, happening to be newcomers with 1 post (I'm looking at you needcash)
So his sarcasm was a bit understandable.

 

[overlord00]

With a slightly different approach than previous devs, and that this is open source, I ask this;

As someone who has watched this scene slowly grow and now with this development of truly open source materials, where does someone with coding experience - BUT, not with RE experience - go to start learning all of this stuff?

I've spoken to, and asked in various threads, but generally get shot down with these sorts of questions. It's mostly read more, which is fine, but doesn't give a good starting point. I am grateful to even get such replies.

Tools for decrypting the gateway launcher were posted here, which is awesome, but it gives a bunch of binary files which may contain useful information, but without some sort of other knowledge on how to read or parse the files, they are again of little use to me at this point in time.

I've read writeups from Yifan Lu and Smea which are actually quite insightful reads, and read the source provided by KARL (and now OSKA), but without the knowledge on how they got this sort of stuff from the gateway launcher (or otherwise), it's hard trying to learn how it was put together, or to build upon it.

I'm not asking to be spoon fed, or made as a part of a team, I'd just like to know some of the things that are not necessarily public knowledge relating to starting such a journey.
I hope that such a question isn't crazy, as I am just curious. Not trying to start anything, I just would like some knowledge.
Perhaps, I just don't have the moxie for 3ds development.

Thanks

POST SCRIPT:
I realise that some people (people like yellows8) had to figure out this sort of stuff themselves.

 

[pidoubt]

there was a lot of people claiming having exploits in the past, happening to be newcomers with 1 post (I'm looking at you needcash)
So his sarcasm was a bit understandable.

Fact : Nobody is perfect and we are all different.
Fact 2 : Better have one post than 1000 useless post ?
Fact 3 : Well I can have my point-of-view, I don't like sarcasm, even more when it come from people that don't know anything.
You can't judge a book by its cover.

 

[VinsCool]

Fact : Nobody is perfect and we are all different.
Fact 2 : Better have one post than 1000 useless post ?
Fact 3 : Well I can have my point-of-view, I don't like sarcasm, even more when it come from people that don't know anything.
You can't judge a book by its cover.

And I completely agree with you.
Do what you think is the best. Try contacting devs working on this project.