Hey all, here's some clarification. Ninjhax starts out by using a bug in the QR code reading/save reading to gain
ROP. This means they can execute through a premade stack to accomplish some stuff. To run actual code,
gspwn is used through ROP. This copies a payload from the end of the save payload to executable memory. Since ROP gives us stack access, we can then just branch to it.
Those two exploits (an entrypoint giving ROP, and gspwn to get actual code running) comprise an ARM11 userspace hack. Ninjhax additionally uses
rohax to gain control of the ro module, giving access to memory mapping syscalls. That's particularly important for loading homebrew apps, as they'll need their own memory mapped and won't always fit in Cubic Ninja's premapped section sizes and such. The ro module is then also tweaked to add a bunch of extra service calls ("the HB service").
Ninjhax
also uses gspwn and ROP to take over the browser and gain its permissions.
Beyond that, you need to get arm9 kernel access. On 4.5, this was actually done from userland. You could just register with srv
m and give yourself access to all services. From there, an overflow in the PXI command for VerifyRsaSha256 was used to get code exec in ARM9.
On versions 7.0 and above, this isn't possible. Instead, we use a combination of exploits.
memchunkhax lets you corrupt kernel memory and ultimately execute your own code in a kernel context. From there, you do
firmlaunch-hax by modifying the arm11-side reset handling code and triggering a reset. Proper implementation of that will cause ARM9 to start executing your code.
So, to be as clear as possible, versions things were patched on:
Entrypoints:
mset: 7.0 (can be downgraded and re-enabled, as we and roxas have done)
spider: 9.5.0-23 (can be downgraded too, but currently exploitable consoles already have an exploitable version so w/e)
Ocarina of Time: never
Cubic Ninja: never
Exploits:
srv
m registration: 7.0
VerifyRsaSha256 overflow: 5.0
--
gspwn: never (kinda difficult to patch without breaking compatability or ruining performance)
rohax: 9.3 (but this is only needed for homebrew)
memchunkhax: 9.3
firmlaunch-hax: 9.5
The gist of all this is: an ARM11 kernel exploit will support systems up to 9.4, and an ARM9 exploit on top of that will allow for any firmware. (An exploit in a PXI function that one of the entrypoints has access to would remove the need for the ARM11 kernel exploit, but finding one is highly unlikely.)
