3dbrew - User contributions [en]

Talk:3DSExplorer

2011-10-09T19:11:19Z

Kiddyshaq34:

Now I figured that I didn't explain the target of this app... It's suppose to be an Explorer like program to see inside the different filesystems that the 3ds has. Now it's the ExeFS, RomFS and SAVE. As knownledge keep flowing i'll continue to develop the application. With the goal of making a full functional drag&drop file explorer for image files. --[[User:Elisherer|Elisherer]] 18:35, 15 September 2011 (CEST)

It fails showing the tmd file content. Have you finshed working on this feature?--[[User:Lazymarek9614|Lazymarek9614]] 15:49, 20 September 2011 (CEST)
:No, I don't have time to work on it..it's not interesting enough --[[User:Elisherer|Elisherer]] 15:36, 21 September 2011 (CEST)
::Yeah, the 3DS doesn't care when the tmd file was modified... it's not useful for hacking.--[[User:Lazymarek9614|Lazymarek9614]] 21:09, 21 September 2011 (CEST)

I downloaded the sources,but I can't find Save.cs and reference "System.Development". Matyapiro31
:You are right... I fixed it.. notice that the source is not the released version it has some experimental stuff in it... --[[User:Elisherer|Elisherer]] 10:53, 30 September 2011 (CEST)

Do you know [http://monodevelop.com/ Mono Develop]?
You can release it as multi-patform,such as Linux,Machitosh,etc.
:I did not know that until now. But I don't have time to make the transition. I'm happy with VS2008 and it's relatively easy to make changes and new features for the app. The source is open and you can make a linux port if you want. --[[User:Elisherer|Elisherer]] 18:16, 30 September 2011 (CEST)
:You need no change.mono can run c# program like Java VM. Matyapiro31
::I tried to compile it,but That was old one,and there is "System.development."
:::[http://stackoverflow.com/questions/5865060/c-on-os-x-and-linux This] says that I need to fix stuff after I convert my project. and then work with the mono app which I don't find very convinient... and about the reference I don't know what it's about..I don't know a namespace called System.Development --[[User:Elisherer|Elisherer]] 17:42, 2 October 2011 (CEST) (P.s you can sign your messages with the quick signature button or 4 tildes: '~' 4 times)

lblBrew_Click() had no exception handler,

you have to change this method in fmExplorer.cs to
private void lblBrew_Click(object sender, EventArgs e)
{
try
{
System.Diagnostics.Process.Start(lblBrew.Text);
}
catch (Exception ex)
{
MessageBox.Show("Cannot open link that was clicled.\n"+ ex.Message);
}
}

Matyapiro31

The algorithm for the Image Hash might be either MD2 or MD4. I found out by using HxD and Notepad. --[[User:Kiddyshaq34|Kiddyshaq34]]
:Ok, but of what? (i know it's suppose to be 128 bit) And why not MD-5? --[[User:Elisherer|Elisherer]] 07:10, 9 October 2011 (CEST)
::Because MD5 is longer and the Image Hash has the same number of bytes as MD2 and MD4.
:::MD2, 4 & 5 are all 128bit which is 0x10 bytes... --[[User:Elisherer|Elisherer]] 20:28, 9 October 2011 (CEST)
::::Oh, I've forgotten about MD5. You are right.

3DS include RSA Securuty 's [http://www.rsa.com/node.aspx?id=1204 BSafe]

from 3DS manual. Matyapiro31
:Thanks Matyapiro31 but I think RSA is used for encryption and *not* hashing. So the RSA might be used for ROMs and WiFi... --[[User:Elisherer|Elisherer]] 14:48, 9 October 2011 (CEST)

Talk:3DSExplorer

2011-10-09T14:55:04Z

Kiddyshaq34: one more thing.

Now I figured that I didn't explain the target of this app... It's suppose to be an Explorer like program to see inside the different filesystems that the 3ds has. Now it's the ExeFS, RomFS and SAVE. As knownledge keep flowing i'll continue to develop the application. With the goal of making a full functional drag&drop file explorer for image files. --[[User:Elisherer|Elisherer]] 18:35, 15 September 2011 (CEST)

It fails showing the tmd file content. Have you finshed working on this feature?--[[User:Lazymarek9614|Lazymarek9614]] 15:49, 20 September 2011 (CEST)
:No, I don't have time to work on it..it's not interesting enough --[[User:Elisherer|Elisherer]] 15:36, 21 September 2011 (CEST)
::Yeah, the 3DS doesn't care when the tmd file was modified... it's not useful for hacking.--[[User:Lazymarek9614|Lazymarek9614]] 21:09, 21 September 2011 (CEST)

I downloaded the sources,but I can't find Save.cs and reference "System.Development". Matyapiro31
:You are right... I fixed it.. notice that the source is not the released version it has some experimental stuff in it... --[[User:Elisherer|Elisherer]] 10:53, 30 September 2011 (CEST)

Do you know [http://monodevelop.com/ Mono Develop]?
You can release it as multi-patform,such as Linux,Machitosh,etc.
:I did not know that until now. But I don't have time to make the transition. I'm happy with VS2008 and it's relatively easy to make changes and new features for the app. The source is open and you can make a linux port if you want. --[[User:Elisherer|Elisherer]] 18:16, 30 September 2011 (CEST)
:You need no change.mono can run c# program like Java VM. Matyapiro31
::I tried to compile it,but That was old one,and there is "System.development."
:::[http://stackoverflow.com/questions/5865060/c-on-os-x-and-linux This] says that I need to fix stuff after I convert my project. and then work with the mono app which I don't find very convinient... and about the reference I don't know what it's about..I don't know a namespace called System.Development --[[User:Elisherer|Elisherer]] 17:42, 2 October 2011 (CEST) (P.s you can sign your messages with the quick signature button or 4 tildes: '~' 4 times)

lblBrew_Click() had no exception handler,

you have to change this method in fmExplorer.cs to
private void lblBrew_Click(object sender, EventArgs e)
{
try
{
System.Diagnostics.Process.Start(lblBrew.Text);
}
catch (Exception ex)
{
MessageBox.Show("Cannot open link that was clicled.\n"+ ex.Message);
}
}

Matyapiro31

The algorithm for the Image Hash might be either MD2 or MD4. I found out by using HxD and Notepad. --[[User:Kiddyshaq34|Kiddyshaq34]]
:Ok, but of what? (i know it's suppose to be 128 bit) And why not MD-5? --[[User:Elisherer|Elisherer]] 07:10, 9 October 2011 (CEST)
::Because MD5 is longer and the Image Hash has the same number of bytes as MD2 and MD4.

3DS include RSA Securuty 's [http://www.rsa.com/node.aspx?id=1204 BSafe]

from 3DS manual. Matyapiro31
:Thanks Matyapiro31 but I think RSA is used for encryption and *not* hashing. So the RSA might be used for ROMs and WiFi... --[[User:Elisherer|Elisherer]] 14:48, 9 October 2011 (CEST)

Talk:3DSExplorer

2011-10-09T14:51:30Z

Kiddyshaq34:

Now I figured that I didn't explain the target of this app... It's suppose to be an Explorer like program to see inside the different filesystems that the 3ds has. Now it's the ExeFS, RomFS and SAVE. As knownledge keep flowing i'll continue to develop the application. With the goal of making a full functional drag&drop file explorer for image files. --[[User:Elisherer|Elisherer]] 18:35, 15 September 2011 (CEST)

It fails showing the tmd file content. Have you finshed working on this feature?--[[User:Lazymarek9614|Lazymarek9614]] 15:49, 20 September 2011 (CEST)
:No, I don't have time to work on it..it's not interesting enough --[[User:Elisherer|Elisherer]] 15:36, 21 September 2011 (CEST)
::Yeah, the 3DS doesn't care when the tmd file was modified... it's not useful for hacking.--[[User:Lazymarek9614|Lazymarek9614]] 21:09, 21 September 2011 (CEST)

I downloaded the sources,but I can't find Save.cs and reference "System.Development". Matyapiro31
:You are right... I fixed it.. notice that the source is not the released version it has some experimental stuff in it... --[[User:Elisherer|Elisherer]] 10:53, 30 September 2011 (CEST)

Do you know [http://monodevelop.com/ Mono Develop]?
You can release it as multi-patform,such as Linux,Machitosh,etc.
:I did not know that until now. But I don't have time to make the transition. I'm happy with VS2008 and it's relatively easy to make changes and new features for the app. The source is open and you can make a linux port if you want. --[[User:Elisherer|Elisherer]] 18:16, 30 September 2011 (CEST)
:You need no change.mono can run c# program like Java VM. Matyapiro31
::I tried to compile it,but That was old one,and there is "System.development."
:::[http://stackoverflow.com/questions/5865060/c-on-os-x-and-linux This] says that I need to fix stuff after I convert my project. and then work with the mono app which I don't find very convinient... and about the reference I don't know what it's about..I don't know a namespace called System.Development --[[User:Elisherer|Elisherer]] 17:42, 2 October 2011 (CEST) (P.s you can sign your messages with the quick signature button or 4 tildes: '~' 4 times)

lblBrew_Click() had no exception handler,

you have to change this method in fmExplorer.cs to
private void lblBrew_Click(object sender, EventArgs e)
{
try
{
System.Diagnostics.Process.Start(lblBrew.Text);
}
catch (Exception ex)
{
MessageBox.Show("Cannot open link that was clicled.\n"+ ex.Message);
}
}

Matyapiro31

The algorithm for the Image Hash might be either MD2 or MD4. I found out by using HxD and Notepad. --[[User:Kiddyshaq34|Kiddyshaq34]]
:Ok, but of what? (i know it's suppose to be 128 bit) And why not MD-5? --[[User:Elisherer|Elisherer]] 07:10, 9 October 2011 (CEST)
::Because MD5 is longer.

3DS include RSA Securuty 's [http://www.rsa.com/node.aspx?id=1204 BSafe]

from 3DS manual. Matyapiro31
:Thanks Matyapiro31 but I think RSA is used for encryption and *not* hashing. So the RSA might be used for ROMs and WiFi... --[[User:Elisherer|Elisherer]] 14:48, 9 October 2011 (CEST)

Talk:3DSExplorer

2011-10-08T20:09:31Z

Kiddyshaq34: The image hash might be MD2. It might be MD4.

Talk:3DSExplorer

2011-10-08T19:29:57Z

Kiddyshaq34:

Now I figured that I didn't explain the target of this app... It's suppose to be an Explorer like program to see inside the different filesystems that the 3ds has. Now it's the ExeFS, RomFS and SAVE. As knownledge keep flowing i'll continue to develop the application. With the goal of making a full functional drag&drop file explorer for image files. --[[User:Elisherer|Elisherer]] 18:35, 15 September 2011 (CEST)

It fails showing the tmd file content. Have you finshed working on this feature?--[[User:Lazymarek9614|Lazymarek9614]] 15:49, 20 September 2011 (CEST)
:No, I don't have time to work on it..it's not interesting enough --[[User:Elisherer|Elisherer]] 15:36, 21 September 2011 (CEST)
::Yeah, the 3DS doesn't care when the tmd file was modified... it's not useful for hacking.--[[User:Lazymarek9614|Lazymarek9614]] 21:09, 21 September 2011 (CEST)

I downloaded the sources,but I can't find Save.cs and reference "System.Development". Matyapiro31
:You are right... I fixed it.. notice that the source is not the released version it has some experimental stuff in it... --[[User:Elisherer|Elisherer]] 10:53, 30 September 2011 (CEST)

Do you know [http://monodevelop.com/ Mono Develop]?
You can release it as multi-patform,such as Linux,Machitosh,etc.
:I did not know that until now. But I don't have time to make the transition. I'm happy with VS2008 and it's relatively easy to make changes and new features for the app. The source is open and you can make a linux port if you want. --[[User:Elisherer|Elisherer]] 18:16, 30 September 2011 (CEST)
:You need no change.mono can run c# program like Java VM. Matyapiro31
::I tried to compile it,but That was old one,and there is "System.development."
:::[http://stackoverflow.com/questions/5865060/c-on-os-x-and-linux This] says that I need to fix stuff after I convert my project. and then work with the mono app which I don't find very convinient... and about the reference I don't know what it's about..I don't know a namespace called System.Development --[[User:Elisherer|Elisherer]] 17:42, 2 October 2011 (CEST) (P.s you can sign your messages with the quick signature button or 4 tildes: '~' 4 times)

lblBrew_Click() had no exception handler,

you have to change this method in fmExplorer.cs to
private void lblBrew_Click(object sender, EventArgs e)
{
try
{
System.Diagnostics.Process.Start(lblBrew.Text);
}
catch (Exception ex)
{
MessageBox.Show("Cannot open link that was clicled.\n"+ ex.Message);
}
}

Matyapiro31

The algorithm for the Image Hash is MD-2. I found out by using HxD and Notepad. --[[User:Kiddyshaq34|Kiddyshaq34]]

Talk:News

2011-09-16T16:33:31Z

Kiddyshaq34:

Is the defective by designs campaign really relevant to 3dbrew? Should it really be on the news page? --[[User:Matthew|Matthew]] 06:27, 13 May 2011 (CEST)

I believe so. Homebrew appears to be a primary target of the Nintendo 3DS EULA and any bricking efforts Nintendo may implement.--[[User:Winmaster|Winmaster]] 17:29, 13 May 2011 (CEST)

It shouldn't be there. This wiki is for cataloging up to date knowledge about the 3ds hardware/software and any development efforts. It is not a bulletin board or a place to solicitate anything - even if its related to the 3DS platform.

It's also myth and wrong/misinformation. Another reason we shouldn't be hosting or "spreading" it.

The only argument I've read about that was referencing a statement in the user manual that says something about "interruption of service". There's a service associated with the 3ds. How do you think you get your updates and notifications. Apparently someone believed it meant they're going to "brick" your 3ds. Don't believe everything you come across plz. Do your own homework and check for it up yourself.

Don't spread misinformation if you don't know either.

I feel sorry for the one getting those paper bricks ( if the page isn't shut down first ) because he's not responsible for some kid misreading their user manual elsewhere in the world or the lame trends they started, instead of asking somebody else that would have known better. Someone studying law maybe. Not like gbatemp/wiki I guess. >_>

[[User:Jl12|Jl12]] 20:39, 14 May 2011 (CEST)

What about crown3ds? Is it a fake?--[[User:Lazymarek9614|Lazymarek9614]] 19:30, 16 September 2011 (CEST)

Why would it be a fake? Crown3DS's website is 50% finished. Fake flashcards never let you know when their website will be completed. --[[User:Kiddyshaq34|Kiddyshaq34]] 19:36, 16 September 2011 (BST)

Talk:News

2011-09-16T16:31:38Z

Kiddyshaq34:

Talk:Homebrew Format

2011-09-15T19:47:38Z

Kiddyshaq34:

It might be a bit early, but I think we can plan the homebrew format for the 3DS now.

Here we can discuss and plan the format (e.g:)
*file extension (.3ds?)
*structure of the format
:*header, banner (icon, 3d model, description...)
:*header and executable areas
...and so on.

I think we should make it similar to the CXI format, that flashcards can run both: commercial and homebrew files.--[[User:Lazymarek9614|Lazymarek9614]] 16:17, 11 September 2011 (CEST)

According to the decisions here I create a tool to create homebrew (3dstool?).--[[User:Lazymarek9614|Lazymarek9614]] 17:13, 11 September 2011 (CEST)
:Do you have any experience in making such files and tool? --[[User:Elisherer|Elisherer]] 19:02, 11 September 2011 (CEST)

::Well, I know about the elf, afx, bmp, 3ds, obj, nds format. I also have read the sources of tools like ndstool (used for creating nds files).

::Let's discuss the format!--[[User:Lazymarek9614|Lazymarek9614]] 19:33, 11 September 2011 (CEST)
:::Ok, i just wanted to know if it's somebody who knows what he talks about, You could never know... I was wondering, because I watch this wiki a lot maybe we wanna make this discussion on another forum like gbatemp so it won't notify us for every post. Because these wiki pages weren't made for big discussions, just on stuff that we aren't sure about... --[[User:Elisherer|Elisherer]] 20:04, 11 September 2011 (CEST)

:::Wouldn't we just use CXI or CCI? I don't see why we'd need to make a new format. Any flash carts made for the 3DS would boot files in the CXI or CCI format, since that's the format commercial ROM images use, and the primary goal of flash carts is to boot commercial pirated content (unfortunately). CXI is also the 3DS's native format, and has space reserved for code, the banner, etc. Not trying to be rude, but I don't think we need to make a new format for 3DS homebrew, or really discuss it for that matter. And we're spamming the crap out of the changelog, so... --[[User:CHR15x94|CHR15x94]] 21:00, 11 September 2011 (CEST)

:::.3ds is used as 3DCG file extension.I want homebrew like linux application. License would be GPL.we could update automatically via spot pass! --Matyapiro31
::::I Agree. it's imprtant that the format would be GPL because otherwise we will be called outlaws...the Wii's homebrew channel clearly was legal. We need to use a wrapper structure (like the CXI) to have an icon, 3d model (based on an existing one) & data (elf binary file). we can add stuff like structure version for future extensions... --[[User:Elisherer|Elisherer]] 08:30, 12 September 2011 (CEST)
:::::We can't deside that the person who make the first homebrew loader can deside that because if you have a format that nobody can lunch nobody will use it. I think the first will be an elf loader because you can just copy the code for loading the elf and lunching it. (http://en.wikipedia.org/wiki/Executable_and_Linking_Format) --[[User:ichfly|ichfly]]
:::::: "I Agree. it's imprtant that the format would be GPL because otherwise we will be called outlaws..." What? Nintendo's .srl/.nds format is used for DS(i) homebrew as well, and many other hb formats... --[[User:Yellows8|Yellows8]] 19:40, 12 September 2011 (CEST)

OK, to summarize the hole thing a bit:

*we have to think about a legal file extension (not .3ds!) and its GPL license
*the homebrew format will have a structure similar to CXI
*elf binary file for the executable area

What about the encryptions made in the CXI file? Will our format encrypted too and what about the model, icon and executable data, are those only file formats like obj /3ds, bmp and elf saved in the homebrew file?

I will start coding the "3ds homebrew tool" soon and publish it on my dropbox folder.
@[[User:ichfly|ichfly]]: The first loader will be sure an elf loader, but for the programmer made this loader it wouldn't be much of work to launch an executble area in the homebrew format (so far it will contain an elf).

Maybe we could use elf as-is and add the media stuff at the end. (every thing has offset so it wont clash with other elf loaders). we can also use the SHT_NOTE section to add the offset to the media_struct.. [http://www.skyfree.org/linux/references/ELF_Format.pdf Elf Format] --[[User:Elisherer|Elisherer]] 16:24, 12 September 2011 (CEST)

Don't waste your time writing a "3ds homebrew tool". Don't be concerned about the hb format, the people who write the first hax decide that. "What about the encryptions made in the CXI file?" CXI supports cleartext *FS etc, no need to encrypt those for a hb format. --[[User:Yellows8|Yellows8]] 19:40, 12 September 2011 (CEST)

:Do you think writing a hack would be more useful, [[User:Yellows8|Yellows8]]? However, before we can run hacks we have to find an exploit. Also writing a hack is complicated (for example we now zero about the GPU). What is your plan? @[[User:Elisherer|Elisherer]]: the link "[http://www.skyfree.org/linux/references/ELF_Format.pdf Elf Format]" seems to be dead.--[[User:Lazymarek9614|Lazymarek9614]] 20:35, 12 September 2011 (CEST)
::Sorry...fixed both links.. --[[User:Elisherer|Elisherer]] 20:51, 12 September 2011 (CEST)
:::"Do you think writing a hack would be more useful" Sure. "for example we now zero about the GPU" Homebrew doesn't *have* to use the PICA200 IMO, unless ds-mode gfx is disabled in 3ds-mode. "What is your plan?" Well, what I'm doing ATM is working on DSi stuff while waiting for someone to get a ramhax rig going, then RE 3DS code once that's possible. --[[User:Yellows8|Yellows8]] 21:45, 12 September 2011 (CEST)

::we must use UTF-8 and universal true type font.Various language can be expressed.

::x3d is not standard,I know...
3ds,stl are used almost softwares,so we can use more resources.
Matyapiro31

::I think we should give the homebrew format the .n3ds extension since I don't think it's used by any application. --[[User:Kiddyshaq34|Kiddyshaq34]]

Talk:Homebrew Format

2011-09-14T19:25:03Z

Kiddyshaq34:

Trash:Talk:Internet Browser

2011-09-13T17:12:32Z

Kiddyshaq34:

I have created a simple page that when opened in the browser freezes the 3DS system. I assume that too much memory is allocated to the JavaScript engine. This freeze can only be fixed by turning the system off and on again, but the communication switch works during this freeze. This is the page: https://dl-web.dropbox.com/get/Public/alerttest.html?w=88d076e5 [[User:R4wrz0rz0r|R4wrz0rz0r]] 14:57, 20 June 2011 (CEST)
I cannot access your page.you should make a public link from dropbox menu.

Sorry, I thought putting it in the Public folder would just make it work: http://dl.dropbox.com/u/18757478/alerttest.html [[User:R4wrz0rz0r|R4wrz0rz0r]] 00:56, 21 June 2011 (CEST)
Here's a shortened link: http://tinyurl.com/4x4u69o [[User:Kiddyshaq34|Kiddyshaq34]]

I think it is not so easy because this browser using Apple Webkit.

I don't think this is exploitable in any way. To me, seems more like NULL pointer dereferencing. Here's my full theory, may be wrong tho:
* the Javascript engine doesn't allocate memory for strings that are too long, but still keeps track of their length. (try generating a 2^31 characters long string, alert()'ing it shows an empty alert, however its length returns the expected value)
* such strings point to NULL instead of pointing to a memory buffer with characters. Their size is checked before trying to read them to display them in an alert.
* now, if you generate a 2^32 string, the length of the string is 0x100000000 characters. This value gets cut off to zero because it doesn't fit in a 32bit integer. Therefore the length property of the string is zero.
* when trying to alert() this string, the security check described above does infact "0 < maxlength", so the string is considered short enough to be displayed. However, since it was made from strings being already too large, its pointer is NULL.
* the browser tries to read from NULL, causing an exception. Probably said exception would trigger special stuff on dev/debug units, but was set to just enter an endless loop on retail units.

Long story short, nothing gets overwritten. Just an attempt at using a NULL pointer. This is only a theory though, I may be wrong. --[[User:Luigi2us|Luigi2us]] 01:40, 13 August 2011 (CEST)

It seems to be not exploitable, I have tried to write some NOPs into memory after the 'exploit' code and it doesn't seem to work.--[[User:Lazymarek9614|Lazymarek9614]] 18:37, 11 September 2011 (CEST)

Well I have seen a Google Chrome exploit that uses a null pointer. It executes the nopsled and the shellcode so that it generates an exception.
I think that if you try that exploit on Chrome on your computer, it still works(I tried it on version 15.0.865.1000 with sandbox disabled, and it generated an exception(a few times). So I think that's a sign that Google and the Chromium team still haven't fixed the exploit yet, but my antivirus detects it). But what I said might be wrong and misleading. And sometimes null pointer dereferencing can be exploitable if you try and think harder. --[[User:Kiddyshaq34|Kiddyshaq34]] 22:00, 03 September 2011 (GMT)

I am not sure if this is any help, but browsing to this page http://bit.ly/qV82en in the 3DS browser, causes the page to take an age to load... (around 5 mins), when the page does finally load you can see dots,
scrolling down a few times till you see symbols instead of dots, then tapping the lower screen causes a load of pop unders.
I had tried other Android based exploits, that were all thrown out (page to big errors), but this one seems different.
viewing some pop unders (ones with target like icons) cause some to close and more to open...

The exploit used can be seen here... http://www.exploit-db.com/exploits/16974/ --[[User:Madshaun1984|Madshaun1984]] 23:27, 01 September 2011 (GMT)
I've got a link if anyone wants to try it out: http://db.tt/D3hmZJE --[[User:Kiddyshaq34|Kiddyshaq34]] 23:19, 02 September 2011 (GMT)

Not to mention, the 3DS hardware is surely a lot different from Android/phones. Scriptkiddyish attempts like running Android exploits on a 3DS will not work. --[[User:Luigi2us|Luigi2us]] 15:35, 2 September 2011 (CEST)

That Android shellcode is crap for the 3DS. Also the memory map should be different. BTW: How can we find out the memory map like ROM area, display memory, ... ? --[[User:Lazymarek9614|Lazymarek9614]] 20:00, 2 September 2011 (CEST)

The webkit has a lot of android based code in it... therefore it is not unreasonable to think that maybe (just maybe) and android based exploit would have an effect on the 3DS. My assumptions werent just based on the browsers webkit either... what other platforms do you know that run on arm cpu's and use the .APP file extension? Then theres the whole QR code compatibility, that seems all to similar to pre-existing android software... Now dont get me wrong im not suggesting that the 3DS is running android, but it seems to be some sort of hybrid that has some compatibility with android, of course my assumptions and theory's could be well off... but i'll leave it to you to prove me wrong. --[[User:Madshaun1984|Madshaun1984]] 19:02, 02 September 2011 (GMT)

And again a boring way freeze the web browser:
http://dl.dropbox.com/u/41173070/3ds_web_browser_freeze_click.html --[[User:Lazymarek9614|Lazymarek9614]] 18:03, 13 September 2011 (CEST)
Here's a shortened link: http://tinyurl.com/6enaawc --[[User:Kiddyshaq34|Kiddyshaq34]] 20:15, 13 September 2011 (BST)

Trash:Talk:Internet Browser

2011-09-03T19:07:27Z

Kiddyshaq34:

I have created a simple page that when opened in the browser freezes the 3DS system. I assume that too much memory is allocated to the JavaScript engine. This freeze can only be fixed by turning the system off and on again, but the communication switch works during this freeze. This is the page: https://dl-web.dropbox.com/get/Public/alerttest.html?w=88d076e5 [[User:R4wrz0rz0r|R4wrz0rz0r]] 14:57, 20 June 2011 (CEST)
I cannot access your page.you should make a public link from dropbox menu.

Sorry, I thought putting it in the Public folder would just make it work: http://dl.dropbox.com/u/18757478/alerttest.html [[User:R4wrz0rz0r|R4wrz0rz0r]] 00:56, 21 June 2011 (CEST)
Here's a shortened link: http://tinyurl.com/4x4u69o [[User:Kiddyshaq34|Kiddyshaq34]]

I think it is not so easy because this browser using Apple Webkit.

I don't think this is exploitable in any way. To me, seems more like NULL pointer dereferencing. Here's my full theory, may be wrong tho:
* the Javascript engine doesn't allocate memory for strings that are too long, but still keeps track of their length. (try generating a 2^31 characters long string, alert()'ing it shows an empty alert, however its length returns the expected value)
* such strings point to NULL instead of pointing to a memory buffer with characters. Their size is checked before trying to read them to display them in an alert.
* now, if you generate a 2^32 string, the length of the string is 0x100000000 characters. This value gets cut off to zero because it doesn't fit in a 32bit integer. Therefore the length property of the string is zero.
* when trying to alert() this string, the security check described above does infact "0 < maxlength", so the string is considered short enough to be displayed. However, since it was made from strings being already too large, its pointer is NULL.
* the browser tries to read from NULL, causing an exception. Probably said exception would trigger special stuff on dev/debug units, but was set to just enter an endless loop on retail units.

Long story short, nothing gets overwritten. Just an attempt at using a NULL pointer. This is only a theory though, I may be wrong. --[[User:Luigi2us|Luigi2us]] 01:40, 13 August 2011 (CEST)

Well I have seen a Google Chrome exploit that uses a null pointer. It executes the nopsled and the shellcode so that it generates an exception.
I think that if you try that exploit on Chrome on your computer, it still works(I tried it on version 15.0.865.1000 with sandbox disabled, and it generated an exception(a few times). So I think that's a sign that Google and the Chromium team still haven't fixed the exploit yet, but my antivirus detects it). But what I said might be wrong and misleading. And sometimes null pointer dereferencing can be exploitable if you try and think harder. --[[User:Kiddyshaq34|Kiddyshaq34]] 22:00, 03 September 2011 (GMT)

I am not sure if this is any help, but browsing to this page http://bit.ly/qV82en in the 3DS browser, causes the page to take an age to load... (around 5 mins), when the page does finally load you can see dots,
scrolling down a few times till you see symbols instead of dots, then tapping the lower screen causes a load of pop unders.
I had tried other Android based exploits, that were all thrown out (page to big errors), but this one seems different.
viewing some pop unders (ones with target like icons) cause some to close and more to open...

The exploit used can be seen here... http://www.exploit-db.com/exploits/16974/ --[[User:Madshaun1984|Madshaun1984]] 23:27, 01 September 2011 (GMT)
I've got a link if anyone wants to try it out: http://db.tt/D3hmZJE --[[User:Kiddyshaq34|Kiddyshaq34]] 23:19, 02 September 2011 (GMT)

Not to mention, the 3DS hardware is surely a lot different from Android/phones. Scriptkiddyish attempts like running Android exploits on a 3DS will not work. --[[User:Luigi2us|Luigi2us]] 15:35, 2 September 2011 (CEST)

That Android shellcode is crap for the 3DS. Also the memory map should be different. BTW: How can we find out the memory map like ROM area, display memory, ... ? --[[User:Lazymarek9614|Lazymarek9614]] 20:00, 2 September 2011 (CEST)

The webkit has a lot of android based code in it... therefore it is not unreasonable to think that maybe (just maybe) and android based exploit would have an effect on the 3DS. My assumptions werent just based on the browsers webkit either... what other platforms do you know that run on arm cpu's and use the .APP file extension? Then theres the whole QR code compatibility, that seems all to similar to pre-existing android software... Now dont get me wrong im not suggesting that the 3DS is running android, but it seems to be some sort of hybrid that has some compatibility with android, of course my assumptions and theory's could be well off... but i'll leave it to you to prove me wrong. --[[User:Madshaun1984|Madshaun1984]] 19:02, 02 September 2011 (GMT)

Trash:Talk:Internet Browser

2011-09-03T18:58:26Z

Kiddyshaq34:

I have created a simple page that when opened in the browser freezes the 3DS system. I assume that too much memory is allocated to the JavaScript engine. This freeze can only be fixed by turning the system off and on again, but the communication switch works during this freeze. This is the page: https://dl-web.dropbox.com/get/Public/alerttest.html?w=88d076e5 [[User:R4wrz0rz0r|R4wrz0rz0r]] 14:57, 20 June 2011 (CEST)
I cannot access your page.you should make a public link from dropbox menu.

Sorry, I thought putting it in the Public folder would just make it work: http://dl.dropbox.com/u/18757478/alerttest.html [[User:R4wrz0rz0r|R4wrz0rz0r]] 00:56, 21 June 2011 (CEST)
Here's a shortened link: http://tinyurl.com/4x4u69o [[User:Kiddyshaq34|Kiddyshaq34]]

I think it is not so easy because this browser using Apple Webkit.

I don't think this is exploitable in any way. To me, seems more like NULL pointer dereferencing. Here's my full theory, may be wrong tho:
* the Javascript engine doesn't allocate memory for strings that are too long, but still keeps track of their length. (try generating a 2^31 characters long string, alert()'ing it shows an empty alert, however its length returns the expected value)
* such strings point to NULL instead of pointing to a memory buffer with characters. Their size is checked before trying to read them to display them in an alert.
* now, if you generate a 2^32 string, the length of the string is 0x100000000 characters. This value gets cut off to zero because it doesn't fit in a 32bit integer. Therefore the length property of the string is zero.
* when trying to alert() this string, the security check described above does infact "0 < maxlength", so the string is considered short enough to be displayed. However, since it was made from strings being already too large, its pointer is NULL.
* the browser tries to read from NULL, causing an exception. Probably said exception would trigger special stuff on dev/debug units, but was set to just enter an endless loop on retail units.

Long story short, nothing gets overwritten. Just an attempt at using a NULL pointer. This is only a theory though, I may be wrong. --[[User:Luigi2us|Luigi2us]] 01:40, 13 August 2011 (CEST)

Well I have seen a Google Chrome exploit that uses a null pointer. It executes the nopsled and the shellcode so that it generates an exception.
I think that if you try that exploit on Chrome on your computer, it still works(I tried it on version 15.0.865.1000, and it generated an exception. So I think that's a sign that Google and the Chromium team still haven't fixed the exploit yet, but my antivirus detects it). But what I said might be wrong and misleading. And sometimes null pointer dereferencing can be exploitable if you try and think harder. --[[User:Kiddyshaq34|Kiddyshaq34]] 22:00, 03 September 2011 (GMT)

I am not sure if this is any help, but browsing to this page http://bit.ly/qV82en in the 3DS browser, causes the page to take an age to load... (around 5 mins), when the page does finally load you can see dots,
scrolling down a few times till you see symbols instead of dots, then tapping the lower screen causes a load of pop unders.
I had tried other Android based exploits, that were all thrown out (page to big errors), but this one seems different.
viewing some pop unders (ones with target like icons) cause some to close and more to open...

The exploit used can be seen here... http://www.exploit-db.com/exploits/16974/ --[[User:Madshaun1984|Madshaun1984]] 23:27, 01 September 2011 (GMT)
I've got a link if anyone wants to try it out: http://db.tt/D3hmZJE --[[User:Kiddyshaq34|Kiddyshaq34]] 23:19, 02 September 2011 (GMT)

Not to mention, the 3DS hardware is surely a lot different from Android/phones. Scriptkiddyish attempts like running Android exploits on a 3DS will not work. --[[User:Luigi2us|Luigi2us]] 15:35, 2 September 2011 (CEST)

That Android shellcode is crap for the 3DS. Also the memory map should be different. BTW: How can we find out the memory map like ROM area, display memory, ... ? --[[User:Lazymarek9614|Lazymarek9614]] 20:00, 2 September 2011 (CEST)

The webkit has a lot of android based code in it... therefore it is not unreasonable to think that maybe (just maybe) and android based exploit would have an effect on the 3DS. My assumptions werent just based on the browsers webkit either... what other platforms do you know that run on arm cpu's and use the .APP file extension? Then theres the whole QR code compatibility, that seems all to similar to pre-existing android software... Now dont get me wrong im not suggesting that the 3DS is running android, but it seems to be some sort of hybrid that has some compatibility with android, of course my assumptions and theory's could be well off... but i'll leave it to you to prove me wrong. --[[User:Madshaun1984|Madshaun1984]] 19:02, 02 September 2011 (GMT)

Trash:Talk:Internet Browser

2011-09-02T20:17:40Z

Kiddyshaq34:

I have created a simple page that when opened in the browser freezes the 3DS system. I assume that too much memory is allocated to the JavaScript engine. This freeze can only be fixed by turning the system off and on again, but the communication switch works during this freeze. This is the page: https://dl-web.dropbox.com/get/Public/alerttest.html?w=88d076e5 [[User:R4wrz0rz0r|R4wrz0rz0r]] 14:57, 20 June 2011 (CEST)
I cannot access your page.you should make a public link from dropbox menu.

Sorry, I thought putting it in the Public folder would just make it work: http://dl.dropbox.com/u/18757478/alerttest.html [[User:R4wrz0rz0r|R4wrz0rz0r]] 00:56, 21 June 2011 (CEST)
Here's a shortened link: http://tinyurl.com/4x4u69o [[User:Kiddyshaq34|Kiddyshaq34]]

I think it is not so easy because this browser using Apple Webkit.

I don't think this is exploitable in any way. To me, seems more like NULL pointer dereferencing. Here's my full theory, may be wrong tho:
* the Javascript engine doesn't allocate memory for strings that are too long, but still keeps track of their length. (try generating a 2^31 characters long string, alert()'ing it shows an empty alert, however its length returns the expected value)
* such strings point to NULL instead of pointing to a memory buffer with characters. Their size is checked before trying to read them to display them in an alert.
* now, if you generate a 2^32 string, the length of the string is 0x100000000 characters. This value gets cut off to zero because it doesn't fit in a 32bit integer. Therefore the length property of the string is zero.
* when trying to alert() this string, the security check described above does infact "0 < maxlength", so the string is considered short enough to be displayed. However, since it was made from strings being already too large, its pointer is NULL.
* the browser tries to read from NULL, causing an exception. Probably said exception would trigger special stuff on dev/debug units, but was set to just enter an endless loop on retail units.

Long story short, nothing gets overwritten. Just an attempt at using a NULL pointer. This is only a theory though, I may be wrong. --[[User:Luigi2us|Luigi2us]] 01:40, 13 August 2011 (CEST)

I am not sure if this is any help, but browsing to this page http://bit.ly/qV82en in the 3DS browser, causes the page to take an age to load... (around 5 mins), when the page does finally load you can see dots,
scrolling down a few times till you see symbols instead of dots, then tapping the lower screen causes a load of pop unders.
I had tried other Android based exploits, that were all thrown out (page to big errors), but this one seems different.
viewing some pop unders (ones with target like icons) cause some to close and more to open...

The exploit used can be seen here... http://www.exploit-db.com/exploits/16974/ --[[User:Madshaun1984|Madshaun1984]] 23:27, 01 September 2011 (GMT)
I've got a link if anyone wants to try it out: http://db.tt/D3hmZJE --[[User:Kiddyshaq34|Kiddyshaq34]] 23:19, 02 September 2011 (GMT)

Not to mention, the 3DS hardware is surely a lot different from Android/phones. Scriptkiddyish attempts like running Android exploits on a 3DS will not work. --[[User:Luigi2us|Luigi2us]] 15:35, 2 September 2011 (CEST)

That Android shellcode is crap for the 3DS. Also the memory map should be different. BTW: How can we find out the memory map like ROM area, display memory, ... ? --[[User:Lazymarek9614|Lazymarek9614]] 20:00, 2 September 2011 (CEST)

The webkit has a lot of android based code in it... therefore it is not unreasonable to think that maybe (just maybe) and android based exploit would have an effect on the 3DS. My assumptions werent just based on the browsers webkit either... what other platforms do you know that run on arm cpu's and use the .APP file extension? Then theres the whole QR code compatibility, that seems all to similar to pre-existing android software... Now dont get me wrong im not suggesting that the 3DS is running android, but it seems to be some sort of hybrid that has some compatibility with android, of course my assumptions and theory's could be well off... but i'll leave it to you to prove me wrong. --[[User:Madshaun1984|Madshaun1984]] 19:02, 02 September 2011 (GMT)

Trash:Talk:Internet Browser

2011-08-13T18:09:19Z

Kiddyshaq34:

User talk:Kiddyshaq34

2011-05-08T09:27:17Z

Kiddyshaq34: Created page with "This is the discussion page. Here you can add friend codes so I can add you."

This is the discussion page. Here you can add friend codes so I can add you.

Hardware

2011-05-04T20:56:55Z

Kiddyshaq34:

{{stub}}

== Specifications ==
According to iFixit.com ([http://www.ifixit.com/Teardown/Nintendo-3DS-Teardown/5029/1#s22696 source]):

{| class="wikitable"
! Type !! Name !! Datasheet !! Source
|-
| CPU || Nintendo 1048 0H 2x ARM11 266 || N/A || N/A
|-
| GPU || Digital Media Professionals Pica 200 || N/A || [http://en.wikipedia.org/wiki/PICA200]
|-
| RAM || Fujitsu MB82M8080-07L || [http://crediar.no-ip.com/sg_/download.php?id=d67d1c] || [http://www.ifixit.com/blog/blog/2011/03/28/nintendo-3ds-has-128mb-ram/]
|-
| Storage || Toshiba THGBM2G3P1FBAI8 1GB NAND Flash || N/A || N/A
|-
| Power Management || Texas Instruments PAIC3010B 0AA37DW || N/A || FCC filing
|-
| Gyroscope || Invensense ITG-3270 MEMS Gyroscope || [http://dl-web.dropbox.com/u/20520664/references/PS-ITG-3200-00-01.4.pdf] || --
|-
| Accelerometer || ST Micro 2048 33DH X1MAQ Accelerometer Model LIS331DH || [http://dl.dropbox.com/u/20520664/references/CD00213470.pdf] || --
|-
| Wifi || 802.11b/g Atheros AR6014 || N/A || N/A
|}

== Images ==

=== Front ===

[[Image:CTR_Front.jpg|600px]]

=== NAND pinout ===
[[Image:CTR_NAND_pinout.png]]

NAND Dumping has been successful, but we still have to decrypt the NAND dump, and that involves running arm7 code on the 3DS to get the xorpad.

User:Kiddyshaq34

2011-04-24T21:25:51Z

Kiddyshaq34:

Hi there! I like 3DS games and 3DS h*******. (censored because I don't want to upset nintendo.) For the other guys, keep up the good work! ;) P.S. I'm a 3DS user.

Here's my Friend Code: 1977-0146-6524
If you want to add me, please leave your name and friend code in the discussion page please.

User:Kiddyshaq34

2011-04-23T16:04:20Z

Kiddyshaq34: Created page with "Hi there! I like 3DS games and 3DS h*******. (censored because I don't want to upset nintendo.) For the other guys, keep up the good work! ;) P.S. I'm a 3DS user."

Hi there! I like 3DS games and 3DS h*******. (censored because I don't want to upset nintendo.) For the other guys, keep up the good work! ;) P.S. I'm a 3DS user.

User talk:Crediar

2011-04-23T14:34:49Z

Kiddyshaq34:

Hey I love how much you did for homebrew and I can't wait what you'd accomplish for the 3DS.
<br>
Friend Code: 0774 - 4266 - 1999
<br>
Name: Timmy
<br>
:[[User:Timmyishappy|Timmyishappy]] 01:33, 21 April 2011 (CEST)
<br>

Hiya, I've just recently bought a 3DS and I can't believe there is all ready hacking progress on it. (Congrats :D )
I Hope you add me so we can keep in touch.
: Name: Nick
: FC: 2062 - 9164 - 2503
: --[[User:Nooz1|Nooz1]] 03:24, 18 April 2011 (CEST)

Good stuff Crediar. I will post you my FC when I get home. Wesperino.

Moin,
würde mich freuen wenn du mich addest:
Simon
3909-7495-9525

Hi! My fc is
1891-1170-7648:
Also I would like to say thank you for all the homebrew you created over the years and I
cant wait to see what you will do with the 3ds;) keep up the amazing work!
Daniel.R
[[User:Smvb64|Smvb64]] 18:31, 10 April 2011 (CEST)

Hi there Crediar, I've been watching you succeed and succeed in the Wii hacking community,
I'm amazed by the things you have accomplished, if we would be able to do 30% of what can be done
to the Wii I'd be more then happy.
FC is 3523 - 2027 - 7900

Nickname is Linus.

Wow, you got a Save Tool out already?! Awesome!
[[User:MrZombax|MrZombax]] 22:57, 5 April 2011 (CEST)

Hi there, Crediar. I have been looking your work on the 3DS. Very good work. I was thinking if you could make a homebrew for DSi to extract and send data to the PC like you did with the Save Tool.

Oh yea, here is my Friend Code 2277-6646-9164

[[User:Kazuma|Kazuma]]

Hi thank you for your work.
My friend code: 1160-9718-1643, thanks
Aliak

The progression of early homebrew is always very interesting stuff.
My friend code is 0044-2836-4738
- SaltyPancakes

Hi,I'm [[メインページ|Matyapiro]].I am Japanese.
My friend code:4339-2455-6521
I confirmed 3DSaveTool ver.0.2b does not work for Japanese Game.
It may be able to find a key,but try to decrypt savefile,an exception has occured.
: Make sure syntax is correct. It crashes if the commandline isn't formatted correctly. You can place filenames in quotes if absolutely necessary.
: '''3dsavetool.exe -x gamesave.sav gamesave_out.sav xorkey.bin'''
: --[[User:Jl12|Jl12]] 13:39, 15 April 2011 (CEST)

I am ctr and your work is awesome. my friend code is 4511-0450-6568 --[[User:Ctr|Ctr]] 23:39, 15 April 2011 (CEST)

0344-9330-2337 --[[User:Matthew|Matthew]]

Hi, Crediar! I really love your work! :D I bought my 3DS 1 month ago.
Here is my Friend Code: 1977-0146-6524
--[[User:Kiddyshaq34|Kiddyshaq34]]