KHeapChunkHeader: Difference between revisions
Jump to navigation
Jump to search
Absolutely fucking not |
No edit summary |
||
| Line 1: | Line 1: | ||
This is the header stored | This is the header stored at the beginning of unused blocks of FCRAM memory. The kernel maintains these structures to keep a list of free blocks and their sizes. | ||
By overwriting the pointers in instances of this struct (e.g. using an attack like gspwn) and then (de)allocating memory, one can achieve a controlled ARM11 kernel-mode write on system versions up to 9.2 ([[3DS_System_Flaws#Kernel11|memchunkhax]]). | |||
Revision as of 21:37, 27 September 2015
This is the header stored at the beginning of unused blocks of FCRAM memory. The kernel maintains these structures to keep a list of free blocks and their sizes.
By overwriting the pointers in instances of this struct (e.g. using an attack like gspwn) and then (de)allocating memory, one can achieve a controlled ARM11 kernel-mode write on system versions up to 9.2 (memchunkhax).
Size : 0xC bytes?
| Offset | Type | Description |
|---|---|---|
| 0x0 | u32 | Size in pages |
| 0x4 | KHeapHeader* | Next |
| 0x8 | KHeapHeader* | Prev |