3DS System Flaws - Revision history

Kynex7510: More RO stuff

2025-07-24T16:47:40Z

More RO stuff

← Older revision		Revision as of 20:47, 24 July 2025
Line 1,323:		Line 1,323:
	\| None		\| None
	\| [[11.17.0-50\|11.17.0-50]]		\| [[11.17.0-50\|11.17.0-50]]
	\|		\| May 2025
	\| May 2025		\| May 2025
	\| [[User:kynex7510\|kynex7510]], probably others		\| [[User:kynex7510\|kynex7510]], probably others
Line 1,332:		Line 1,332:
	\| None		\| None
	\| [[11.17.0-50\|11.17.0-50]]		\| [[11.17.0-50\|11.17.0-50]]
	\|		\| June 2025
	\| June 2025		\| June 2025
	\| [[User:kynex7510\|kynex7510]]		\| [[User:kynex7510\|kynex7510]]
Line 1,359:		Line 1,359:
	\| None		\| None
	\| [[11.17.0-50\|11.17.0-50]]		\| [[11.17.0-50\|11.17.0-50]]
	\|
	\| June 2025		\| June 2025
			\| June 2025
			\| [[User:kynex7510\|kynex7510]]
			\|-
			\| [[RO_Services\|RO]]: target process patching
			\| A custom CRS file can be used to apply relocation patches anywhere in the target process, and since all pages are mapped as RW, this includes executable pages aswell.

			A possible exploitation strategy takes advantage of relocation type 2 (R_ARM_ABS32), where the payload data is encoded as a series of import patches, each encoding 4 bytes of data in the "addend" field.
			\| Arbitrary write in the target process bypassing page protections, hence code execution.
			\| None
			\| [[11.17.0-50\|11.17.0-50]]
			\| June 2025
			\| July 2025
	\| [[User:kynex7510\|kynex7510]]		\| [[User:kynex7510\|kynex7510]]
	\|-		\|-

Kynex7510: GSP DMA + RO stuff

2025-06-24T12:48:16Z

GSP DMA + RO stuff

@@ Line 1,316: / Line 1,316: @@
 | smea, [[User:Yellows8|Yellows8]]/others before then
 |-
-| [[GSP_Services|GSP]] client management failures
+| [[GSP_Services|GSP]]: client management failures
 | Shared memory of GSP clients is all on the same page, this allows any GSP client to craft custom GX commands for other clients. Additionally, [[GSPGPU:TriggerCmdReqQueue]] does not check if the calling client has rendering rights.
@@ Line 1,326: / Line 1,326: @@
 | May 2025
 | [[User:kynex7510|kynex7510]], probably others
 |-
 | rohax
@@ Line 1,337: / Line 1,346: @@
+|
 | smea, [[User:Plutooo|plutoo]] joint effort
 |-
 | Region free

Kynex7510 at 07:05, 2 May 2025

2025-05-02T05:05:02Z

← Older revision		Revision as of 09:05, 2 May 2025
Line 1,317:		Line 1,317:
	\|-		\|-
	\| [[GSP_Services\|GSP]] client management failures		\| [[GSP_Services\|GSP]] client management failures
	\| Shared memory of GSP clients is all on the same page, this allows any GSP client to craft custom GX commands for other clients.		\| Shared memory of GSP clients is all on the same page, this allows any GSP client to craft custom GX commands for other clients. Additionally, [[GSPGPU:TriggerCmdReqQueue]] does not check if the calling client has rendering rights.

	~~When~~ a ~~process with memtype != APPLICATION acquires rights, the FCRAM cutoff is increased~~ to ~~0x26800000 (O3DS)~~ / ~~0x2D000000~~ (~~N3DS~~)~~. Meanwhile, [[GSPGPU:TriggerCmdReqQueue]] does not check if the calling client has rendering rights. This allows any process to access most~~ of ~~the SYSTEM region by crafting DMA commands for the [[Home Menu]] (a non-APPLICATION process which is always a~~ client ~~of GSP) and jumping to it so that GSP updates the cutoff, while triggering queue processing from a separate thread~~.		These two flaws can be used to craft DMA/Transfer Engine commands within a different GSP client to issue reads/writes to both physical (akin to gspwn) and virtual memory of said client.
	\| ~~Access to most of the SYSTEM memory region~~.		\| Arbitrary RW from and into a client process.
	\| None		\| None
	\| [[11.17.0-50\|11.17.0-50]]		\| [[11.17.0-50\|11.17.0-50]]

Kynex7510: GSP behaviour

2025-05-01T18:29:12Z

GSP behaviour

@@ Line 1,315: / Line 1,315: @@
+|
 | smea, [[User:Yellows8|Yellows8]]/others before then
 |-
 | rohax

Riley at 14:00, 20 November 2023

2023-11-20T13:00:21Z

← Older revision		Revision as of 16:00, 20 November 2023
Line 1,420:		Line 1,420:

	Wiki: November 20, 2023.		Wiki: November 20, 2023.
	\| [[User:Riley\|Riley]]}		\| [[User:Riley\|Riley]]
			\|}

Riley: was going to wait until march-april, but N apparently confirmed to someone that there will be no more 3DS firmware updates ( https://nitter.net/RoseSilicon/status/1720635007788552396#m )

2023-11-20T12:59:41Z

was going to wait until march-april, but N apparently confirmed to someone that there will be no more 3DS firmware updates ( https://nitter.net/RoseSilicon/status/1720635007788552396#m )

@@ Line 1,399: / Line 1,399: @@
 | See [https://switchbrew.org/wiki/Switch_System_Flaws#Pia here]; separately checked later (UpdateConnectionReport) by [[User:Riley|Riley]] on: June 14, 2023
 | [[User:Yellows8|Yellows8]]; added to 3dbrew (UpdateConnectionReport) by [[User:Riley|Riley]] later
-|}
+|-

Riley: describe FSPXI:EnumerateExtSaveData bug further

2023-08-14T09:27:48Z

describe FSPXI:EnumerateExtSaveData bug further

← Older revision		Revision as of 13:27, 14 August 2023
Line 462:		Line 462:
	\|-		\|-
	\| [[FS:EnumerateExtSaveData]] crashes process9 when trying to parse a file as an extdata directory in Data Management (MSET9)		\| [[FS:EnumerateExtSaveData]] crashes process9 when trying to parse a file as an extdata directory in Data Management (MSET9)
	\| ~~When FS_EnumerateExtData is~~ called by [[System_Settings\|MSET]] to parse 3DS extdata IDs for Data Management, a file that starts with 8 hex digits can crash process9 if placed directly inside the extdata directory. It can crash in various ways based on subtle differences in the way the user triggers the crash event.		\| In the implementation for FSPXI:EnumerateExtSaveData (called by [[System_Settings\|MSET]] to parse 3DS extdata IDs for Data Management), the return value of the P9 internal function call to open a directory (when enumerating contents of the extdata directory) was not checked. Therefore, if the call fails, an uninitialised pointer on stack will be used for a vtable call.

			As such, a file that starts with 8 hex digits can crash process9 if placed directly inside the extdata directory. It can crash in various ways based on subtle differences in the way the user triggers the crash event.

	While mostly leading to null derefs, in one specific context, process9 jumps directly to an ID1 string being held in ARM9 memory. Surprisingly, the 3DS doesn't discern what characters are used for the ID1 directory name on the SD, only requiring exactly 32 chars. This allows the attacker to insert arm instructions into the unicode ID1 dirname and take control of the ARM9, and thus, full control of the 3DS.		While mostly leading to null derefs, in one specific context, process9 jumps directly to an ID1 string being held in ARM9 memory. Surprisingly, the 3DS doesn't discern what characters are used for the ID1 directory name on the SD, only requiring exactly 32 chars. This allows the attacker to insert arm instructions into the unicode ID1 dirname and take control of the ARM9, and thus, full control of the 3DS.

EvilFlight: Process9 primary

2023-08-07T23:25:41Z

Process9 primary

@@ Line 460: / Line 460: @@
+|
 | [[User:Yellows8|Yellows8]]
 |-
 | RSA signature padding checks

Yellows8: /* General/CTRSDK */

2023-06-16T14:09:29Z

General/CTRSDK

← Older revision		Revision as of 18:09, 16 June 2023
Line 1,378:		Line 1,378:
	\| [[User:Yellows8\|Yellows8]]		\| [[User:Yellows8\|Yellows8]]
	\|-		\|-
	\| ~~nn::pia::session::RelayRouteManageJob::UpdateConnectionReport buffer overflow~~		\| Pia vulns
	\| [https://switchbrew.org/wiki/Switch_System_Flaws#Pia Originally discovered in Pia v5.x for Switch], ~~this buffer overflow is~~ also present in earlier versions (v3.x/4.x/5.x, possibly earlier?) for 3DS (and Wii U too).		\| [https://switchbrew.org/wiki/Switch_System_Flaws#Pia Originally discovered in Pia v5.x for Switch], these vulns are also present in earlier versions (v3.x/4.x/5.x, possibly earlier?) for 3DS (and Wii U too).
	\| ~~Heap buffer overflow~~		Pia encryption generally wasn't used pre-Switch (sent packets are plaintext). 3DS is affected by all Pia vulns listed above except for LAN. The functionality for ParseLeaveMeshInvitation doesn't exist in 3DS Pia v3.9.2. Wii U is affected by all listed Pia vulns except for the LAN vulns.
	\| Unfixed on 3DS		\| See [https://switchbrew.org/wiki/Switch_System_Flaws#Pia here].
			\| Unfixed on 3DS/Wii U
	\| "[SDK+Nintendo:PIA_5_4_3]"		\| "[SDK+Nintendo:PIA_5_4_3]"
	\| ~~3DS~~: June 14, 2023		\| See [https://switchbrew.org/wiki/Switch_System_Flaws#Pia here]; separately checked later (UpdateConnectionReport) by [[User:Riley\|Riley]] on: June 14, 2023
	\| ~~3DS:~~ [[User:~~Riley~~\|~~Riley~~]]~~, originally:~~ [[User:~~Yellows8~~\|~~Yellows8~~]]		\| [[User:Yellows8\|Yellows8]]; added to 3dbrew (UpdateConnectionReport) by [[User:Riley\|Riley]] later
	\|}		\|}

Riley: /* General/CTRSDK */ pia RelayRouteManageJob::UpdateConnectionReport bug does also exist on 3DS (and also on Wii U)

2023-06-15T14:03:38Z

General/CTRSDK: pia RelayRouteManageJob::UpdateConnectionReport bug does also exist on 3DS (and also on Wii U)

@@ Line 1,377: / Line 1,377: @@
 | November 14, 2016
 | [[User:Yellows8|Yellows8]]
 |}