11.0.0-33

The Old3DS+New3DS 11.0.0-33 system update was released on May 9, 2016. This Old3DS update was released for the following regions: USA, EUR, JPN, CHN, KOR, and TWN. This New3DS update was released for the following regions: USA, EUR, JPN, CHN, and KOR.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

Change-log

Official USA change-log:

• Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience

System Titles

<fill this in (manually) later>

NATIVE_FIRM

The ARM9 FIRM section is larger.

The only updated FIRM sysmodules are loader and pm.

svcBackdoor has been removed (on ARM11).

loader

Exactly one function was updated: L_140022b8(same addr as previous version).

The codebin physical-memory randomization code introduced with 10.4.0-29 was updated so that it's now used for OoT3D and Cubic Ninja(checked in the same aforementioned order), for the USA+EUR+JPN titles. This means oot3dhax and ninjhax need updated to handle this. Using the pre-sysupdate exploit versions will result in the title randomly crashing, if you retry enough times it should run fine however.

pm

Two functions were updated for calling a new function for exheader handling.

This new function at L_101cfc immediately returns when the input programID isn't a CTR title / Cubic Ninja(USA/EUR/JPN uniqueID). This function removes all services in the exheader service-access-control which match services from a blacklist stored in pm-module. This blacklist contains two services: "http:C" and "soc:U".

This breaks QR-code ninjhax with the version available at the time of sysupdate release, since the QR-code build downloads the payload via HTTPC.

ARM11-kernel

The same lone function updated with v10.4 was updated with this version again.

3 new functions used for validation with memory management were added(kernelpanic() on failure). 57 functions were updated, at least 48 of these are the actual functions used for handling SVCs.

Those new functions use XOR + rotation(besides the checks which were already done in previous versions).

The function which initializes a memalloc heap(FCRAM memregions + the container which the SlabHeap is under), had a major update. This uses XOR + rotation code, and it also uses svcGetSystemTick.

The svcGetSystemTick + XOR/rotation code mentioned above is a new security feature for the kernel heaps(see above). This is intended to stop non-arm11kernel from modifying kernel heap memchunkhdrs. However, it's unknown how much the svcGetSystemTick() output really varies if anything(?) for each hard-boot during initialization of the heaps.

6 memory management functions were updated to use the above new functions, these func-calls replaced the validation code previously used in these functions in some cases. These were also updated for the above heap security implementation. One function had a validation func-call added where previously there wasn't any validation done in the beginning of the function for previous versions.

Another function(L_fff13b68 previously at L_fff13b68) was updated for offsets it uses, nothing else.

The function handling the arm11kernel exheader descriptors was updated, if anything changed besides the kernel-version value it seems minor.

Process9

Various data was moved around in the .data section(.data is 0x99C-bytes smaller than before).

Before installing titles, including NATIVE_FIRM, AMPXI will now check the version of the title to install against a hard-coded list of (titleID, minimumVersionRequired) pairs. This applies to MSET, Home Menu, spider, ErrDisp, SKATER, NATIVE_FIRM, and every retail system module.

This effectively prevents downgrading.

AMPXI_InstallFIRM's firm-writing code has changed, though it seems it is only a refactor.

New3DS

The arm9loader wasn't changed at all.

See Also

System update report(s):

• [1]
• [2]