11.3.0-36

The Old3DS+New3DS 11.3.0-36 system update was released on February 6, 2017. This Old3DS update was released for the following regions: USA, EUR, JPN, CHN, KOR, and TWN. This New3DS update was released for the following regions: USA, EUR, JPN, CHN, KOR, and TWN.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

Change-log

Official USA change-log:

• Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience

System Titles

NATIVE_FIRM

Process9

Actual code changed in Process9 .text. 2 functions were updated, and 1 new function was added which is called by the first function(see below).

Process9 now sets a global flag when starting applications (other than unique ID 0xF802A), and the firmlaunch function panics when attempting to launch SAFE_FIRM with if that flag has been set, to prevent safehax.

New3DS arm9loader

New3DS arm9loader wasn't updated.

ARM11 kernel

Numerous functions were updated, fixing fasthax.

• Additional bound checks were added to timer-handling code (setting and/or incrementing a timer's value, etc.) and to the KTimerAndWDTManager second virtual function, so that a timer's value can never be set to either a negative value or the past (which is what fasthax needed to do).
• The two functions that either add a KTimeableInterruptEvent instance to the global queue of pending KTimeableInterruptEvent (see KTimerAndWDTManager), or remove one from it, now return a boolean indicating whether the interrupt event already is/was in the queue (if that is true, the function that adds the interrupt event will now update the timer registers in that case as well). This is especially used for the below fixes.
• When adding a timer to that queue, its reference count is incremented (if it wasn't already in the queue). It is only decremented when needed, after actually signaling the timer by the interrupt-handling code.
• A virtual method was added to the definition of abstract class KTimeableInterruptEvent, which returns static_cast<KAutoObject *>(this)->referenceCount != 1 for KTimer instances and true for KThread instances. Prior to (re)adding timer interrupt events (as well as some other objects) to the queue, objects with a refcount of 1 are removed from it.

Modules

No section0 module was changed.

NS

Only two constants were actually changed: the minimal value required for the kernel's minor version number (now 0x35, ie. 11.3 NFIRM, it used to be 0x23, ie. 5.0 NFIRM), and the version number used for FS:InitializeWithSdkVersion.

New_3DS GSP

At least the 3 following functions were updated (11.3 N3DS addresses):

• sub_102048: now writes 0 to LCD register 0x10202014 and ORs 0x1020200C with 0x10001
• sub_10B4F4
• sub_10B7DC

Home Menu

Exactly 1 function was updated, this fixed bossbannerhax(the last exploit used by menuhax). Code was added to verify that the common and {region/language}-specific exbanner sections don't have a decompressed size >{max_size}, when that happens it jumps over the func-call for doing the actual decompression.

See Also

System update report(s):

• [1]
• [2]