3dbrew

Internet Browser

Page Discussion
Revision as of 21:17, 23 October 2015 by Yellows8 (talk | contribs) (→‎Old3DS v10.2: Removed the mention for the other vuln since it wasn't tested properly yet.)

The 3DS Internet Browser was added in the June 2011 Update for JPN/EUR/USA.

From the Internet Browser help section: In compliance with the LGPL, the source code of the OSS is available via the Nintendo website. This source code can be downloaded here: [1] [2]

The 3DS Internet Browser is Netfront Browser NX v1.0 based on WebKit engine.

The browser supports up to 64 bookmarks.

The exheader name of this title is "spider".

The only difference between the ExeFS .code for each region of the Old3DS/New3DS browser, is byte values for the title uniqueID/region, otherwise the binaries are identical.

New 3DS Internet Browser

New3DS has a separate browser title, the exheader name is "SKATER".

Unlike the Old3DS browser, this New3DS browser has videos+HTML5 support. This browser also has a filter enabled by default(ExeFS codebin is same for all regions, this filter only applies for JPN region). Disabling it requires paying money with a credit-card, for purchasing web-browser DLC.

During startup the browser does various HTTPS comms. When visting an URL, the browser sends a plaintext HTTP POST to here: [3]. The raw POST data begins with "ARS/2.0\r\n\x00", the rest appears to be encrypted. The server reply content also has this ARS header + encrypted data. This appears to use a fixed xorpad, likely from a fixed encryption CTR/IV. The server content responses for allowed sites, and blocked sites, are fixed. When the server returns that the site is blocked, the browser goes to this page: [4](the Referrer header value is set to the same URL it's actually requesting).

The WebKit source was updated since the Old3DS browser.

Unlike the Old3DS browser, the New3DS browser uses the following services: mvd:STD and ir:rst(DLC-related services are used too but those aren't New3DS specific).

Video decoding is done with mvd:STD. Audio decoding/playback is done with a browser-specific DSP binary. The Old3DS browser used CSND for audio playback, the New3DS browser doesn't have access to that at all since it uses DSP instead.

The browser manual includes licenses for Android and PacketVideo. The browser uses libstagefright from Android.

User-Agent and Browser Versions

Normal user-agent format: Mozilla/5.0 (New Nintendo 3DS like iPhone) AppleWebKit/<WebKit version> (KHTML, like Gecko) NX/<Netfront version> Mobile NintendoBrowser/<Mobile NintendoBrowser version>.<region>

<region> can be one of the following: "JP", "US", or "EU".

Mobile NintendoBrowser version(displayed in browser settings) Normal UA Mobile UA CDN Title-version Network-only system-update version Notes
1.0.9934 Mozilla/5.0 (New Nintendo 3DS like iPhone) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.0.5.8 Mobile NintendoBrowser/1.0.9934.<region> Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A403 Safari/8536.25 v10 9.0.0-20 Initial version.
1.1.9996 Mozilla/5.0 (New Nintendo 3DS like iPhone) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.0.5.10 Mobile NintendoBrowser/1.1.9996.<region> Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A403 Safari/8536.25 v1027 9.3.0-21 See below regarding OSS changes.
1.2.10085 Mozilla/5.0 (New Nintendo 3DS like iPhone) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.0.5.13 Mobile NintendoBrowser/1.2.10085.<region> Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A403 Safari/8536.25 v2051 9.6.0-24 See below.
1.3.10126 Mozilla/5.0 (New Nintendo 3DS like iPhone) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.0.5.15 Mobile NintendoBrowser/1.3.10126.US Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A403 Safari/8536.25 v3077 9.9.0-26 See below.
? ? ? v4096 10.2.0-28 See below.

Note that the latest Old3DS browser WebKit version at the time the initial New3DS browser was released, was the following: 532.8.

OSS 9.0 and 9.3 diff

The following is a diff of the OSS archives from here, for v9.0 and v9.3. 

Files NewNintendo3DS_OpenSources9.0.0-/WKC/WebCore/platform/network/WKC/ResourceHandleManagerWKC.cpp and NewNintendo3DS_OpenSources9.3.0-/WKC/WebCore/platform/network/WKC/ResourceHandleManagerWKC.cpp differ
Files NewNintendo3DS_OpenSources9.0.0-/WKC/WebKit/WKC/webkit/WKCVersion.h and NewNintendo3DS_OpenSources9.3.0-/WKC/WebKit/WKC/webkit/WKCVersion.h differ

WKC_CUSTOMER_RELEASE_VERSION was changed from "0.5.8" to "0.5.10".

The following code was added to ResourceHandleManager::doRedirect(): curl_easy_setopt(d->m_handle, CURLOPT_SHARE, 0);

v9.6

WebKit/OSS code was actually updated. ExeFS .code was updated. The following files in RomFS were updated:

  • "/banner/CN/Skater.icn" and "/banner/KR/Skater.icn".
  • "/browser/rootca.pem"
  • "/build/buildinfo.dat"
  • "/cairo.cro.lex" and "/.crr/static.crr"
  • "/lyt/Button/ButtonSelectHSearch.arc"
  • "/lyt/Kbd/Swkbd.arc"
  • "lyt/Kbd.arc"
  • "skater.msbt" under all of the "/message/<region>_<language>/" directories.
  • "/oss.cro.lex", "/peer.cro.lex", "/static.crs", and "/webkit.cro.lex".

The following was added to RomFS:

  • "/favicon/naver.dat"
  • A "KO" directory under "/iwnn".

v9.9

ExeFS:/.code was updated.

The only RomFS changes is file-updating, all of the following files were updated: 

/browser/rootca.pem
/build/buildinfo.dat
/cairo.cro.lex
/.crr/static.crr
/message/CN_Simp_Chinese/skater.msbt
/message/EU_Dutch/skater.msbt
/message/EU_English/skater.msbt
/message/EU_French/skater.msbt
/message/EU_German/skater.msbt
/message/EU_Italian/skater.msbt
/message/EU_Portuguese/skater.msbt
/message/EU_Russian/skater.msbt
/message/EU_Spanish/skater.msbt
/message/JP_Japanese/skater.msbt
/message/KR_Hangeul/skater.msbt
/message/TW_English/skater.msbt
/message/TW_Trad_Chinese/skater.msbt
/message/US_English/skater.msbt
/message/US_French/skater.msbt
/message/US_Portuguese/skater.msbt
/message/US_Spanish/skater.msbt
/oss.cro.lex
/peer.cro.lex
/static.crs
/webkit.cro.lex

See here for a diff of the OSS(WebKitLibraries/ is not included due to the massive cairo library diff). An exploitable security vuln(which was already known in the context of 3DS webkit) was fixed. Yellows8' private(at the time of writing) exploit for it is based on the PoC from here(see the pastebin for the actual pastebin author).

v10.2

The libstagefright build in the main SKATER codebin was updated to a version which fixed libstagefright vuln(s): the vuln used in browserhax_fright at the time of sysupdate release was fixed. The *only* code changed in the main codebin, was code related to libstagefright.

The only RomFS changes is file-updating, all of the following files were updated: 

/browser/rootca.pem differ
/build/buildinfo.dat differ
/.crr/static.crr differ
/message/CN_Simp_Chinese/skater.msbt differ
/message/EU_Dutch/skater.msbt differ
/message/EU_English/skater.msbt differ
/message/EU_French/skater.msbt differ
/message/EU_German/skater.msbt differ
/message/EU_Italian/skater.msbt differ
/message/EU_Portuguese/skater.msbt differ
/message/EU_Russian/skater.msbt differ
/message/EU_Spanish/skater.msbt differ
/message/JP_Japanese/skater.msbt differ
/message/KR_Hangeul/skater.msbt differ
/message/TW_English/skater.msbt differ
/message/TW_Trad_Chinese/skater.msbt differ
/message/US_English/skater.msbt differ
/message/US_French/skater.msbt differ
/message/US_Portuguese/skater.msbt differ
/message/US_Spanish/skater.msbt differ
/oss.cro.lex differ
/static.crs differ
/webkit.cro.lex differ

New3DS Browser Specifications

[5]

English version(Google translate):

  • "Browser engine: NetFrontÂź Browser NX v3.0"
  • "User agent: Mozilla/5.0 (New Nintendo 3DS like iPhone) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.*.*.* Mobile NintendoBrowser/1.0.****.JP
    • The *** is described version information.
    • When you use the "mobile version of the request" function, which is different from those described above string."
  • "Supported protocols: HTTP1.0/HTTP1.1/SSL3.0/TLS1.0/TLS1.1/TLS1.2"
  • "Web standard: HTML4.01 / HTML5 / XHTML1.1 / Fullscreen / Gamepad / SVG / WebSocket / Video Subtitle / WOFF / Web Messaging / Server-Sent / Web Storage of part / XMLHttpRequest / canvas / Video / DOM1-3 / ECMAScript / CSS1 / CSS2.1 / CSS3 part of"
  • "Image format: bmp / ​​gif / ico / jpeg / png / svg (There are, however, it is not possible to display some image.)"
  • "Image preview: mpo / jpeg (There are, however, it is not possible to display some image.)"
  • "Video format: MP4, M3U8 + TS (HTTPLiveStreaming) (However, there are some you can not play the video.)"
  • "Video codec: H.264 - MPEG-4 AVC Video (max 854x480 level 3.2, 3D compatible) (However, there are some you can not play the video.)"
  • "Audio codec: AAC - ISO / IEC 14496-3 MPEG-4AAC, MP3
    (However, there are some you can not play the video.)"
  • "Of 3D video at the time of upload format: .mkv (However, in order to play the video, you must format is converted in the upload to the site. In addition, even if it is converted you might not be able to play.)"
  • "It does not correspond to the plug-ins such as plug-in Adobe Flash."
  • "Use the Active Rating System of filtering function: Digital Arts, Inc. provides. At the time of access to Web content, and implementing the decision of whether access is permitted based on the category information. Feature that can limit access to Web content that may be inappropriate for viewing by the determination result."
  • "I will request the display of the mobile version page of the web page you are viewing request function the mobile version. (However, if the web page does not correspond to the mobile version of the page does not change the display.)"

MJPEG + .avi is also supported.


Old3DS browser

User-Agent and Browser Versions

User-agent format: Mozilla/5.0 (Nintendo 3DS; U; ; <lang>) Version/<version>.<region>.

<lang> is "en", "fr", etc. <region> is "US", "EU", etc. See below for <version>.

Browser version CDN Title-version Network-only system-update version Notes
1.7412 v6 2.0.0-2 This was the initial version.
1.7455 v1024 2.1.0-4 ExeFS .code was updated, both of the CROs(webkit/OSS) were updated too.
1.7498 v2050 4.0.0-7 ExeFS .code was updated, both of the CROs(webkit/OSS) were updated too. The manual CFA was updated as well.
1.7552 v3075 5.0.0-11 ExeFS .code and icon were updated, both of the CROs(webkit/OSS) were updated too. The manual CFA was updated as well.
1.7552 v3088 7.0.0-13 The main NCCH wasn't updated at all(same TMD contentID/content-hash as the previous version), only the manual CFA for this title was updated.
1.7567 v4096 7.1.0-16 The CXI .code was updated, some data in the RomFS was updated(none of the CROs such as webkit.cro were updated). The manual CFA was updated too.
1.7585 v5121 9.5.0-23 The CXI .code was updated, and the manual CFA was updated. RomFS changes:
  • "/browser/rootca.pem" updated
  • "/cro/oss.cro" updated
  • "/cro/static.crs" updated
  • "/cro/webkit.cro" updated
  • "/.crr/static.crr" updated
  • "/layout/dialogheader/WirelessSwitchOff.arc" was removed
  • "/layout/favorite/favicondata/KOR.arc" updated
1.7610 v6149 9.9.0-26 See below.
? v7168 10.2.0-28 See below.

Old3DS v9.9

ExeFS:/.code was updated.

The only changes in RomFS were file-updating, the following files were updated: 

/browser/rootca.pem
/cro/oss.cro
/cro/static.crs
/cro/webkit.cro
/.crr/static.crr
/message/CN_Simp_Chinese/spider.msbt
/message/EU_Dutch/spider.msbt
/message/EU_English/spider.msbt
/message/EU_French/spider.msbt
/message/EU_German/spider.msbt
/message/EU_Italian/spider.msbt
/message/EU_Portuguese/spider.msbt
/message/EU_Russian/spider.msbt
/message/EU_Spanish/spider.msbt
/message/JP_Japanese/spider.msbt
/message/KR_Hangeul/spider.msbt
/message/TW_English/spider.msbt
/message/TW_Trad_Chinese/spider.msbt
/message/US_English/spider.msbt
/message/US_French/spider.msbt
/message/US_Portuguese/spider.msbt
/message/US_Spanish/spider.msbt

OSS diff for v9.5 and v9.9, without the .dox changes: 

diff --git a/3DS_InternetBrowser_OpenSources_JP_US_EU_KR_TW_HK_CN_9.5.0(23J_23U_23E_19K_18T_3C)/WKC/WebKit/WKC/webkit/WKCVersion.h b/3DS_InternetBrowser_OpenSources_JP_US_EU_KR_TW_HK_CN_9.9.0/WKC/WebKit/WKC/webkit/WKCVersion.h
index be5ff09..55a7274 100644
--- a/3DS_InternetBrowser_OpenSources_JP_US_EU_KR_TW_HK_CN_9.5.0(23J_23U_23E_19K_18T_3C)/WKC/WebKit/WKC/webkit/WKCVersion.h
+++ b/3DS_InternetBrowser_OpenSources_JP_US_EU_KR_TW_HK_CN_9.9.0/WKC/WebKit/WKC/webkit/WKCVersion.h
@@ -29,7 +29,7 @@
 #define WKC_VERSION_CHECK(major, minor, micro) \
     (((major)*10000) + ((minor)*100) + (micro)) >= ((WKC_VERSION_MAJOR*10000) + (WKC_VERSION_MINOR*100) + (WKC_VERSION_MICRO))
 
-#define WKC_CUSTOMER_RELEASE_VERSION "1.8.14"
+#define WKC_CUSTOMER_RELEASE_VERSION "1.8.16"
 
 #define WKC_WEBKIT_VERSION "532.7"
 
diff --git a/3DS_InternetBrowser_OpenSources_JP_US_EU_KR_TW_HK_CN_9.5.0(23J_23U_23E_19K_18T_3C)/webkit/WebCore/rendering/RenderBox.cpp b/3DS_InternetBrowser_OpenSources_JP_US_EU_KR_TW_HK_CN_9.9.0/webkit/WebCore/rendering/RenderBox.cpp
index da4127e..d03403e 100644
--- a/3DS_InternetBrowser_OpenSources_JP_US_EU_KR_TW_HK_CN_9.5.0(23J_23U_23E_19K_18T_3C)/webkit/WebCore/rendering/RenderBox.cpp
+++ b/3DS_InternetBrowser_OpenSources_JP_US_EU_KR_TW_HK_CN_9.9.0/webkit/WebCore/rendering/RenderBox.cpp
@@ -305,23 +305,23 @@ int RenderBox::scrollHeight() const
 
 int RenderBox::scrollLeft() const
 {
-    return hasOverflowClip() ? layer()->scrollXOffset() : 0;
+    return layer() && hasOverflowClip() ? layer()->scrollXOffset() : 0;
 }
 
 int RenderBox::scrollTop() const
 {
-    return hasOverflowClip() ? layer()->scrollYOffset() : 0;
+    return layer() && hasOverflowClip() ? layer()->scrollYOffset() : 0;
 }

 void RenderBox::setScrollLeft(int newLeft)
 {
-    if (hasOverflowClip())
+    if (hasOverflowClip() && layer())
         layer()->scrollToXOffset(newLeft);
 }
 
 void RenderBox::setScrollTop(int newTop)
 {
-    if (hasOverflowClip())
+    if (hasOverflowClip() && layer())
         layer()->scrollToYOffset(newTop);
 }

Old3DS v10.2

The slider vuln from here was fixed in the Old3DS browser it seems.

The main codebin .text only increased by 0x10-bytes.

The only changes in RomFS was that the following files were updated: 

/cro/oss.cro
/cro/static.crs
/cro/webkit.cro
/.crr/static.crr

Web Standards

  • HTML 4.01
  • HTML 5 (120/400 score on HTML5Test.com)
  • XHTML 1.1
  • CSS 1
  • CSS 2.1
  • CSS 3 (some functionality is unavailable)
  • DOM Levels 1-3
  • ECMAScript (partial support for ECMA-262 5th Edition)
  • XMLHttpRequest Level 2
  • Canvas Element (some functionality is unavailable)

Protocols

  • HTTP 1.0
  • HTTP 1.1
  • SSLv3
  • TLS 1.0

Image Formats

  • MPO
  • GIF
  • JPEG
  • PNG
  • BMP
  • ICO (some files cannot be displayed)

Plug-Ins

Plug-ins (such as Adobe Flash) are not supported.

Other details

  • It scored 90/100 on Acid3 test
  • Images from the Internet can be saved to the SD Card and viewed using the Nintendo 3DS Camera application.
  • Images saved to an SD Card or to the Nintendo 3DS system memory can be uploaded to blogs or other sites that allow the uploading of photos using :
<input type="file" />
  • HTML5Test.com say that Drag and drop is supported but it's not (code on WebKit is ready, but it's not implemented on interface of browser)

Tips

Detect User Agent

To detect if the user agent is Nintendo 3DS Browser : 

<script type="text/javascript">
    if (navigator.userAgent.indexOf('Nintendo 3DS') == -1) { //If the UserAgent is not "Nintendo 3DS"
        location.replace('http://www.3dbrew.org'); //Redirect to an other page
    }
</script>
  • You can check navigator.platform=="Nintendo 3DS" as well.

Scrolling

Scrolling can be altered by modifying document.body.scrollTop and document.body.scrollLeft. However, there are drawbacks related to working with these properties:

  • Both properties return 0 when accessed
  • Setting one property resets the other property's scroll position

In order to set both at the same time (without either resetting to 0), use window.scrollTo.

Events

Key Events

The following buttons trigger the onkeydown, onkeypress and onkeyup events:

Code Button
13 A
37 Left
38 Up
39 Right
40 Down

The events cannot have their default action cancelled. Other buttons do not trigger key events.

Touch/Mouse Events

onmousedown, onmouseup & onclick are all triggered by the browser. However, the onmousedown event doesn't trigger until you lift the stylus or you've held it on the screen for ~2 seconds—which is when text selection mode is activated—making it pretty much the same as onmouseup. The events cannot have their default action cancelled.

The onmousemove and common touch/gesture events are not supported.

Screen Resolution

The up screen resolution is 400×240. However, the viewable area in the browser is only 400×220.

The touch screen resolution is 320×240. However, the viewable area in the browser is only 320×212.

You can have a page span both screens. However, the browser will behave as if the bottom screen is the only active screen and the top screen is scrolled off. This is important when computing CSS coordinates. Items positioned from "bottom" will be positioned based on 220px and not the full 432px of both screens.

Using Both Screens

Generally the easiest way to accomplish the correct layout is to create HTML elements that "contain" the top and bottom screens. Here's an example: 

<!DOCTYPE html>
<html>
  <head>
    <meta name="viewport" content="width=400">
    <style>
      body{margin:0px;}
      #topscreen{width:400px;height:220px;overflow:hidden;}
      #bottomscreen{width:320px;height:212px;overflow:hidden;margin:0 auto;}
    </style>
  </head>
  <body>
    <div id="topscreen">Top Screen</div>
    <div id="bottomscreen">Bottom Screen</div>
  </body>
</html>

This scheme allows the page to be easily manipulated through JavaScript. In order to have the window snap to the correct position, use the following JavaScript code: 

window.setInterval(function () {
    window.scrollTo(40, 220);  
}, 50);

This automatically resets the position if the user accidentally scrolls the page.

Example Sites

Retrieved from "https://www.3dbrew.org/w/index.php?title=Internet_Browser&oldid=14286"