11.0.0-33

The Old3DS+New3DS 11.0.0-33 system update was released on May 9, 2016. This Old3DS update was released for the following regions: USA, EUR, JPN, CHN, KOR, and TWN. This New3DS update was released for the following regions: USA, EUR, JPN, CHN, and KOR.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

Change-log

Official USA change-log:

Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience

System Titles

NATIVE_FIRM

The ARM9 FIRM section is larger.

The only updated FIRM sysmodules are loader and pm.

svcBackdoor has been removed (on ARM11).

loader

Exactly one function was updated: L_140022b8(same addr as previous version).

The codebin physical-memory randomization code introduced with 10.4.0-29 was updated so that it's now used for OoT3D and Cubic Ninja(checked in the same aforementioned order), for the USA+EUR+JPN titles. This means oot3dhax and ninjhax need updated to handle this. Using the pre-sysupdate exploit versions will result in the title randomly crashing, if you retry enough times it should run fine however.

pm

Two functions were updated for calling a new function for exheader handling.

This new function at L_101cfc immediately returns when the input programID isn't a CTR title / Cubic Ninja(USA/EUR/JPN uniqueID). This function removes all services in the exheader service-access-control which match services from a blacklist stored in pm-module. This blacklist contains two services: "http:C" and "soc:U".

This breaks QR-code ninjhax with the version available at the time of sysupdate release, since the QR-code build downloads the payload via HTTPC.

ARM11-kernel

The same lone function updated with v10.4 was updated with this version again.

A number of memory management functions were updated.

3 new functions used for validation with memory management were added(kernelpanic() on failure). 57 functions were updated, at least 48 of these are the actual functions used for handling SVCs.

Those new functions use XOR + rotation.

The function which initializes a memalloc heap(FCRAM memregions + the container which the SlabHeap is under), had a major update. This uses XOR + rotation code, and it also uses svcGetSystemTick.

The svcGetSystemTick + XOR/rotation code mentioned above seems to be a new security feature for the kernel heaps(see above). However, it's unknown how much the svcGetSystemTick() output really varies if anything(?) for each hard-boot during initialization of the heaps.

Process9

Various data was moved around in the .data section(.data is 0x99C-bytes smaller than before).

Before installing titles, including NATIVE_FIRM, AMPXI will now check the version of the title to install against a hard-coded list of (titleID, minimumVersionRequired) pairs. This applies to MSET, Home Menu, spider, ErrDisp, SKATER, NATIVE_FIRM, and every retail system module.

This effectively prevents downgrading.

New3DS

The arm9loader wasn't changed at all.