Changes

3DS System Flaws (edit)

Revision as of 20:00, 14 March 2016

91 bytes added , 20:00, 14 March 2016

m

→‎arm9loader

Line 115: Line 115:

| enhanced-arm9loaderhax

| See the 32c3 3ds talk.

−

Since this is a combination of a trick with the arm9-bootrom + arm9loaderhax, and since you have to manually write FIRM to the firm0/firm1 NAND partitions, this can't be completely fixed. Any system with existing ARM9 code execution and an OTP/OTP hash dump can exploit this. Additionally, by using the FIRM partition known-plaintext bug and bruteforcing the second entry in the keystore, this can currently be exploited on all New3DS systems without any other prerequisite hacks.

+

Since this is a combination of a trick with the arm9-bootrom + arm9loaderhax, and since you have to manually write FIRM to the firm0/firm1 NAND partitions, this can't be completely fixed (System Update firm partition writes can be blocked by patching System calls at boot time). Any system with existing ARM9 code execution and an OTP/OTP hash dump can exploit this. Additionally, by using the FIRM partition known-plaintext bug and bruteforcing the second entry in the keystore, this can currently be exploited on all New3DS systems without any other prerequisite hacks.

| arm9loaderhax which automatically occurs at hard-boot.

| See arm9loaderhax / description.

Plailect

16

edits