869
edits
Changes
Jump to navigation
Jump to search
Line 405:
Line 405: − The highest FCRAM address that is gspwn-able is base_region_addr - 0x800000. This translates to: 0x26400000 on Old3DS, 0x2D800000 on New3DS.+
no edit summary
| GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you're running under, and gain real code-execution from a ROP-chain. Normally applets' .text([[Home Menu]], [[Internet Browser]], etc) is located beyond the area accessible by the GPU, except for [[RO_Services|CROs]] used by applets([[Internet Browser]] for example).
| GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you're running under, and gain real code-execution from a ROP-chain. Normally applets' .text([[Home Menu]], [[Internet Browser]], etc) is located beyond the area accessible by the GPU, except for [[RO_Services|CROs]] used by applets([[Internet Browser]] for example).
FCRAM is gpu-accessible up to physaddr 0x26400000 on Old3DS, and 0x2DC00000 on New3DS.
| User-mode code execution.
| User-mode code execution.
| None
| None