6,264
edits
Changes
Jump to navigation
Jump to search
Line 2:
Line 2: − There are currently no known 3DS-mode exploits. Line 9:
Line 8: − + Line 19:
Line 18: − Information on the 3DS's internals is scarce. There is little information on programming the 3DS available, other than basic information found by taking the 3DS apart, leaks and reverse engineering. − − What this means is if any exploits are found, it would be very difficult to do anything useful with them. Work is currently being done to find out how the 3DS ticks and to aid in finding exploits. See the [[#Current efforts | current efforts]] section of this page for examples and more information. −
no edit summary
==List of 3DS exploits==
==List of 3DS exploits==
==Failed attempts==
==Failed attempts==
* Pushmo (3DSWare), QR codes: level name is properly limited to 16 characters, game doesn't crash with a longer name. The only possible crashes are triggered by out-of-bounds values, these crashes are caused by the application attempting to load a ptr from a buffer located at NULL.
* Pushmo (3DSWare), QR codes: level name is properly limited to 16 characters, game doesn't crash with a longer name. The only possible crashes are triggered by out-of-bounds values, these crashes are caused by the application attempting to load a ptr from a buffer located at NULL.
* Pyramids (3DSWare), QR codes: no strings. The LZ10 compression can't be exploited either. Only crashes are from out-of-bounds values (like background ID) and are not exploitable.
* Pyramids (3DSWare), QR codes: no strings. The LZ10 compression can't be exploited either. Only crashes are from out-of-bounds values (like background ID) and are not exploitable.
* 3DS browser, 2^32 characters long string: this is the same vuln fixed [http://git.chromium.org/gitweb/?p=external/Webkit.git;a=commitdiff;h=ec471f16fbd1f879cb631f9b022fd16acd75f4d4 here], concat-large-strings-crash2.html triggers a crash which is basically the same as the one triggered by a 2^32 string. Most of the time this vuln will cause a memory page permissions fault, since the webkit code attempts to copy the string text data to the output buffer located in read-only heap memory. Any attempt at exploiting this on 3DS has failed so far.
* 3DS browser, 2^32 characters long string: this is similar to the vuln fixed [http://git.chromium.org/gitweb/?p=external/Webkit.git;a=commitdiff;h=ec471f16fbd1f879cb631f9b022fd16acd75f4d4 here], concat-large-strings-crash2.html triggers a crash which is about the same as the one triggered by a 2^32 string. Most of the time this vuln will cause a memory page permissions fault, since the webkit code attempts to copy the string text data to the output buffer located in read-only heap memory. The only difference between a crash triggered by a 2^32 string and the concat-large-strings-crash2.html crash is that the former copies the string data using the original string length(like 1 text character for "x", 4 for "xxxx") while the latter attempts to copy >12MB. Any attempt at exploiting this on 3DS has failed so far.
==Current efforts==
==Current efforts==
==Tips and info==
==Tips and info==
The 3DS uses the XN feature of the ARM processor, and only apps that have the necessary permissions in their headers can set memory to be executable. This means that although a usable buffer overflow exploit would still be useful, it would not go the entire way towards allowing code to be run in an easy/practical fashion (ie an actual homebrew launcher) - for that, an exploit in the kernel would probably need to be found. A buffer overflow exploit does, however, provide enough wriggle room through the use of return-oriented programming to potentially trigger a kernel exploit if and when a useful one is found.
The 3DS uses the XN feature of the ARM processor, and only apps that have the necessary permissions in their headers can set memory to be executable. This means that although a usable buffer overflow exploit would still be useful, it would not go the entire way towards allowing code to be run in an easy/practical fashion (ie an actual homebrew launcher) - for that, an exploit in the kernel would probably need to be found. A buffer overflow exploit does, however, provide enough wriggle room through the use of return-oriented programming to potentially trigger a kernel exploit if and when a useful one is found.
SD card [[extdata]] and SD savegames can be attacked, for consoles where the console-unique [[Nand/private/movable.sed|movable.sed]] was dumped.
SD card [[extdata]] and SD savegames can be attacked, for consoles where the console-unique [[Nand/private/movable.sed|movable.sed]] was dumped.