4dsdev
Views: 613,497 Main | Rules/FAQ | Memberlist | Active users | Last posts | Calendar | Stats | Online users | Search 11-19-17 07:11 PM
Guest:

Main - Posts by pseudov


pseudov
Posted on 05-27-15 12:50 PM, in Staplehax -- Ninjhax with kernel access Link | #159
Bonjour! Hopefully, this project is continued. So far, this is the only homebrew solution for browserless systems on 5.0 - 9.2

It compiles successfully, but without the proper blowfish_processed.bin, the generated files are unusable. Have tried going through both a ramdump and code.bin from exefs, but all I've come up with are the default arrays for blowfish. Any hints for calculating/extracting the blowfish stuff are greatly appreciated.

pseudov
Posted on 05-27-15 01:38 PM, in Staplehax -- Ninjhax with kernel access Link | #161
Thanks for the quick reply, StapleButter :)

Hope I can figure that out when I get home from work.

pseudov
Posted on 05-28-15 02:10 AM, in Staplehax -- Ninjhax with kernel access Link | #162
Aaaand I still haven't figured it out. XORed the blowfish init arrays with what I assume the raw key is. Tried a lot of different possible keys, but still failed.

Is that 0x48 bytes from a ramdump or from code.bin?

pseudov
Posted on 05-29-15 02:17 AM, in Staplehax -- Ninjhax with kernel access Link | #164
Oh man, still nothing after two long nights. ARM assembly is definitely not my thing. Is there supposed to be something useful at 0x1048 bytes? Or should I concentrate on the key at 0x48 bytes?

Even if it's hardcoded to your local network, I figured I might still be able to use it by manually transferring the payload files through Savedatafiler (I have access to another 3DS). That is, once I get this darn blowfish_processed.bin :)

pseudov
Posted on 06-04-15 12:57 AM, in Staplehax -- Ninjhax with kernel access Link | #169
I feel like an idiot now. I thought the 0x48 and 0x1028 bytes you mentioned were offsets, not sizes. Nonetheless, any other hints are very much appreciated.

pseudov
Posted on 06-10-15 05:57 PM, in Staplehax -- Ninjhax with kernel access (rev. 2 of 06-10-15 05:59 PM) Link | #202
Managed to compile Staplehax with the correct blowfish_processed.bin, but it freezes at the loading screen. It hangs at
hax = khaxInit();
and doesn't return an error code, which makes debugging hard (for me, at least)

This is on an old 9.2.0-20U

pseudov
Posted on 06-10-15 08:46 PM, in Staplehax -- Ninjhax with kernel access (rev. 2 of 06-10-15 11:52 PM) Link | #204
Sure thing, it'll be my pleasure to test.

I have two old 3DS units to work with:
8.1.0-0U
9.2.0-20U

EDIT: With what firmware version did you get the current Staplehax build to work?

pseudov
Posted on 06-11-15 01:00 AM, in Staplehax -- Ninjhax with kernel access Link | #205
I'm not sure how important the SYSTEM_VERSION minor is, but I noticed that both the systems I tested were not specifically listed in the System version table of khaxinit.cpp

pseudov
Posted on 06-15-15 01:28 AM, in Staplehax -- Ninjhax with kernel access Link | #213
After my limited debugging abilities, I have determined that it hangs somewhere at:
Result KHAX::MemChunkHax::Step5_CorruptCreateThread()

Maybe this:
u32 writeaddr = GetMagicalPointer() + 0xF3D;
is version specific?

pseudov
Posted on 08-04-15 11:31 AM, in Staplehax -- Ninjhax with kernel access Link | #289
Posted by MassExplosion213
Is this project still active or has it been dropped?

Posted by StapleButter
I'm not even sure I want to continue tbh.


^That, and with the release of Ninjhax 2.0 and the upcoming Ironhax, it seems this project has been put aside for now. Hopefully when Ninjhax 2.0 source comes out, StapleButter might take interest in this project once again.


Main - Posts by pseudov

Page rendered in 0.056 seconds. (2048KB of memory used)
MySQL - queries: 22, rows: 79/79, time: 0.039 seconds.
[powered by Acmlm] Acmlmboard 2.064 (2015-10-07)
© 2005-2008 Acmlm, Xkeeper, blackhole89 et al.