5 ms·

Much of the Switch's appeal for me was the interesting hardware configuration, I wonder if Nintendo focused less on obfuscating its inner workings compared to o

by ry_ry 9y ago

Much of the Switch's appeal for me was the interesting hardware configuration, I wonder if Nintendo focused less on obfuscating its inner workings compared to other current-gen consoles based on that? Edit: urgh, was supposed to be a reply to another comment. I guess the point still stands though.

amaranth 9y ago
It's an almost stock Tegra X1 reference system. The hacks that got access to the system recently started with a Tegra backdoor/debug option Nvidia and Nintendo apparently forgot about. https://www.youtube.com/watch?v=Ec4NgWRE8ik https://www.youtube.com/watch?v=Ec4NgWRE8ik
- ReverseCold 9y ago
  Video TL;DW: - Launch hidden web browser through WiFi Web Auth or the Japanese version of PuyoPuyo Tetris. - Connect to MITM'd WiFi hotspot that has a webkit exploit. - Gain userspace access. - Exploit preload (pl:u) service, it has an array out of bounds read. - Exploit SM service by forgetting to initialize it with your PID, therefore it thinks you are PID 0. - The whole Kernel is mapped into userspace for some reason, can be used as ASLR bypass. - Search Tegra manual for "bypass SMMU" - follow instructions, bypass kernel using the GPU. (35:00, oversimplified here) - Change certain parts of DRAM, PMC, etc, and during wakeup TrustZone will execute whatever. This is fixed past v1.0.0.
  - roblabla 9y ago
    The Kernel being mapped in userspace isn't actually used in any of the current hacks though. ROhan, the only implemented and public way to get userland Arbitrary Code Execution, uses ASLR leaks in both Webkit and SDB. Kernel being mapped in userspace is interesting for save hacks though, which would allow us to escape out of the webkit process (webkit is limited to 700MB of ram, so escaping into a game process is very much interesting). The SMMU bypass is not usable outside of 1.0.0 for Kernel ACE. They have a carveout that denies DMA access to builtins and kernel, the problem is that in 1.0.0, the Kernel would allocate some objects outside of that carveout. It does allow ACE in any other process though.
kakarot 9y ago
I've had every previous Nintendo console to date except for the Wii U. I've gone through 2 SNES's, 2 N64's, 2 Gamecubes, 3 Wii's, but 0 Wii U's. Nintendo had a great streak going, and they just ruined it with such a shit piece of hardware. Sure, the Wii was pretty terrible, but it redeemed itself with the ease of which it can be hacked and customized, plus the Wiimotes were pretty neat even if not perfect. My solution to shitty hardware? Buy the games and emulate. Never touch that awful gamepad. I don't care if full-blown 100% commercial emulation dropped tomorrow, I will still buy a Switch this year and probably another in a couple years. Hardware design is extremely important, and with Nintendo's commitment to continually finishing last in the GFX arms race, it's all they have. At least with the Switch, they found a way to justify reduced graphical performance with a hybrid mobile design. As soon as some nice third-party joycons hit the market, I'm in.
- ReverseCold 9y ago
  > third-party joycons You don't like first party Nintendo controllers better? I always find first party to be higher quality, even if the third party one is more expensive.
  - kakarot 9y ago
    Generally yes, but I have yet to hear a single positive thing about the joycons. Word on the street is they're cheap and unreliable and the exact opposite of ergonomic. The usual Nintendo approach of throwing decades of controller design research out the window. If you watched their E3 presentation, it was entirely focused on how awesome the controllers were. They got significantly more attention than any other aspect of the console. This was the first major sign that something was wrong. It seemed almost like they were trying to convince themselves of the controller's quality and usefulness. I've also heard that there are issues with the controllers working correctly when a cellphone sits between them and the console, and this is pretty major considering a mobile phone is more or less required for online multiplayer. I will hold back until something better appears, unless it seems like that just isn't going to happen.
    - 9y ago

by ry_ry 9y ago

amaranth 9y ago

It's an almost stock Tegra X1 reference system. The hacks that got access to the system recently started with a Tegra backdoor/debug option Nvidia and Nintendo apparently forgot about. https://www.youtube.com/watch?v=Ec4NgWRE8ik https://www.youtube.com/watch?v=Ec4NgWRE8ik

ReverseCold 9y ago
Video TL;DW: - Launch hidden web browser through WiFi Web Auth or the Japanese version of PuyoPuyo Tetris. - Connect to MITM'd WiFi hotspot that has a webkit exploit. - Gain userspace access. - Exploit preload (pl:u) service, it has an array out of bounds read. - Exploit SM service by forgetting to initialize it with your PID, therefore it thinks you are PID 0. - The whole Kernel is mapped into userspace for some reason, can be used as ASLR bypass. - Search Tegra manual for "bypass SMMU" - follow instructions, bypass kernel using the GPU. (35:00, oversimplified here) - Change certain parts of DRAM, PMC, etc, and during wakeup TrustZone will execute whatever. This is fixed past v1.0.0.
- roblabla 9y ago
  The Kernel being mapped in userspace isn't actually used in any of the current hacks though. ROhan, the only implemented and public way to get userland Arbitrary Code Execution, uses ASLR leaks in both Webkit and SDB. Kernel being mapped in userspace is interesting for save hacks though, which would allow us to escape out of the webkit process (webkit is limited to 700MB of ram, so escaping into a game process is very much interesting). The SMMU bypass is not usable outside of 1.0.0 for Kernel ACE. They have a carveout that denies DMA access to builtins and kernel, the problem is that in 1.0.0, the Kernel would allocate some objects outside of that carveout. It does allow ACE in any other process though.

kakarot 9y ago

I've had every previous Nintendo console to date except for the Wii U. I've gone through 2 SNES's, 2 N64's, 2 Gamecubes, 3 Wii's, but 0 Wii U's. Nintendo had a great streak going, and they just ruined it with such a shit piece of hardware. Sure, the Wii was pretty terrible, but it redeemed itself with the ease of which it can be hacked and customized, plus the Wiimotes were pretty neat even if not perfect. My solution to shitty hardware? Buy the games and emulate. Never touch that awful gamepad. I don't care if full-blown 100% commercial emulation dropped tomorrow, I will still buy a Switch this year and probably another in a couple years. Hardware design is extremely important, and with Nintendo's commitment to continually finishing last in the GFX arms race, it's all they have. At least with the Switch, they found a way to justify reduced graphical performance with a hybrid mobile design. As soon as some nice third-party joycons hit the market, I'm in.

ReverseCold 9y ago
> third-party joycons You don't like first party Nintendo controllers better? I always find first party to be higher quality, even if the third party one is more expensive.
- kakarot 9y ago
  Generally yes, but I have yet to hear a single positive thing about the joycons. Word on the street is they're cheap and unreliable and the exact opposite of ergonomic. The usual Nintendo approach of throwing decades of controller design research out the window. If you watched their E3 presentation, it was entirely focused on how awesome the controllers were. They got significantly more attention than any other aspect of the console. This was the first major sign that something was wrong. It seemed almost like they were trying to convince themselves of the controller's quality and usefulness. I've also heard that there are issues with the controllers working correctly when a cellphone sits between them and the console, and this is pretty major considering a mobile phone is more or less required for online multiplayer. I will hold back until something better appears, unless it seems like that just isn't going to happen.
  - 9y ago