4 ms·

The implementation is based on mruby, which is riddled with bugs. I spent some time reversing A Dark Room before it got removed. I am confident that there are b

The implementation is based on mruby, which is riddled with bugs. I spent some time reversing A Dark Room before it got removed. I am confident that there are bugs allowing ROP, from which point getting CFW is a matter of privesc. We have privesc to bootrom on every firmware version up to 7.x (inclusive). This is obviously bad for nintendo.

baroffoos 7y ago
The games themselves run in a sandbox and should not have access to the greater OS, hypervisor or arm trustzone which are on the switch.
- minimaxir 7y ago
  "should" is the operative word.
- xena 7y ago
  Assuming the jar has no holes. The jar apparently has holes and the brain inside it can peek out.
  - baroffoos 7y ago
    I haven't seen any exploits from application level getting access to the OS. There is basically one exploit being used on the switch which uses a bug in the nvidia chip at boot which gives you a higher level of access than the OS and all of the security checks. Its such a powerful exploit that can only be fixed by a hardware change that no other exploit is needed.
    - Maxious 7y ago
      There was also a Web browser exploit https://github.com/switchbrew/nx-hbexploit300 https://github.com/switchbrew/nx-hbexploit300
    - dfkasfldjf 7y ago
      Just because you haven't seen them doesn't mean they don't exist. And, there has been one pure "software" kernel access released (for 1.0.0), as well as a handful of later kernel exploits that haven't been. Nintendo is right to be paranoid about ANY code execution, because that is the first step to reducing the pool of end users who can then "root" their consoles.
    - roblabla 7y ago
      You didn’t look too hard then. Deja vu got released recently. It’s a chain from unprivileged to bootrom. Got fixed in 8.0.0, the very latest firmwares. Look it up at https://switchbrew.org/wiki/Switch_System_Flaws https://switchbrew.org/wiki/Switch_System_Flaws It’s currently the only known chain, and might be the only one in existence. And yet it’s a big threat. In practice, A Dark Room isn’t a particularly interesting entrypoint due to requiring an usb keyboard (web browser is easier to open). But it's understandable that Nintendo would want to keep those entrypoint to an absolute minimum. Especially since newer hardware revision exist which fixed Fusee-Gelee, the BootROM bug you talked about.
- lone_haxx0r 7y ago
  All sandboxes have bugs, it's just a matter of time before someone finds a vuln in the DS sandbox.
jstanley 7y ago
Why is this obviously bad for Nintendo?
- naikrovek 7y ago
  It isn't, but it is very likely against the developer's agreements with Nintendo. Things like this are why Nintendo doesn't freely allow save file access, or even allow them to be accessed without encrypting them. If they work this hard to prevent file loading exploits, you can bet your ass there is contract language to prevent what this guy did.

baroffoos 7y ago

The games themselves run in a sandbox and should not have access to the greater OS, hypervisor or arm trustzone which are on the switch.

minimaxir 7y ago
"should" is the operative word.
xena 7y ago
Assuming the jar has no holes. The jar apparently has holes and the brain inside it can peek out.
- baroffoos 7y ago
  I haven't seen any exploits from application level getting access to the OS. There is basically one exploit being used on the switch which uses a bug in the nvidia chip at boot which gives you a higher level of access than the OS and all of the security checks. Its such a powerful exploit that can only be fixed by a hardware change that no other exploit is needed.
  - Maxious 7y ago
    There was also a Web browser exploit https://github.com/switchbrew/nx-hbexploit300 https://github.com/switchbrew/nx-hbexploit300
  - dfkasfldjf 7y ago
    Just because you haven't seen them doesn't mean they don't exist. And, there has been one pure "software" kernel access released (for 1.0.0), as well as a handful of later kernel exploits that haven't been. Nintendo is right to be paranoid about ANY code execution, because that is the first step to reducing the pool of end users who can then "root" their consoles.
  - roblabla 7y ago
    You didn’t look too hard then. Deja vu got released recently. It’s a chain from unprivileged to bootrom. Got fixed in 8.0.0, the very latest firmwares. Look it up at https://switchbrew.org/wiki/Switch_System_Flaws https://switchbrew.org/wiki/Switch_System_Flaws It’s currently the only known chain, and might be the only one in existence. And yet it’s a big threat. In practice, A Dark Room isn’t a particularly interesting entrypoint due to requiring an usb keyboard (web browser is easier to open). But it's understandable that Nintendo would want to keep those entrypoint to an absolute minimum. Especially since newer hardware revision exist which fixed Fusee-Gelee, the BootROM bug you talked about.
lone_haxx0r 7y ago
All sandboxes have bugs, it's just a matter of time before someone finds a vuln in the DS sandbox.

jstanley 7y ago

Why is this obviously bad for Nintendo?

naikrovek 7y ago
It isn't, but it is very likely against the developer's agreements with Nintendo. Things like this are why Nintendo doesn't freely allow save file access, or even allow them to be accessed without encrypting them. If they work this hard to prevent file loading exploits, you can bet your ass there is contract language to prevent what this guy did.