4 ms·
It's funny comparing the effort Nintendo went through in locking down the 3DS, both to how slapdash the BroadON-developed scheme in the iQue, Wii, and DSi were,
by kmeisthax 2y ago
It's funny comparing the effort Nintendo went through in locking down the 3DS, both to how slapdash the BroadON-developed scheme in the iQue, Wii, and DSi were, and to how thoroughly the system got owned and stayed owned once people had a foot in the door. The 3DS had hardware key derivation, strict NX enforcement, DMA attack mitigations, a separate secure zone CPU, hardware-locked save files[0] and a custom microkernel OS with strictly-regulated privileges across separate server processes.
But at the same time, the amount of mistakes[1] Nintendo made implementing these is egregious. That DMA attack mitigation? Wasn't even enabled until a year after smea was distributing exploits that used it. You just asked the GPU to overwrite the application you were exploiting and it happily did so. Firmware builds of the OS intended to service backwards compatibility[2] or service modes were never updated, so you could boot into them and attack that. Most egregiously, they tried re-securing the New3DS with a new bootloader, which actually made the platform less secure as it'd run happily on old hardware and had exploitable bugs.
To make matters worse, the boot ROM was exploitable and Nintendo never bothered to fix it[3]. It even had a hidden service mode that would execute code off a DS flashcart if you held the right button combination while the hinge was closed. You didn't even need to have functioning storage on the device. Not even the Wii was owned this badly.
[0] To be clear, this isn't a good thing for consumers, but it makes it way harder to install entrypoints. On the Wii any system could create save data for any other system, so exploit saves were incredibly easy to install.
[1] https://www.3dbrew.org/wiki/3DS_System_Flaws https://www.3dbrew.org/wiki/3DS_System_Flaws
[2] Which, mind you, includes managing a built-in GBA flashcart in the 3DS hardware that Nintendo only used for the Ambassador Games because... reasons.
[3] Despite, oddly enough, telling the FCC that they were launching a new 3DS revision with an updated boot ROM.
- sillywalk 2y agoAmong one of the excellent articles on game consoles is the on on the 3DS that references the 3dbrew articles, but provides an easier to higher level explanation of the flaws (along with how the rest of the machine works). https://www.copetti.org/writings/consoles/nintendo-3ds/ https://www.copetti.org/writings/consoles/nintendo-3ds/
- userbinator 2y agoI wonder how many of the "flaws" were deliberate, carefully put there by those who are against DRM on principle.
- zzo38computer 2y agoThat is what I thought, too. (There are probably more than one people working on it and some people want to do some of such things deliberately) At least some of the things might be deliberate (such as the working of the hidden service mode); others probably aren't.
- vsuperpower2020 2y agoIncompetence is way more likely than intentional sabotage. It was probably just some guy in a suit demanding that they have everything that looks secure so it's not a repeat of the NDS, while giving no time to actually implement anything properly.
- noirscape 2y agoThe button combination with a closed hinge one is all but confirmed to be deliberate. To my understanding it's meant to be used in Nintendo repair centres to flash a new firmware for refurbished devices. Of course not described as such to repair centre employees, but that was the intended usecase.
- CoolGuySteve 2y agoThe Switch has a similar process, if you join two pins on the right Joycon rail it will allow you to flash a custom firmware.
- dtx1 2y agoMost likely none. I doubt any developer working on this intentionally created a security flaw and snuck it in under the radar. Much more likely these are all fuckups caused by the top brass requiring much more security for their devices to "protect" themselves from piracy build by developers who didn't have experience in hardware security.
- 2y ago
- Gigachad 2y agoOnline gaming ended up being the real death of piracy. I’ve got a hacked switch and the experience is significantly degraded since you can’t use any online features.
- auguzanellato 2y agoThat’s because on the Switch they figured out how to bind online sessions to digital certificates unique per game copy signed by Nintendo themselves. This way “copied” games can’t get online without being detected. The 3DS didn’t have any of those checks so you could actually play online with pirated games.
- CoolGuySteve 2y agoYou could download full games directly from the official online store servers using a homebrew front end. They did all the purchase auth on the 3DS but a hacked firmware could bypass it. They didn’t put the game file download process behind an auth layer until very late in the system’s life.
- dagmx 2y agoFor folks who don’t recall the name BroadON, they’re now Acer Cloud Technology. They’ve also been called RouteFree and eventually iGware https://wiki.raregamingdump.ca/index.php/Acer_Cloud_Technology https://wiki.raregamingdump.ca/index.php/Acer_Cloud_Technolo...