KHeapChunkHeader - Revision history

Bond697: Redirected page to MemoryBlockHeader

2015-10-15T03:02:57Z

← Older revision		Revision as of 07:02, 15 October 2015
Line 1:		Line 1:
	~~This is the header stored at the beginning of unused blocks of FCRAM memory. The kernel maintains these structures to keep a list of free blocks and their sizes.~~		#REDIRECT [[MemoryBlockHeader]]

	By overwriting the pointers in instances of this struct (e.g. using an attack like gspwn) and then (de)allocating memory, one can achieve a controlled ARM11 kernel-mode write on system versions up to 9.2 ([[~~3DS_System_Flaws#Kernel11\|memchunkhax~~]]).


	~~Size : 0xC bytes?~~

	~~{\| class="wikitable" border="1"~~
	\|-
	~~! Offset~~
	~~! Type~~
	~~! Description~~
	\|-
	~~\| 0x0~~
	~~\| u32~~
	~~\| Size in pages~~
	\|-
	~~\| 0x4~~
	\| KHeapHeader*
	~~\| Next~~
	\|-
	~~\| 0x8~~
	\| KHeapHeader*
	~~\| Prev~~
	\|}

Yuriks at 20:37, 27 September 2015

2015-09-27T18:37:15Z

← Older revision		Revision as of 22:37, 27 September 2015
Line 1:		Line 1:
	This is the header stored in FCRAM ~~for each FCRAM heap chunk~~. The kernel maintains ~~this structure~~.		This is the header stored at the beginning of unused blocks of FCRAM memory. The kernel maintains these structures to keep a list of free blocks and their sizes.

	An attack like gspwn can ~~be used to overwrite instances of this header in order to exploit the~~ ARM11 kernel on system versions ~~below~~ 9.3 ([[3DS_System_Flaws#Kernel11\|memchunkhax]]).		By overwriting the pointers in instances of this struct (e.g. using an attack like gspwn) and then (de)allocating memory, one can achieve a controlled ARM11 kernel-mode write on system versions up to 9.2 ([[3DS_System_Flaws#Kernel11\|memchunkhax]]).

Bond697: Absolutely fucking not

2015-09-27T16:25:30Z

Absolutely fucking not

← Older revision		Revision as of 20:25, 27 September 2015
Line 1:		Line 1:
	~~[[Category:Kernel objects]]~~

	This is the header stored in FCRAM for each FCRAM heap chunk. The kernel maintains this structure.		This is the header stored in FCRAM for each FCRAM heap chunk. The kernel maintains this structure.

Line 16:		Line 14:
	\| 0x0		\| 0x0
	\| u32		\| u32
	\| Size (in 4K pages)		\| Size in pages
	\|-		\|-
	\| 0x4		\| 0x4

Neobrain: Thanks! Added some tiny clarifications.

2015-09-27T09:36:26Z

Thanks! Added some tiny clarifications.

← Older revision		Revision as of 13:36, 27 September 2015
Line 1:		Line 1:
	[[Category:Kernel objects]]		[[Category:Kernel objects]]

	This is the header stored in FCRAM for each FCRAM heap chunk. The kernel maintains this structure. An attack like gspwn can overwrite this header~~, and~~ exploit the kernel ~~pre~~ 9.3 (memchunkhax).		This is the header stored in FCRAM for each FCRAM heap chunk. The kernel maintains this structure.

			An attack like gspwn can be used to overwrite instances of this header in order to exploit the ARM11 kernel on system versions below 9.3 ([[3DS_System_Flaws#Kernel11\|memchunkhax]]).

Plutooo: moved KHeapHeader to KHeapChunkHeader

2015-09-27T09:26:20Z

moved KHeapHeader to KHeapChunkHeader

← Older revision		Revision as of 13:26, 27 September 2015
(No difference)

Plutooo at 11:23, 27 September 2015

2015-09-27T09:23:44Z

← Older revision		Revision as of 13:23, 27 September 2015
Line 1:		Line 1:
	[[Category:Kernel objects]]		[[Category:Kernel objects]]

	This is the header ~~that~~ the kernel ~~uses to implement the FCRAM heap~~.		This is the header stored in FCRAM for each FCRAM heap chunk. The kernel maintains this structure. An attack like gspwn can overwrite this header, and exploit the kernel pre 9.3 (memchunkhax).


	Size : 0xC bytes?		Size : 0xC bytes?

Plutooo at 11:19, 27 September 2015

2015-09-27T09:19:22Z

@@ Line 1: / Line 1: @@
 [[Category:Kernel objects]]
-Here is some code describing the layout of a memory chunk header.
+This is the header that the kernel uses to implement the FCRAM heap.
-    struct MemoryChunkHeader {
+Size : 0xC bytes?
-The "next" and "prev" members are used to implement a linked-list. In fact, chances are this is actually a kernel object inherited from [[KLinkedList]].
+{| class="wikitable" border="1"

Vague Rant: neobrain, you appear to be misunderstanding how MediaWiki redirects work. The other similar pages redirect to this one. There are no other pages with this content on them.

2015-09-27T09:16:18Z

neobrain, you appear to be misunderstanding how MediaWiki redirects work. The other similar pages redirect to this one. There are no other pages with this content on them.

← Older revision	Revision as of 13:16, 27 September 2015
Line 1:	Line 1:
		[[Category:Kernel objects]]
		{{stub}}
		memchunkhdr = a data structure describing chunks of memory allocated by the ARM11 kernel.

		Here is some code describing the layout of a memory chunk header.

		struct MemoryChunkHeader {
		int num_pages; // size of this chunk in terms of small pages
		void* next;
		void* prev;
		int unk1;
		int unk2;
		};

		The "next" and "prev" members are used to implement a linked-list. In fact, chances are this is actually a kernel object inherited from [[KLinkedList]].

Plutooo: moved Memchunkhdr to KHeapHeader

2015-09-27T09:14:52Z

moved Memchunkhdr to KHeapHeader

← Older revision		Revision as of 13:14, 27 September 2015
(No difference)

Neobrain: Clean up redundant wiki pages -- there's already another one with the same content. If you're unhappy, at least fixup things properly.

2015-09-27T09:12:25Z

Clean up redundant wiki pages -- there's already another one with the same content. If you're unhappy, at least fixup things properly.

← Older revision		Revision as of 13:12, 27 September 2015
Line 1:		Line 1:
	~~[[Category:Kernel objects]]~~
	~~{{stub}}~~
	~~memchunkhdr = a data structure describing chunks of memory allocated by the ARM11 kernel.~~

	~~Here is some code describing the layout of a memory chunk header.~~

	~~struct MemoryChunkHeader {~~
	~~int num_pages; // size of this chunk in terms of small pages~~
	~~void* next;~~
	~~void* prev;~~
	~~int unk1;~~
	~~int unk2;~~
	};

	~~The "next" and "prev" members are used to implement a linked-list. In fact, chances are this is actually a kernel object inherited from [[KLinkedList]].~~