3DS System Flaws: Difference between revisions
No edit summary |
|||
| Line 404: | Line 404: | ||
| gspwn | | gspwn | ||
| GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you're running under, and gain real code-execution from a ROP-chain. Normally applets' .text([[Home Menu]], [[Internet Browser]], etc) is located beyond the area accessible by the GPU, except for [[RO_Services|CROs]] used by applets([[Internet Browser]] for example). | | GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you're running under, and gain real code-execution from a ROP-chain. Normally applets' .text([[Home Menu]], [[Internet Browser]], etc) is located beyond the area accessible by the GPU, except for [[RO_Services|CROs]] used by applets([[Internet Browser]] for example). | ||
The highest FCRAM address that is gspwn-able is base_region_addr - 0x800000. This translates to: 0x26400000 on Old3DS, 0x2D800000 on New3DS. | |||
| User-mode code execution. | | User-mode code execution. | ||
| None | | None | ||