3DS System Flaws: Difference between revisions
→Kernel11: Multiple KLinkedListNode SlabHeap use after free bugs |
WulfyStylez (talk | contribs) bootrom hax time |
||
| Line 18: | Line 18: | ||
! Timeframe this was discovered | ! Timeframe this was discovered | ||
! Discovered by | ! Discovered by | ||
|- | |||
| ARM9 bootrom vectors point at RAM | |||
| ARM9's exception vectors are hardcoded to point at ARM9 RAM. While the bootrom does set them up to point to itself at some point during boot, it does not do so immediately. As such, a carefully-timed fault injection to induce an invalid instruction will cause execution to fall into ARM9 RAM. | |||
Since RAM isn't cleared on boot, one can immediately start execution of their own code here to dump bootrom, OTP, etc. | |||
| May 2015 | |||
| WulfyStylez | |||
|- | |- | ||
| Missing AES key clearing | | Missing AES key clearing | ||