3dbrew

3DS System Flaws: Difference between revisions

← Older editNewer edit →
No edit summary
No edit summary
Line 405: Line 405:
| GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you're running under, and gain real code-execution from a ROP-chain. Normally applets' .text([[Home Menu]], [[Internet Browser]], etc) is located beyond the area accessible by the GPU, except for [[RO_Services|CROs]] used by applets([[Internet Browser]] for example).
| GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you're running under, and gain real code-execution from a ROP-chain. Normally applets' .text([[Home Menu]], [[Internet Browser]], etc) is located beyond the area accessible by the GPU, except for [[RO_Services|CROs]] used by applets([[Internet Browser]] for example).


The highest FCRAM address that is gspwn-able is base_region_addr - 0x800000. This translates to: 0x26400000 on Old3DS, 0x2D800000 on New3DS.
FCRAM is gpu-accessible up to physaddr 0x26400000 on Old3DS, and 0x2DC00000 on New3DS.
| User-mode code execution.
| User-mode code execution.
| None
| None
Retrieved from "https://www.3dbrew.org/wiki/3DS_System_Flaws"