3DS System Flaws: Difference between revisions
→Kernel11: Fix duplicated entry. |
|||
Line 435: | Line 435: | ||
| | | | ||
| Everyone | | Everyone | ||
|- | |||
| veryslowpidhax | |||
| '''This is completely different from the kernelmode-code-execution vuln described in the below separate entry.''' | |||
When updating the kernel global PID counter under [[SVC|svcCreateProcess]] the kernel does not check for wraparound to 0x0(the PID for the very first process). This only matters because [[Services|SM-module]] allows processes with PID value less than <total ARM11 FIRM modules> to access ''all'' services, without checking exheader service-access-control. This alone does not affect access to [[SVC|SVCs]] at all. | |||
Inlined ldrex+strex code is used for updating the above counter. [[11.2.0-35|11.2.0-X]] had changes for similar code, but it was only for dedicated ldrex+strex functions(mainly for kernel objects) and hence this PID code was not affected. | |||
With launching+terminating a sysmodule repeatedly with this via ns:s, it would take weeks to finish(if not at least about a month?). | |||
| Access to all [[Services_API|services]]. | |||
| None | |||
| [[11.2.0-35|11.2.0-X]] | |||
| 2012 maybe? | |||
| | |||
|- | |- | ||
| slowhax | | slowhax |