Changes

Jump to navigation Jump to search

3DS Userland Flaws (edit)

Revision as of 15:09, 4 October 2020

11,830 bytes added ,  15:09, 4 October 2020
no edit summary
Line 49: Line 49:  
| Pokemon Super Mystery Dungeon uses zlib compression for most of its save files, possibly due to the save files being larger than its predecessor, Gates to Infinity. When a save file is being prepared to be loaded and read from, only a 0x32000 large buffer is allocated for file reading, and a 0x3e800-large buffer for decompression is also allocated before the file is read. However, the game does not limit the size of the file read to this allocation bound, allowing for the file to overflow into the linear memory heap and into the next allocation. Since Pokemon Super Mystery Dungeon stores allocation memchunks directly before the allocation, overwriting the next memchunk with a corrupted one allows for arbitrary writes of linear heap pointers when the next buffer is allocated or arbitrary writes of any pointer within writable memory when the corrupted buffer is freed.
 
| Pokemon Super Mystery Dungeon uses zlib compression for most of its save files, possibly due to the save files being larger than its predecessor, Gates to Infinity. When a save file is being prepared to be loaded and read from, only a 0x32000 large buffer is allocated for file reading, and a 0x3e800-large buffer for decompression is also allocated before the file is read. However, the game does not limit the size of the file read to this allocation bound, allowing for the file to overflow into the linear memory heap and into the next allocation. Since Pokemon Super Mystery Dungeon stores allocation memchunks directly before the allocation, overwriting the next memchunk with a corrupted one allows for arbitrary writes of linear heap pointers when the next buffer is allocated or arbitrary writes of any pointer within writable memory when the corrupted buffer is freed.
 
| None
 
| None
−
| [[10.7.0-32]].
+
| O3DS: [[11.3.0-36]]. N3DS: [[11.4.0-37]].
 
| Time of exploit release.
 
| Time of exploit release.
 
| April 14, 2016
 
| April 14, 2016
Line 57: Line 57:  
| Buffer overflow in XML save file array parsing
 
| Buffer overflow in XML save file array parsing
 
| VVVVVV utilizes several XML files (renamed with a .vvv extension) to store level save data, stats and settings. Within these XML files are several tags containing an array of data which, when parsed, is not properly checked to be of proper length for the tag being parsed from. This allows for an overflow of 16-bit array values from the location where the array is parsed. With unlock.vvv, XML data is parsed to the stack, and with level saves the heap. This allows for the pointer where the level save worldmap tag array should be parsed into to be overwritten with a stack address, allowing for ROP from within the XML array parsing function on the next level load.
 
| VVVVVV utilizes several XML files (renamed with a .vvv extension) to store level save data, stats and settings. Within these XML files are several tags containing an array of data which, when parsed, is not properly checked to be of proper length for the tag being parsed from. This allows for an overflow of 16-bit array values from the location where the array is parsed. With unlock.vvv, XML data is parsed to the stack, and with level saves the heap. This allows for the pointer where the level save worldmap tag array should be parsed into to be overwritten with a stack address, allowing for ROP from within the XML array parsing function on the next level load.
−
| v1.1
+
| App: v1.1
 
| [[10.7.0-32]].
 
| [[10.7.0-32]].
 
| Time of exploit release.
 
| Time of exploit release.
Line 82: Line 82:  
| slackerSnail, 12Me12, incvoid
 
| slackerSnail, 12Me12, incvoid
 
Exploited by MrNbaYoh and [[User:Plutooo|plutoo]].
 
Exploited by MrNbaYoh and [[User:Plutooo|plutoo]].
 +
|-
 +
| SmileBASIC 3.x
 +
| Subscripted TIME$/DATE$ allow write access to DATA/BSS
 +
| Utf-16 characters can be assigned to subscripted TIME$/DATE$ interpreter sysvars which results in write-only access to all of DATA and some BSS in userland.
 +
TIME$[0]/DATE$[0] actually point to somewhere in rodata, and an overly large subscript can be used to write well past it and into the aforementioned areas. Demo [https://github.com/zoogie/smilehax-IIe here.]
 +
| App: 3.6.2 (3.6.0 latest for US/EU, JP appvers. can be downgraded)
 +
| System: [[11.13.0-45]].
 +
| April 2020
 +
| February 2020
 +
| bug publicly documented [https://translate.google.com/translate?sl=auto&tl=en&u=http%3A%2F%2Fsmilebasic.com%2Fdebug%2Farchive%2F here.]
 +
Exploited by Zoogie
 
|-
 
|-
 
| The Legend of Zelda: Tri Force Heroes
 
| The Legend of Zelda: Tri Force Heroes
Line 132: Line 143:  
| December 30, 2016
 
| December 30, 2016
 
| June, 2016
 
| June, 2016
 +
| [[User:Nba_Yoh|MrNbaYoh]]
 +
|-
 +
| Swapdoodle
 +
| Heap buffer overflow via unchecked size
 +
| The letter file format used by doodlebomb is composed of multiple chunks. Each chunks is described in the header of the file where the name, size and CRC of each chunk are stored. Some chunks are meant to be headers, every header's size should be 0x80, however the length of the STAHED1 chunk remains unchecked and the game memcpy the chunk to a 0x80 byte buffer with the length provided in the file. This way one is able to overwrite some pointers and get control of the execution flow.
 +
| App: > v1.1.1
 +
| App: v1.1.1
 +
| April 24, 2017
 +
| February, 2017
 +
| [[User:Nba_Yoh|MrNbaYoh]]
 +
|-
 +
| Pokemon Picross
 +
| Arbitrary memcpy via unchecked size
 +
| When reading the savefile, the game handles some lists of buffers that are copied to memory. These buffers should always be 0x14-bytes long but the game uses the size provided in the savefile to copy them. These buffers are copied in some structs and thus with a big enough length value, one can overwrite the next struct which contains a size and a destination address for a memcpy.
 +
| None?
 +
| App: ?
 +
| May 29, 2017
 +
| June, 2016
 +
| [[User:Nba_Yoh|MrNbaYoh]]
 +
|-
 +
| RPG Maker Fes/Player
 +
| Buffer overflow on .bss section
 +
| When loading a project, the game copies multiple chunks over the BSS section. However the number of chunks to copy is not checked, thus a large amount of chunk result in a buffer overflow. There's multiple way to exploit this flaw to gain an arbitrary memcpy or an arbitrary jump.
 +
| None?
 +
| App: ?
 +
| August 28, 2017
 +
| August, 2017
 +
| [[User:Nba_Yoh|MrNbaYoh]]
 +
|-
 +
| RPG Maker Fes/Player
 +
| Buffer overflow via unchecked file size
 +
| When loading a project, the game loads the file to a 0x200000 bytes long buffer. However the size remains unchecked, so with a big enough file one can overflow the buffer and overwrite a thread stack and then achieve ROP.
 +
| None?
 +
| App: ?
 +
| August 29, 2017
 +
| August, 2017
 +
| [[User:Nba_Yoh|MrNbaYoh]], [[User: ChampionLeake|ChampionLeake]]
 +
|-
 +
| Pokemon Omega Ruby/Alpha Sapphire
 +
| PSS data heap/stack overflow
 +
| When launching the game, multiple chunks from the save file are parsed and copied to a large heap buffer. When parsing PSS data (acquaintances, passerby) the game copies each entry to the heap buffer, the number of entries to copy is read from the end of the multiple pss data chunks and is not checked, leading to an overflow. The "PSS data - friends" chunk is vulnerable too, but the overflow occurs on the stack and unfortunately this isn't exploitable because of a 4 bytes uncontrolled value (in each entry) that gets written on sensitive data.
 +
| None
 +
| App: 1.4. System: [[11.6.0]].
 +
| October 1, 2017
 +
| June, 2016
 +
| [[User:Nba_Yoh|MrNbaYoh]]
 +
|-
 +
| RPG Maker Fes/Player
 +
| OOB write
 +
| When handling events in a map, the indices of "buttons" are not checked. This results in an out of bound bit write, one can thus write a rop directly on the stack (bit by bit).
 +
| None?
 +
| App: ?
 +
| August 5, 2018
 +
|
 +
| [[User:Nba_Yoh|MrNbaYoh]]
 +
|-
 +
| Unholy Heights
 +
| Buffer overflow via unchecked string size
 +
| The game stores some utf-16 messages in the savefile. Right before the message is the length(u32) for the string, the game uses this size to memcpy the message from the savefile to the stack without checking the length. This allows one to overwrite some function addresses on the stack and form a rop chain.
 +
| None
 +
| App: Initial Version
 +
| September 13, 2018
 +
| August, 2018
 +
| Kartik
 +
|-
 +
| Mononoke Forest
 +
| String Buffer Overflow via unchecked string length
 +
| The game stores plaintext profile names in the savefile. The profile names are strcpy/memcpy to different areas of the game's functions in the stack. Using a large extensive profile name, a user can overwrite some stack-registers and point to stack buffer addresses to eventually gain control of the stack to lead and form a rop-chain.
 +
| None
 +
| App: v1.0.0
 +
| August 14, 2019
 +
| February 8, 2019
 +
| [[User: ChampionLeake|ChampionLeake]] and [[User: Kartik|Kartik]]
 +
|-
 +
| Picross 3D: Round 2
 +
| Out of bounds array access allowing to point to fabricated objects and vtable
 +
| Game only checks save header. With the last interacted save slot index at +0xb270 in the save data unchecked we can achieve a predictable out of bounds access, as well inserting ROP data without detecting save corruption. Game references an object from an array of 3 elements and passes it to a function that will read object pointers and hit a vtable call. With a copy save data left in memory and a properly calculated index, we can point to a fake object position in the save, vtable jump to a stack pivot and start the ROP chain.
 +
| None
 +
| App: Initial version
 +
| September 10, 2020
 +
| August 24, 2020
 +
| [[User: Luigoalma|Luigoalma]] and [[User: Kartik|Kartik]]
 +
|}
 +
 +
==Flipnote Studio 3D==
 +
 +
{| class="wikitable" border="1"
 +
|-
 +
!  Summary
 +
!  Description
 +
!  Fixed in app/system version
 +
!  Timeframe info related to this was added to wiki
 +
!  Flaw discovered by
 +
|-
 +
| KFH frame count overflow
 +
| The KFH frame count field should not be >= 0x3E8, but it wasn't checked and so uncontrolled data were written over pointers, causing an unexploitable crash.
 +
| System: 11.6
 +
| September 20, 2017
 +
| [[User:Nba_Yoh|MrNbaYoh]]
 +
|-
 +
| KMI paper color overflow
 +
| Paper color field (and similar color fields) in KMI chunks was not checked, a too high value caused a jump to an uncontrolled location.
 +
| System: 11.6
 +
| September 20, 2017
 +
| [[User:Nba_Yoh|MrNbaYoh]]
 +
|-
 +
| KSN BGM data size overflow
 +
| The size of the BGM data in the KSN chunk was not checked, it was used in a memcpy so with a big enough size one could overwrite a thread stack on linear mem and achieve ROP (notehax v1).
 +
| System: 11.6
 +
| September 20, 2017
 +
| [[User:Nba_Yoh|MrNbaYoh]]
 +
|-
 +
| KMC chunk unchecked
 +
| The KMC chunk was not verified at all, the CRC32 and the size were not checked. A big enough size caused an integer overflow and made the game read the file backward.
 +
| System: 11.6
 +
| September 20, 2017
 +
| [[User:Nba_Yoh|MrNbaYoh]]
 +
|-
 +
| KMI layer size unchecked
 +
| The 3 layer size fields in KMI chunks were not checked, leading to some crashes in the editor.
 +
| System: 11.6
 +
| September 20, 2017
 +
| [[User:Nba_Yoh|MrNbaYoh]]
 +
|-
 +
| Bad "queue" implementation
 +
| When a KWZ was parsed, frames were copied in a kind of queue, bounds were not checked obviously, so with the KMI layer size flaw one was able to fill completely the queue, then write past the buffer and overwrite a heap chunk header (notehax v2). This is not possible anymore, the queue cannot be filled because layer sizes are checked. Moreover each time an element is removed from the queue, the whole content is memmoved *facepalm*.
 +
| System: 11.6
 +
| September 20, 2017
 
| [[User:Nba_Yoh|MrNbaYoh]]
 
| [[User:Nba_Yoh|MrNbaYoh]]
 
|}
 
|}
Line 146: Line 285:  
* "The Legend of Zelda: A Link Between Worlds" and "The Legend of Zelda: Tri Force Heroes": these games don't crash at all when the entire save-file(minus constant header data) is overwritten with /dev/random output / 0xFF-bytes. All of the CRC32s were updated for this of course.  Note that this refers to the regular save file: Tri Force Heroes can be exploited via BOSS extdata - see above.
 
* "The Legend of Zelda: A Link Between Worlds" and "The Legend of Zelda: Tri Force Heroes": these games don't crash at all when the entire save-file(minus constant header data) is overwritten with /dev/random output / 0xFF-bytes. All of the CRC32s were updated for this of course.  Note that this refers to the regular save file: Tri Force Heroes can be exploited via BOSS extdata - see above.
   −
* Pokemon Mystery Dungeon: Gates to Infinity has the same unchecked file bounds as Pokemon Super Mystery Dungeon, however since save compression was introduced in Pokemon Super Mystery Dungeon, it only allocates one buffer within the application heap instead of several within the linear heap, resulting in nothing to corrupt or overwrite even if the file's length is extended past it's allocation.
+
* Pokemon Mystery Dungeon: Gates to Infinity has the same unchecked file bounds as Pokemon Super Mystery Dungeon, however since save compression was introduced in Pokemon Super Mystery Dungeon, it only allocates one buffer within the application heap instead of several within the linear heap, resulting in nothing to corrupt or overwrite even if the file's length is extended past its allocation.
    
* "Kid Icarus: Uprising": Overwriting the entire savedata results in various crashes, nothing useful.
 
* "Kid Icarus: Uprising": Overwriting the entire savedata results in various crashes, nothing useful.
Line 157: Line 296:     
* "Mutant Mudds": Overwriting the savefile with random data results in a crash
 
* "Mutant Mudds": Overwriting the savefile with random data results in a crash
 +
 +
* "Worcle Worlds": Overwriting the savefile with 0xFF results in a crash due to an out of bound read
    
* "Animal Crossing: New Leaf": Creating a QR code from random data results in a valid QR code and a random design. In some very rare cases(which aren't always reproducible?) a crash/etc may occur, but this isn't known to be useful.
 
* "Animal Crossing: New Leaf": Creating a QR code from random data results in a valid QR code and a random design. In some very rare cases(which aren't always reproducible?) a crash/etc may occur, but this isn't known to be useful.
 +
 +
* "Angry Birds Star Wars": Strings in the savefile are preceded by their lengths. These strings are never stored on the stack and are memcpy'd into heap memory. If the size is invalid the alloc will fail and thus the memcpy will operate on a nullptr resulting in a useless data abort.
 +
 +
* "Gem Smashers": Overwriting the savefile with random bytes results in useless crashes.
 +
 +
* "Luxor:" Strings/plaintext in the savefile are present and these's no checks. Overwriting the whole save (excluding the header), with /dev/random cause a useless crash.
 +
 +
* "Luv Me Buddies Wonderland:" Doesn't crash at all with the entire savedata overwritten. Overwriting some areas, points to useless nulls
    
==Crashes needing investigation==
 
==Crashes needing investigation==
Line 181: Line 330:  
| 2012
 
| 2012
 
| [[User:Ichfly|Ichfly]]
 
| [[User:Ichfly|Ichfly]]
 +
|-
 +
| 3DS [[System Settings]] stack smash via title strings in [[DSiWare_Exports]]
 +
| DSiWare export banners contain 16 consecutive 0x100 byte, utf-16 game title strings for different languages. Nintendo correctly limits the string's max length by placing a NULL at str[127] before it's copied to the stack. However, they didn't allocate enough space for all 128 wchars (char/wchar type confusion?), so an attacker can craft a valid full-length string that will crash the stack at about str+0xEC. ROP execution can then be obtained from this crash in DSiWare Data Management as demonstrated [https://github.com/zoogie/Bannerbomb3 here].
 +
 +
Interesting note: A line feed wchar (00 0A) at any point in the string before the crash offset will prevent the crash from occurring.
 +
| None
 +
| [[11.13.0-45]]
 +
| Dec. 2018
 +
| Zoogie
 +
|-
 +
| 3DS SAFE_MODE [https://www.3dbrew.org/wiki/System_Settings#System_Updater System Updater] stack smash from proxy-url string
 +
| During [[Recovery Mode]] and after all 3 wifi slots fail to find an access point for sysupdate, a user is permitted to access the wifi settings mode to make changes. Here, if the proxy-url field string's NULL terminator had been altered beforehand, a stack smash can occur when the user selects Proxy Settings -> Detailed Setup and the corrupted url string is displayed.
 +
 +
This is a difficult crash to control because the url string is converted from ascii to utf-16 between the slot and stack, effectively reducing the available gadgets to 0.4% of the normal amount. It's possible to improvise an "escape" using an eoreq pc w/shift gadget to combine registers and form a jump that can access 1/2 of all available gadgets.
 +
 +
Because this exploit runs *under* SAFE_MODE, it's possible to run safehax with one's choice of k11 and arm9 hax. Prerequisite: a userland exploit with cfg:s/i access to modify the wifi slot. A demonstration can be viewed [https://github.com/zoogie/unSAFE_MODE here].
 +
| None
 +
| [[11.13.0-45]]
 +
| Jan. 2020
 +
| Zoogie
 
|-
 
|-
 
| [[Nintendo 3DS Sound]]
 
| [[Nintendo 3DS Sound]]
−
| "A heap overflow in tag processing leads to code execution when a specially- crafted m4a file is loaded by Nintendo 3DS Sound." (description from soundhax's github readme)
+
| When a .m4a is loaded, the song name is copied to a 256 byte buffer. When the song name begins with a Unicode BOM marker, it memcpy's the tag using the user-provided length. This gives an arbitrary write which can be used to achieve ROP.
−
| None
+
| [[11.4.0-37]]
−
| [[11.2.0-35]]
+
| [[11.4.0-37]]
−
| 2016
+
| June/July 2016
 
| [[User:nedwill|nedwill]]
 
| [[User:nedwill|nedwill]]
 
|}
 
|}
Line 224: Line 393:  
| November 2, 2015 (Exactly one week after the browser version pages were initially updated server-side)
 
| November 2, 2015 (Exactly one week after the browser version pages were initially updated server-side)
 
| [[User:Yellows8|Yellows8]]
 
| [[User:Yellows8|Yellows8]]
 +
|-
 +
| Skater - Bookmark OOB write
 +
| Each bookmark has an id that should not exceed 0x63 (99), however ids are not checked, this results in an OOB write on the stack, but only the value 0x01 can be written.
 +
|
 +
| [[11.6.0-39|11.6.0-39]]
 +
|
 +
| May 21, 2018
 +
| May 20, 2018
 +
| [[User:Nba_Yoh|MrNbaYoh]]
 +
|-
 +
| MicroSD Management - malformed security blob causes stack buffer overflow (mhax)
 +
| The MicroSD Management application's parsing of Windows NTLM security blobs in the SMB/CIFS protocol doesn't verify that the client's specified NT domain name is less than 32 UTF-16 characters.  When it's longer, a stack buffer overrun occurs, leading to a ROP chain and complete control of the mcopy application.
 +
 +
The malformed security blob can be sent by an attacker within the SMB_COM_SESSION_SETUP_ANDX (0x73) packet.
 +
| [[11.8.0-41|11.8.0-41]]
 +
| [[11.8.0-41|11.8.0-41]]
 +
| [[9.0.0-20|9.0.0-20]]
 +
| August 12, 2018
 +
| 2018
 +
| smea
 
|}
 
|}
   Line 237: Line 426:  
!  Timeframe this was discovered
 
!  Timeframe this was discovered
 
!  Discovered by
 
!  Discovered by
 +
|-
 +
| u8 brightness setting OOB index (menuhax67)
 +
| Config block 0x50001, which contains a u8 brightness setting that indexes a table of u32 addresses, can be set to an out-of-bounds index (it's normally 1-5). Located within cfg block 0x50009, there exists a single controllable u32 that's located within the u8's range. With these set properly, one can eventually redirect a function pointer to an address of their choice. This is triggered after the Home Menu quick launch tab is activated. POC [https://github.com/zoogie/menuhax67 here].
 +
| None
 +
| [[11.13.0-45]]
 +
|
 +
| October 4, 2020
 +
| September, 2020
 +
| Zoogie
 
|-
 
|-
 
| bossbannerhax
 
| bossbannerhax
Line 242: Line 440:     
Used with menuhax as of v3.2.
 
Used with menuhax as of v3.2.
−
| None
+
| [[11.3.0-36|11.3.0-X]]
−
| [[11.2.0-35|11.2.0-X]]
+
|
 
| [[1.0.0-0|1.0.0-0]]
 
| [[1.0.0-0|1.0.0-0]]
 
| November 18, 2016
 
| November 18, 2016
EvilFlight
48

edits

Retrieved from "https://www.3dbrew.org/wiki/Special:MobileDiff/19210...21337"

Navigation menu