Difference between revisions of "DSiWare VulnList"

From DSiBrew
Jump to navigation Jump to search
 
(48 intermediate revisions by 3 users not shown)
Line 1: Line 1:
−
This lists DSiWare that might have vulnerabilities, like strcpy or sprintf from savedata. If you know of DSiWare that has English-only string(high-scores, player name, high-scores that use username from system settings, etc) input, mention it on IRC EFNet #dsidev. Or contact yellowstar 6 at gmail dot com.
 
−
Before you contact anyone about your dsiware, please make sure your dsiware is _not_ listed on this page anywhere.
 
−
 
−
It would be nice to target DSiWare that are listed under the DSi Shop most popular search: Nintendo would have a lot of difficultly removing DSiWare from that list without ticking off a lot of non-homebrewer customers. Targets not on that list will suffer the same fate as Sudoku,(removed quickly and patched eventually) if exploits for those were released.
 
−
 
−
DSiWare savedata is extracted and modified with these tools: https://github.com/neimod/dsi save_extract and save_adjust both require sd_key, but we will not redistribute this key.
 
−
 
−
For these lists status "None" means code reversing engineering for the DSiWare wasn't started. Status "Started" means code reversing engineering for that DSiWare was started. Status "Done" means code reverse engineering was finished.
 
−
 
 
== Total listed DSiWare ==
 
== Total listed DSiWare ==
  
Line 18: Line 9:
 
|-
 
|-
 
|  Incomplete
 
|  Incomplete
−
|  21
+
|  16
 
|-
 
|-
 
|  Done
 
|  Done
−
|  13
+
|  27
 
|-
 
|-
 
|  DSiWare which probably aren't exploitable
 
|  DSiWare which probably aren't exploitable
−
|  47
+
|  59
 
|-
 
|-
 
|  Already have
 
|  Already have
Line 30: Line 21:
 
|-
 
|-
 
|  All total
 
|  All total
−
|  84
+
|  100
 
|}
 
|}
  
Line 81: Line 72:
 
|  None
 
|  None
 
|  Has ASCII strings. It's unlikely this can be exploited, seems to crash /w out-of-bounds array-index.
 
|  Has ASCII strings. It's unlikely this can be exploited, seems to crash /w out-of-bounds array-index.
−
|-
 
−
|  Crazy Sudoku
 
−
|  Player name
 
−
|  None
 
−
|  Has ASCII strings for player name.
 
 
|-
 
|-
 
|  Crystal Monsters
 
|  Crystal Monsters
Line 102: Line 88:
 
|  Has ASCII string but the checksum is unknown.
 
|  Has ASCII string but the checksum is unknown.
 
|-
 
|-
−
|  Field Runners
+
|  Jelly Car 2
−
|  High-Scores
+
|  High Score name
−
|  Started
+
|  None
−
|  The xml .plist the game uses for storing savedata contains high-scores strings.
+
|  Uses ASCII player name for time scores; It's unlikely this can be exploited, seems to crash /w out-of-bounds array-index.
−
|-
 
−
|  Frogger Returns
 
−
|  High-Scores
 
−
|  Started
 
−
|  Has ASCII high-scores.
 
−
|-
 
−
|  Guitar Rock Tour
 
−
|  High-Scores
 
−
|  Started
 
−
|  Has ASCII high-scores.
 
−
|-
 
−
|  Legends of Exidia
 
−
|  Player name
 
−
|  Started
 
−
|  Has ASCII player name.
 
 
|-
 
|-
 
|  Lets golf
 
|  Lets golf
Line 140: Line 111:
 
|  Player name
 
|  Player name
 
|  None
 
|  None
−
|  Has ASCII strings, unknown checksum.
+
|  Has ASCII strings.
−
|-
 
−
|  UNO
 
−
|  Player name and high-scores
 
−
|  Started
 
−
|  Has ASCII text. It's unlikely this can be exploited, seems to crash /w out-of-bounds array-index.
 
 
|}
 
|}
  
Line 164: Line 130:
 
|  High-Scores
 
|  High-Scores
 
|  Has ASCII high-scores with null terminated strings. string bugs only corrupted the display, making the game unplayable.
 
|  Has ASCII high-scores with null terminated strings. string bugs only corrupted the display, making the game unplayable.
 +
|-
 +
|  Academy: Checkers
 +
|  Profile names
 +
|  Game didn't crash with a long profile string.
 
|-
 
|-
 
|  Arcade Hoops Basketball
 
|  Arcade Hoops Basketball
Line 180: Line 150:
 
|  High-scores and word list
 
|  High-scores and word list
 
|  Has ASCII null-terminated high-score list names and null-terminated word list strings.  ( No crash, just nice very high scores, and very long words displayed. )
 
|  Has ASCII null-terminated high-score list names and null-terminated word list strings.  ( No crash, just nice very high scores, and very long words displayed. )
 +
|-
 +
|  Crazy Sudoku
 +
|  Profile names/Data File
 +
|  The ASCII player name or the game data aren't exploitable. This game can still be crashed.
 
|-
 
|-
 
|  Dark Void Zero
 
|  Dark Void Zero
 
|  High-Scores
 
|  High-Scores
 
|  No limit on length of drawn record names, no vuln with high-scores. Although this game can be crashed it isn't exploitable.
 
|  No limit on length of drawn record names, no vuln with high-scores. Although this game can be crashed it isn't exploitable.
 +
|-
 +
|  Digger Dan & Kaboom
 +
|  Player name
 +
|  The ASCII player names aren't exploitable, but the save is <10KB anyway.
 
|-
 
|-
 
|  Dracula
 
|  Dracula
Line 192: Line 170:
 
|  None
 
|  None
 
|  Has high-scores without names, scores are ASCII null-terminated strings. Managed to semi-crash this, but system reset still worked so this probably isn't exploitable.
 
|  Has high-scores without names, scores are ASCII null-terminated strings. Managed to semi-crash this, but system reset still worked so this probably isn't exploitable.
 +
|-
 +
|  Fieldrunners
 +
|  High-Scores
 +
|  The xml, ".plist", in the game is used for storing savadata which contains high-score strings. Using a very large string crashes the game leading it to stack buffer overflow. The game has already been exploited through [https://github.com/yellows8/dsi/tree/master/exploits/fieldrunhax fieldrunnerhax].
 +
|-
 +
|  Frogger Returns
 +
|  High-Scores
 +
|  Has ASCII high-scores. strcpys to a static buffer from savedata, unknown if this is exploitable but there's only <10KB free space available(way too low for a payload) so meh.
 +
|-
 +
|  Guitar Rock Tour
 +
|  High-Scores
 +
|  Has ASCII high-score strings stored in the savedata. Using a very long excessive string can crash the game to lead into a stack smash. This game was successfully exploited through [https://github.com/yellows8/dsi/tree/master/exploits/grtpwn grtpwn].
 +
|-
 +
|  Legends of Exidia
 +
|  Player name
 +
|  Has ASCII player name stored in the savadata. Using an extensive long string will cause a stack smash to saved registers and can eventually be exploited through [https://github.com/yellows8/dsi/tree/master/exploits/exidiahax exidiahax].
 +
|-
 +
|  Mario Calculator
 +
|  None
 +
|  No savedata at all in the tad.
 
|-
 
|-
 
|  Paul's Shooting Adventure
 
|  Paul's Shooting Adventure
 
|  High-Scores
 
|  High-Scores
 
|  Records are entered when you complete the game, names are ASCII strings null-terminated. Not exploitable.
 
|  Records are entered when you complete the game, names are ASCII strings null-terminated. Not exploitable.
 +
|-
 +
|  Prehistorik Man
 +
|  Password text
 +
|  Has some ASCII password text for continuing, but there's less than 10KB free.
 
|-
 
|-
 
|  Primrose
 
|  Primrose
 
|  High-scores
 
|  High-scores
 
|  Has English-only high-scores and a trivial checksum, not exploitable.
 
|  Has English-only high-scores and a trivial checksum, not exploitable.
 +
|-
 +
|  Rayman
 +
|  Player name
 +
|  No overflow, with a long string the game only displays one extra character.
 +
|-
 +
|  Soul of Darkness
 +
|  Player name
 +
|  Has ASCII player name with 3 profiles.
 
|-
 
|-
 
|  Sudoku
 
|  Sudoku
Line 205: Line 215:
 
|  Has ASCII player name for each of the 3 save slots. Game was crashed with an excessively long player name. The game has already been exploited through [[Sudokuhax]].
 
|  Has ASCII player name for each of the 3 save slots. Game was crashed with an excessively long player name. The game has already been exploited through [[Sudokuhax]].
 
|-
 
|-
−
|  Rayman
+
|  Telegraph Sudoku & Kakuro
−
|  Player name
+
|  Profile name
−
|  No overflow, with a long string the game only displays one extra character.
+
|  No overflow, the game slot acts as if things are normal, only gives you a lot of completion stars
 +
|-
 +
|  The Legend of Zelda: Four Swords Anniversary
 +
|  Savedata filesize
 +
|  The game has 2 savefiles. When one savefile fails to load (larger than a usual savefile), the game loads the backup save and will continue load without any errors. That being said, one can crash the game with a larger game filesize to attack the heap and successfully overwrite the stack registers including the pointer counter. The game has already been exploited through [https://github.com/yellows8/dsi/tree/master/exploits/4swordshax 4swordshax].
 +
|-
 +
|  UNO
 +
|  Profile names
 +
|  Has ASCII Player name each for of the 5 save slots. The game was crashed with a very large player name which overwritten the stack registers including the pointer counter. The game was successfully exploited which is known as [https://github.com/ChampionLeake/UNO-pwn UNO*pwn].
 +
|-
 +
|  WordSearcher
 +
|  Player name & WordSearch Board
 +
|  Has ASCII strings (profile or slot names) and has plaintext crossword levels. No overflows with a large string nor a bigger crossword board resulting thus, not exploitable
 
|}
 
|}
  
Line 225: Line 247:
 
|  Absolute Reversi
 
|  Absolute Reversi
 
|  None
 
|  None
−
|  No strings in savedata.
+
|  No strings in savedata, not enough space for payload anyways.(payload exceeds the free space by ~6KB)
 
|-
 
|-
 
|  A Little Bit of... All-Time Classics: Card Classics
 
|  A Little Bit of... All-Time Classics: Card Classics
Line 236: Line 258:
 
|-
 
|-
 
|  A Little Bit of... All-Time Classics: Strategy Games
 
|  A Little Bit of... All-Time Classics: Strategy Games
 +
|  None
 +
|  No strings
 +
|-
 +
|  Alpha Bounce
 
|  None
 
|  None
 
|  No strings
 
|  No strings
Line 244: Line 270:
 
|-
 
|-
 
|  Aquia: Art Style Series
 
|  Aquia: Art Style Series
 +
|  None
 +
|  No strings
 +
|-
 +
|  Aura Aura Climber
 
|  None
 
|  None
 
|  No strings
 
|  No strings
Line 274: Line 304:
 
|  None
 
|  None
 
|  No strings in savedata.
 
|  No strings in savedata.
 +
|-
 +
|  Brain Drain
 +
|  None
 +
|  No strings in save.
 +
|-
 +
|  Castle of Magic
 +
|  None
 +
|  No strings
 +
|-
 +
|  Cave Story
 +
|  None
 +
|  No strings
 
|-
 
|-
 
|  Countdown Calender
 
|  Countdown Calender
Line 280: Line 322:
 
|-
 
|-
 
|  Crash Course Domo
 
|  Crash Course Domo
 +
|  None
 +
|  No strings.
 +
|-
 +
|  Chronos Twins
 
|  None
 
|  None
 
|  No strings.
 
|  No strings.
Line 290: Line 336:
 
|  None
 
|  None
 
|  No strings.
 
|  No strings.
 +
|-
 +
|  DodoGo! Robo
 +
|  None
 +
|  No strings
 
|-
 
|-
 
|  Dr. Mario Express
 
|  Dr. Mario Express
Line 302: Line 352:
 
|  None
 
|  None
 
|  No strings in savedata.
 
|  No strings in savedata.
 +
|-
 +
|  Little Red Riding Hood's Zombie BBQ
 +
|  None
 +
|  No strings
 
|-
 
|-
 
|  FIZZ
 
|  FIZZ
 
|  High-scores
 
|  High-scores
−
|  Savedata contains ASCII high-scores, but all the high-scores are contained in the same string without a null terminator. A vuln is unlikely.
+
|  Savedata contains ASCII high-scores, but all the high-scores are contained in the same string without a null terminator. Can't be crashed at all, no payload space anyways.
 
|-
 
|-
 
|  Flipper
 
|  Flipper
Line 322: Line 376:
 
|  No strings
 
|  No strings
 
|  Saves only scores not strings.
 
|  Saves only scores not strings.
 +
|-
 +
|  GO Series: 10 Second Run
 +
|  None
 +
|  No strings.
 
|-
 
|-
 
|  Metal Torrent
 
|  Metal Torrent
Line 362: Line 420:
 
|  None
 
|  None
 
|  No strings.
 
|  No strings.
 +
|-
 +
|  Plants Vs. Zombies
 +
|  None
 +
|  No strings, uses system user name for player name.
 
|-
 
|-
 
|  Pop Island
 
|  Pop Island
Line 382: Line 444:
 
|  None
 
|  None
 
|  Has 3 save slots but no string input.
 
|  Has 3 save slots but no string input.
 +
|-
 +
|  Simply Minesweeper
 +
|  None
 +
|  No strings.
 
|-
 
|-
 
|  Sokomania
 
|  Sokomania
Line 397: Line 463:
 
|  Tetris Party Live
 
|  Tetris Party Live
 
|  None
 
|  None
−
|  Zero text input.
+
|  Zero text input, not enough payload space anyway.
 
|-
 
|-
 
|  WarioWare: Snapped
 
|  WarioWare: Snapped
Line 404: Line 470:
 
|-
 
|-
 
|  ZENGAGE: Art Style Series
 
|  ZENGAGE: Art Style Series
 +
|  None
 +
|  No strings.
 +
|-
 +
|  Zenonia
 
|  None
 
|  None
 
|  No strings.
 
|  No strings.
Line 423: Line 493:
 
|-
 
|-
 
|  Opera
 
|  Opera
−
|  Nothing interesting in savedata.
+
|  The savedata is private NAND-only, no savedata is copied to SD card.
 
|}
 
|}

Latest revision as of 04:09, 31 March 2019

Total listed DSiWare

Total DSiWare in below lists.

List Total
Incomplete 16
Done 27
DSiWare which probably aren't exploitable 59
Already have 3
All total 100

DSiWare with incomplete analysis

Name Input type(s) Status Description
Academy: Tic-Tac-Toe Player name None Has an UCS-2 player name. It's unlikely this can be exploited, seems to crash /w out-of-bounds array-index.
Advanced Circuits Profile names Started Save slots are obfuscated, the algorithm is understood for all but the first save slot. The checksum calculation is unknown.
Arcade Bowling High-Scores None The checksum seemed to be identical to arcade hoops, but when save modification was attempted the game appeared to reset the high-scores?
Art Academy: First Semester None? None Has some ASCII strings in savedata, but they seem to be from the game binary not user input?
Bejeweled Twist High-scores None Checksum is unknown, save has ASCII strings.
Bounce & Break High-scores Started Has ASCII high-scores. It's unlikely this can be exploited, seems to crash /w out-of-bounds array-index.
Card games Player name None Has ASCII player names, checksum is unknown.
Chess Challenge Profile names None Has ASCII strings. It's unlikely this can be exploited, seems to crash /w out-of-bounds array-index.
Crystal Monsters Player name Started Has ASCII player name. Not sure if this can be exploited somehow, it crashes /w array-index out-of-bounds fail.
Elemental Masters Player name? None Has ASCII strings but the checksum is unknown.
Faceez Player name? None Has ASCII string but the checksum is unknown.
Jelly Car 2 High Score name None Uses ASCII player name for time scores; It's unlikely this can be exploited, seems to crash /w out-of-bounds array-index.
Lets golf Player name None Has ASCII player name checksum is unknown.
Mixed Messages Player name and other text None Uses ASCII for player name and other text input, but the checksum is unknown.
Number Battle Player name None Uses ASCII strings, the value of each char is - 0x20 of the actual ASCII value. The checksum is unknown.
Pop Superstar: Road to celebrity Player name None Has ASCII strings.

DSiWare with finished analysis

Name Input type(s) Description
5 in 1 Solitaire Profile names Game didn't crash with a long profile string.
Airport Mania: Non Stop Flights High-Scores Has ASCII high-scores with null terminated strings. string bugs only corrupted the display, making the game unplayable.
Academy: Checkers Profile names Game didn't crash with a long profile string.
Arcade Hoops Basketball High-Scores, names via settings Has ASCII high-scores with null terminated strings, no string bugs.
Army Defender High-scores Has ASCII strings for high-scores, game didn't crash with modified high-scores.
Bloons Profile names Has some profile names but they're all in one tiny savfile.
Bookworm High-scores and word list Has ASCII null-terminated high-score list names and null-terminated word list strings. ( No crash, just nice very high scores, and very long words displayed. )
Crazy Sudoku Profile names/Data File The ASCII player name or the game data aren't exploitable. This game can still be crashed.
Dark Void Zero High-Scores No limit on length of drawn record names, no vuln with high-scores. Although this game can be crashed it isn't exploitable.
Digger Dan & Kaboom Player name The ASCII player names aren't exploitable, but the save is <10KB anyway.
Dracula No manual input Savedata contains ASCII high-scores from DSi username, and ASCII perks/powerups. High-scores doesn't have string bugs.
Escapee Go None Has high-scores without names, scores are ASCII null-terminated strings. Managed to semi-crash this, but system reset still worked so this probably isn't exploitable.
Fieldrunners High-Scores The xml, ".plist", in the game is used for storing savadata which contains high-score strings. Using a very large string crashes the game leading it to stack buffer overflow. The game has already been exploited through fieldrunnerhax.
Frogger Returns High-Scores Has ASCII high-scores. strcpys to a static buffer from savedata, unknown if this is exploitable but there's only <10KB free space available(way too low for a payload) so meh.
Guitar Rock Tour High-Scores Has ASCII high-score strings stored in the savedata. Using a very long excessive string can crash the game to lead into a stack smash. This game was successfully exploited through grtpwn.
Legends of Exidia Player name Has ASCII player name stored in the savadata. Using an extensive long string will cause a stack smash to saved registers and can eventually be exploited through exidiahax.
Mario Calculator None No savedata at all in the tad.
Paul's Shooting Adventure High-Scores Records are entered when you complete the game, names are ASCII strings null-terminated. Not exploitable.
Prehistorik Man Password text Has some ASCII password text for continuing, but there's less than 10KB free.
Primrose High-scores Has English-only high-scores and a trivial checksum, not exploitable.
Rayman Player name No overflow, with a long string the game only displays one extra character.
Soul of Darkness Player name Has ASCII player name with 3 profiles.
Sudoku Player name Has ASCII player name for each of the 3 save slots. Game was crashed with an excessively long player name. The game has already been exploited through Sudokuhax.
Telegraph Sudoku & Kakuro Profile name No overflow, the game slot acts as if things are normal, only gives you a lot of completion stars
The Legend of Zelda: Four Swords Anniversary Savedata filesize The game has 2 savefiles. When one savefile fails to load (larger than a usual savefile), the game loads the backup save and will continue load without any errors. That being said, one can crash the game with a larger game filesize to attack the heap and successfully overwrite the stack registers including the pointer counter. The game has already been exploited through 4swordshax.
UNO Profile names Has ASCII Player name each for of the 5 save slots. The game was crashed with a very large player name which overwritten the stack registers including the pointer counter. The game was successfully exploited which is known as UNO*pwn.
WordSearcher Player name & WordSearch Board Has ASCII strings (profile or slot names) and has plaintext crossword levels. No overflows with a large string nor a bigger crossword board resulting thus, not exploitable

DSiWare that probably don't have vulnerabilities

Name Input type(s) Description
24/7 Solitaire None No high-scores or string input.
Absolute Reversi None No strings in savedata, not enough space for payload anyways.(payload exceeds the free space by ~6KB)
A Little Bit of... All-Time Classics: Card Classics None No strings
A Little Bit of... All-Time Classics: Family Games None No strings
A Little Bit of... All-Time Classics: Strategy Games None No strings
Alpha Bounce None No strings
Asphalt 4 None No strings
Aquia: Art Style Series None No strings
Aura Aura Climber None No strings
Birds & Beans No strings No strings in savedata.
Boom Boom Squaries No strings No strings in savedata.
Bomberman Blitz Name Has UCS-2 strings.
Boxlife None No strings.
Blackjack None No strings.
Brain Age Express: Arts & Letters None No strings in savedata.
Brain Age Express: Math None No strings in savedata.
Brain Drain None No strings in save.
Castle of Magic None No strings
Cave Story None No strings
Countdown Calender None No user strings. There's many "ANIV" tokens in the save and some embedded bmp files.
Crash Course Domo None No strings.
Chronos Twins None No strings.
Dictionary 6 in 1 None No strings in savedata.
DIGIDRIVE: Art Style Series None No strings.
DodoGo! Robo None No strings
Dr. Mario Express None No strings.
Earthworm Jim None No strings.
Extreme Hangman None No strings in savedata.
Little Red Riding Hood's Zombie BBQ None No strings
FIZZ High-scores Savedata contains ASCII high-scores, but all the high-scores are contained in the same string without a null terminator. Can't be crashed at all, no payload space anyways.
Flipper None No strings.
Frenzic High-scores Has UCS-2 high-scores.
Gene Labs None Small savedata with no strings.
Glory Days - Tactical Defense No strings Saves only scores not strings.
GO Series: 10 Second Run None No strings.
Metal Torrent Player name Uses a UCS-2 string.
Master of Illusion Express: Psychic Camera None Tiny savfile no strings.
My Notebook: Blue None No strings.
My Notebook: Pearl None No strings.
My Sims: Camera None No strings.
Mighty Flip Champs None No strings.
My Exotic Farm Player name Not exploitable, there's a 0x01 byte immediately after the string not null-terminated.
Paper Airplane Chase None The size of both files in the savedata are only 8 bytes, no strings.
PiCOPiCT: Art Style series None No strings.
PiCTOBiTS: Art Style series None No strings.
Plants Vs. Zombies None No strings, uses system user name for player name.
Pop Island None No strings.
Pyoro None 16-byte savedata no strings.
Photo Clock None Small savedata, no strings at all.
Photo Dojo Handwritten character name via stylus Savedata only contains .jpg files and some tiny "save"/"info" files.
Shantae: Risky's Revenge None Has 3 save slots but no string input.
Simply Minesweeper None No strings.
Sokomania None No strings.
Sparkle Snapshots None No strings.
Starship Defense None No strings.
Tetris Party Live None Zero text input, not enough payload space anyway.
WarioWare: Snapped None No high-scores or string input.
ZENGAGE: Art Style Series None No strings.
Zenonia None No strings.

DSiWare that were already obtained for analysis

Do not contact us about the DSiWare in this list, we already have them. We had these for ages, and never managed to find any vulns.

Name Text format
Flipnote Studio UCS-2
Mario Vs. Donkey Kong: Minis March Again UCS-2
Opera The savedata is private NAND-only, no savedata is copied to SD card.
Retrieved from "https://dsibrew.org/w/index.php?title=DSiWare_VulnList&oldid=2098948"