DSi system flaws

boot0

Summary	Description	Successful exploitation result	Discovered	Discovered by
Undefined instruction/abort exception handler backed by RAM not cleared on reset	Much like the 3DS boot0, some of the DSi's exception handlers are backed by RAM which isn't immediately cleared on a reset. Using fault injection, it is possible to cause an undefined instruction exception before the clearing happens, making the CPU jump to code remaining in RAM from the previous boot cycle. This only works on the ARM7, as on the ARM9, it is backed by main memory, which is only initialized by boot1.	Code execution under ARM7 boot0	June 2016 (first successful exploit: data-sort-value="2021C"|March 2021	Nocash, Normmatt, dark_samus, ApacheThunder (first successful exploit: PoroCYon)

boot1

Summary	Description	Successful exploitation result	Fixed in boot1 version	Discovered	Discovered by
Poor System Menu TMD size check	boot1 loads the System Menu's TMD for verification and loading, and it attempts to check the size. However, instead of checking if size > capacity, it checks if size > size, which is always false, resulting in a buffer overflow.	Code execution under boot1	Unfixed	August 2017	Nocash

System Menu

Summary	Description	Successful exploitation result	Discovered	Discovered by
DS games are not patched to verify overlays.	While the System Menu checks all cartridge overlays to prevent unauthorized software, no such check exists when the overlays are actually loaded, despite an MIOS-like patcher being possible to implement. By changing the overlay after it is checked, it is possible to run arbitrary code.	Code execution under any DS game with overlays.	January 2010	Datel, blasty (by reverse engineering Action Replay)