DSiBrew

Changes

DSi exploits (view source)

Revision as of 03:41, 23 March 2020

4,765 bytes added ,  03:41, 23 March 2020
→‎Type of exploits
Line 3: Line 3:  
== Type of exploits ==
 
== Type of exploits ==
 
Here is a general list of all the different types/terms of exploits to know. This is to know the differences of each exploit.
 
Here is a general list of all the different types/terms of exploits to know. This is to know the differences of each exploit.
−
*'''NTR/NDS-Mode Exploits:'''
+
== NTR/NDS-Mode Exploits ==
 
These are ARM9 exploits that takes over a NDS-mode cartridge. These cartridges (on the back) are labeled as ''NTR''. These type of exploits are very limited since there's no SD or NAND access. They can be used to run a small binary payload making these exploits almost useless.
 
These are ARM9 exploits that takes over a NDS-mode cartridge. These cartridges (on the back) are labeled as ''NTR''. These type of exploits are very limited since there's no SD or NAND access. They can be used to run a small binary payload making these exploits almost useless.
−
*'''TWL/DSi-Enhanced Cart Exploits:'''
+
 
 +
{| class="wikitable" border="1"
 +
!  Name
 +
!  Description
 +
!  Author
 +
!  Source
 +
|-
 +
| FIFA NDS
 +
| Every single FIFA game on the Nintendo DS has been exploited.
 +
| Everyone
 +
| [https://github.com/CTurt/Dara CTurt's Source Code]
 +
|-
 +
| Bangai-O-Sploit
 +
| A ''primary'' entrypoint for the game, ''Bangai-O Spirit'', on the Nintendo DS. This game was successfully exploit through sound.
 +
| smealum
 +
| [https://github.com/smealum/bangai-o-sploit Install]
 +
|-
 +
| NDS-ILH-Save-Exploit
 +
| "I Love Horses" Nintendo DS save exploit
 +
| [https://github.com/mojobojo/ mojobojo]
 +
| [https://github.com/mojobojo/NDS-ILH-Save-Exploit Install]
 +
|-
 +
| ABR-NDS-SaveExploit
 +
| A stack smash savegame exploit for the game "Asterix Brain Trainer"
 +
| [https://github.com/WemI0/ Weml0]
 +
| [https://github.com/WemI0/ABR-NDS-SaveExploit Install]
 +
|-
 +
| HaxxStation
 +
| DS Download Station exploit, allowing one to run any commercial homebrew over from the DS download play application.
 +
| shutterbug2000, Gericom, and Apache Thunder
 +
| [https://gbatemp.net/threads/haxxstation-ds-download-station-exploit.473648/ See Here]
 +
|-
 +
| BreakingNews
 +
| A stack smash savegame exploit for the game "The New York Times: Crossword" resulting from stack buffer overflow (profile slot names).
 +
| [[User:ChampionLeake|ChampionLeake]]
 +
| [https://github.com/ChampionLeake/BreakingNews/ Install]
 +
|}
 +
 
 +
 
 +
== TWL/DSi-Enhanced Cart Exploits ==
 
These are ARM9 exploits that take over a enhanced DSi-mode cartridge. These cartridges (on the back) are labeled as ''TWL''. Unfortunately they don't have SD or NAND access but can be used to gather console information and maybe find other vulnerabilities. These exploits can also be used for dslink, which can load homebrew applications via internet connections.
 
These are ARM9 exploits that take over a enhanced DSi-mode cartridge. These cartridges (on the back) are labeled as ''TWL''. Unfortunately they don't have SD or NAND access but can be used to gather console information and maybe find other vulnerabilities. These exploits can also be used for dslink, which can load homebrew applications via internet connections.
−
*'''DSiWare(True DSi-Mode) Exploits:'''
+
 
 +
{| class="wikitable" border="1"
 +
!  Name
 +
!  Description
 +
!  Author
 +
!  Source
 +
|-
 +
| The Biggest Losers
 +
| Exploit for The Biggest Loser which runs in DSi mode if you use a real cartridge on a DSi or 3DS system, otherwise, it runs in DS mode.
 +
| st4rk
 +
| [https://github.com/st4rk/The-Biggest-Loser Install]
 +
[https://davejmurphy.com/dslink/ WinterMute's dslink]
 +
|-
 +
| Cookhack
 +
| DSi Cooking Coach exploit
 +
| WinterMute
 +
| [https://github.com/WinterMute/savesploits/tree/master/cookhack PoC]
 +
[https://davejmurphy.com/dslink/ dslink]
 +
|-
 +
| Classichack
 +
| DSi Classic Word Games exploit
 +
| WinterMute
 +
| [https://github.com/WinterMute/savesploits/tree/master/classichack PoC]
 +
[https://davejmurphy.com/dslink/ dslink]
 +
|-
 +
| SystemFlaaw
 +
| The first DSi exclusive cartridge title to be exploited for the game, SystemFlaw
 +
| zoogie
 +
| [https://github.com/zoogie/SystemFlaaw Install]
 +
|}
 +
 
 +
 
 +
== DSiWare(True DSi-Mode) Exploits ==
 
These are ARM9 exploits that take over a DSiWare title. They run in the same context that the DSi-Enhanced games do, but with additional SD and NAND access. These exploits are valuable since they can be used to downgrade the console firmware to older versions. You can also run commercial homebrew applications from the SD card. However this doesn't allow any cartridge access.
 
These are ARM9 exploits that take over a DSiWare title. They run in the same context that the DSi-Enhanced games do, but with additional SD and NAND access. These exploits are valuable since they can be used to downgrade the console firmware to older versions. You can also run commercial homebrew applications from the SD card. However this doesn't allow any cartridge access.
−
*'''ARM7 Exploits:'''
+
 
 +
{| class="wikitable" border="1"
 +
!  Name
 +
!  Description
 +
!  Author
 +
!  Source
 +
|-
 +
| Sudokuhax
 +
| One of the first DSiWare exploits for the Nintendo DSi on the game SUDOKU by EA. (You must have the 1st version of this game in order to use the exploit as it was patched.
 +
| TeamTwiizer, yellows8
 +
| [https://github.com/yellows8/dsi/tree/master/exploits/sudokuhax Install]
 +
|-
 +
| grtpwn
 +
| A Gameloft DSiWare savegame exploit for the game, Guitar Rock Tour!
 +
| yellows8
 +
| [https://github.com/yellows8/dsi/tree/master/exploits/grtpwn Install]
 +
|-
 +
| exidiahax
 +
| A Gameloft DSiWare savegame exploit for the game, Legend of Exidia!
 +
| yellows8
 +
| [https://github.com/yellows8/dsi/tree/master/exploits/exidiahax Install]
 +
|-
 +
| fieldrunhax
 +
| A Subatomic Studios DSiWare savegame exploit for the game, FIELDRUNNERS!
 +
| yellows8
 +
| [https://github.com/yellows8/dsi/tree/master/exploits/fieldrunhax Install]
 +
|-
 +
| 4swordhax
 +
| A DSiWare savegame exploit for the game, The Legend of Zelda: Four Swords Anniversary Edition!
 +
| yellows8
 +
| [https://github.com/yellows8/dsi/tree/master/exploits/4swordhax Install]
 +
|-
 +
| Flipnote( ͡° ͜ʖ ͡°) or ugopwn
 +
| A Primary entrypoint for the DSiWare Application, Flipnote Studio! This exploit was first exploit by shutterbug2000. Later, WinterMute and fincs released a stable version of the exploit.
 +
| shutterbug2000, WinterMute, fincs, zoogie
 +
| [https://davejmurphy.com/%CD%A1-%CD%9C%CA%96-%CD%A1/ Install]
 +
|-
 +
| UNO*pwn
 +
| A DSiWare savegame exploit for the game, UNO, that involves a simple stack buffer overflow within the player's username with the settings functionality of the game!
 +
| [[User:ChampionLeake|ChampionLeake]]
 +
| [https://github.com/ChampionLeake/UNO-pwn Install]
 +
|-
 +
| MemoryPit
 +
| A primary exploit for the DSi that involves the system application "Camera"! All you need is an SD Card to use this exploit.
 +
| shutterbug2000
 +
| [https://gbatemp.net/threads/memory-pit-a-new-dsi-exploit-for-dsi-camera.539432/ See Here]
 +
|}
 +
 
 +
 
 +
== ARM7 Exploits ==
 
These exploits take over the ARM7 processor. In the DSi, these processor handles critical operations and cryptography operations, among other things. These exploits are extremely rare and there's no concrete targets. The DSi menu (The Launcher) is known to run in the ARM7 context. At the moment there's only one exploit known as RocketLauncher. These exploits allow FULL ACCESS with the DSi launcher.
 
These exploits take over the ARM7 processor. In the DSi, these processor handles critical operations and cryptography operations, among other things. These exploits are extremely rare and there's no concrete targets. The DSi menu (The Launcher) is known to run in the ARM7 context. At the moment there's only one exploit known as RocketLauncher. These exploits allow FULL ACCESS with the DSi launcher.
−
*'''Bootcode Exploits:'''
+
{| class="wikitable" border="1"
 +
!  Name
 +
!  Description
 +
!  Author
 +
!  Source
 +
|-
 +
| RocketLauncher
 +
| One of the first ever unlocked ARM7 DSi exploit involving the DS Cart White list in secton 3. This exploit only works on firmwares v1.4!
 +
| ApacheThunder, stuckpixel, NoCash, Gericom, and Normmatt
 +
| [https://gbatemp.net/threads/announcing-rocketlauncher-the-first-exploit-with-unlocked-arm7.476288/ Writeup]
 +
|}
 +
 
 +
 
 +
== Bootcode Exploits: ==
 
These exploits gain full SCFG_EXT access rights immediately after powering on the system (right before starting the launcher). These exploits are significantly rare and concrete targets can be the launcher's ''title.tmd''. At the moment, nocash's exploit, ''Unlaunch'' is the only known exploit.
 
These exploits gain full SCFG_EXT access rights immediately after powering on the system (right before starting the launcher). These exploits are significantly rare and concrete targets can be the launcher's ''title.tmd''. At the moment, nocash's exploit, ''Unlaunch'' is the only known exploit.
 +
{| class="wikitable" border="1"
 +
!  Name
 +
!  Description
 +
!  Author
 +
!  Source
 +
|-
 +
| Unlaunch
 +
| Possibly one of the first bootcode exploit for the Nintendo DSi!
 +
| NoCash
 +
| [https://problemkaputt.de/unlaunch.htm Install & Writeup]
 +
|}
    
== DSi-mode exploits ==
 
== DSi-mode exploits ==
Retrieved from "https://dsibrew.org/wiki/Special:MobileDiff/2099021"