Fierce Waffle ROP Loader 3DS: Difference between revisions

From GameBrew
(Created page with "{{Infobox 3DS homebrew | title = fierce waffle RAM dumper | image = https://dlhb.gamebrew.org/3dshomebrew/|250px | type = System Tools | version = | licence = Mixed | author...")
 
m (Text replacement - "Category:3DS homebrew loaders" to "")
 
(20 intermediate revisions by the same user not shown)
Line 1: Line 1:
{{Infobox 3DS homebrew
{{Infobox 3DS Homebrews
| title = fierce waffle RAM dumper
|title=3DS Toolkit by Fierce Waffle
| image = https://dlhb.gamebrew.org/3dshomebrew/|250px
|image=3dstoolkitfie2.png
| type = System Tools
|description=3DS RAM dumper and ROP Loader.
| version =  
|author=Fierce Waffle
| licence = Mixed
|lastupdated=2013/12/26
| author = Fierce Waffle
|type=System Tools
| website = https://gbatemp.net/threads/homebrew-development.360646/
|version=2014
| download = https://dlhb.gamebrew.org/3dshomebrew/fierce-waffles-RAM-dumper.rar
|license=Mixed
| source = https://dlhb.gamebrew.org/3dshomebrew/fierce-waffles-RAM-dumper.rar
|download=https://dlhb.gamebrew.org/3dshomebrews/3dstoolkitfie.7z
|website=https://gbatemp.net/threads/homebrew-development.360646
}}
}}
<youtube>OuQR4Sm8Jm8</youtube>
{{Obsolete}}


Contains two Launchers, one for GW and one for Waffles Loader, dumps the whole FCRAM to SDCard, might take a few tries to boot. Needs about 30 Minutes for the entire dump.
The 3DS Toolkit is a utility that can extract memory dump, developed by Fierce Waffle. The project was initially titled ROP Loader, where ROP is an abbreviation for Return-Oriented Programming, and is one of the exploit technologies that utilize the code of programs that are already installed.
 
==User guide==
===How does it work===
Since the 3DS Toolkit uses the same DS Profile exploit as Gateway 3DS, the operating environment is 4.1-4.5. The DS Profile exploit is/was a well known, but not often performed exploit for the Nintendo 3DS. This exploit involved setting a value too high for the length of a string which caused too much to be read on the stack.
 
There is a file called SYS: /Launcher.dat that 3DS uses to configure the system, and the first character "S" is removed from the string "SYS: /Launcher.dat" in the memory of 3DS. Furthermore, by mounting the SD card as "YS: /", Launcher.dat functions as ROP.
 
However, that alone is only a userland exploit (DS Profile exploit), so in order to go beyond that it would require a kernel exploit. The method this 3DS Toolkit used is through changing the permissions of IOpen_File, which allows user to dump RAM and possbility to execute custom codes.
 
===How to use===
Copy the ROPLoader.nds file to any flashcart compatible 3DS flashcard.
 
Insert the flash card and open the 'game' with the title of ROPLoader.
 
When loaded, press the A button to initiate the initial ROP payload installation process
 
If the verification process fails, repeat steps 2-3. Otherwise, press A to return to your 3DS home menu.
 
Copy the Launcher.dat that you wish to use to your 3DS' SD card and reinsert the SD into your 3DS.
 
To initiate the exploit navigate to System Settings >  Other Settings > Profile > Nintendo DS Profile.
 
===References===
* [http://3dbrew.org/wiki/Filesystem_services Nintendo 3DS Filesystem Services].
* [http://3dbrew.org/wiki/Memory_layout Nintendo 3DS Memory Layout].
* [http://3dbrew.org/wiki/3DS_System_Flaws Nintendo 3DS Exploits].
* [https://web.archive.org/web/20140203084258/http://nocash.emubase.de/gbatek.htm#dsserialperipheralinterfacebusspi DS Serial Peripheral Interface Bus] (archived).
* [https://web.archive.org/web/20140122214721/http://smealum.net/?page_id=299 3DS Homebrew and Custom Firmware] (archived).
 
==Changelog==
'''v0.0.0.2 2013/12/26'''
* Fixed Verify Bug.
* Fixed an error users would get when installing the ROP Loader.
 
'''v0.0.0.1 2013/12/25'''
* Initial Release.
* RAM dumping from 0x00100000 with a size of 0x00300000 bytes.
 
==External links==
* GitHub - https://github.com/naehrwert/p3ds
* Official website - [https://web.archive.org/web/20140122214721/http://www.fiercewaffle.com/softwareArticle.php?id=10 http://www.fiercewaffle.com/softwareArticle.php?id=10] (archived)
* GBAtemp - https://gbatemp.net/threads/homebrew-development.360646

Latest revision as of 06:02, 6 May 2024

3DS Toolkit by Fierce Waffle
3dstoolkitfie2.png
General
AuthorFierce Waffle
TypeSystem Tools
Version2014
LicenseMixed
Last Updated2013/12/26
Links
Download
Website
Ambox content.png
 This application has been obsoleted by one or more applications that serve the same purpose, but are more stable or maintained.

The 3DS Toolkit is a utility that can extract memory dump, developed by Fierce Waffle. The project was initially titled ROP Loader, where ROP is an abbreviation for Return-Oriented Programming, and is one of the exploit technologies that utilize the code of programs that are already installed.

User guide

How does it work

Since the 3DS Toolkit uses the same DS Profile exploit as Gateway 3DS, the operating environment is 4.1-4.5. The DS Profile exploit is/was a well known, but not often performed exploit for the Nintendo 3DS. This exploit involved setting a value too high for the length of a string which caused too much to be read on the stack.

There is a file called SYS: /Launcher.dat that 3DS uses to configure the system, and the first character "S" is removed from the string "SYS: /Launcher.dat" in the memory of 3DS. Furthermore, by mounting the SD card as "YS: /", Launcher.dat functions as ROP.

However, that alone is only a userland exploit (DS Profile exploit), so in order to go beyond that it would require a kernel exploit. The method this 3DS Toolkit used is through changing the permissions of IOpen_File, which allows user to dump RAM and possbility to execute custom codes.

How to use

Copy the ROPLoader.nds file to any flashcart compatible 3DS flashcard.

Insert the flash card and open the 'game' with the title of ROPLoader.

When loaded, press the A button to initiate the initial ROP payload installation process

If the verification process fails, repeat steps 2-3. Otherwise, press A to return to your 3DS home menu.

Copy the Launcher.dat that you wish to use to your 3DS' SD card and reinsert the SD into your 3DS.

To initiate the exploit navigate to System Settings > Other Settings > Profile > Nintendo DS Profile.

References

Changelog

v0.0.0.2 2013/12/26

  • Fixed Verify Bug.
  • Fixed an error users would get when installing the ROP Loader.

v0.0.0.1 2013/12/25

  • Initial Release.
  • RAM dumping from 0x00100000 with a size of 0x00300000 bytes.

External links

Retrieved from ‘https://www.gamebrew.org/index.php?title=Fierce_Waffle_ROP_Loader_3DS&oldid=154368’

Advertising: