122 lines
5.4 KiB
Plaintext
122 lines
5.4 KiB
Plaintext
Brahma - Privilege elevation exploit for the Nintendo 3DS
|
|
=========================================================
|
|
|
|
WTF is 'Brahma'?
|
|
----------------
|
|
Brahma is a development tool for the Nintendo 3DS platform that enables
|
|
privileged code execution on the ARM9 processor of the Nintendo 3DS platform.
|
|
It does so by exploiting two vulnerabilities in order to elevate its
|
|
privileges.
|
|
|
|
The exploits utilized by Brahma are based on "commercial" exploits that
|
|
have been reverse engineered. Brahma has been developed with the goal of
|
|
understanding and documenting the nature of the exploits in mind and has
|
|
been put further effort into during its development process in order to
|
|
achieve reliable exploitation and stability.
|
|
|
|
Brahma comes with full source code that is based on libctru and requires
|
|
existing user mode code execution privileges (Ninjhax), and can then be
|
|
used to further elevate privileges to ARM9 pre-kernel / SVC mode.
|
|
|
|
Also, "Brahma, the creator" is a god in hinduism that is often portrayed
|
|
with four heads and arms (heh... so funny :\).
|
|
|
|
How to build:
|
|
-------------
|
|
- Download and install devkitARM (http://devkitpro.org/wiki/Getting_Started)
|
|
- Open a shell and run make
|
|
|
|
How to use:
|
|
-----------
|
|
- Prebuilt binary releases are available at
|
|
https://github.com/patois/Brahma/releases
|
|
- Run brahma.3dsx (using homebrew launcher)
|
|
- By default, the exploit will attempt to gain ARM11 kernel privileges before
|
|
finally gaining ARM9 pre-kernel privileges (by performing a "firmlaunch")
|
|
|
|
"Hotkeys" (press and hold during startup of BRAHMA):
|
|
----------------------------------------------------
|
|
|
|
* LEFT : Loads 'arm9payload.bin' from the root folder of the 3DS' SD card
|
|
and executes it
|
|
|
|
* RIGHT : Performs a reboot / firm launch of the 3DS system
|
|
|
|
* NONE : Displays a menu which allows payload files to be received via
|
|
a WiFi network connection or loaded from the '/brahma' folder
|
|
located in the root folder of the SD card
|
|
|
|
In order to send payload files to the 3DS via a network connection,
|
|
the Python script '/tools/client.py' can be used. Alternatively, netcat
|
|
does the job as well.
|
|
|
|
Syntax:
|
|
-------
|
|
client.py: 'python client.py <3DS ip> <filename>'
|
|
netcat: 'nc <3DS ip> 80 < <filename>'
|
|
|
|
Examples:
|
|
---------
|
|
client.py: 'python client.py 10.0.0.5 payload.bin'
|
|
netcat: 'nc 10.0.0.5 80 < payload.bin'
|
|
|
|
Example programs that run in privileged ARM9 mode can be downloaded from
|
|
https://github.com/patois/3DSProjects/tree/master/Brahma/
|
|
|
|
A memory dumper (3DSDevTools) for Brahma is available at
|
|
https://github.com/patois/3DSDevTools/releases
|
|
|
|
There is also a port of Decrypt9 by archshift which can be loaded using
|
|
bootstrap or Brahma (use 'make' to build the project, then use one of the
|
|
methods supported by Brahma to load the Decrypt9 payload). Decrypt9 can be
|
|
downloaded from https://github.com/archshift/Decrypt9/tree/bootstrap
|
|
|
|
Developers:
|
|
-----------
|
|
Brahma and its exploits which enable privileged ARM9 code execution
|
|
on the Nintendo 3DS may also be used as a "library" (#include "brahma.h")
|
|
|
|
- call brahma_init() - initializes Brahma
|
|
- call load_arm9_payload() - loads a payload binary from disk
|
|
- call firm_reboot() - executes a payload binary (privileged ARM9 code)
|
|
- (please check the source code for more features and options)
|
|
|
|
ARM9 payload must consist of valid ARM9 executable code and will be
|
|
mapped to physical address 0x23F00000 during run-time. Its code should begin
|
|
with a branch instruction at offset 0 and a 'placeholder' for a u32
|
|
variable at offset 4, which will be filled by Brahma with a backup of
|
|
the original ARM9 entry point of the FIRM header during runtime.
|
|
|
|
Brahma is written in a way that allows developers of payload binaries
|
|
to easily return control to the 3DS' firmware by simply returning from
|
|
the main() function of the payload.
|
|
|
|
This allows reading and altering of memory contents, such as the mapped
|
|
Nintendo firmware (including ARM9 kernel, Process9, ARM11 kernel and several
|
|
processes running on the ARM11 core), for testing purposes, without requiring
|
|
any changes on the file system level.
|
|
|
|
Credits:
|
|
--------
|
|
- To 3dbrew.org and all its contributors for being such a great resource
|
|
- To whomever initially found the vulnerabilities and wrote the publicly
|
|
available exploit code
|
|
- To everybody who's been working on porting this exploit and its various
|
|
"bootstrap" branches to newer firmware versions and improving its stability
|
|
(in particular yifanlu, yuriks and shinyquagsire23)
|
|
- To everybody involved in creating libctru, Ninjhax and the Homebrew Menu
|
|
|
|
Disclaimer:
|
|
THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESSED OR IMPLIED WARRANTIES,
|
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS
|
|
OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
|
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
|
|
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
|
|
IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
|
|
OF SUCH DAMAGE.
|
|
|
|
(c) 2015, patois
|