How to boot a custom payload (RAM Dumping)?

[yellows8]

How to boot a custom payload (RAM Dumping)?

[yellows8]

"If I use your hosted version and create browserhax_hblauncher_payload.bin on SD Card" Please don't use that, it's only meant for running Home Menu ROP(aka hblauncher-payload).

"The payload bin is a compiled RAM dumper from Spider3DSTools." That will not work unless you modified it to use the paramblk passed to the payload(unless you're on the same system-version Spider3DSTools was intended for, of course).

"It's interesting to find the webkithax_tmp.bin " That's where the arm11code payload is downloaded to with HTTP.

[lotsa-spaghetti]

How to modifiy the paramblk?

Also, on the local server the payload was never downloaded. The temp file was first created after running the exploit from your server, which I did later. On my server it simply freezed a few seconds and then kicked me out everytime. So the payload never ran.

[yellows8]

"How to modifiy the paramblk?" {/reading fail}

[lotsa-spaghetti]

*How to modify it to use the paramblk passed to the payload?

[yellows8]

shutterbug2000/vcinject#1

[lotsa-spaghetti]

What exactly do I have to do? I don't understand assembler very well and also don't know how your code exactly works. I also found a 3DS memory dumping program in C. Can I use the ASM code of RegionFOUR and then the C code or do I have to modify it?

[yellows8]

This is just browser ROP not arm11code-payload, if this is what you're referring to..... https://github.com/yifanlu/Spider3DSTools/blob/master/MemoryDump.S

" I also found a 3DS memory dumping program in C." Link?

[lotsa-spaghetti]

Yes, the assembler file is the right one. The other was in a link on a video. I am not on the computer right now, but here is the link: http://www.mediafire.com/?p1lutz7k8gvpuo5

[lotsa-spaghetti]

Or here is another version of the C RAM dumper: http://www.mediafire.com/?vp1sn61ow2i5ozz

[yellows8]

"Can I use the ASM code of RegionFOUR and then the C code" Sure if you use it correctly.

[lotsa-spaghetti]

Can you help me at this?

[yellows8]

Be more specific.

[lotsa-spaghetti]

What should I change to make the C code running?

[yellows8]

What do you not understand?

EDIT: In the code linked in the issue from above.

[lotsa-spaghetti]

How the C code and the ASM code works. I also don't really know what a ROP chain is. I am programming since at least 6 years now, but this is too hard for me to understand. So I am asking you for the steps or changes I need to do to make the code running. Maybe I will learn also from that.

[lotsa-spaghetti]

Also, even if the code should be working, it will maybe not executed by the exploit as stated above.

[yellows8]

If you can't figure it out from the regionFOUR source you probably shouldn't be tinkering with this tbh.

[lotsa-spaghetti]

And here are some random questions about the RegionFour C code:

• What exactly do methods like void inject_payload(u32* linear_buffer, u32 target_address)
• What does APT or gspwn mean in the method's names?
• Which methods are needed for the memdump to run? Do I need something like inject_payload or this gspwn stuff from R4 in the memdump C code or is this only dedicated to R4?
• How to compile the assembly code along with C code?

[lotsa-spaghetti]

"If you can't figure it out from the regionFOUR source you probably shouldn't be tinkering with this tbh."

Could you do that for me then, please?

[yellows8]

Only the code using the paramblk is relevant.

[lotsa-spaghetti]

"Only the code using the paramblk is relevant."

On which file/line is that code? In the payload asm file this is documented, but not on the R4 stuff.

[yellows8]

Not sure what you're on about with "u32 *paramblk" being in the regionFOUR cn_secondary_payload/source/main.c in plenty of places.....

[lotsa-spaghetti]

Oh, there are many, I see. If I only have the entry point method, how should that paramblk be coded in? And what exactly is paramblk?

[yellows8]

https://github.com/yellows8/3ds_browserhax_common/blob/master/3dsbrowserhax_common.php#L1965

[lotsa-spaghetti]

This means?

[profi200]

Common now this is not for support and it is not worth opening an issue for this. Read what he linked and try it out. If you can't then too bad i guess.

[lotsa-spaghetti]

I'll try to do that today. Maybe I'll get lucky.