Homebrew [33c3] Console Hacking 2016 (3DS/WiiU) talk Dec 27-30: smea, derrek, nedwill, naehrwert

[DinohScene]

https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/8344.html

Important details:
Title: Nintendo Hacking 2016: Game Over
Dec 27 (8:30pm German time) 2:30pm EST, 1:30pm CST, 12:30pm MST, 11:30am PST
Room: Saal 2
new info "includes exploits for achieving persistent code execution capabilities and the extraction of secrets from both Wii U and 3DS"

Cheers for sharing.
I just noted down the Nintendo talk, the PS4 talk, the gameboy talk and several other talks.

 

[VinsCool]

https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/8344.html

Important details:
Title: Nintendo Hacking 2016: Game Over
Dec 27 (8:30pm German time) 2:30pm EST, 1:30pm CST, 12:30pm MST, 11:30am PST
Room: Saal 2
new info "includes exploits for achieving persistent code execution capabilities and the extraction of secrets from both Wii U and 3DS"

This is a9lh hype again!

 

[naddel81]

This is a9lh hype again!

only better this time.

 

[Goombi]

Dis gon be gud. Maybe we'll hear about seed bypass I once read about... Would be cool.
And the Wii U is gonna have a bad time during that talk.

 

[Deleted User]

It'd be hilarious if the 3ds's private key was unlocked/found.

 

[zoogie]

It'd be hilarious if the 3ds's private key was unlocked/found.

That would certainly explain their "Game Over" talk subtitle. Still think that's really unlikely.

 

[PRAGMA]

"includes exploits for achieving persistent code execution capabilities and the extraction of secrets from both Wii U and 3DS"
OH SHIT!

 

[Slattz]

I honestly think the 3ds wont get a big exploit like a9lh but rather the Wii U will. If there isn't going to be a bootrom dump, it might just be persistent homebrew or something for 3ds. I think the Wii U might get more attention and possible get a coldboot exploit.

 

[Suiginou]

1. Wii U boot1
2. 3DS bootroms
3. a new Kernel11 exploit
4. soundhax

Let's see how right I'll be.

 

[RealityNinja]

1. Wii U boot1
2. 3DS bootroms
3. a new Kernel11 exploit
4. soundhax

Let's see how right I'll be.

and why not a new arm9 exploit even on 11.2?! XD

 

[Vappy]

1. Wii U boot1
2. 3DS bootroms
3. a new Kernel11 exploit
4. soundhax

Let's see how right I'll be.

Need something like a bingo chart for 33c3 predictions.

 

[Suiginou]

Need something like a bingo chart for 33c3 predictions.

https://i.imgur.com/opRmcM0.png

 

[VinsCool]

https://i.imgur.com/opRmcM0.png

Hah, I like that!

 

[gkoelho]

This sounds interesting. Also I think nintendo is planning to expand the 3ds's lifespan so it would be a wonderful time for a bootroom dump. Other than that, there isnt anything that can really change the game aside from keys and a k9hax for 9.2<

 

[Aurora Wright]

"persistent code execution capabilities" and "extraction of secrets" imply 3DS bootroms and bootromhax to me. A bootrom exploit is already semi-public (it was discussed on IRC and the like) so I'd say they'll present that.

 

[zoogie]

https://i.imgur.com/opRmcM0.png

I'd replace my crappy poll with that if I could. Added to OP, nice job.

"persistent code execution capabilities" and "extraction of secrets" imply 3DS bootroms and bootromhax to me. A bootrom exploit is already semi-public (it was discussed on IRC and the like) so I'd say they'll present that.

iirc derrek ruled out the possibility he'd present bootrom stuff on IRC. Need to check my logs.

 

[Aurora Wright]

I'd replace my crappy poll with that if I could. Added to OP, nice job.

iirc derrek ruled out the possibility he'd present bootrom stuff on IRC. Need to check my logs.

That's weird:

While both have since been the targets of many successful attacks, certain aspects have so far remained uncompromised, including critical hardware secrets.
During this talk, we will present our latest research, which includes exploits for achieving persistent code execution capabilities and the extraction of secrets from both Wii U and 3DS.

There are no "uncompromised hardware secrets" except for the bootrom crypto keys; unless there's some major hardware fail with the AES hardware that allows one to get them without bootrom it has to be bootrom...

 

[wiiu more like pee u]

What was revealed last time they did this conference?

 

[fodder]

What was revealed last time they did this conference?

https://smealum.github.io/3ds/32c3/#/

Here's a vid

 

[zoogie]

What was revealed last time they did this conference?

tl'dr
a9lh - self explanatory
memchunkhax2 - downgrades <= 10.3
ntrcardhax - new arm9 sploit <= 10.3. currently needs ak2i and a9 hacked 3ds for flasher.
snshax - userland privilege escalation (am:u). downgrades <=10.1. never implemented.

new browserhax, ironhax part2, menuhax.

That's weird:

There are no "uncompromised hardware secrets" except for the bootrom crypto keys; unless there's some major hardware fail with the AES hardware that allows one to get them without bootrom it has to be bootrom...

Ok, this is what he said (around nov 27 #3dsdev):
[15:10] <Stary[m]> derrek: you know what to do in your ccc talk now
.....
.....
[16:29] <@derrek> yeah no bootrom exploit sry

I guess that doesn't rule out some form of dumping method or other bootrom info.