File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change 11# fasthax
22
33This is an exploit for an ARM11 kernel vulnerability in Nintendo 3DS versions
4- <= 11.2. Core 1 (SYSCORE) runs a thread that handles a synchronization event
4+ <= 11.2.
5+
6+ Core 1 (SYSCORE) runs a thread that handles a synchronization event
57queue. Objects added to the queue do not have their reference count incremented.
68When the thread goes to fetch an object, it locks the scheduler, but this
79doesn't prevent a user thread on core 0 from freeing the timer object, thus
810leading to a UAF. Because a vtable pointer is located at the free pointer
911location, this leads to kernel code execution. Many workarounds are needed for
10- stability. Those are documented as part of the codebase.
12+ stability; those are documented as part of the codebase.
1113
1214This exploit installs ` svcBackdoor ` at SVC numbers 0x30 and 0x7b.
1315
You can’t perform that action at this time.
0 commit comments