Skip to content

Commit 0f93f4c

Browse files
author
Ned Williamson
committed
tweak
1 parent 8aa76b2 commit 0f93f4c

1 file changed

Lines changed: 4 additions & 2 deletions

File tree

README.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
11
# fasthax
22

33
This is an exploit for an ARM11 kernel vulnerability in Nintendo 3DS versions
4-
<= 11.2. Core 1 (SYSCORE) runs a thread that handles a synchronization event
4+
<= 11.2.
5+
6+
Core 1 (SYSCORE) runs a thread that handles a synchronization event
57
queue. Objects added to the queue do not have their reference count incremented.
68
When the thread goes to fetch an object, it locks the scheduler, but this
79
doesn't prevent a user thread on core 0 from freeing the timer object, thus
810
leading to a UAF. Because a vtable pointer is located at the free pointer
911
location, this leads to kernel code execution. Many workarounds are needed for
10-
stability. Those are documented as part of the codebase.
12+
stability; those are documented as part of the codebase.
1113

1214
This exploit installs `svcBackdoor` at SVC numbers 0x30 and 0x7b.
1315

0 commit comments

Comments
 (0)