Herald: Okay
Welcome to our last talk in this hall today
It's about console hacking
and I guess that's the reason why you are here
Console hacking has a long tradition
at our great conference
and we have seen lots of funny things.
People doing stuff with Xboxes,
Playstations and everything.
Okay.
Today we got a team which deals with the Nintendo DS,
so give a warm applause for plutoo, derrek and smea!
*applause*
smea: Hi!
I'm smea,
this is plutoo, this is derrek,
and today we are going to talk to you about our work on the Nintendo 3DS.
So, the way this talk is going to be structured, is we are just going to
go over all the hardware, organisation, software, like ...
Just give you a basic overview about how the system works.
And after that we are going to go into
basically every layer of security the system has,
and break every one of them.
*laughter*
*applause*
smea: Okay. So, as you probably know,
the 3DS, the original Nintendo 3DS was released in 2011.
It's a system that is kind of underpowered.
It's got, like ...
It's got an ARM11 dual core CPU,
268Mhz, it's got a nice proprietary GPU,
bit of RAM, you know, the usual.
It's also backwards compatible with DS games, which is nice.
Then the new 3DS was released
in 2014 and 2015,
there was like different regions.
And it was basically just the same console,
just some improvements in the hardware.
You've got a better CPU, it has got more cores
It's faster, it has got more RAM. Basically everywhere.
So, it is just the same thing, it runs the same software, exactly.
It has got some exclusive software, but not much.
So, in terms of the hardware overview,
this is what we are going to talk about looks like, in general.
So you got the top part right here,
which is what we are going to go into first.
This is like the ARM11 part.
Basically, you've got the ARM 11,
which is the main CPU.
It runs the main operating system.
It has two cores as I just said, or four cores.
So, it runs the main operating system, it runs the games,
it runs all the applications.
Basically, it's just - If you're doing something on the 3DS that you can,
you can see it happening, it's happening on that CPU.
It has got access to all of the main memory.
So that includes FCRAM,
which is 128MB or 256MB, depending on which model it is.
And FCRAM is actually divided in three separate regions.
So you first got the application region,
which contains the currently running game or application.
The system region, which contains applets, which are basically tiny applications,
which run in the background.
So, that includes the home menu,
which is actually always running in the background,
and the web browser,
which can actually run at the same time as your game,
so it has to run there.
And then you got the base region, which is more interesting,
it contains all the system modules of the operating system,
as well as some kernel data, such as handle tables and MMU tables.
So it is kind of sensitive stuff.
And then we got a WRAM, which is tiny
and contains all the kernel code,
and, well, most of the kernel structures as well.