- 打卡等级：偶尔看看
- 打卡总天数：7
- 打卡月天数：1
- 打卡总奖励：672
- 最近打卡：2025-08-03 01:57:06
|
ContentHax的方式不用网页直接通过WiiU购买的VC虚拟主机游戏进入Homebrew Launcher
通过eshop购买一个任天堂ds的虚拟主机游戏（可能是这个游戏，看了一下下面的英文有提到这个名字Kirby Squeak Squad，但是去fix94的官方网页似乎又没有提供这个rom是否所有游戏都行，还是固定游戏，没写的话估计是所有ds游戏都行） ，然后上传一些破解的文件就可以通过ds的频道进入hbl了。省去每天开机访问网页，有时候还不成功的闹心事情了。
rom.zip
(5.17 KB, 下载次数: 40)
把这个包上传到wiiu上就行了
haxchi是对Wii U（hachihachi）的Nintendo DS虚拟主机模拟器的攻击。它最初是为柯比吱吱小队。理论上，可以利用所有DS虚拟控制台游戏。这是可能的，由于“contenthax”，一个漏洞在wii u的标题完整性设计：只有代码和关键描述符签名，所有其他内容留在攻击者的宽容。这可以简单地通过要求IOSU复制在MLC或USB上的/ content /目录中的文件来利用。 contenthax也可以通过使用MCP_CopyTitle命令（不是所有进程都具有访问权，但是例如主菜单和系统设置具有它）可以从powerpc用户空间利用。由于没有针对该内容的完整性数据，因此CopyTitle无法验证该恶意内容，并且因此乐意将其从SD卡复制到MLC或USB（如果询问）。
很可能几乎所有的应用程序都可以通过contenthax以某种方式利用，因为开发者不太可能编程防御内容，他们应该是唯一的控制。为此漏洞选择了Nintendo DS虚拟控制台应用程序，因为它具有动态发出可执行代码的能力。作为一个好的奖金，hachihachi包括其代码的符号。 haxchi利用了模拟器的rom加载器中的一个bug，并基本上让它执行任意memcpy操作。从那里，实现代码执行是微不足道的，因为没有ASLR到位。
haxchi（以及任何其他contenthax）可以用于在wii u上实现持久自动无符号代码执行。 这是因为可以将wii u配置为只需通过修改SLC上的文件即可引导到任何给定的标题。 所述文件是sys / config / system.xml，并且<default_title_id type =“hexBinary”length =“8”> ... </ default_title_id>可以被设置为任何任意标题ID，例如hachihachi的。
注意：这是很容易通过搞乱这个文件，所以不要这样做，除非你真的知道你在做什么。
Haxchi
Smealum just posted this on Github:
https://github.com/smealum/haxchi
FIX94 ported smea's haxchi (originally made for Kirby Squeak Squad) to the eur version of Brain Age:
https://github.com/FIX94/haxchi
install process
haxchi can be very easily installed using iosuhax's wupclient. for example, if hachihachi is installed to the MLC, it suffices to do:
w.up("rom.zip", "/vol/storage_mlc01/usr/title/00050000/101A5600/content/0010/rom.zip")
of course, using wupclient to install haxchi permanently requires that redNAND be disabled, unless hachihachi is installed to USB, in which case it can be installed from redNAND using:
w.up("rom.zip", "/vol/storage_usb01/usr/title/00050000/101A5600/content/0010/rom.zip")
coldboothax can be installed by downloading system.xml as so:第二个方法，不建议弄，虽然简单，但是改错了，就砖了，这个是往真实系统内写入东西的，所以还是我们的川岛博士吧
w.dl("/vol/system/config/system.xml")
modifying it, and then uploading it back:
w.up("system.xml", "/vol/system/config/system.xml")
contents
- haxchi_code: basic demo (native code)
- haxchi_rop.s: hachihachi process ROP which will emit haxchi_code as executable
- haxchi.s: generates a malicious SRL file
credit
smea, plutoo, yellows8, naehrwert and derrek
-----------------------------------------------------------------------
[UPDATE 8/11/16]
Yellows8 added informations regarding contenthax for N64 Virtual Console games!
N64 VC contenthax
Present in system versions: N/A
Publicly exploited: No
Discovered by: yellows8 (Early 2016)
The Wii U N64 VC emulator title("VESSEL") has two known vulns which can be attacked via contenthax. These vulns were tested on hardware, but actual exploitation wasn't tested.
Note that this title can only write to codegen(JIT) via using OSCodegenCopy(), unlike other titles.
Currently this is the only known VC platform(N64) which is affected by any of these VESSEL vulns(not all platforms were checked for this).
The .ini loading occurs much earlier during title boot than the font loading. These vulns(or at least the .ini one) trigger while the system is still displaying the application spash-screen(from the title's meta/ directory).
- Stack buffer overflow when handling BMFont "pages". The entire block is copied to stack using just the size, without checking the size. The loaded data is not checked either, other than converting uppercase to lowercase('A'..'Z' to 'a'..'z'). This string is used with sprintf + PNG texture loading afterwards.
- Heap buffer overflow during .ini parsing with field-data string starting with '"'. The allocated heap buffer is 0x100-bytes, but the size is not checked when copying the value string into this buffer. During copying/etc this string content is not checked/modified, besides checking for the end of the string with '"'. For example: HAX = "LONGSTRINGHERE"
Source wiiubrew.org/w/index.php?title=Exploits
未完
来源
|
|
x 0
狗仔卡
发表于 2016-11-10 13:50:11
提升卡
置顶卡
变色卡
千斤顶
显身卡
发表于 2016-11-10 18:53:29
楼主