RicBent

C/C++/ASM | Newer/Next Team member | @smbnext |

[RicBent @ricbent_]

Bad Apple!! but played on coins in New Super Mario Bros. 2 on a 3ds

[RicBent @ricbent_]

The write forges a texture-copy command directly into the GPU command queue to gspwn a loader into executable memory. This then streams in the rest of the payload and jumps to it. No ROP. Will do a proper writeup at some point.

[RicBent @ricbent_]

Arbitrary remote code execution in New Super Mario Bros. 2, delivered from another console in the same local wireless game.

Two array indices are taken straight off the wire from the other player, never bounds-checked, resulting in an arbitrary write.

https://t.co/4ZSnwN764N

[RicBent @ricbent_]

@gergely_kalman I guess you'd use this when wanting to test iOS from the toilet.

[RicBent @ricbent_]

@gergely_kalman @theevilbit Congrats. Looking forward to your talk :)

[Super Mario Bros. Next @smbnext]

To celebrate this holiday season, we've prepared a short trailer featuring some new & familiar courses! ❄️

[RicBent @ricbent_]

@MarioBrothBlog The HDMA just is not disabled when the crash dump appears, causing these horizontal scanline shifts. So I guess the crash dump screen doesn't really "crash" here. But I guess this is still an oversight on Nintendo's side indeed.

[RicBent @ricbent_]

@sottaku_app Prefetching the next quiz/audio would be nice as currently it's kinda slowing you down compared to stuff like Anki.

Also the reading quiz too often asks for words with hiragana where only one answer can make sense.

[RicBent @ricbent_]

@ArthurTheEagle The game has a function to draw tiles. This includes animated tiles like coins, ? blocks, etc.
Frames are just stored as a bitfield and read from one file frame by frame.

[RicBent @ricbent_]

Bad Apple!! but played on coins in New Super Mario Bros. 2 on a 3ds

[RicBent @ricbent_]

@MrNbaYoh @HiccupJul Luma3ds already patches application code for the file redirection. Should be possible to catch a large amount of these cases with simple signature checks for the offending code.

[RicBent @ricbent_]

@Kharosx0 @ShinyQuagsire Home is entirely useless for me. Why is there no 32 bit ARM? And why is it single architcture? Can they not decide if it’s actually for hobbyists or not?

[Super Mario Bros. Next @smbnext]

Jump through, across, and over all sorts of prickly hazards in this bright, blue bramble-themed stage! 🌿🍀

[RicBent @ricbent_]

It certainly isn't clever, is it?

[RicBent @ricbent_]

This compiler is, uh, not really clever or the devs really feared 0 not beeing 0.

[RicBent @ricbent_]

@MikageEmu I would be willing to donate but I would not pay for an emulator directly. Open source and preservation is the most important part. Though maybe a good middle way would be open source + easy user friendly apps in stores.

[RicBent @ricbent_]

@LubbaSMG2 @smbnext @primmcutie The level editor is called CoinKiller. The code mod to load the levels is built into SMBNext itself.

[RicBent @ricbent_]

@ThatRRfan727 @smbnext Not really. The code of the game needs to be modded to include this functionality at which point it isn't "vanilla" anymore.

[Super Mario Bros. Next @smbnext]

Remote level loading (and more) is now possible over HTTP! (Courtesy of @ricbent_ )

[RicBent @ricbent_]

@HexRaysSA Will IDA Home ever include 32 bit cloud decompilers? The odd limitation to 64 bit renders IDA Home useless to me.

[Super Mario Bros. Next @smbnext]

Take a peek at this newly-updated factory stage, featuring @lunarbunten's arrangement of "Steam Gardens" from Super Mario Odyssey! ⛰️🏭

[RicBent @ricbent_]

@KingProgma @MarioBrothBlog You too! Obviously we have no chance to be 100% certain with this. Can only speculate and judge what the most plausible thing that happened was. Considering Nintendo almost always overwrites that behavior to prevent spins like this, an oversight seems the most plausible :)