|Exploit working on v2.0 to v9.5.0-22|
The spider exploit was found by MathewE and used by Gateway-3DS team to launch their flashcard's Gateway v3.0 payload on 3DS system menu version 2.0.x to 9.2.x.
Gateway used another exploit in addition to this one to get Kernel access which has been patched on System menu version 9.3.0, but the Spider exploit was still possible to use by homebrew.
This vulnerability has finally been fixed for homebrew too in System menu version 9.5.0-23 with the release of a new Browser Title (Webkit version 1.7585).
The exploit uses 5 different ROP chains based on the browser's version, detected using the user agent string.
- 3DS System version 2.0 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7412.US"
- 3DS System version 2.1-3.X = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7455.US"
- 3DS System version 4.0-4.X = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7498.US"
- 3DS System version 5.0-7.0 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7552.US"
- 3DS System version 7.1-9.2 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7567.US"
A 6th version is served for browsers with a non compatible user agent.
By visiting the webpage, it checks the user agent and serves the corresponding page based on the user agent. The ROP chain loads the Launcher.dat file located on SD card.
For Gateway 3DS : Place the Launcher.dat file (Gateway v3.0 or newer) you want to boot on the root of your SD card, and visit http://go.gateway-3ds.com to trigger the exploit.
For homebrew : See below for custom homebrew projects.
Since the release of this exploit by Gateway 3DS team, users analyzed how this exploit works and extracted all the different user agent's ROP payload.
The ROP payload has been reverse engineered by Yifan Lu.
You can find a list of custom projects, sources or websites based on the Spider exploit.
|Official Payloads||Files||Download the payload used by Go.gateway-3ds.com, extracted by Falo|
|PHP script||Files||PHP script to host the exploit yourself on your own server.|
|PHP script||Files||a single file PHP script to host the exploit yourself on you own server.|
|esp8266 module||Offline||Hardware mod by lukas_2511 to insert a wifi webserver chipset inside the console|
|Android webserver tutorial||Android||Tutorial to setup an android webserver as Access point.|
|SD Card Wifi access point||Offline||You can use SD Card with Wifi Access point capability to serves the exploit directly from your 3DS.|
|http://go.scmods.com/||Online||mirror website by Gary Opa serving the gateway exploit|
|GW3DS Loader||Android||An android application to serves the exploit. -removed from google play-|
|Go! Gateway||Android||Android application to serves the exploit. Possibility to change the exploit file name (default : Launcher.dat)|
|MultiLauncher||Online||A mirror website, with ability to specify the filename to load from SD card. Allows launching different "Launcher.dat" file.|
The spider exploit can be used to launch homebrew.
Here is a list of homebrew projects compatible using this launching method.
|Spider3DSTools||A set of tools for Spider exploit homebrew execution on 9.x Git discussion||Yifan Lu|
|Regionthree||region free loader for 3DS/3DSXL/2DS on firmware versions 4.0-9.5.||Smealum|
|byebye bluecard||Installs the gateway-3DS MSET exploit on 4.x console without the need of NDS flashcart. Spider DS Profile ROPLoader||peekatyou|
|Decrypt9||XOR Pad generator for 9.x and lower console version.||archshift|
|Virtual Console Injector||Inject GB/GBC ROMs to launched VC installed channel Discussion||KazoWAR, shutterbug2000|
|rxTools||A collection of tools for ROM and NAND manipulation. (extract keys, decrypt ROMs, etc.) discussion||Roxas75|
|Animal Crossing: New Leaf RAM editor||Animal crossing new leaf, RAM dumper and online editor. Discussion||Marc_max|