From WikiTemp, the GBAtemp wiki
(Other homebrew: regionthree)
(Description: Fixed inverted version)
Line 26: Line 26:
 
The exploit uses 5 different ROP chains based on the browser's version, detected using the user agent string.
 
The exploit uses 5 different ROP chains based on the browser's version, detected using the user agent string.
 
* 3DS System version 2.0 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7412.US"
 
* 3DS System version 2.0 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7412.US"
* 3DS System version 2.1-3.X = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7498.US"
+
* 3DS System version 2.1-3.X = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7455.US"
* 3DS System version 4.0-4.X = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7455.US"
+
* 3DS System version 4.0-4.X = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7498.US"
 
* 3DS System version 5.0-7.0 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7552.US"
 
* 3DS System version 5.0-7.0 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7552.US"
 
* 3DS System version 7.1-9.2 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7567.US"
 
* 3DS System version 7.1-9.2 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7567.US"

Revision as of 12:57, 8 February 2015

Spider exploit
General
AuthorMathewE
Links
Download
Website
Discussion
Exploit working on v2.0 to v9.2

The spider exploit was found by MathewE and used by Gateway-3DS team to launch their flashcard's Gateway v3.0 payload on 3DS system menu version 2.0.x to 9.2.x.

It uses a vulnerability in webkit browser (code name Spider) to load a ROP chain using javascript and DOM which allows loading a file from SD card (usually the Launcher.dat file).

This vulnerability has been fixed in System menu version 9.3.0

Description

The exploit uses 5 different ROP chains based on the browser's version, detected using the user agent string.

  • 3DS System version 2.0 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7412.US"
  • 3DS System version 2.1-3.X = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7455.US"
  • 3DS System version 4.0-4.X = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7498.US"
  • 3DS System version 5.0-7.0 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7552.US"
  • 3DS System version 7.1-9.2 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7567.US"

A 6th version is served for browsers with a non compatible user agent.

By visiting the webpage, it checks the user agent and serves the corresponding page based on the user agent. The ROP chain loads the Launcher.dat file located on SD card.

Usage

Place the Launcher.dat file (Gateway v3.0 or newer) you want to boot on the root of your SD card, and visit http://go.gateway-3ds.com to trigger the exploit.


Custom Projects

Since the release of this exploit by Gateway 3DS team, users analyzed how this exploit works and extracted all the different user agent's ROP payload.

The ROP payload has been reverse engineered by Yifan Lu.


In attempt to make this Gateway launching method portable and not always rely on internet access, users ported this exploit to multiple supports such as Android or offline private web servers. As the filename target to load from SD Card is included in the javascript ROP chain, users can keep multiple version of launcher.dat files (either exploit or homebrew) on their SD card and select the one to launch by visiting different custom web pages.


You can find a list of custom projects, sources or websites based on the Spider exploit.

Gateway Launcher

Name Type comment
Official Payloads Files Download the payload used by Go.gateway-3ds.com, extracted by Falo
PHP script Files PHP script to host the exploit yourself on your own server.
PHP script Files a single file PHP script to host the exploit yourself on you own server.
esp8266 module Offline Hardware mod by lukas_2511 to insert a wifi webserver chipset inside the console
Android webserver tutorial Android Tutorial to setup an android webserver as Access point.
SD Card Wifi access point Offline You can use SD Card with Wifi Access point capability to serves the exploit directly from your 3DS.
http://go.scmods.com/ Online mirror website by Gary Opa serving the gateway exploit
GW3DS Loader Android An android application to serves the exploit. -removed from google play-
Go! Gateway Android Android application to serves the exploit. Possibility to change the exploit file name (default : Launcher.dat)
MultiLauncher Online A mirror website, with ability to specify the filename to load from SD card. Allows launching different "Launcher.dat" file.
Static GW Multilauncher Online/Files PHP script to host the files yourself. Allows specifying filename to launch using a GET parameter.
Custom ROP Loader Online Website allowing ROP filename to be set by GET parameter.

Other homebrew

The spider exploit can be used to launch homebrew.

Here is a list of homebrew projects using this launching method.

Title Description Author
Spider3DSTools A set of tools for Spider exploit homebrew execution on 9.x Git discussion Yifan Lu
Regionthree region free loader for 3DS/3DSXL/2DS on firmware versions 4.0-9.5. Smealum
byebye bluecard Installs the gateway-3DS MSET exploit on 4.x console without the need of NDS flashcart. Spider DS Profile ROPLoader peekatyou