Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor

nintendolife.com

Post reply on HN
Print view View original

101–110 of 188 posts

Re: Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor

#101

Post by naikrovek »

jstanley wrote: post #89
roblabla wrote: post #47

Earlier quoted context omitted.

The implementation is based on mruby, which is riddled with bugs. I spent some time reversing A Dark Room before it got removed. I am confident that there are bugs allowing ROP, from which point getting CFW is a matter of privesc. We have privesc to bootrom on every firmware version up to 7.x (inclusive). This is obviously bad for nintendo.

Why is this obviously bad for Nintendo?

It isn't, but it is very likely against the developer's agreements with Nintendo.

Things like this are why Nintendo doesn't freely allow save file access, or even allow them to be accessed without encrypting them.

If they work this hard to prevent file loading exploits, you can bet your ass there is contract language to prevent what this guy did.

Re: Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor

#102

Post by Jasper_ »

xkcd-sucks wrote: post #82
jdietrich wrote: post #60

Earlier quoted context omitted.

That's not the story at all. Rajan entered a voluntary agreement with Nintendo, through which his game would be distributed on their platform. He deliberately deceived them about the presence of a potentially security-critical feature, thereby breaching that agreement; Nintendo took the perfectly reasonable decision to remove his game from their platform. There is a perfectly reasonable debate to be had about bootloa…

So all one needs to do to make exploits/jailbreaks/backup loaders for switch is to get a Nintendo developer account? Sounds like a win

... and buy separate devkit hardware (relatively cheap compared to Wii U days, but still), make an actual game (devkit does not play retail games, and retail console cannot install dev-signed apps), get it through TRC/lotcheck, pay the fees to publish the game, give trailers/launch material to Nintendo, never once mention its secret purpose as a jailbreak, and then secretly share it with all your friends without any bit of the hacker community finding it out. Extremely easy.

Re: Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor

#103

Post by beenBoutIT »

praptak wrote: post #40
jdietrich wrote: post #11

>The narrative that has played out online is exactly what's wrong with this trashcan fire of a world. >Everyone is an armchair expert. Everyone thought the worst. You've seen that I've been called a dick, idiot, and everything in between. Because sensationalised news sells. If the narrative was 'I added a sandbox to A Dark Room that lets you mod the game and provide a medium for kids to code (and technical parents to…

The fact that Nintendo were always like this does not mean it is okay. If there's anything wrong with this story it's how everyone seems to silently accept it is okay for a company to tell you what you can run on the hardware that you "buy" but not really own.

It is okay, just don't buy anything made by Nintendo unless you're ok with Nintendo's restrictive 'nanny console' TOS. You can run Linux and play GTA and Mortal Kombat on other consoles. Nintendo is geared towards people who like Nintendo.

Re: Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor

#104

Post by naikrovek »

Wowfunhappy wrote: post #88
jplayer01 wrote: post #59

Earlier quoted context omitted.

Which was then used to enable privilege escalation in an exploit. https://mrnbayoh.github.io/basicsploit/ Nintendo is doing far more to prevent piracy and homebrew than they ever have before. It's no surprise to anybody who's familiar with this stuff that they aren't okay with arbitrary code execution, especially if none of the interpreter code was vetted/audited by anybody security conscious. I'm even surprised so m…

Oh, heh, I hadn't heard about that exploit! I will point out that the Switch already supports untrusted and unvetted code execution—it's called Javascript. The Nintendo Switch may appear to not have a web browser, but it pops up when you try to log into a captive portal. Without it, no one would be able to use public wifi hotspots. I will also note that Nintendo hasn't exactly done a great job at preventing piracy or…

Show me a captive portal that exploits a hole in the security of the Switch, and I'll show you a whole line of captive portals that will very soon no longer load on a patched Switch. Also, I don't think JavaScript is required by most captive portals. Form tags don't require JavaScript.

Recovery Mode was the fault of Nvidia, not Nintendo. Soon after that was discovered, the silicon for the Switch was iterated and now you need a signed binary, even in recovery mode.

They plug holes as soon as they find them. I don't think it's fair to compare the relatively limited number of people that work at Nintendo to the literal army of people that work to break Nintendo's work every day.

Re: Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor

#105

Post by naikrovek »

0815test wrote: post #6

There goes my idea of porting Core War to the Nintendo Switch. Ah well.

Feel free to port to a Switch emulator. I realize that the point of porting Core War is lost on an emulator. Even when the OS shell crashes, it starts right back up, anyway.

Re: Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor

#106

Post by baroffoos »

xena wrote: post #97
baroffoos wrote: post #87

Earlier quoted context omitted.

The games themselves run in a sandbox and should not have access to the greater OS, hypervisor or arm trustzone which are on the switch.

Assuming the jar has no holes. The jar apparently has holes and the brain inside it can peek out.

I haven't seen any exploits from application level getting access to the OS. There is basically one exploit being used on the switch which uses a bug in the nvidia chip at boot which gives you a higher level of access than the OS and all of the security checks. Its such a powerful exploit that can only be fixed by a hardware change that no other exploit is needed.

Re: Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor

#107

Post by naikrovek »

crankylinuxuser wrote: post #13

And this is what happens when people don't own the hardware they buy. Instead, they get awful DRM'ed bullshit, with a monopolistic store 'owner' digitally forcing whatever they say on their fiefdom. The first computer I had access to had BASIC built in. Having control of a computer of what runs and not is an absolute basic right of ownership. And from these computers called "game consoles", you the purchaser have non…

People do own it, and when we bought the hardware, we were sold a game console that plays games specifically designed for it.

That's it.

If you expected more, you've been lied to. It does exactly what it's supposed to do, exactly what it was sold to do, and it does this very well.

If you want development hardware, then buy development hardware. There's no shortage of it; it's everywhere. Go nuts.

If you buy commercial hardware meant for use by end users, made by a company that fights hard against piracy, you get hardware that is anywhere between "annoyingly difficult" all the way to "virtually impossible" to use in your own way. This should not come as a surprise.

The Switch is sold as a game console, and nothing more. Certainly not a development platform. If you can squeeze a development platform out of an off-the-shelf Switch, you are lucky. If you can't, then you got exactly what you were sold, and you have (in my eyes) very little room to complain about the lack of development capability. You knew what you were buying when you bought it.

Re: Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor

#108

Post by naikrovek »

rococode wrote: post #85
xkcd-sucks wrote: post #82

Earlier quoted context omitted.

So all one needs to do to make exploits/jailbreaks/backup loaders for switch is to get a Nintendo developer account? Sounds like a win

Apparently, getting a Nintendo developer account is pretty difficult. You have to pitch a specific game to them and follow a bunch of rules to make your game and code secure. That's also why Nintendo treated this incident as such a big deal - they are very strict about access to the platform, and this blatantly broke their rules.

Getting the account is easy.

Getting approval to develop for the Switch is much harder.

You can buy Wii U and 3DS dev kits right away, though. And boy they are EXPENSIVE.

Re: Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor

#109

Post by [deleted] »

jdietrich wrote: post #60
praptak wrote: post #40

Earlier quoted context omitted.

The fact that Nintendo were always like this does not mean it is okay. If there's anything wrong with this story it's how everyone seems to silently accept it is okay for a company to tell you what you can run on the hardware that you "buy" but not really own.

That's not the story at all. Rajan entered a voluntary agreement with Nintendo, through which his game would be distributed on their platform. He deliberately deceived them about the presence of a potentially security-critical feature, thereby breaching that agreement; Nintendo took the perfectly reasonable decision to remove his game from their platform. There is a perfectly reasonable debate to be had about bootloa…

[deleted]

Re: Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor

#110

Post by Wowfunhappy »

naikrovek wrote: post #104
Wowfunhappy wrote: post #88

Earlier quoted context omitted.

Oh, heh, I hadn't heard about that exploit! I will point out that the Switch already supports untrusted and unvetted code execution—it's called Javascript. The Nintendo Switch may appear to not have a web browser, but it pops up when you try to log into a captive portal. Without it, no one would be able to use public wifi hotspots. I will also note that Nintendo hasn't exactly done a great job at preventing piracy or…

Show me a captive portal that exploits a hole in the security of the Switch, and I'll show you a whole line of captive portals that will very soon no longer load on a patched Switch. Also, I don't think JavaScript is required by most captive portals. Form tags don't require JavaScript. Recovery Mode was the fault of Nvidia, not Nintendo. Soon after that was discovered, the silicon for the Switch was iterated and now…

You can create a captive portal on your home network that just lets you navigate to any website.

https://www.imore.com/how-use-hidden-web-browser-nintendo-sw...

Edit: Oh, the particular article I linked has you use a public, specially-crafted DNS server, instead of setting one up on your home network as I've done in the past. Oh well, same principle.

Plenty of captive portals do indeed require Javascript, which is why the Switch's web browser supports Javascript.

Post reply on HN