Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “unpatchable” exploit that makes every current Nintendo Switch hackable

arstechnica.com

Post reply on HN
Print view View original

71–78 of 78 posts

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#71

Post by Jonnax »

userbinator wrote: post #65
Jonnax wrote: post #60

Earlier quoted context omitted.

"Why disclose this at all? Why not hold onto this in order to increase the number of affected Switch consoles? Unfortunately, this bug affects a significant number of Tegra devices beyond the Switch, and beyond even the X1 included in the Switch. I can tell you, it wasn't fun to find a bug with such a broad impact; it significantly complicated the ethics involved. In the end, given the potential for a lot of bad to b…

Even cars. If there's a risk that someone could conduct a crime through through a firmware hack then that presents an ethical dilemma. If it was a remote exploit, I'd certainly agree about the ethical dilemma, but everything I've read suggests that this requires physical access. As for being used in cars... don't get me started on what manufacturers are doing these days to stop repairs and modifications... just searc…

Sure. But at the end of the day Nintendo aren't some bad actor company that's forcing people to spend thousands in repair fees.

They make video games.

------

Trusted by whom? Essentially it's a group of internet hackers that are doing it for internet fame. Or in the case of others to make money off selling any hardware tools required.

"actions of companies who want to lock out users from the devices they own."

This doesn't really matter. When someone buys a Nintendo Switch they are aware that you can only use software from an official channel from the manufacturer.

It's not a sneaky action by them nobody is forced to use a Switch and its primary functionality is consuming entertainment products.

It's not like a router or tv set top box that you are forced to use.

Open hardware (in the sense of OS/software) is cheap and available today. If you don't want to be locked out of doing what you want to a device, then don't buy a locked down device.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#72

Post by misterbowfinger »

> By sending a bad "length" argument to an improperly coded USB control procedure at the right point, the user can force the system to "request up to 65,535 bytes per control request." That data easily overflows a crucial direct memory access (DMA) buffer in the bootROM, in turn allowing data to be copied into the protected application stack and giving the attacker the ability to run arbitrary code.

Classic.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#73

Post by khedoros1 »

freerobby wrote: post #62
white-flame wrote: post #21

Earlier quoted context omitted.

I actually kind of liked the Gameboy approach. You needed to include a byte-for-byte image of the trademarked Nintendo logo in order for the boot ROM to run your cartridge. So there were no technical hurdles to running your code in it, but it just made it legally dangerous to distribute.

Do you by any chance have a source on this? I believe you, this is just such a clever system that I want to read more about it.

In the sense of "that's how the Game Boy behaves", it's not hard to find a dump of the startup firmware (and it's just 256 bytes).

At offset 0x21 (33), it loads the offset for the bitmap data in the cartridge into one register, and the address for tile data RAM into another. Offsets 0x27-0x32 are a loop that calls out to functions at offsets 0x95-0xa7 and 0x96-0xa7 to double up the bits and scale the image to 2x its original size. After the code to scroll the logo, it plays the iconic double-ping sound.

At offset 0xE0, it loads offsets for the firmware copy of the logo and the cartridge copy of the logo. 0xe6-0xef iterate through the logo. If at any point the 2 copies don't match, there's a jump at offset 0xe9. Here's the relevant part of the loop:

LD A, (DE) ;Load a byte from the cartridge copy

INC DE ;Increment the pointer to the next byte

CP (HL) ;Compare A with the byte at (HL)

JR NZ, -2 ;If not equal, lock up by jumping back to this location

The patent actually covers this on page 7: https://patentimages.storage.googleapis.com/77/c0/90/d2c7514...

And claims 14+15 seem pertinent:

> 14. A hand-held electronic game machine in accordance with claim 9, wherein said processing means includes detecting means responsive to a connected external memory for detecting whether said connected external memory is an authorized or unauthorized memory.

> 15. A hand-held electronic game machine in accordance with claim 14 wherein the processing means includes further means responsive to said detecting means for preventing an unauthorized external memory from being used for executing a game program.

There's some good commentary on the legal situation, and its relation to Sega's similar legal theories (as regarded the Genesis/MegaDrive) on TVTropes (although it's a bit short):

http://tvtropes.org/pmwiki/pmwiki.php/CopyProtection/Nintend...

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#74

Post by Pharaoh2 »

monocasa wrote: post #45
Pharaoh2 wrote: post #38

Earlier quoted context omitted.

IANAL, but the two things seem related, why is GP being down voted? From just a reading of the wiki pages without much law knowledge it does seem like sega would win today? What I am getting wrong?

I don't think they would assuming that they wrote their own game and were only using of Sony's what was necessary to run their own code. See Chamberlain v. Skylink for a post DMCA case on the matter. https://en.m.wikipedia.org/wiki/Chamberlain_Group,_Inc._v._S... .

That seems to deal with anti-circumvention provisions and not copyright provision and not with infringing on trademark/copyright as the GGGGP (white-flame) seems to be pointing to.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#75

Post by monocasa »

Pharaoh2 wrote: post #74
monocasa wrote: post #45

Earlier quoted context omitted.

I don't think they would assuming that they wrote their own game and were only using of Sony's what was necessary to run their own code. See Chamberlain v. Skylink for a post DMCA case on the matter. https://en.m.wikipedia.org/wiki/Chamberlain_Group,_Inc._v._S... .

That seems to deal with anti-circumvention provisions and not copyright provision and not with infringing on trademark/copyright as the GGGGP (white-flame) seems to be pointing to.

Chamberlain is cited as a rebuttal to the DMCA argument; the DMCA has nothing to do with trademarks, and therefore I took it's citation to be in reference to it's anti-circumvention clauses. For the trademark argument, see Sega v. Accolade's decision.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#76

Post by baud147258 »

BoorishBears wrote: post #69
boomboomsubban wrote: post #64

Earlier quoted context omitted.

>DRM (10NES) was a core part of the strategy for the console that brought a recovery from the 1983 video game crash. About 1/3rd of the consoles sold didn't contain the DRM, yet the Japanese market still saw similar growth. Publishers value Denuovo, is there any proof that it helps sales?

1/3rd of the units sold? Or 1/3rd of the types of consoles? I know several consoles of the era also had DRM, so I’d be curious which ones youre referring to and the time period if referring to 1/3rd sold. And if Denuovo actually helps sales is not an easy question to answer since no publisher has come out and said it (that I’ve seen). The premise seems sound enough, sales follow an “inverse hockey stick”, so design D…

If I remember right, DOOM and the latest Tomb Raider used Denuvo and they weren't cracked until a few weeks after release, but they did not report sales above the norm.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#77

Post by BoorishBears »

baud147258 wrote: post #76
BoorishBears wrote: post #69

Earlier quoted context omitted.

1/3rd of the units sold? Or 1/3rd of the types of consoles? I know several consoles of the era also had DRM, so I’d be curious which ones youre referring to and the time period if referring to 1/3rd sold. And if Denuovo actually helps sales is not an easy question to answer since no publisher has come out and said it (that I’ve seen). The premise seems sound enough, sales follow an “inverse hockey stick”, so design D…

If I remember right, DOOM and the latest Tomb Raider used Denuvo and they weren't cracked until a few weeks after release, but they did not report sales above the norm.

Are those digital sales? Usually I see numbers quoted as tracking physical sales, which don’t tell the whole story.

And I still feel only publishers would be able to tell what the “norm” is. They have better insight into what their “norm” is in terms of returns for development and marketing based on game type, release date, and tons of other factors that can’t be correlated casually

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#78

Post by boomboomsubban »

BoorishBears wrote: post #69
boomboomsubban wrote: post #64

Earlier quoted context omitted.

>DRM (10NES) was a core part of the strategy for the console that brought a recovery from the 1983 video game crash. About 1/3rd of the consoles sold didn't contain the DRM, yet the Japanese market still saw similar growth. Publishers value Denuovo, is there any proof that it helps sales?

1/3rd of the units sold? Or 1/3rd of the types of consoles? I know several consoles of the era also had DRM, so I’d be curious which ones youre referring to and the time period if referring to 1/3rd sold. And if Denuovo actually helps sales is not an easy question to answer since no publisher has come out and said it (that I’ve seen). The premise seems sound enough, sales follow an “inverse hockey stick”, so design D…

Sorry for the late reply

>1/3rd of the units sold? Or 1/3rd of the types of consoles? I know several consoles of the era also had DRM, so I’d be curious which ones youre referring to and the time period if referring to 1/3rd sold.

The Famicom did not have the DRM, and accounts for about a third of the total Nintendo sales. That market did not suffer because of the presence of piracy.

As for Denuovo, why would publishers hide data showing it works? And the base capitalism answer doesn't work,continuing to use aggressive DRM gives them information and a power over users that may not directly show a profit.

The rest of your arguments ignore the sales piracy brings because more people talking about it, an effective advertising, and the people who use piracy as a true demo.

Post reply on HN