DSiBrew - User contributions [en]

User:Josephvb10

2011-01-28T03:20:24Z

Josephvb10:

Wii and DSi owner.

Waiting for DSi hacks from the launch day.

User:Josephvb10

2011-01-28T03:18:54Z

Josephvb10: Created page with "Wii and DSi owner. Waiting foro DSi hacia from the launch day."

Wii and DSi owner.

Waiting foro DSi hacia from the launch day.

Sudokuhax

2011-01-28T03:08:02Z

Josephvb10:

Sudokuhax is an exploit for the game Sudoku by EA, currently only avaiable trough the American and Australian DSi Shop, for 200 Nintendo Points. The exploit works by hacking the game's savedata to make it to load the file "boot.nds" from the SD in DSi-mode.

More instructions and download is avaiable here: [http://hackmii.com/2011/01/sudokuhax-release/ Hackmii post]

Sudokuhax

2011-01-28T03:06:11Z

Josephvb10: Created page with "Sudokuhax is an exploit for the game Sudoku by EA, currently only avaiable trough the American and Australian DSi Shop, for 200 Nintendo Points. More instructions and download is..."

Sudokuhax is an exploit for the game Sudoku by EA, currently only avaiable trough the American and Australian DSi Shop, for 200 Nintendo Points. More instructions and download is avaiable here: [http://hackmii.com/2011/01/sudokuhax-release/ Hackmii post]

DSiWare VulnList

2011-01-28T03:02:49Z

Josephvb10:

This lists DSiWare that might have vulnerabilities, like strcpy or sprintf from savedata. If you know of DSiWare that has English-only string(high-scores, player name, high-scores that use username from system settings, etc) input, mention it on IRC EFNet #dsidev. Or contact yellowstar 6 at gmail dot com.
Before you contact anyone about your dsiware, please make sure your dsiware is _not_ listed on this page anywhere.

DSiWare savedata is extracted and modified with these tools: https://github.com/neimod/dsi

For these lists status "None" means code reversing engineering for the DSiWare wasn't started. Status "Started" means code reversing engineering for that DSiWare was started. Status "Done" means code reverse engineering was finished.

== DSiWare that can be crashed ==

{| class="wikitable" border="1"
|-
! Name
! Input type(s)
! Status
! Regions
! Developer
! Points
! Description
|-
| Dark Void Zero
| High-Scores
| Done
| USA/EUR
| Capcom
| 500
| No limit on length of drawn record names, no vuln with high-scores. The level var from savedata doesn't have any bounds check, this is used with array indexes. This is not exploitable since the array structs only contain char* strings and other fields, and that var is used with level class init. Level class init fail is most likely the cause of the crash which isn't exploitable, level paths are determined by if statements and the level object is used uninitialized when the level var is out-of-bounds.
|-
| Frogger Returns
| High-scores
| Started
| USA
| Konami
| 500
| Has ASCII null-terminated high-scores. Manged to crash this game. The high-score draw function uses strcpy to copy the records' name to a static buffer, it's unknown if this is exploitable.
|-
| Guitar Rock Hero
| High-scores
| Started
| USA/EUR
| Gameloft
| 500
| Has ASCII strings for high-scores. Overwriting high-scores with a 0x194f-byte string caused the game to crash.
|-
| Legends of Exidia
| Player name
| Started
| USA/EUR/JP
| Gameloft
| 800
| Has ASCII player name in one file, and UCS-2 player name in a profile file. This game was crashed by modifying strings in the profile savedata file.
|-
| Sudoku
| Player name
| Done
| USA/EUR
| EA
| 200
| Has ASCII player name for each of the 3 save slots. Game was crashed with an excessively long player name. The game has already been exploited through [[Sudokuhax]].
|}

== DSiWare with incomplete analysis ==

{| class="wikitable" border="1"
|-
! Name
! Input type(s)
! Status
! Description
|-
| Advanced Circuits
| Profile names
| Started
| Save slots are obfuscated, the algorithm is understood for all but the first save slot. The checksum calculation is unknown.
|}

== DSiWare with finished analysis ==

{| class="wikitable" border="1"
|-
! Name
! Input type(s)
! Description
|-
| 5 in 1 Solitaire
| Profile names
| Game didn't crash with a long profile string.
|-
| Arcade Hoops Basketball
| High-Scores, names via settings
| Has ASCII high-scores with null terminated strings, no string bugs.
|-
| Bookworm
| High-scores and word list
| Has ASCII null-terminated high-score list names and null-terminated word list strings. ( No crash, just nice very high scores, and very long words displayed. )
|-
| Dracula
| No manual input
| Savedata contains ASCII high-scores from DSi username, and ASCII perks/powerups. High-scores doesn't have string bugs.
|-
| Escapee Go
| None
| Has high-scores without names, scores are ASCII null-terminated strings. Managed to semi-crash this, but system reset still worked so this probably isn't exploitable.
|-
| Paul's Shooting Adventure
| High-Scores
| Records are entered when you complete the game, names are ASCII strings null-terminated. Not exploitable.
|-
| Primrose
| High-scores
| Has English-only high-scores and a trivial checksum, not exploitable.
|}

== DSiWare that probably don't have vulnerabilities ==

{| class="wikitable" border="1"
|-
! Name
! Input type(s)
! Description
|-
| 24/7 Solitaire
| None
| No high-scores or string input.
|-
| Absolute Reversi
| None
| No strings in savedata.
|-
| Aquia: Art Style Series
| None
| No strings
|-
| Brain Age Express: Arts & Letters
| None
| No strings in savedata.
|-
| Brain Age Express: Math
| None
| No strings in savedata.
|-
| Dictionary 6 in 1
| None
| No strings in savedata.
|-
| Dr. Mario Express
| None
| No strings
|-
| FIZZ
| High-scores
| Savedata contains ASCII high-scores, but all the high-scores are contained in the same string without a null terminator. A vuln is unlikely.
|-
| Gene Labs
| None
| Small savedata with no strings.
|-
| Paper Airplane Chase
| None
| The size of both files in the savedata are only 8 bytes, no strings.
|-
| Pyoro
| None
| 16-byte savedata no strings.
|-
| Photo Clock
| None
| Small savedata, no strings at all.
|-
| Photo Dojo
| Handwritten character name via stylus
| Savedata only contains .jpg files and some tiny "save"/"info" files.
|-
| Tetris Party Live
| None
| Zero text input.
|-
| WarioWare: Snapped
| None
| No high-scores or string input.
|}

== DSiWare that were already obtained for analysis ==
Do not contact us about the DSiWare in this list, we already have them.

{| class="wikitable" border="1"
|-
! Name
! Text format
|-
| Flipnote Studio
| UCS-2
|-
| Mario Vs. Donkey Kong: Minis March Again
| UCS-2
|}

DSiWare VulnList

2011-01-27T23:05:18Z

Josephvb10: /* DSiWare that can be crashed */

This lists DSiWare that might have vulnerabilities, like strcpy or sprintf from savedata. If you know of DSiWare that has English-only string(high-scores, player name, high-scores that use username from system settings, etc) input, mention it on IRC EFNet #dsidev. Or contact yellowstar 6 at gmail dot com.
Before you contact anyone about your dsiware, please make sure your dsiware is _not_ listed on this page anywhere.

DSiWare savedata is extracted and modified with these tools: https://github.com/neimod/dsi

For these lists status "None" means code reversing engineering for the DSiWare wasn't started. Status "Started" means code reversing engineering for that DSiWare was started. Status "Done" means code reverse engineering was finished.

== DSiWare that can be crashed ==

{| class="wikitable" border="1"
|-
! Name
! Input type(s)
! Status
! Regions
! Developer
! Points
! Description
|-
| Dark Void Zero
| High-Scores
| Done
| USA/EUR
| Capcom
| 500
| No limit on length of drawn record names, no vuln with high-scores. The level var from savedata doesn't have any bounds check, this is used with array indexes. This is not exploitable since the array structs only contain char* strings and other fields, and that var is used with level class init. Level class init fail is most likely the cause of the crash which isn't exploitable, level paths are determined by if statements and the level object is used uninitialized when the level var is out-of-bounds.
|-
| Frogger Returns
| High-scores
| Started
| USA
| Konami
| 500
| Has ASCII null-terminated high-scores. Manged to crash this game. The high-score draw function uses strcpy to copy the records' name to a static buffer, it's unknown if this is exploitable.
|-
| Guitar Rock Hero
| High-scores
| Started
| USA/EUR
| Gameloft
| 500
| Has ASCII strings for high-scores. Overwriting high-scores with a 0x194f-byte string caused the game to crash.
|-
| Legends of Exidia
| Player name
| Started
| USA/EUR/JP
| Gameloft
| 800
| Has ASCII player name in one file, and UCS-2 player name in a profile file. This game was crashed by modifying strings in the profile savedata file.
|-
| Sudoku
| Player name
| Started
| USA/EUR
| EA
| 200
| Has ASCII player name for each of the 3 save slots. Game was crashed with an excessively long player name. The game has already been exploited trough [[Sudokuhax]].
|}

== DSiWare with incomplete analysis ==

{| class="wikitable" border="1"
|-
! Name
! Input type(s)
! Status
! Description
|-
| Advanced Circuits
| Profile names
| Started
| Save slots are obfuscated, the algorithm is understood for all but the first save slot. The checksum calculation is unknown.
|}

== DSiWare with finished analysis ==

{| class="wikitable" border="1"
|-
! Name
! Input type(s)
! Description
|-
| 5 in 1 Solitaire
| Profile names
| Game didn't crash with a long profile string.
|-
| Arcade Hoops Basketball
| High-Scores, names via settings
| Has ASCII high-scores with null terminated strings, no string bugs.
|-
| Bookworm
| High-scores and word list
| Has ASCII null-terminated high-score list names and null-terminated word list strings. ( No crash, just nice very high scores, and very long words displayed. )
|-
| Dracula
| No manual input
| Savedata contains ASCII high-scores from DSi username, and ASCII perks/powerups. High-scores doesn't have string bugs.
|-
| Escapee Go
| None
| Has high-scores without names, scores are ASCII null-terminated strings. Managed to semi-crash this, but system reset still worked so this probably isn't exploitable.
|-
| Paul's Shooting Adventure
| High-Scores
| Records are entered when you complete the game, names are ASCII strings null-terminated. Not exploitable.
|-
| Primrose
| High-scores
| Has English-only high-scores and a trivial checksum, not exploitable.
|}

== DSiWare that probably don't have vulnerabilities ==

{| class="wikitable" border="1"
|-
! Name
! Input type(s)
! Description
|-
| 24/7 Solitaire
| None
| No high-scores or string input.
|-
| Absolute Reversi
| None
| No strings in savedata.
|-
| Aquia: Art Style Series
| None
| No strings
|-
| Brain Age Express: Arts & Letters
| None
| No strings in savedata.
|-
| Brain Age Express: Math
| None
| No strings in savedata.
|-
| Dictionary 6 in 1
| None
| No strings in savedata.
|-
| Dr. Mario Express
| None
| No strings
|-
| FIZZ
| High-scores
| Savedata contains ASCII high-scores, but all the high-scores are contained in the same string without a null terminator. A vuln is unlikely.
|-
| Gene Labs
| None
| Small savedata with no strings.
|-
| Paper Airplane Chase
| None
| The size of both files in the savedata are only 8 bytes, no strings.
|-
| Pyoro
| None
| 16-byte savedata no strings.
|-
| Photo Clock
| None
| Small savedata, no strings at all.
|-
| Photo Dojo
| Handwritten character name via stylus
| Savedata only contains .jpg files and some tiny "save"/"info" files.
|-
| Tetris Party Live
| None
| Zero text input.
|-
| WarioWare: Snapped
| None
| No high-scores or string input.
|}

== DSiWare that were already obtained for analysis ==
Do not contact us about the DSiWare in this list, we already have them.

{| class="wikitable" border="1"
|-
! Name
! Text format
|-
| Flipnote Studio
| UCS-2
|-
| Mario Vs. Donkey Kong: Minis March Again
| UCS-2
|}

DSi exploits

2011-01-27T23:00:30Z

Josephvb10: /* DSi-mode exploits */

This page is dedicated to the listing of exploits used used to run homebrew on the Nintendo DSi. Anyone may contribute to this list, as long as any exploits added are explained and verifiable.

== DSi-mode exploits ==
Team Twiizers had relased a DSi-Mode Exploit called [[Sudokuhax]] that loads a homebrew from the SD card in DSi Mode. The exploit requires that you have purchased the Sudoku by EA game. More details and download at: [http://hackmii.com/2011/01/sudokuhax-release/].

Team Twiizers also have found a DSi-Mode Exploit and have managed to use it to run DSi Mode homebrew. However it has not yet been released. More details at : [http://hackmii.com/2009/07/dsi-mode-homebrew-anyone/] The additional hardware is just required to get a connection to a computer so that things like ram dumps can be created.

Wintermute has made available an open source DSi hack. The exploit works on DSi enhanced games, allowing you to run custom code from a save file. Instructions for using the exploit can be found here: [http://drunkencoders.com/2009/08/dsi-hack-update/]

If you know of DSiWare that has English-only string input,(high-scores, player name, high-scores that use username from system settings, etc) go [[DSiWare_VulnList|here]].

== DS-mode exploits ==

This type of exploit is undesirable because all DSi functionality, such as usage of the [[cameras]], is unavailable to homebrew.

Blasteh (Blasty) has posted a [http://www.youtube.com/watch?v=7QHO7ctWuZ8 video on Youtube] showing code being run in DS mode on the DSi using [http://en.wikipedia.org/wiki/Fifa_08 Fifa '08].

DSi exploits

2011-01-27T22:59:18Z

Josephvb10: /* DSi-mode exploits */

This page is dedicated to the listing of exploits used used to run homebrew on the Nintendo DSi. Anyone may contribute to this list, as long as any exploits added are explained and verifiable.

== DSi-mode exploits ==
Team Twiizers had relased a DSi-Mode Exploit called Sudokuhax that loads a homebrew from the SD card in DSi Mode. The exploit requires that you have purchased the Sudoku by EA game. More details at: [http://hackmii.com/2011/01/sudokuhax-release/].

Team Twiizers also have found a DSi-Mode Exploit and have managed to use it to run DSi Mode homebrew. However it has not yet been released. More details at : [http://hackmii.com/2009/07/dsi-mode-homebrew-anyone/] The additional hardware is just required to get a connection to a computer so that things like ram dumps can be created.

Wintermute has made available an open source DSi hack. The exploit works on DSi enhanced games, allowing you to run custom code from a save file. Instructions for using the exploit can be found here: [http://drunkencoders.com/2009/08/dsi-hack-update/]

If you know of DSiWare that has English-only string input,(high-scores, player name, high-scores that use username from system settings, etc) go [[DSiWare_VulnList|here]].

== DS-mode exploits ==

This type of exploit is undesirable because all DSi functionality, such as usage of the [[cameras]], is unavailable to homebrew.

Blasteh (Blasty) has posted a [http://www.youtube.com/watch?v=7QHO7ctWuZ8 video on Youtube] showing code being run in DS mode on the DSi using [http://en.wikipedia.org/wiki/Fifa_08 Fifa '08].

DSiBrew:News/Archive

2010-12-14T18:11:09Z

Josephvb10:

*'''3 August 09''' Nintendo has released [[System Menu 1.4]] in every supported country.
*'''2 August 09''' The Drunken Coders [http://drunkencoders.com/2009/08/dsi-hack-update/ have released] the exploit they are using to run unsigned code in DSi mode.
*'''9 July 09:''' Team Twiizers successfully ran DSi-Mode Homebrew. More details can be found over at [http://hackmii.com/2009/07/dsi-mode-homebrew-anyone/ HackMii]
*'''25 June 09:''' Voting has begun for the [[DSiBrew:Contests|DSiBrew logo]] contest! Please cast your vote '''[[DSiBrew talk:Contests#Voting time!|here]]'''.
*'''8 June 09:''' The [[DSiBrew:Contests|DSiBrew logo]] contest is now closed to submissions.
*'''12 April 09:''' A [[DSiBrew:Contests|DSiBrew logo]] contest has started.
*'''5 April 09:''' The Nintendo DSi has been released in North America.
*'''3 April 09:''' Nintendo has released [[System Update 1.3]]. DSi Shop is accessible. All DSi flashcarts still work. Added a button to start DSi Camera application when pressing L or R.
*'''3 April 09:''' The Nintendo DSi has been released in Europe.
*'''2 April 09:''' The Nintendo DSi has been released in Australia.
*'''19 February 09:''' [http://nintendo.co.uk/NOE/en_GB/news/2008/nintendo_dsi_arrives_in_europe_on_3_april_2009_11627.html Nintendo of Europe] and [http://www.nintendo.com/whatsnew/detail/Q5D4ti_bPqJO_I0Oup0AMFudaUOLz6C7 Nintendo of America] have announced that the DSi will be released on April 3 in Europe and April 5 in North America.
* '''25 January 09 ''': [[User:Bushing|Bushing]] from [http://www.hackmii.com Hackmii] created this wiki as a spinoff of the [http://wiibrew.org/wiki/Main_Page WiiBrew wiki].