DSiWare VulnList - Revision history

ChampionLeake: /* Total listed DSiWare */

2019-03-31T01:09:03Z

Total listed DSiWare

← Older revision		Revision as of 05:09, 31 March 2019
Line 9:		Line 9:
	\|-		\|-
	\| Incomplete		\| Incomplete
	\| 15		\| 16
	\|-		\|-
	\| Done		\| Done

ChampionLeake: /* DSiWare with incomplete analysis */

2019-03-31T01:08:30Z

DSiWare with incomplete analysis

← Older revision		Revision as of 05:08, 31 March 2019
Line 87:		Line 87:
	\| None		\| None
	\| Has ASCII string but the checksum is unknown.		\| Has ASCII string but the checksum is unknown.
			\|-
			\| Jelly Car 2
			\| High Score name
			\| None
			\| Uses ASCII player name for time scores; It's unlikely this can be exploited, seems to crash /w out-of-bounds array-index.
	\|-		\|-
	\| Lets golf		\| Lets golf

ChampionLeake: /* Total listed DSiWare */

2019-03-03T15:30:15Z

Total listed DSiWare

← Older revision		Revision as of 18:30, 3 March 2019
Line 9:		Line 9:
	\|-		\|-
	\| Incomplete		\| Incomplete
	\| 20		\| 15
	\|-		\|-
	\| Done		\| Done
	\| 22		\| 27
	\|-		\|-
	\| DSiWare which probably aren't exploitable		\| DSiWare which probably aren't exploitable

ChampionLeake: /* DSiWare with incomplete analysis */

2019-03-03T15:25:20Z

DSiWare with incomplete analysis

@@ Line 87: / Line 87: @@
 |  None
 |  Has ASCII string but the checksum is unknown.
 |-
 |  Lets golf
@@ Line 122: / Line 107: @@
 |  None
 |  Has ASCII strings.
 |}

ChampionLeake: /* DSiWare with finished analysis */

2019-03-03T15:18:04Z

DSiWare with finished analysis

← Older revision		Revision as of 18:18, 3 March 2019
Line 185:		Line 185:
	\| None		\| None
	\| Has high-scores without names, scores are ASCII null-terminated strings. Managed to semi-crash this, but system reset still worked so this probably isn't exploitable.		\| Has high-scores without names, scores are ASCII null-terminated strings. Managed to semi-crash this, but system reset still worked so this probably isn't exploitable.
			\|-
			\| Fieldrunners
			\| High-Scores
			\| The xml, ".plist", in the game is used for storing savadata which contains high-score strings. Using a very large string crashes the game leading it to stack buffer overflow. The game has already been exploited through [https://github.com/yellows8/dsi/tree/master/exploits/fieldrunhax fieldrunnerhax].
	\|-		\|-
	\| Frogger Returns		\| Frogger Returns
	\| High-Scores		\| High-Scores
	\| Has ASCII high-scores. strcpys to a static buffer from savedata, unknown if this is exploitable but there's only <10KB free space available(way too low for a payload) so meh.		\| Has ASCII high-scores. strcpys to a static buffer from savedata, unknown if this is exploitable but there's only <10KB free space available(way too low for a payload) so meh.
			\|-
			\| Guitar Rock Tour
			\| High-Scores
			\| Has ASCII high-score strings stored in the savedata. Using a very long excessive string can crash the game to lead into a stack smash. This game was successfully exploited through [https://github.com/yellows8/dsi/tree/master/exploits/grtpwn grtpwn].
			\|-
			\| Legends of Exidia
			\| Player name
			\| Has ASCII player name stored in the savadata. Using an extensive long string will cause a stack smash to saved registers and can eventually be exploited through [https://github.com/yellows8/dsi/tree/master/exploits/exidiahax exidiahax].
	\|-		\|-
	\| Mario Calculator		\| Mario Calculator
Line 221:		Line 233:
	\| Profile name		\| Profile name
	\| No overflow, the game slot acts as if things are normal, only gives you a lot of completion stars		\| No overflow, the game slot acts as if things are normal, only gives you a lot of completion stars
			\|-
			\| The Legend of Zelda: Four Swords Anniversary
			\| Savedata filesize
			\| The game has 2 savefiles. When one savefile fails to load (larger than a usual savefile), the game loads the backup save and will continue load without any errors. That being said, one can crash the game with a larger game filesize to attack the heap and successfully overwrite the stack registers including the pointer counter. The game has already been exploited through [https://github.com/yellows8/dsi/tree/master/exploits/4swordshax 4swordshax].
			\|-
			\| UNO
			\| Profile names
			\| Has ASCII Player name each for of the 5 save slots. The game was crashed with a very large player name which overwritten the stack registers including the pointer counter. The game was successfully exploited which is known as [https://github.com/ChampionLeake/UNO-pwn UNO*pwn].
	\|-		\|-
	\| WordSearcher		\| WordSearcher

ChampionLeake: /* DSiWare with finished analysis */

2019-01-16T17:48:38Z

DSiWare with finished analysis

← Older revision		Revision as of 20:48, 16 January 2019
Line 205:		Line 205:
	\| High-scores		\| High-scores
	\| Has English-only high-scores and a trivial checksum, not exploitable.		\| Has English-only high-scores and a trivial checksum, not exploitable.
			\|-
			\| Rayman
			\| Player name
			\| No overflow, with a long string the game only displays one extra character.
	\|-		\|-
	\| Soul of Darkness		\| Soul of Darkness
Line 217:		Line 221:
	\| Profile name		\| Profile name
	\| No overflow, the game slot acts as if things are normal, only gives you a lot of completion stars		\| No overflow, the game slot acts as if things are normal, only gives you a lot of completion stars
	\|-
	~~\| Rayman~~
	~~\| Player name~~
	~~\| No overflow, with a long string the game only displays one extra character.~~
	\|-		\|-
	\| WordSearcher		\| WordSearcher

ChampionLeake: /* Total listed DSiWare */

2019-01-16T17:47:36Z

Total listed DSiWare

← Older revision		Revision as of 20:47, 16 January 2019
Line 12:		Line 12:
	\|-		\|-
	\| Done		\| Done
	\| 18		\| 22
	\|-		\|-
	\| DSiWare which probably aren't exploitable		\| DSiWare which probably aren't exploitable

ChampionLeake: /* DSiWare with finished analysis */

2019-01-16T17:46:33Z

DSiWare with finished analysis

← Older revision		Revision as of 20:46, 16 January 2019
Line 221:		Line 221:
	\| Player name		\| Player name
	\| No overflow, with a long string the game only displays one extra character.		\| No overflow, with a long string the game only displays one extra character.
			\|-
			\| WordSearcher
			\| Player name & WordSearch Board
			\| Has ASCII strings (profile or slot names) and has plaintext crossword levels. No overflows with a large string nor a bigger crossword board resulting thus, not exploitable
	\|}		\|}

ChampionLeake: /* DSiWare with incomplete analysis */

2019-01-10T02:18:59Z

DSiWare with incomplete analysis

← Older revision		Revision as of 05:18, 10 January 2019
Line 72:		Line 72:
	\| None		\| None
	\| Has ASCII strings. It's unlikely this can be exploited, seems to crash /w out-of-bounds array-index.		\| Has ASCII strings. It's unlikely this can be exploited, seems to crash /w out-of-bounds array-index.
	\|-
	~~\| Crazy Sudoku~~
	~~\| Player name~~
	~~\| None~~
	~~\| Has ASCII strings for player name.~~
	\|-		\|-
	\| Crystal Monsters		\| Crystal Monsters

ChampionLeake: /* DSiWare with finished analysis */

2019-01-10T02:18:23Z

DSiWare with finished analysis

← Older revision		Revision as of 05:18, 10 January 2019
Line 170:		Line 170:
	\| High-scores and word list		\| High-scores and word list
	\| Has ASCII null-terminated high-score list names and null-terminated word list strings. ( No crash, just nice very high scores, and very long words displayed. )		\| Has ASCII null-terminated high-score list names and null-terminated word list strings. ( No crash, just nice very high scores, and very long words displayed. )
			\|-
			\| Crazy Sudoku
			\| Profile names/Data File
			\| The ASCII player name or the game data aren't exploitable. This game can still be crashed.
	\|-		\|-
	\| Dark Void Zero		\| Dark Void Zero