fail0verflow

tangent: there's a nice mouse position based shimmer effect on failoverflow's logo here: http://fail0verflow.com/ it's pretty clever how it actually works, in my opinion.

Yeah marcan helped hack the Nintendo Wii. See his original talk at 25C3 here [1]. The other guy in the talk [1] is the late Ben 'bushing' Byer. I only knew him from his online work, but it's still very sad that he passed away in 2016 [2]. I'm sure if he was still alive, he'd also continue to be doing great reverse engineering work! [1] https://www.youtube.com/watch?v=lyVuY_S5VcI [2] https://fail0verflow.com/ben

I recently got a teensy 2.0 for rooting my chromecast, (which it does, roughly by appearing to chain 32 usb hubs, better description at https://fail0verflow.com/blog/2014/hubcap-chromecast-root-pt2.html ) They are nifty little dev boards, as you can pretend to be a variety of different devices, but the real benefit in my mind is the ease at which you can use the solder pads to build a device and connect it to usb. YOu can dump roms. The teensy 3.0 is a 32 bit arm processor and has extra ram and flash memory, which is certainly an improvement over the 8 bit avr processor... that said the teensy 2.0 or 2.0++ might be better if you have arduino experience. Both are great boards to play around with, and I expect lots more exploits based around pretending to be various usb devices.

There is a good discussion of it here: http://fail0verflow.com/blog/2012/dcpu-16-review.html The key criticisms center around it being not a instruction set for compiling C and other higher language code. The biggest reasons for that are: 1. No ability to store based on the stack pointer (this is great for handling local variables not in registers) 2. No ability to deal with negative numbers 3. No way to address single bytes, everything is full words only. This makes many basic manipulations take many instructions 4. Not very many registers, particularly in light of limitation 1 The 6809 and 6502 had far fewer registers, but didn't have any of the other limitations listed above.

> it is, after all, a popular hobby of children who have nothing but time on their hands and access to the Internet. You certainly don’t need to buy hardware or have access to special training to get started. yup, that's how I learned all of this! > And, to be clear, I do think the current situation of closed systems is not great, Agreed! > and I do think that we do have a lot of engineers who grew up on open systems that they could tinker on going on to design things like iPhone for their children to use. These days there are also more open system like, say, the Raspberry Pi. Back in my day (oh god, I'm growing old!) we had to first exploit video game consoles to get something comparable :-) We made a slightly related argument when we didn't really feel like driving the WiiU homebrew scene almost 8 years ago (stop making me feel old!) [1] [1] https://fail0verflow.com/blog/2013/espresso/

It's obviously a crypto challenge to anyone who has ever played them. It maps way too nicely to human concepts. This is what every amateur putting together an "alien challenge" without attempting to be scientific about it ends up doing, and it's easy to tell. That's fine if you're doing it for fun, but it's obviously not real. And that is confirmed: https://www.popularmechanics.com/space/a19257/nsa-key-to-extraterrestr… I've been here solved that. ACM tried to run an challenge about an "alien computer" that was obviously not alien, but ended up being very real. I was part of the team that reverse engineered it first, but the whole contest collapsed and all interest waned after we ended up finding the very-much-not-alien chip involved by accident. We did cover the initial process, but unfortunately never got around to writing the follow-up posts. https://fail0verflow.com/blog/2012/unprogramming-intro/ https://web.archive.org/web/20160304030848/http://queue.acm.org/unprog…

Assuming that the web service is doing proper client side authentication most of the time (which, with enough effort, can be verified), and then gets coerced into sending compromised JS at some point in the future - we still have better security than the alternative of no client side security at all. Sure the increased chance of a malicious update is a real threat, but it is better than that attack not needing to be performed at all. A further incremental improvement could be made using a Mega-style root of trust (ironically, an article explaining how they messed up the implementation explains it best: http://fail0verflow.com/blog/2013/megafail.html). Only the initial loader page (with embedded hashes and MACs) needs to be checked for whether or not it has changed on each page load. If you want to be immune from a later malicious update, you just have to manually save the loader page and open it instead of re-requesting it from the Mega. Yes, during an update they can stop serving the old scripts and deny access, but you will at least always know when an update has occurred.

Just to hijack this thread on how resilient PCIe is. PS4 Linux hackers ran PCIe over UART serial connection to reverse engineer the GPU. [0] [1] [0] https://www.psdevwiki.com/ps4/PCIe [1] https://fail0verflow.com/blog/2016/console-hacking-2016-postscript/

The top-level Verilog module and Vivado .xdc file (contains pin mappings, timing constraints, etc) from Gidel for the HawkEye 20G-48. [0] No SDK from Gidel though. My back burner project for them is to create a PCIe TLP sniffer/MiTM/device emulator by hooking up two together via 10 GbE for relaying TLPs with one of the remaining 10 GbE connection going to a host PC for the sniffed/injected TLPs. The Aria 10 FPGA PCIe hard IP allows for either root or endpoint mode so I “just” need to draw the rest of the owl, avoiding any Quartus IP modules that would make the setup non-transparent. I’m not sure what using a 10 Gbit link for PCIe will be like with faster devices but fail0verflow got away with TLP proxying with 115200 baud UART. [1] [0]: https://www.ebay.com/itm/335904285904 [1]: https://fail0verflow.com/media/33c3-slides/#/11

The ISA not but the platform does. Like you can make an x86 computer that is not a PC. PS4 is one example: https://fail0verflow.com/media/33c3-slides/#/22 But when you make a PC, you are stuck with multiple layers of legacy crap, any of which can prevent proper low power states or suspend.

You're either being sarcastic or wildly underestimating how hard it is to write an exploit. I haven't written about exploit dev publicly for a _long_ time, but I invite you to read https://fail0verflow.com/blog/2014/hubcap-chromecast-root-pt2/ for what I consider to be a pretty trivial exploit of a very "squishy" (industry term) target. XNU isn't the hardest target to pop but it is far from the easiest.

The Wii U titles appear to be far more integrated into the OS. On the Wii it appears that games were run at a pretty low level [0]. Also, on the Wii, although there is an updatable system menu capable of downloading and running some small apps, the menu shown when you press the home button while in a game was included with each game as part of the SDK, not as part of the OS [1]. (The Korean version of Mario Kart Wii was found to have unused files for a Chinese home menu [2].) Meanwhile on the Wii U it is possible to launch an entire web browser and certain other apps from the home menu and still return to your running game afterwards. [0]: https://fail0verflow.com/blog/2013/espresso/ [1]: https://wiibrew.org/wiki/HOME_Menu [2]: https://www.youtube.com/watch?v=0gfFDAXNMj8

https://fail0verflow.com/blog/2016/console-hacking-2016-postscript/ I think this is the talk that goes through their PCIe intercept stuff. Absolutely hilarious to me; I believe they were running one direction at 115.2kbps and everything was just a-ok about it.

Unfortunately this isn't the complete story. Being able to use a DS4/DualSense with a PC or other device is a different beast from being able to emulate a DS4/DualSense for a PS4/5. The console actually authenticates the controller using some secret [0]. I find it very doubtful that Sony has implemented this authentication in their Linux driver and released the necessary secrets. Unless this procedure is a part of a standard that I'm unfamiliar with that it may still need to be reversed for PS5/DualSense. We also need the secrets or use the workaround with a legitimate controller I referenced in a different comment [1, 2]. [0] https://fail0verflow.com/blog/2018/ps4-ds4/ [1] https://news.ycombinator.com/item?id=27378663 [2] https://www.cronusmax.com/manual/wired_controllers_connecting_to_ps4.h…

> seriously, I've tunnelled PCIe over 115200 baud RS232. You can do all kinds of horrible things to PCIe and it will still work. Ah, yeah, I remember this presentation: https://fail0verflow.com/media/33c3-slides/#/11

Here's a link to the talk & blog post: https://fail0verflow.com/blog/2016/console-hacking-2016-postscript

A more direct link to the source article about the exploit itself: https://fail0verflow.com/blog/2018/shofel2/

And the article that goes with it: https://fail0verflow.com/blog/2018/shofel2/

Yes, those customizations are made by AMD. They aren't even very custom, fail0verflow have managed to run a lightly modified linux kernel with the open-source AMD drivers on PS4 hardware with full graphics acceleration[0]. [0] https://fail0verflow.com/blog/2016/console-hacking-2016-postscript/

That's the security through obscurity model though. As fail0verflow continually notes in their blogs [1], piracy is the least interesting use case of exploits for them. Yes, the additional attack surface available when loading a user-controlled OS is helpful in writing exploits. But Sony bungling the PS3's PRNG for code signing would have still been broken even without Other OS. [1] https://fail0verflow.com/blog/2016/console-hacking-2016-postscript/

Here's a good writeup of the original bug: https://fail0verflow.com/blog/2012/cve-2012-0217-intel-sysret-freebsd.… With the VA width changing, all the fixes for that and related bugs will need to be updated.

> "Unlike its predecessor, Dotcom's new site Mega offers secure encryption, which he says protects each user's identity and data." I haven't kept up with Mega much lately, but does anyone know if the security issues identified after the Mega launch were ever fixed (see e.g. http://fail0verflow.com/blog/2013/megafail.html)? It seemed like the Mega launch was rushed to take advantage of the free publicity they were getting, but I would expect that they've had enough time to get their house in order by now.

See http://fail0verflow.com/blog/2013/megafail.html there are still security concerns.

Some details in this article: http://fail0verflow.com/blog/2013/megafail.html

> every bit of media that is “exclusive” to DRM-encumbered formats shows up, every single time, unlocked on file-sharing networks and torrent sites. Incorrect. PC games, software, console games - many of these have not and likely will not be cracked. That's not to say there aren't many out there but if you have paid attention to information dripping out of cracking groups, you'll see it's becoming much more difficult to get around DRM. Similarly, Cinavia works. RTMPE works. It doesn't mean they should be there. It doesn't mean that adding the DRM doesn't cause annoyances to legitimate consumers. But that blanket statement that whatever DRM you add is ineffective is simply wrong. Edit: quick example - ps4 released Nov 2013. Can you play pirated games on it? Nope. You can install linux but it's likely a number of years before piracy can happen. https://fail0verflow.com/blog/2015/console-hacking-2015-liner-notes.ht…

The coupling of a cryptoprocessor[1] to avoid network packets and circuitry tampering with a locked kernel could stop people to use cheats. The CPU would only execute a signed kernel[2] while the kernel would only load signed modules. Today, each gaming studios/publishers are working on their own anticheat solution in their corner. Here, the anticheat would be the platform itself, you would only have to focus on keeping the kernel secure to turn all games cheats free (in theory). video game consoles are going this route with varying degrees of success[3] [1] https://en.wikipedia.org/wiki/Secure_cryptoprocessor [2] https://en.wikipedia.org/wiki/Code_signing [3] https://en.wikipedia.org/wiki/PlayStation_Portable_homebrew https://en.wikipedia.org/wiki/PlayStation_3_homebrew https://fail0verflow.com/blog/2014/console-hacking-2013-omake/