stuck pixel retweeted
Got the chance to abuse one of my favorite crypto issues again today. Heads up @nvidia i know that the name "cipher block chaining" confuses you, but AES-CBC decryption is not a chaining mode. Only encryption. You can forge arbitrary plaintext in CBC dec without knowing key lol
stuck pixel retweeted
This is a big deal: Apple is locking batteries to iPhones now. ifixit.com/News/apple-is-loc…
stuck pixel retweeted
We are very proud to present you with the new release of Luma3DS, v10.0! NTP client, blue light filters, lots of cheat engine improvements, many new debugger features, and more! Check it out at github.com/AuroraWright/Luma… !
stuck pixel retweeted
I want to make a small experiment and see how far this goes: retweet and share this tweet if you want Mother 3 to be released in the West.
The goal is simple: to create tangible proof of the interest for it to be localized and for this to reach whoever is able to make it happen.
stuck pixel retweeted
This is what happens when you chain @SciresM, @hexkyz, @CTCaer, @balika011, @pixel_stuck and my work together!
Fully compromising Horizon 1.0.0 using PegaSwitch and Nereba, booting into 8.0.1 emuNAND + CFW.
Video by Milenko.
youtube.com/watch?v=1vhDL43Z…
stuck pixel retweeted
Soooo, after a few evenings of work, I've 100% broken Widevine L3 DRM. Their Whitebox AES-128 implementation is vulnerable to the well-studied DFA attack, which can be used to recover the original key. Then you can decrypt the MPEG-CENC streams with plain old ffmpeg...
stuck pixel retweeted
When I was hacking the Switch, I was working on an exploit requiring generation of very specific Mii database entries. If you looked at one, this was what you saw. #nightmarefuel
stuck pixel retweeted
Got permission to publicly disclose this bug by @Nintendo, so I decided to do a quick write-up. Enjoy! daeken.svbtle.com/nintendo-s…
stuck pixel retweeted
After a long debugging process, way too many mesa recompiles, and Armada's wonderful assistance, I'm happy to say that OpenGL 4.3 (Core Profile) can be used now.
If all goes well there will be a public beta test release within a week, stay tuned for the ( ͡° ͜ʖ ͡°)s!
stuck pixel retweeted
PSA: SX OS contains brick code. How do I know this? Take a guess... :/
Anyway, the concept is the same that was used by Gateway for the 3DS: your eMMC will be locked with a specific password. Sadly, in my case, the password was generated from random garbage on the stack. :(
stuck pixel retweeted
Fixed a few more bugs, and Atmosphère's custom "loader" implementation (and its custom "sm" implementation) work on 5.0: youtube.com/watch?v=h--YfiKh… ( ͡° ͜ʖ ͡°)
NOTE: Atmosphère is still not usable to boot Horizon OS proper yet! With any luck that should be working soon, though :)
stuck pixel retweeted
Running my own recrypted homebrew on iQue, the improved RAM bandwidth makes it run incredibly fast
stuck pixel retweeted
Running the unreleased Zelda Ocarina of Time: Traditional Chinese version on iQue
stuck pixel retweeted
Another day of debugging later...and my re-implementation of the Switch's "loader" sysmodule works on hardware, and can be used to redirect exefs content arbitrarily to the SD card. :)
Example video (used to launch the HBL instead of album): youtube.com/watch?v=g_f1HfEP… ( ͡° ͜ʖ ͡°)
stuck pixel retweeted
First public arbitrary code execution on iQue, made possible by recent releases
stuck pixel retweeted
ShofEL2, a Tegra X1 and Nintendo Switch exploit fail0verflow.com/blog/2018/s… github.com/fail0verflow/shof…
stuck pixel retweeted
I guess this means "nspwn" is now public -- an issue in the Switch's OS fixed in 5.0.0 that gives arbitrary code execution with full system privileges (if one has access to the lr service).: switchbrew.org/index.php?tit… nitter.gq/qlutoo/status/98853631…
source code for the 3.0.0 homebrew exploit -- includes homebrew loader + python obfuscators for rop + installer
github.com/switchbrew/nx-hbe…
stuck pixel retweeted
And, done -- once you use Puyo Puyo Tetris JP to install this on a 1.0.0 console, you'll never need to launch Puyo again to get a browser open for hax :): github.com/reswitched/pegasw…
