reswitched / pegaswitch

PegaSwitch is an exploit toolkit for the Nintendo Switch
https://reswitched.team
ISC License
934 stars 107 forks source link

1.0 support in dumpModules #97

Closed GovanifY closed 6 years ago

GovanifY commented 6 years ago

Fixes #96
/!\ UNTESTED, should work as is though unless I've been very, very dumb

roblabla commented 6 years ago

That probably won't work (I actually have something similar to this locally). This bug doesn't seem to exist in 1.0.0 (or at least not in this exact shape). I'll make sure by testing right now.

GovanifY commented 6 years ago

@roblabla Thanks. The issue I referenced earlier quoted this offset as working, so I thougt it would work like this. I do not have any means to test on 1.0 though so I'll leave that to you

roblabla commented 6 years ago

Just confirming: this doesn't work.

GovanifY commented 6 years ago

Eh, going to close this then unless you have any idea of how the bug work. I do not have any mean to study 1.0 kernel unfortunately to figure out this(nor tbh the time)

EDIT: Gosh my spelling is so bad today

pixel-stuck commented 6 years ago

It appears on 1.0 that the bug just isn't present, it returns an error about wrong handle type iirc. Requires another way to crash loader. This isn't a kernel bug, though, it's just a loader bug.

GovanifY commented 6 years ago

@dark-samus https://screenshots.firefox.com/LyJlUUfQPojM2mi8/switchbrew.org Also closing

pixel-stuck commented 6 years ago

@GovanifY sure, they're bundled with kernel, but they are still not kernel :P

GovanifY commented 6 years ago

@dark-samus Suuuuuure but that would still require(unless you've found a pretty tricky exploit) a 1.0 console + a kexploit, and I am missing the console :/

pixel-stuck commented 6 years ago

It doesn't require a kexploit, just the decryption keys and a dump of the 819 archive (which browser has access to by default) and the keys are leaked

but yes, you do need a 1.0 console

GovanifY commented 6 years ago

@dark-samus Oh yeah forgot the keys were leaked, my bad. Going in the legit way would still require one to get those though, correct?

pixel-stuck commented 6 years ago

If by legit you mean not downloading leaked keys + 819 archive, yeah.

GovanifY commented 6 years ago

So I wasn't wrong! °^°. Anyways stopping this discussion as this bad PR is growing much bigger than it should, thanks for the confirmation.