Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/836 Thanks!
For as long as Nintendo has been making
video games, they've been building in
copy protection and region locking,
and as long as there's been copy
protection, there have been people
breaking it.
Today, Pluto, Derek
and Nevitt return to enlighten
us on the state of the Nintendo switch.
Give them a round of applause.
Hi, guys.
Oh.
Is it working?
Oh, yeah.
OK.
Hey, I'm up to though this is
dark and and
yeah, first off,
we try to be ethical
hackers, so we don't
really condone piracy and we really
just want to do creative things with
hardware that we own.
So, um.
Yeah. And
so the Nintendo switch was released about
nine months, months ago and we
didn't play around with it since.
It, uh,
it's it's been real successful, like it's
on a lot of units.
And so
we want to hack it. Right. So
the usual entry points that you do is you
go by the Web browser and
the switch has a Web browser, but it
doesn't have a generic Web browser.
So we found a way
to launch the browser, but it's not
actually intended to be launched this
way. So there's this Tetris
game that you can buy
and.
It will take some time.
So you go into the main menu,
you press that right to your bottom on
your right, joka and
it launches the game manual and
then you go to the menu and you go
all the way down to the bottom.
And then they included a link
to their website.
Take some time spraying the heat,
so.
Oh, boy, I hope I didn't break it.
I'm sorry I broke it.
OK, so one more time.
This was actually the export
that we use, it's really old one,
like it was six months old at the time
that the switch was released and
we didn't even have to find our own.
We could just take a public one.
And, uh, yeah,
you start.
It's pretty painful doing this over and
over, but I've gotten used to it like
I've done this a thousand times.
It's the wi fi.
Yeah, I don't have I'm sorry.
This was not the way we intended it to
be, but maybe
we can try it later.
I'm so sorry.
If you can go into the menu
later.
OK, OK, so we're
talking about security.
We'll get to them working for later.
So, um, uh, OK,
so,
uh, the switch is actually quite
powerful unit. It's a hybrid,
handheld and stationary console.
So it has a quad core
that's connected the one gigahertz.
It's an F seven arm
and it has an individual GPU Maxwell
architecture.
It's clocked on either 300 for 84
or double that if
depending on if you're docked to a
power supply or not.
So if you're running a battery, they want
to reduce the power consumption.
It has plenty of memory, like four
gigabytes of DRAM.
And then there's the selling point
pretty much to jerricans and
those are detachable.
So you can either play yourself or you
can share one of your accounts with a
friend and you can play two players.
They have all the nice sensors,
accelerometer, gyro, NCAR,
and they have this feature called H.I.G.
Rumbo. But it's just a vibrator
and these ones don't have any security at
all. So you can just unscrew them.
Look at that part. No Google, Dipak, no.
Get all the data sheets and dump the
flash. It's all plaintext.
But when you open the main unit, this is
what you see, you have the two
drums, it's in the orange section,
and then you have the main CPU, which is
in red, and then the rest is just
the power management wi fi,
boring stuff.
So.
Oh, yeah. And the Flash, they actually
made a separate board for the Flash
so we can easily just unplug it and dump
it and stuff.
And yeah, the code name for
the switch is that I'm not
sure what they were thinking, but yeah,
when we look at the main CPU,
it's branded Odean X
or two.
It's like because Nintendo is the OEM,
this chip is actually just got from
Nvidia and Anex is the code name
of the Nintendo switch.
But it turns out that the part number
is just a lie. It's just a regular Tegra
X1 Nvidia chip
like people decapitates and it looks just
the same.
And yeah, we have the reference manual
online. It's freely available, pretty
much it's 3000 pages.
So it goes into detail pretty much
everything except the security part.
But they also have provide their own
Linux drivers.
But yeah, we can get the security,
at least some of the security
registers and everything like that.
Um, the main overview of the SCC
is that you have an on seven Blackbutt.
It does power management and it
has a boot drum.
They also have some internal s ram
and then you have the main CPU and it has
six four K of RAM.
That's for TRUSSONI.
So it's secure on secure bus,
secure access only.
And then you have the GPU on the same day
and then you have the security engine
that are say yes,
acceleration, it can DNA and stuff.
And then they have on diffusers,
a lot of them actually like
a thousand and
then they have the memory controller,
they have a Tesuque, which is
security CPU.
It's a really weird architecture.
They they were really
creative. And so and then
they had the DSP, which is
kind of boring.
And then they have a bunch of busses that
you can talk to, external devices.
So
the highlights for refuses to use it for
a lot of stuff, configuration stuff, but
they are 30 bits dedicated to downgrade
protection. So every time they have a
vulnerable firmware, they can just burn a
Fuze. And every bootloader
needs to Fuze to make sure that
the number of bits it expects is actually
set. So if you try
to downgrade, just rewrite the flash
memory, it will not
boot because there's a Fuze inside of the
CPU that
says we're not allowed to do this
anymore.
So and then they have the SPCA,
which is a just normal
yes, 108 ASCII,
and it's the source of all the
confidentiality in system.
So this is what you want to have if you
want to decrypt all the software.
And it's also in the fuzes and you can
disable this one later on in booth, so
you can only access it during early boom
time.
And then they saw the hash of the
RSA public key, which is
how they verify the firmware binaries,
but they don't store is actually they
just sort of hash because they want to
save space, but it's equally good.
And then they have this cool feature that
they can patch the boot from so they can
store patch instructions
for how to modify the Buttram code.
So if they have exploitable bugs in the
goodrum and they do, they
can actually fix them, which is they
can fix the factory time.
So they actually filled up all of this
space just fixing bugs.
And it turns out that since this is just
an off the shelf shipped from Nintendo,
from Nvidia, sorry, they actually just
provide this board.
You can buy from them.
It's seven bucks or half that
if you're a student.
So this gives you access
to you can play with all the audio and
discover what's undocumented about it,
and if we look
at the software, so
people just. There was this rumor
concerning VBAC and everyone was asking,
does it run? No, it doesn't run it and
stop asking.
Instead, it runs because the micro kernel
called Horizon that's been in development
at Nintendo for free
for the three days.
So it's it's yeah.
Like eight, nine years old, maybe.
Um, all the drivers are running userspace
and they called services.
So it's a micro micro services
architecture.
And then they have a custom Nvidia
graphics driver that's kind of similar
to the Linux driver,
but they modified it a lot and then
they have the a custom API to talk to
it. So they have a kind of it's
like Volcan like it's a really thin
abstraction on top of the GPU
and it's custom it's undocumented for us.
So.
So if you come from the U.S.
hacking scene, you can we can do a
comparison.
So the main difference is that all U.S.
processes now, Áslaug, so all the drivers
and all the games are using Áslaug.
So it's randomizing the outer
space and that makes it really hard to
exploit save games, because if you just
have a file format bug, you
really can't do much if you don't know
where things are in memory.
And they rewrote
everything pretty much just refactored
and renamed everything.
But if you just.
Which of the abbreviations, all the
concepts are the same,
they don't have a security processor like
the three of us had our nine, it was a
big problem for us because it was a.
Come back.
So were so three deaths
at this R.M. processor, which did a lot
of stuff, it was a big attack surface and
it didn't have any memory protection.
So they remove
this. Now everything is running on the
same CPU with memory protection.
So the security model they have is
the most privileged part is
trussoni. And it just is a krypto
interface. Pretty much.
It's designed in a way that the keys
never leave the trust. So hopefully.
Well, that's that's how they wanted
it. So it kind of works like a hardware
secret
and then you have the kernel.
So its goal is just
to enforce process, isolation and
communication between processors.
And as the Iowa Review,
it controls the menu and
then it has what are called base
services. These are processors with
Áslaug and everything.
And this FS module, which is the
filesystem driver and
NCM, which is not really interesting, and
some which is a service manager.
This one's pretty interesting.
It, um, it
enforces the whitelist of which process
is allowed to talk to which process.
And then this RPM loader, which just
loads and creates new processors
and then SBL, which is the interface
to trust.
And then they have a bunch of micro
services like the GPU
driver, Wi-Fi, driver, Bluetooth
and stuff like that.
And then finally, we have at the lowest
level we have the game or
the Web browser.
So the Web, so the Web browser game,
sandbox, we only get
access to approximately half of the
calls.
And there are 40 user services
which are. Yeah.
Services that you're supposed to access
as a user.
And it has a concept of process
filesystems. So a game can really
only access its own save data and save
games.
Um, and it can mount SD card,
which is when we want to make a homebrew
exploit, for example, we want to
load files of the card like elfs,
but we can't do that just from the
browser alone
and then the service sandbox, which is
where all the drivers are at.
We have like 20 more Sisco's.
It's mostly just for talking to
DMA devices and handling
IP communication.
It has to service whitelist, but it's
vastly reduced, but you get access to a
few more and the services
don't have any access at
all. In general, there are a few
exceptions, but this is pretty powerful
because even if you were to elevate,
let's say, go into the GPU driver,
you don't get any extra file access
as a result.
And they sometimes need to talk to
external devices. So they have MMI
mapped.
But even if a malicious driver tries
to do it, you may request outside its own
process outerspace.
The kernel is actually the one who
maintains the autonomy for all the bus
messers. So a malicious
driver cannot really askia
a device to do something it's
not supposed to do.
The base service unbox, which is those
five, six processes that
are special,
they are bundled inside the colonel
package together with the colonel and
they have approximately the same size as
the normal services.
But these ones don't have a service
whitelist because these ones are the ones
that actually enforce the whitelist.
So you can't
like they are they're the ones who
enforce it and also fill it in
and maintain it so they can
check themselves basically.
And they also because they maintain the
file system, they have no
wait list for, they can access everything
basically.
So we're going places
and we start from the lower
back, the most underprivileged part.
And yeah, so we start with
Webjet, that's the emulator.
And um,
yeah. So they've had a bunch of bugs
here. They fix them all, but it just
keeps coming more.
Um, it's used for
each of uh like when you buy games
online and manual and other stuff,
but it's always over htp or.
Yeah, we can control the data except with
this one game.
Also Firmware 2.0 input
implemented a new way of launching the
browser. You can just
create a new access point and act like a
wi fi.
And yeah, you can just render arbitrary
HTML because it thinks it's a login page
for a particular WiFi network.
And yet we just took this Pegasus exploit
and just works.
Um, so when we get
the memory of the browser, the first
thing we find is that it's
linking, it's dynamic, linking with a
file called STK.
And when we run strings
on it, it's not an alpha, but we convert
it enough.
We get pretty much all of their function
names, which is really nice when you
reverse engineering stuff.
We get names of all the calls and all
the fancy.
Some of the crypto stuff.
Yeah.
So, yeah, this is what we're going to do
later.
So the game application,
yeah, they knew we were going to get this
at some point and with Webcke
it is pretty easy.
So what we didn't done is we're trying to
blackbox trying to elevate our privileges
from the sandbox.
So my my
my handle is Pluto.
And there's a service called Cloo.
So I don't believe in fate.
But yeah, I looked into the service
and it's a user accessible service.
That's what we use for.
We think please for preload
there three commands to take an integer
sign integer.
And if you feel it's a big value,
you know, it's crashes.
And this is just like an array autobahns
read where we control the index
completely so we can just give
it a negative index and we can read out
the entire binary of service.
So this way we can dump the code of
Années, which is one of the.
So we managed to get one of the micro
services for just blackbox
poking things.
And now we're going to look into the s.m,
which is the service manager is the one
that enforces the white list of
which services you're allowed to access.
So the way you you ask it for,
you give it a string and it gives back a
handle to that service that you ask for
and you send it appeared you
send your kid so that
it knows which whitelist to
enforce.
But yeah, what if we just don't call
the initialize function so we never
actually give it up?
It turns out that the variable
that's supposed to sort of is on
initialized, it will just be zero.
And so as some things were a process,
we did zero.
And then we get access to everything, so,
um, but we still we
can talk to everything, but we don't have
the code. So we want to do is we
want to dump all the code in the system
so we can analyze it.
So if you look at the monitor launched
it launched this way and
all the code comes from this F.S.B loader
service. It has a function called Mount
Code.
So we just need to connect to it and read
out all the binaries. Right.
Uh, when we try to connect, we get some
error message. Turns out
the kernel and forces, you can only have
one section at a time,
but this section is currently held by the
loader.
So the loader has a solution to the
filesystem driver.
But if we crash loader, the colonel
will garbage collect the reference count
will go to zero and
it will release decision.
So we find a command in Loader
that you just give it a thread handle
and it crashes.
So we get all the code binders,
just carry them out.
This really nice. Well, now we can really
understand the system a lot better.
And finally, we look at Colonel, and
for that, we're going to take a little
bit of a detour. So Derek is going to
talk next about
what happens before the system
is put it up. So.
OK, it seems like we lost some time on
the demo, so I'm trying to hurry a little
bit,
so, OK, so far this was
all achieved by just using
black box, black box testing
and, you know, like so black box
testing is fun, except that it's
not because, well,
the switch uses an Michoacana and
that means the tech surface is
pretty low. It seems quite unlikely
that you will get some primitive
where you can just dump the entire
country. And also
there's Asel are in the privileged
processes.
So you might even need to vulnerability's
in the process to get access
to like
Crellin system because that only purge
process can use.
So yeah, like I
was testing on the kernel, I was kind of
a dead end for us.
And when you think about the chain of
trust, what kid is
pretty much at the
end?
So maybe it's
a new console. So maybe you why not
just start at the other end
so we
can have a look at the boot sequence?
And it's very cool because
it's all documented publicly by
and video and yeah,
you get a bunch of information just
for free.
And the way it works is there is a bridge
that runs on the ARM seven, which is like
a super old and crappy CPU
that they call the Eppy and P,
which means like Booch
on power management processor.
And this this
is actually not a custom Buderim.
It's written by Invidia.
But as you already
mentioned, Nintendo Hassan
custom patches on it,
the BAJRAM wheel
well as it is, as it is
explained in the documentation,
it will just load the BCT, which is the
boot configuration, Taylor and the
second stage loader from Immanency.
So at this point, you don't really
need know what the obesity is, but
basically it holds the boot from where
the next well well, the
where the second stage loader is located
in the emcee and it also
contains the signatures.
Um, so when
that's the usual boot flow on the switch,
it will try to boot from infancy.
But if that fails because, for example,
the C is missing, it
will enter a recovery mode
which allows you to send USB messages
to the Buderim.
And if you might think, yeah, this is the
ultimate pectore.
Well, unfortunately, it's not, because
all messages must be signed
by using Nintendo's private RSA
key. And of course, we don't have that.
Uh, but what we can do is we
can dump the see, which is
like super easy.
And we did that.
And we got a pretty nice overview
of all the boot components
that are stored on the EMC.
So this is a little bit complicated.
But what you can see is
the boot from on the left, it
loads something that is called package
one, which is basically
the second stage bootloader and next
stage in one image.
And the first part is actually
stored on E.M.S.
in plaintext.
It is not encrypted and
the other part is encrypted
by using.
Universal universal encryption
keys, it's not there's no
console's unique encryption there.
So how does it work?
How does the package one,
the decrypts the next stage?
So they have this feature where
they lower the keep block from
in and see which is console
unique and it basically contains
encrypted keys and
package one. Lawder generates
a couple of key to
decrypt that key block and then it uses
the decryption keys from that
key block to decrypt the next
stage.
So we would like to get this key
because the car
is also encrypted
when it's part of a package, too,
as you can see on the right.
And well,
this key is only available to
this package, one loader.
So that means we need
to get code execution in package
one loader.
OK, so
how do you get some keys?
Well, in the past,
as you might know, we clicked
the three years and got the keys and we
released the EU and got the keys.
So maybe,
yeah, maybe
you can click the switch and get the
keys.
So we wanted to try that, and
in order to do this,
you want to get Constitution Package One
Law Order and
basically you want to acknowledge the
component and load the package and order,
which is the Buderim.
But how is this
actually verified?
So the boot from this
is that BCT, which I've
already mentioned, and
this is basically
a
plan to explore start on the
E.M.S.
and it contains all the signatures of the
bootloader.
And then there's an
AP signature on top, or as AP
says, it's a really strong signature
scheme and
it uses the hours a public key,
which you can see on the
top to verify the signature.
And this public key is
Hashd.
And this hash is stored
in the Fuze of the device,
so you cannot you cannot change it.
Basically, what we want to do is
when the bureau verifies this publicly
using the hash, we want to
klich this hash
check because then we can put
our own public key and our own
BCT signatures, and that's
our own bootloader signatures
so we can sign on bootless.
OK, but we don't.
Well, we didn't have the Buderim then
back there and
we didn't know when this check like
the hash tag, when when does it happen.
So we have to find the timing for
it. And for that we can
take a look at the invincibles.
You can just sniff it.
So we get a really nice dump of
all the comments that are issued
by the Buderim to the see.
So you can see that if
it's the time difference
between each command that
was issued and
it's basically the
time that the patrol needed to
do some operation between those streets.
So when the when the
when the beseeches was good,
it took quite some time
to verify it.
And when you
put, like an invalid
public in the BCT, the BCT
validation will fail and it will actually
start ringing next to you.
And then you can see the
difference is much smaller.
So that means the Buderim
will see, oh, the
the public is wrong.
I will not I will not try to verify
the rest of the BCT.
And with that they basically leaked
the time of check
when the Buderim checks the
public. He has.
OK, so this was all in theory
and basically
it took like one month to develop
a glittering set up.
And this is this just uses
power clicking.
So what I did was
I first dissolved all the capacitors
on the voltage titrated that was
that powers the seven and
then have used an FPGA
to basically control
Somerset's. And those muscles
will pretty much lower
the voltage for a short time.
So hopefully the
public high hatcheck will fail.
And and then
when you get code execution,
we are pretty lazy and we just beat
back the clock
because we actually found some clock
divider register.
So basically,
by changing the frequency, we could
encode
the data of all the secret keys
bit by bit, sending it to FPGA.
And then we got
all the keys and
with that, all the binaries.
OK, so, um, so
thanks, Derek, you got us all the keys,
which is really nice.
So now we can analyze the Colonel White
white box instead of black box, which
means we can read the code.
And the first thing you do when you want
to explode something is you find out the
memory map because you want to go up
memory eventually.
Where should you write?
So it turns map to the high address
somewhere. If you see
it's read execute.
But this actually is a virtual address
that maps to dirham and then they
have a different mirror that's read.
Right.
So we can
actually bypass the read-only portion by
using the other address instead.
And the three of are the same floor.
But I think they're thinking here is
that, yeah, it makes the code a lot
cleaner. So they just, uh,
always keep this door a mirror inside
the door at this space.
Um, all the objects are Elkadi using a
slagheap, which is like one
object type, and all the
applications are of the same size.
So this makes use of Kifri is really
difficult to exploit because
you can't overlap two different
two objects of different type, which
you usually want to do.
So you can only overlap an object with a
different object, um,
that has the same types of some of the
fields would be different, but.
Um, most of the pointers are still valid
for both objects will still
be at the same offset.
So, yeah, and
now the kernel cannot execute this line
code because they use the privileged
you'd never bet on, which
is a hurdle that you have to get through.
Um, I'm not sure if anyone paid
attention, so just explain this, the
strictly right is the permissions
for the first three are privileged
permissions and the lower three
are usually land permissions.
And there's something a little bit weird
here. So, um,
they accidentally mapped the kernel into
userspace as, uh,
executable.
And it's mostly useless.
But, uh, it
means that we can use this we can just
jump in the kernel from userspace and we
will execute kernel functions in
userspace context.
But we can use this as an áslaug bypass
because the kernel is always not at the
same address. So we can
use it for gadget's.
But this really we haven't really
owned the colonel yet, so the Ayumu
is one of the parts of the current you
can attack.
It's yeah, it's no
controller of the sea.
Um, the idea is that all of the North Sea
bass masters are protected, so.
You sign it and aerospace identifier
Essid, and then you assign a pitch
table to that acid and
every device that goes through the item
and you can only access what's left in
the pitch table.
And the colonel maintains this pitch
table. That's why it's secure.
So a malicious driver can't,
uh, violate the
process isolation.
And so this this, of course, is that
you can only access your own heat through
DNA.
There's a functionality for accessing it
for another process as well.
You can lend memory, but.
Yeah.
So how do we bypass this and so we
got the official data sheet, three
thousand pages, and we can just search
for bypass this and then you
get this.
So the GMU is a memory management unit
inside the GPU and, yeah,
it supports bypassing,
passing something so Invidia
back door themselves.
So this is a game you attack,
you can set be 31 in the pitch table
entry and it's in hardware.
So you can fix it and
video. Thank you.
So this is one way of doing it and they
can fix it, but we also had a different
way of bypassing the simu
and it has to do it's a trust issue.
So the loader
loads the permissions that we have from
EFS. And if we own efforts
or vulnerability, Nafez, we can just tell
it what we're allowed to do so
we can tell it where we should be allowed
to access the memory controller and then
we can just assign acid's so we can
assign the acid zero here to our device.
Just means don't do
any virtual addressing.
So we can do all over dirham,
pretty much so the answer is simple,
we can just the critics in the room, so
we can just it but that
doesn't work because there's a
security feature in the remote
controller. You can specify a
contiguous memory range that's protected
from DNA and they protect this to
include all of the kernels.
So we can't really touch it.
But we inspected the code a little bit
more. And when they allocate the
handle table and they
are two different ways of allocation,
if you have a smaller table,
less than 40 capacity,
you you just use the internal struct
as storage.
But if you have more than 40,
they are in the pool.
And this is the same pool that's used for
all the memory of all the user processes.
And this pool is not protected by the
carveout, but the
handle table just is trusted like it
contains kernel pointers and everything.
And yeah, we can just inmates.
So we can create a shared memory object,
which is just
primitive that the current provides and
we can tell it to share the kernel to
and I'm going to inject it into our
Handal table of our process and then we
can use the skull to map it into our
own process. So then it will move the
kernel into our process, thinking it's
a shared memory and then
we can just patch it or insert a back
door or anything.
So this is the way we own the kernel.
And here's some code.
Uh, yeah.
And now we're going to talk.
Yeah.
Now, we're going to talk a little bit
about Drosten, so there were.
All right, so is this
nice execution environment program
and we are seeing there glitching
actually give us a method to decrypt
package one point one, and it just
contains the trust on payload.
You know what I will show you in
the next 10 minutes or so is where we can
actually ignore just at all.
So the
Army supports trust on
the code running under a secure A3,
which is just as soon as we call
it, is called a secure monitor.
This is an official name.
Nintendo calls it the same, but
on the Nintendo switch, it doesn't
monitor anything.
All right.
So the secure monitor.
Hmm. It's the first code
that runs on the arm, the main CPU.
So the seven decrypts packets,
one point one it.
Right. The Treston payload to
ram. That is what we saw.
It's this small ram in the arm.
The aide that's distressed Sunseeker
memory puts up the Army
eight times there.
And then this is actually the first task
of the security monitor already
booting the horizon kernel.
All right. So we saw
this package at this point
because it will be in main RAM,
then secure monitoring will start
deriving some keys, the package
to write to Col to
the dirham and
decrypt the the package modules
and then just start executing the
kernel. So this is the most important
task probably, or one of the most
important ones.
And the second most important task of
this agreement was actually cryptography.
So cryptography
is not directly done in software by the
secure monitor, but they
actually make use of this nice security
engine that is provided by Invidia,
the technical security engine
and other some
not so important task is
Treston or the security is actually
used to start stop the additional
CPU because as we've seen, we have four
CPU course.
We start executing from core three
initially. So we have to have means
to stop the attackers.
And the last important part is the sleep
mode. So the Tegra actually
supports some deep sleep mode
to save some battery.
This is always a nice feature of Nintendo
consoles, usually very long through the
Sleetmute.
Now take a good
look at this list.
And this is actually not important for
homebrew at all.
That's why I said we can really just
ignore the Trussoni completely.
But let's look at it
anyways for completeness sake.
So the Tagaris e
I mentioned it's a hardware krypto
engine. It supports ESR,
RSG, all the good things.
And maybe you remember from the 3D,
they had this Kiesler concept.
It's apparently a good concept, so they
kept it for here as well.
So you have 16 key slots for a Yes.
Two four hours a you can lock
them individually.
This is for example, but the boot uses
the SB Keys written to a key slot.
It's locked. So you can just read it out.
I mean, it gets cleared once we're in
this area.
But in the
trust zone, code does the same.
It drives some keys into the upper keys
lots and locks them.
So even if you get code
execution in a trust zone, you wouldn't
be simply able to just read out
this keys so that that's quite secure.
All right, and what's
another interesting thing about the
is that the crypto operations actually
don't just operate on memory, you can
actually encrypt and decrypt between
key slots. So this actually enables you
to do some secure key derivation.
So you can imagine having a key in one
key slot key slot could be locked
and then you could actually decrypt this
key slot into another one without ever
having any keys leaving into
memory.
So this maybe you could think
of some cool things you could do with
that.
So how does the cryptography
work on the left
side, you see the secure world, this
would be the secure monitor.
The right side is the nonsecure world or
the user mode.
Mostly this is used in the file system
module.
So what you have to do at first,
you have to request a key encryption key
and then a secure world will generate
this key encryption key.
You put some parameters, it'll wreck
the key encryption key.
And this is where the important part
comes in. It'll actually use a random
session key.
So even if you get a key encryption
key from one session, once you report
your console, your switch, and the
next time it'll be invalid.
So even if you, for example, exploit the
file system module and grab
one key encryption key, you won't be able
to use it after the reboot.
So this is a security sign there.
But on the other hand,
how do you use these key encryption keys?
Will you pass an
encrypted key into a secure
world along with the key encryption keys?
And this is and unwrapped the keys
decrypted and then the plaintext final
key actually is passed back to
use them.
So that's quite interesting.
So what you actually find is
that, for example, the filesystem module
doesn't use the hardware
crypto engine to decrypt games or
binaries or whatnot at all.
So this is all done by accelerated
hardware, accelerated
instruction, actually.
So in theory,
you could, for example, exploit the file
system and you'll get some permissions
and then ask the security
monitor to derive all the keys for
you. All right. So this is another
reason why it's not really important.
Now, the last task
we've seen is to Sleetmute.
So this is actually a string from the
secure monitoring to call it Zoome
apparently means good night or something.
And so on a sock
there is the small thing.
It's the power management controller.
And this controls to sleep and wake
transitions and
and system sleep.
The entire system on a chip is powered
down except for the PMC.
So there is a small block that's
Always-On and the dirham is put
into some self refreshment so that
it keeps the contents.
Right now, if you
into sleep mode, the monitor
actually has to save some states.
Right? So it does its bills to secure
memory into external Deran, which is
untrusted.
But but it's all right.
It's encrypted, so don't worry.
And it also authenticates to TCM,
to PMC.
So it's encrypted and authenticated to
contest it.
Right.
And it tells the security engine to
save its context to dirham.
You also have to retain the keys.
I mean, you have to use them after you
wake up. Right.
And then we signal the arm to
put everything into this ELPIDIO mode,
which is like the slow power mode
and then wake up. You just roll
everything up from back and forth.
So this is the Ohio and
the Buttram will restore desisted
from dirham.
Then it'll pass Aamco execution to
assign one bobin.
And this one would be a bit like a
bootloader for dirham.
So instead, from an end boot, a cold
boot, we're doing a warmblood.
So from dirham and
this one would be unsigned.
That's nice.
What this does it just decrypt the secure
monitor from dirham to trust and verify
it with the authentication information
that we have left in PMC.
And then if you will just resume
running theory.
This all sounds very good, but
for completeness sake, we can
just remove the trust from Treston.
So as we've already
seen from Pluto, there are some trust
issues.
We can just ask the colonel to map the
lower dirham. With all this data stored,
we can map in PMC into user mode,
the PMC registers, etc., etc.
And we just seen that these
are crucial. We can process.
Right. We've seen that the trust
on memory is decrypted from the araminta,
it's around and whatnot.
So if you plug all these
areas in just the right way,
you get code execution from
from user mode.
Right. So, yeah.
But as I said, it's it's
just a fun thing to do is not very useful
for homebrew anyways.
Thank you.
All right, so it's pretty green.
OK, so what we've done so far is
when we put the kernel, we made a USB
debugger up
and it's.
Yeah, it works, you can use your
programs, you can put break points and
inspect the registers, you don't get
the symbols yet, but it's open
source. So if anyone wants to add it, it
currently requires a criminal exploit,
but we don't share it.
But hopefully someone will make
their own buy this after the stock.
But what we really care about is
homebrew. So we've made Liban X,
which is user mode homebrew
library.
We have we provide all the kernel
primitives like you can create threads.
You can mutex you can
talk to all the processors using IPCA.
We have nice wrappers for everything
we have for the working network
filesystem.
We can act as a USB host.
We have the controllers working and
it's Metzgar.
OK, so we have about four working
and this really long time, I think our
friend LSH worked on this for like
two weeks, full time
running like Android binder
IPC interface inside their own IPCA
interface. It's pretty crazy, but
yeah, we have it working and
we're pushing the updates so
anyone can just use this now.
So but still, there's work to be done,
right? We enjoy reversing
Friday code a lot.
It's a lot of fun and it's fun.
I hope you agree. And
we still have work to be done, right.
So we don't have any GPU acceleration
right now in Lebanon.
So right now, everything is software
rendering and
all support.
We don't have it right now. So, uh,
and then we want people to make games
because otherwise the hacking is for
nothing. Um,
so we can't release
it today, but we're working on a homebrew
launcher, so there will be homebrew soon.
Uh, it's, uh, in collaboration
with a dance team team with which
which actually implemented a lot of
the exploit.
So we're just like trying to make it a
nice, stable platform for homebrew
and yeah.
Get on firmware three if you're lower
and stay stay there.
So
thank you to everyone involved and
especially yellow, you couldn't make it.
So now we have the demo working
and I'll have it, uh, not.
Also, thanks to our
this is a all of
thanks to Nintendo. Well,
it's a pretty nice system.
So you do
a.
It is you know,
this is where you
know.
This is just something I wrote like last
night, but.
Hopefully works.
Thank you.
If we have time for questions, we can
have them, we
have time for some questions.
There are microphones stationed around
the auditorium, numbered one through six.
You have a question burning that you
would like to ask then, please.
I would ask you to line up behind these
microphones and I will call you.
Also, there is a signal angel who
is taking questions from the Internet,
and I see that he already has one.
So, dear signal angel, please.
Our first question.
Thank you. When glitching to get
the keys, how long did it take to get the
keys with the, you know, the exact
right timing?
Have you been able to anyhow automate
this task?
Sorry, could you repeat the question that
the speaker is a bit lazy?
GLITCHING to get the keys.
How long did it take and could you
anyhow automate this task?
OK, so the question was
how long it took to get the keys and if
we could automated it?
Yeah, it took about like one
month to get some
people up keys.
And just recently, like
I think last week,
we got some other keys
as well.
So, yeah,
um, regarding the glitching set up, yes.
It was possible to automate it because
we found the reset signal.
So after each clicking
attempt that failed, we could just reset
and try again.
Microphone number six,
yeah. Thank you for a great talk.
I would really like to rebuild
your little tech.
Is this stuff some of your neighbor?
So could you repeat it was something
about the taking reproducing it?
Yes, I would really like to try
it myself.
Is this information about the glitch
somewhere available?
So the question is, if the more
information is available on the glitch
attack and.
Yeah, well, basically, it's
just clicking.
Um, there's a lot of information
about it, but it's it's not that
difficult. I mean, you saw it was a
pretty cheap set up.
You just need some offsets
that somehow the voltage don't
you ground.
And that will just work, I guess.
Microphone one,
since there have been jokes about the
switch just being an Android tablet, if
you guys try to start running Android.
No, we didn't try that yet, but
I think it would be pretty sweet to have
Android running on switches.
Well, yeah, I think it would
only make sense with some kind of code
good exploit.
And yet we are still working
on that. So, yeah.
Signal Angel.
Thank you.
So you told about doing crypto on the
key slots.
Could you copy an encrypted
key from a locked key slot into an
unlocked key slot, read it out and then
decrypted.
So there are bits that actually or the
question was whether you could copy an
encrypted lock key slide into
an unlocked keys lot and then read it
out. So there are some bits
that actually controls whether you can
read right from a low key slot and you
could actually set it up such that you
wouldn't be able to encrypt
from a key slot into an unlocked key
slot.
So you can actually make it secure.
This is one that we thought of, but there
are mitigations against this attack by
the locking mechanism.
So unfortunately, that that's not
possible if you set it up correctly.
Thank you.
Microphone four.
Yeah. Thank you very much.
You just told us that we should
stay on exactly three
point zero point zero.
So what did change
from two to three?
That doesn't make a
whole group feasible on that version.
And what was patched for
three point zero point
one so that it doesn't work anymore.
So the question is why
it won't work beyond the three point zero
zero if I got it right, and the reason
is that the bug we
talked about where you
don't send the pitch, so think it's zero,
they fix that bug on three
one. So if you're below
that, you're still vulnerable.
But if you're above that,
you can bypass the whitelist
and you can really get anywhere.
So that's the answer to that.
But.
Something I was going to say.
Yeah, I would probably, yeah.
It wasn't anything important from my
microphone, too, yeah.
So this exploits work,
work. Some people touch us.
What have you been able to test
it on other web hits like The
Captive Portal?
Yeah, so the question was, if
there were expert only works with this
Tetris game and no,
the answer is that
the website is not actually bundled with
the game. It's more like a system
athlete. So so the game
just launches an update from the system
for firmware.
So we have
the same bug, the Pegasus one that we
demoed. Um, it works
up to two point
three, I think.
And then they fixed it and then it will
be fixed for all of the games.
But yeah,
if you're above 2.0, you don't
really have to buy this game, this Tetris
game, you can just launch it without it.
So.
All right. That was all the time we had
for questions. Let's give them another
round of applause.