Neat copy protection scheme. Reminds me of the GC/Wii disk protection (also based on holes punched by a laser), but on read-write floppies. The obfuscation is similar to what we do for antitampering on The Homebrew Channel (but we go a bit further :P).https://www.youtube.com/watch?v=Qaq9vlfoGnA …
-
Show this thread
-
Our integrity protection hash stores its result in a *memory controller register* (address indirectly constructed), not a variable. That register is not accessible from IOS, in case anyone tries to debug from there. It is checked with a completely different code sequence.pic.twitter.com/2S8NdRuuRR
2 replies 5 retweets 22 likesShow this thread -
What does the code do when it detects tampering? It re-introduces a buffer overflow bug in the new TTF font code that took us a month to originally debug before release. Making HBC *just* crashy enough to be unusable. And the crashes happen *way* later, due to a corrupted heap.pic.twitter.com/P9uGYb4goU
5 replies 7 retweets 46 likesShow this thread -
Separate from this, system and title integrity (i.e. that you aren't using warez IOSes or a "pirated" HBC) is checked by a whole bunch of code (that is much more obvious), and the result stored in a Graphics Quantization Register, read by doing bit manipulation on a stored float.pic.twitter.com/o2aDrqsPTs
2 replies 1 retweet 16 likesShow this thread -
Of course addresses are obfuscated in similar ways to what
@JonTt did, by breaking them up into chunks and shifting/offsetting them. And one of the potential outcomes is... good old upside down screen.pic.twitter.com/w47k58NEk0
1 reply 0 retweets 15 likesShow this thread -
At an outer layer, in the executable packer, we depend on a hardware bug that corrupts uncached MEM2 writes to generate an AES key, which is also mixed with the code itself (antitampering) and a check that we're running from an address in range. This is what breaks Dolphin.pic.twitter.com/0PNgj03uTb
2 replies 3 retweets 21 likesShow this thread -
The installer has many checks including custom ARM code that reads titles and checks signatures, but the best is the Ioctl Fun Machine, which sends random ioctls to IOS and compares timing against what we expect for a standard retail IOS. Also has encrypted functions.pic.twitter.com/qPqpPhhX9t
2 replies 0 retweets 13 likesShow this thread -
This Tweet is unavailable.
-
This Tweet is unavailable.
Yes, it's a global and _ios_ioctlv (which is a wrapper) writes to it.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.