15.0.0 - Revision history

Yellows8: /* bluetooth */

2025-11-27T04:40:06Z

bluetooth

← Older revision		Revision as of 07:40, 27 November 2025
Line 164:		Line 164:

	===[[Bluetooth_Driver_services\|bluetooth]]===		===[[Bluetooth_Driver_services\|bluetooth]]===
	Besides the various IPC changes, ~~a vulnerable func was~~ [[Switch_System_Flaws\|fixed]].		Besides the various IPC changes, security flaws were [[Switch_System_Flaws\|fixed]].

	===[[HID_services\|hid]]===		===[[HID_services\|hid]]===

SciresM: Move this to the sensible place.

2023-04-30T21:57:56Z

Move this to the sensible place.

← Older revision		Revision as of 01:57, 1 May 2023
Line 126:		Line 126:
	*** KMemoryState_Io now supports the CanAlignedDeviceMap and CanDeviceMap flags.		*** KMemoryState_Io now supports the CanAlignedDeviceMap and CanDeviceMap flags.
	*** KPageTableBase::GetContiguousMemoryRangeWithState no longer checks that the passed memory address is heap.		*** KPageTableBase::GetContiguousMemoryRangeWithState no longer checks that the passed memory address is heap.
			**** KPageTable::MemoryRange now tracks whether the range is reference counted, and Close() only closes the pages if they are.
	*** KPageTableBase::OpenMemoryRangeForMapDeviceAddressSpace no longer checks passes KMemoryState_FlagReferenceCounted.		*** KPageTableBase::OpenMemoryRangeForMapDeviceAddressSpace no longer checks passes KMemoryState_FlagReferenceCounted.
	*** KPageTableBase::LockForMapDeviceAddressSpace takes two new arguments, an output bool * to write whether the state was io, and a bool for whether to check KMemoryState_FlagReferenceCounted.		*** KPageTableBase::LockForMapDeviceAddressSpace takes two new arguments, an output bool * to write whether the state was io, and a bool for whether to check KMemoryState_FlagReferenceCounted.
Line 149:		Line 150:
	*** When a process is created with system resource size > 0, it now creates a KSecureSystemResource (which manages allocation with KSystemControl).		*** When a process is created with system resource size > 0, it now creates a KSecureSystemResource (which manages allocation with KSystemControl).
	**** All actual underlying logic is the same, this just abstracts the KSystemControl/secure memory interaction out of KProcess.		**** All actual underlying logic is the same, this just abstracts the KSystemControl/secure memory interaction out of KProcess.
	* KPageTable::MemoryRange now tracks whether the range is reference counted, and Close() only closes the pages if they are.
	* KInterruptEventTask was removed and no longer exists.		* KInterruptEventTask was removed and no longer exists.
	** KInterruptEvent now inherits from KInterruptTask directly.		** KInterruptEvent now inherits from KInterruptTask directly.

SciresM: /* Kernel */ Missed this during 14 -> 15 diffing, apparently.

2023-04-30T21:52:09Z

Kernel: Missed this during 14 -> 15 diffing, apparently.

← Older revision		Revision as of 01:52, 1 May 2023
Line 149:		Line 149:
	*** When a process is created with system resource size > 0, it now creates a KSecureSystemResource (which manages allocation with KSystemControl).		*** When a process is created with system resource size > 0, it now creates a KSecureSystemResource (which manages allocation with KSystemControl).
	**** All actual underlying logic is the same, this just abstracts the KSystemControl/secure memory interaction out of KProcess.		**** All actual underlying logic is the same, this just abstracts the KSystemControl/secure memory interaction out of KProcess.
			* KPageTable::MemoryRange now tracks whether the range is reference counted, and Close() only closes the pages if they are.
	* KInterruptEventTask was removed and no longer exists.		* KInterruptEventTask was removed and no longer exists.
	** KInterruptEvent now inherits from KInterruptTask directly.		** KInterruptEvent now inherits from KInterruptTask directly.

Hexkyz: /* nnSdk */

2023-02-28T16:50:31Z

nnSdk

← Older revision		Revision as of 19:50, 28 February 2023
Line 179:		Line 179:
	===nnSdk===		===nnSdk===
	<code>nn::diag::detail::VAbortImpl</code> when handling the retaddr for storing elsewhere, now uses instruction [https://developer.arm.com/documentation/dui0801/g/A64-General-Instructions/XPACD--XPACI--XPACLRI xpaclri]. PAC instructions are NOPs on ARM hardware which doesn't support it, which includes current NX consoles.		<code>nn::diag::detail::VAbortImpl</code> when handling the retaddr for storing elsewhere, now uses instruction [https://developer.arm.com/documentation/dui0801/g/A64-General-Instructions/XPACD--XPACI--XPACLRI xpaclri]. PAC instructions are NOPs on ARM hardware which doesn't support it, which includes current NX consoles.

			This is likely due to a LLVM [https://reviews.llvm.org/D84502 patch] where xpaclri is now always emitted and not related to actual Armv8.3 hardware.

	=== IPC Interface Changes ===		=== IPC Interface Changes ===

Yellows8 at 02:24, 28 February 2023

2023-02-28T01:24:11Z

← Older revision		Revision as of 04:24, 28 February 2023
Line 176:		Line 176:
	===[[RO_services\|ro]]===		===[[RO_services\|ro]]===
	The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].		The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].

			===nnSdk===
			<code>nn::diag::detail::VAbortImpl</code> when handling the retaddr for storing elsewhere, now uses instruction [https://developer.arm.com/documentation/dui0801/g/A64-General-Instructions/XPACD--XPACI--XPACLRI xpaclri]. PAC instructions are NOPs on ARM hardware which doesn't support it, which includes current NX consoles.

	=== IPC Interface Changes ===		=== IPC Interface Changes ===

Hexkyz at 17:08, 10 November 2022

2022-11-10T16:08:17Z

← Older revision		Revision as of 19:08, 10 November 2022
Line 161:		Line 161:
	====Loader====		====Loader====
	The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].		The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].


	===[[Bluetooth_Driver_services\|bluetooth]]===		===[[Bluetooth_Driver_services\|bluetooth]]===
Line 168:		Line 167:
	===[[HID_services\|hid]]===		===[[HID_services\|hid]]===
	Besides the various IPC changes, an infoleak vuln was [[Switch_System_Flaws\|fixed]].		Besides the various IPC changes, an infoleak vuln was [[Switch_System_Flaws\|fixed]].

			===[[WLAN_services\|wlan]]===
			Besides the various IPC changes, a vulnerable func was [[Switch_System_Flaws\|fixed]].

	===[[NS_Services\|ns]]===		===[[NS_Services\|ns]]===

SciresM: fix added -> removed for some removed commands

2022-10-15T18:27:37Z

fix added -> removed for some removed commands

SciresM: ro is not a firm sysmodule

2022-10-12T01:17:48Z

ro is not a firm sysmodule

← Older revision		Revision as of 05:17, 12 October 2022
Line 160:		Line 160:

	====Loader====		====Loader====
	~~The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].~~

	~~====Ro====~~
	The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].		The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].

Line 174:		Line 171:
	===[[NS_Services\|ns]]===		===[[NS_Services\|ns]]===
	Besides the various IPC changes, vulnerable RNG usage was [[Switch_System_Flaws\|fixed]] to properly use secure RNG where needed.		Besides the various IPC changes, vulnerable RNG usage was [[Switch_System_Flaws\|fixed]] to properly use secure RNG where needed.

			===[[RO_services\|ro]]===
			The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].

	=== IPC Interface Changes ===		=== IPC Interface Changes ===

SciresM: ro had same issue fixed

2022-10-12T01:16:58Z

ro had same issue fixed

← Older revision		Revision as of 05:16, 12 October 2022
Line 161:		Line 161:
	====Loader====		====Loader====
	The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].		The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].

			====Ro====
			The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].


	===[[Bluetooth_Driver_services\|bluetooth]]===		===[[Bluetooth_Driver_services\|bluetooth]]===

Yellows8: /* System Titles */

2022-10-11T21:08:25Z

System Titles

← Older revision		Revision as of 01:08, 12 October 2022
Line 161:		Line 161:
	====Loader====		====Loader====
	The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].		The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].

			===[[Bluetooth_Driver_services\|bluetooth]]===
			Besides the various IPC changes, a vulnerable func was [[Switch_System_Flaws\|fixed]].

	===[[HID_services\|hid]]===		===[[HID_services\|hid]]===

← Older revision		Revision as of 07:40, 27 November 2025
Line 164:		Line 164:

	===[[Bluetooth_Driver_services\|bluetooth]]===		===[[Bluetooth_Driver_services\|bluetooth]]===
	Besides the various IPC changes, ~~a vulnerable func was~~ [[Switch_System_Flaws\|fixed]].		Besides the various IPC changes, security flaws were [[Switch_System_Flaws\|fixed]].

	===[[HID_services\|hid]]===		===[[HID_services\|hid]]===

← Older revision		Revision as of 19:08, 10 November 2022
Line 161:		Line 161:
	====Loader====		====Loader====
	The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].		The broken RNG for ASLR was [[Switch_System_Flaws\|fixed]].


	===[[Bluetooth_Driver_services\|bluetooth]]===		===[[Bluetooth_Driver_services\|bluetooth]]===
Line 168:		Line 167:
	===[[HID_services\|hid]]===		===[[HID_services\|hid]]===
	Besides the various IPC changes, an infoleak vuln was [[Switch_System_Flaws\|fixed]].		Besides the various IPC changes, an infoleak vuln was [[Switch_System_Flaws\|fixed]].

			===[[WLAN_services\|wlan]]===
			Besides the various IPC changes, a vulnerable func was [[Switch_System_Flaws\|fixed]].

	===[[NS_Services\|ns]]===		===[[NS_Services\|ns]]===

← Older revision		Revision as of 22:27, 15 October 2022
Line 244:		Line 244:
	*** Added command 155 - inbytes: 6, outbytes: 1		*** Added command 155 - inbytes: 6, outbytes: 1
	** nn::btm::IBtm		** nn::btm::IBtm
	*** ~~Added~~ command 112 - inbytes: 7, outbytes: 0		*** Removed command 112 - inbytes: 7, outbytes: 0
	*** ~~Added~~ command 113 - inbytes: 6, outbytes: 1		*** Removed command 113 - inbytes: 6, outbytes: 1
	*** Added command 116 - inbytes: 7, outbytes: 0		*** Added command 116 - inbytes: 7, outbytes: 0
	*** Added command 117 - inbytes: 6, outbytes: 1		*** Added command 117 - inbytes: 6, outbytes: 1
Line 301:		Line 301:
	*** Added command 4 - buffers: [5], inbytes: 0, outbytes: 0		*** Added command 4 - buffers: [5], inbytes: 0, outbytes: 0
	** nn::mnpp::detail::ipc::IServiceForSystem		** nn::mnpp::detail::ipc::IServiceForSystem
	*** ~~Added~~ command 300 - inbytes: 0, outbytes: 1		*** Removed command 300 - inbytes: 0, outbytes: 1
	*** ~~Added~~ command 400 - inbytes: 0, outbytes: 1		*** Removed command 400 - inbytes: 0, outbytes: 1
	** nn::ncm::IContentMetaDatabase		** nn::ncm::IContentMetaDatabase
	*** Added command 23 - inbytes: 16, outbytes: 1		*** Added command 23 - inbytes: 16, outbytes: 1
Line 320:		Line 320:
	*** Added command 141 - inbytes: 0, outbytes: 1		*** Added command 141 - inbytes: 0, outbytes: 1
	** nn::nim::detail::IShopServiceManager		** nn::nim::detail::IShopServiceManager
	*** ~~Added~~ command 102 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncValue']		*** Removed command 102 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncValue']
	*** ~~Added~~ command 103 - inbytes: 0, outbytes: 32		*** Removed command 103 - inbytes: 0, outbytes: 32
	*** ~~Added~~ command 104 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncValue']		*** Removed command 104 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncValue']
	*** ~~Added~~ command 105 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncResult']		*** Removed command 105 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncResult']
	*** ~~Added~~ command 106 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncResult']		*** Removed command 106 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncResult']
	*** ~~Added~~ command 501 - inbytes: 16, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncResult']		*** Removed command 501 - inbytes: 16, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncResult']
	** nn::ns::detail::IApplicationManagerInterface		** nn::ns::detail::IApplicationManagerInterface
	*** Added command 90 - inbytes: 8, outbytes: 0		*** Added command 90 - inbytes: 8, outbytes: 0
	*** Changed command 607 - inbytes: 16 -> 8 (final state: buffers: [6], inbytes: 8, outbytes: 4)		*** Changed command 607 - inbytes: 16 -> 8 (final state: buffers: [6], inbytes: 8, outbytes: 4)
	*** ~~Added~~ command 909 - inbytes: 8, outbytes: 0		*** Removed command 909 - inbytes: 8, outbytes: 0
	*** Added command 2357 - inbytes: 0, outbytes: 0		*** Added command 2357 - inbytes: 0, outbytes: 0
	*** Added command 2358 - inbytes: 0, outbytes: 0		*** Added command 2358 - inbytes: 0, outbytes: 0
	*** Added command 2359 - inbytes: 0, outbytes: 1		*** Added command 2359 - inbytes: 0, outbytes: 1
	*** ~~Added~~ command 2516 - inbytes: 16, outbytes: 0		*** Removed command 2516 - inbytes: 16, outbytes: 0
	** nn::pdm::detail::IQueryService		** nn::pdm::detail::IQueryService
	*** Removed command 7 - buffers: [6, 5], inbytes: 0, outbytes: 4		*** Removed command 7 - buffers: [6, 5], inbytes: 0, outbytes: 4
Line 343:		Line 343:
	*** Added command 10500 - buffers: [9], inbytes: 40, inhandles: [1], outbytes: 0, outinterfaces: ['nn::prepo::detail::ipc::IAsyncContext'], pid: True		*** Added command 10500 - buffers: [9], inbytes: 40, inhandles: [1], outbytes: 0, outinterfaces: ['nn::prepo::detail::ipc::IAsyncContext'], pid: True
	** nn::settings::ISystemSettingsServer		** nn::settings::ISystemSettingsServer
	*** ~~Added~~ command 119 - inbytes: 1, outbytes: 3		*** Removed command 119 - inbytes: 1, outbytes: 3
	** nn::srepo::detail::ipc::ISrepoService		** nn::srepo::detail::ipc::ISrepoService
	*** Added command 10300 - buffers: [9], inbytes: 40, inhandles: [1], outbytes: 0, outinterfaces: ['nn::srepo::detail::ipc::IAsyncContext']		*** Added command 10300 - buffers: [9], inbytes: 40, inhandles: [1], outbytes: 0, outinterfaces: ['nn::srepo::detail::ipc::IAsyncContext']