Switch System Flaws: Difference between revisions
Add information about ASLR leak in Mario Kart World, and a publicly disclosed Splatoon 3 report |
No edit summary |
||
| Line 1,528: | Line 1,528: | ||
| Mario Kart World | | Mario Kart World | ||
| ASLR leak in application data | | ASLR leak in application data | ||
| A memory address can be leaked by changing your username to something short, and hosting a network session in LAN mode (press L + R + Left Stick on the main menu to enable this). The memory address can be found in bytes 12 - 19 of the application data that is transmitted | | A memory address can be leaked by changing your username to something short, and hosting a network session in LAN mode (press L + R + Left Stick on the main menu to enable this). The memory address can be found in bytes 12 - 19 of the application data that is transmitted in response to a browse request. | ||
'''Note:''' there is more uninitialized data in the packet, but the memory address is probably the most interesting part. The vulnerability was fixed by clearing the application data with zeros, before filling in the information. | '''Note:''' there is more uninitialized data in the packet, but the memory address is probably the most interesting part. The vulnerability was fixed by clearing the application data with zeros, before filling in the information. | ||