Line 1: |
Line 1: |
− | Exploits are used to execute unofficial code (homebrew) on the Nintendo Switch. This page is a list of publicly known Switch system flaws.
| + | This page is a list of publicly known Switch flaws. |
| | | |
| = Hardware = | | = Hardware = |
Line 464: |
Line 464: |
| |} | | |} |
| | | |
− | == FIRM-package System Modules == | + | == BootImagePackage System Modules == |
| Flaws in this category pertain to any of the [[Package2#Section_1|built-in system modules]]. | | Flaws in this category pertain to any of the [[Package2#Section_1|built-in system modules]]. |
| | | |
Line 1,017: |
Line 1,017: |
| | December 24, 2022 | | | December 24, 2022 |
| | March 26, 2024 | | | March 26, 2024 |
| + | | [[User:Yellows8|yellows8]] |
| + | |- |
| + | | [[Audio_services|audctl]] GetSystemInformationForDebug infoleak / buffer overflow |
| + | | audctl GetSystemInformationForDebug calls a func with a 0x1000-byte stack tmpbuf, then afterwards that buffer is memcpy'd into the cmd outbuf. This called func doesn't clear the buffer. This func eventually uses [[BTM_services|btm]] cmd75 with outarray={global ptr} and count=10. Then if the outcount is s32 >=1, it loops through the output using the outcount, without validating it besides the <1 check. Data from that outarray is copied into the array in the func output buffer (tmpbuf above). |
| + | |
| + | With btm comprimised, one could return a large output count and trigger a stack buffer overflow with data following that global array, however exploiting this would be difficult since that data would be uncontrolled (can't directly control it from this cmd at least). |
| + | |
| + | A stack infoleak can be obtained with this as well (assuming the above output array isn't full). |
| + | |
| + | Even though the name has "ForDebug", there's no checks which would trigger an error / return early (this also always returns 0). |
| + | |
| + | [18.0.0+] now clears the output buffer, and also now prints strings into the buffer instead of writing binary data (overflow no longer possible). |
| + | | audio-sysmodule infoleak, which allows defeating ASLR. Also audio-sysmodule memory corruption, likely not useful unless there's a way to control the data. |
| + | | [[18.0.0]] |
| + | | [[18.0.0]] |
| + | | December 7, 2022 |
| + | | March 27, 2024 |
| | [[User:Yellows8|yellows8]] | | | [[User:Yellows8|yellows8]] |
| |} | | |} |