Found another RCE for 3ds, this time in the sd management applet. Pretty neat primary entrypoint, will polish this up to get it booting into hbmenu.
youtube.com/watch?v=TXpCCQ8Y…
This is a format string vuln, quite limited, but enough to be turned into a limit r/w primitive. With some heap grooming, this allows ROP, which gspwns a payload from the SD card over executable code.
Arbitrary remote code execution in New Super Mario Bros. 2, delivered from another console in the same local wireless game.
Two array indices are taken straight off the wire from the other player, never bounds-checked, resulting in an arbitrary write.
youtu.be/oiqbQSvgWsc
The write forges a texture-copy command directly into the GPU command queue to gspwn a loader into executable memory. This then streams in the rest of the payload and jumps to it. No ROP. Will do a proper writeup at some point.
Wow. I actually think Super Nintendo World's designers used art from Newer Super Mario Bros. Wii (a NSMBW mod) as a reference for their cacti. They have a somewhat distinct shape, were made specifically for Newer, and show up when you Google "New Super Mario Bros. Wii cactus".
other people: buying banks of 3090s to mine shitcoin with
me: running hashcat overnight on my GTX 1060 (the one with a giant case fan ziptied to it) so that i can discover more of the function names in this 11-year-old Wii game
SMBNext: The Lost Levels is now out! This contains a huge collection of cut content from SMBNext that spans around three years of development.
Get it here: smbnext.net/lostlevels/
Discord Server: discord.gg/EnESkrr