攻击Nintendo 3DS Boot ROM
Attacking the Nintendo 3DS Boot ROMs
摘要：
我们演示了对任天堂3DS的引导ROM的攻击，以便从通常受保护的内存区域中泄露秘密信息，并在以前未被泄露的设备上获得持久的早期代码执行。该攻击利用其中一个引导ROM的RSA签名验证实现中的缺陷，以使ASN. 1长度字段溢出，并导致无效的固件映像在签名解析器看来是有效的。这然后用于加载定制固件映像，该定制固件映像用定制数据中止处理程序覆盖数据中止向量，然后引发数据中止异常，以便在引导时可靠地重定向引导ROM代码流。这执行有效载荷，由于其由特权处理器的可靠早期执行，该有效载荷能够用作系统的持久利用，以便从存储器的正常保护区域中泄露秘密信息（例如加密密钥）。
英文摘要：
We demonstrate attacks on the boot ROMs of the Nintendo 3DS in order to exfiltrate secret information from normally protected areas of memory and gain persistent early code execution on devices which have not previously been compromised. The attack utilizes flaws in the RSA signature verification implementation of one of the boot ROMs in order to overflow ASN.1 length fields and cause invalid firmware images to appear valid to the signature parser. This is then used to load a custom firmware image which overwrites the data-abort vector with a custom data abort handler, then induces a data-abort exception in order to reliably redirect boot ROM code flow at boot time. This executes a payload which, due to its reliable early execution by a privileged processor, is able to function as a persistent exploit of the system in order to exfiltrate secret information (such as encryption keys) from normally protected areas of memory.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
