5,579
edits
Changes
→IOS: added SDI hack fixed in 4.3
Line 209:
Line 209:
| {{SortableMonth|Jul|2010}}
| {{SortableMonth|Jul|2010}}
| giantpune
| giantpune
+|-
+| SDI
+| Register access IOCTLs use ints for register IDs
+| IOCTLs 1 and 2 in [[:/dev/sdio]] devices are used to write or read register values. When passing 4 at offset 0xC in the in buffer, this manipulation appears to happen in some cached register set linked to the file descriptor. If an index outside this pool is passed, it becomes possible to access arbitrary memory that SDI can access.
+
+This was fixed by adding a cast to a short to to these IOCTLs, likely a result of the parameters themselves being changed to shorts.
+| Leaking or rewriting memory as SDI. Possibly used by [[HackMii Installer]] 0.5 and 0.6.
+| [[4.2rev04]]
+| Unknown (documented in May 2022)
+| Unknown
|-
|-
| ETH
| ETH