oot3dhax
oot3dhax copied to clipboard
Any willing to support OoT3D Korean version?
I know the other region support is not good, but Is there are any chance to launch hax from Korean console by support Korean OoT 3D hax? The Legend of Zelda: Ocarina of Time 3D CTR-P-AQEK 000400000008F800
- The *hax payloads don't support KOR atm.
- I obviously can't obtain the non-{USA/EUR/JPN} OoT3D codebin(s) for this myself.
Okay, I can give you the code.bin for OoT3D Korean verison. {removed by yellows8}
Not for now, but I hope to support Korean version soon™ :)
That's copyrighted material, not downloading that.
few week ago, i purchased oot3d kr ver and kr n3ds device, and try to reverse oot3d kr code.bin basically oot3d kr looks like also have vulns. but kor region's compile optimize option may be difference to other regions, many rop points looks difference(registers, command, ...)
so, i'm try to search rop points, and remake asm code, but my works failed.(i'm asm newbie. so it is probably my fault)
- REGPOPADR 0x1888a4
- BLXR6 not exists
- BLXR3 0x16c8f0 // r3(); if r5+1 >= 0x10: pop {r4-r9,sl,pc}
- BLXR4 0x4b22f4 // r4(); pop {r3-r5,pc}
- BLXR5 0x17d120 // r5(); pop {r4-r8,pc}
- ADDSHIFTVAL_BLXR3 0x2c808c
- ROP_WRITER4_TOR0_x2b0_POPR4R5R6PC 0x22426c
- SLEEP_THREAD 0x31cff8
- GSP_CMD8 0x16fe34
- GXLOWCMD_4 0x179f20
- ROP_LDRR1R1_ADDR1R1R2LSL3_STRR1R0 0x2acdf4
- COND_THROWFATALERR 0x3211cc
- THROWFATALERR 0x2dcc694
- DSP_SHUTDOWN 0x320f80
- srv_GetServiceHandle 0x31da0c
- REGPOPR0R3SL 0x18b8c0
- REGPOP24ADR 0x100590
- svcCreateThread 0x10bf3c
- ROP_POPR3_ADDSPR3_POPPC 0x187f28
- MEMCPY 0x31f084
- STACKMEMCPYADR 0x1aa988
- GSPGPU_HANDLEADR 0x566e44
"but my works failed" ?
ah.. not working. game was just crash and return home menu. maybe i wrote wrong asm code :(