1
edit
Changes
Jump to navigation
Jump to search
Line 35:
Line 35: + + + + + + + + + + + + + + + + + +
no edit summary
Documented libstagefright MP4 integer overflow.
Documented libstagefright MP4 integer overflow.
===contenthax===
'''Present in system versions''': All
'''Publicly exploited''': Yes
'''Discovered by''': yellows8, smea
The Wii U's data management system does not include provisions to validate title content integrity. As such, any game or app's contents may be altered by attackers. In particular, attackers with IOSU code execution may use FSA commands to alter the content files in USB or MLC filesystems. Alternatively, an attacker with control over certain PPC usermode processes (such as home menu or system settings) may use commands such as MCP:CopyTitle to copy title contents over from SD to MLC or USB.
===haxchi===
'''Present in system versions''': N/A
'''Publicly exploited''': Yes
'''Discovered by''': smea
The Wii U Nintendo DS virtual console emulator is vulnerable to contenthax attacks. In particular, the rom parsing code lets an attacker perform fully controled arbitrary write operations, which very easily leads to ROP and code execution, because these titles are among the few that have JIT capabilities.
==PPC kernel exploits==
==PPC kernel exploits==