Kartdlphax 3DS

kartdlphax
General
Author	PabloMK7
Type	Exploits
Version	1.3.3
License	Unlicense
Last Updated	2023/07/25
Links
Download
Website
Source

Kartdlphax is a semi-primary exploit for the download play mode of Mario Kart 7. It allows running a userland payload on an unmodified Nintendo 3DS by having it connect through download play to another 3DS with Custom Firmware running the exploit.

Installation

To use kartdlphax, you need to install the Luma3DS 3GX Loader Edition 3DS fork on the host system. The exploit uses a 3GX Plugin, and you can place the .3gx file from the Releases page in the appropriate directories depending on your game region.

• EUR: luma/plugins/0004000000030700
• JAP: luma/plugins/0004000000030600
• USA: luma/plugins/0004000000030800

By default, the plugin uses the built-in otherapps (3DS ROP xPloit Injector or Universal-otherapp 3DS). However, you can place your own otherapp at /kartdlphax_otherapp.bin if desired.

Usage

1. Enable the plugin loader from the Rosalina menu (L+Down+Select) on the host 3DS.
2. Launch the Mario Kart 7 game matching the region of the client 3DS(es).
3. On the host 3DS, select Local Multiplayer and enter the settings, including selecting the client 3DS type and exploit type.
4. On the client 3DS(es), launch the download play application.
5. On the host 3DS, select Create Group and let the client 3DS(es) join the group.
6. Once the multiplayer menu loads on the host 3DS, select Grand Prix, 50cc, any driver combination, and the Mushroom Cup. The exploit will trigger on the client 3DS(es) after some time.
7. Keep in mind that while you can send the exploit to 7 consoles simultaneously, the success rate seems to decrease for each console added.

Media

kartdlphax - A Mario Kart 7 semi-primary exploit for the Nintendo 3DS - (PabloMK7)

Technical Details

The exploit works by leveraging a vtable pwn exploit and a ROP chain. The download play child application doesn't have the course files stored in its ROMFS, so it has to ask the host to send them when needed. Since this data is not part of the child .cia and is not signed, arbitrary data can be sent. The client sets up a buffer to receive data from the host but never checks the incoming data size, allowing a buffer overflow to overwrite important data after the receive buffer. By overwriting a vtable, an arbitrary jump in the main thread can be produced, eventually leading to the ROP chain github.com.

The ROP chain, using yellows8's 3DS ROP kit as a base, can terminate problematic threads and replace the area at 0x100000 with the next stage using gspwn. A small helper payload is needed first since some gadgets and important functions are in the same area as the otherapp target address. The miniapp payload, based on luigialma's version from nitpic3d, terminates the rest of the problematic threads, reconstructs the partitioned otherapp from the received buffer, maps it to 0x290000 with gspwn, and finally launches it github.com.

Changelog

v1.3.3

• Fixed menuhax for 11.17 consoles.

v1.3.2

• Fixed all issues related to firmware version 11.17.

v1.3.1

• Fixed EUR and JPN not working.

v1.3.0

• Added support for firmware version 11.17.

v1.2

• Added built-in 3DS ROP xPloit Injector otherapp.
• Added menu to select the target 3DS type and which exploit to use.

v1.1

• Added compatibility to the American and Japanese versions of the game.

v1.0

• First Release.

Credits

• 3ds ropkit (by yellows8).
• universal-otherapp (Copyright (c) 2020 TuxSH).
• 3DS ROP xPloit Injector
• CTRPF (by Nanquitas).
• nitpic3d's developer luigoalma for his huge help.
• Kartic for his huge help and all the people from his development discord server.
• ihaveamac for helping me try the exploit in an American console.

Notice

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

External Links

• Github - https://github.com/PabloMK7/kartdlphax
• Gbatemp - https://gbatemp.net/threads/kartdlphax-a-mario-kart-7-semi-primary-exploit.587755/
• Reddit - https://www.reddit.com/r/3dshacks/comments/xfc7ki/kartdlphax_v12_3ds_rop_xploit_injector/