Skip to content

Instantly share code, notes, and snippets.

void inject_trusts(int pathc, const char *paths[])
{
printf("[+] injecting into trust cache...\n");
extern uint64_t g_kern_base;
static uint64_t tc = 0;
if (tc == 0) {
/* loaded_trust_caches
iPhone11,2-4-6: 0xFFFFFFF008F702C8

The following is a write-up of how I initially achieved kernel code execution on the Nintendo Switch, very much inspired by hexkyz's write-ups. The work discussed was completed over the course of a single conversation between hthh and I during the evening of November 21st, 2017. A number of snippets are attached from that conversation as inline links, in the hopes that they'll be interesting to readers.

Background information


I would recommend one read hexkyz's recent write-up on how the switch was broken into via GPU DMA attacks. It's a great read!

In particular, he describes:

Additionally, the kernel itself would start allocating memory outside of the carveout region
@LexManos
LexManos / clean.txt
Created December 8, 2018 20:06
1.13 Announcement.
So about 1.13. As we have been stating since the public release of 1.13,
the Forge update is a time we are taking to re-write everything from the
ground up. Not just Forge, but the entire toolchain, launcher, installer,
and core of Forge is being rewritten. Every line of code is being inspected,
and re-validated. This whole process takes a while. To give you (the reader)
an idea of what has been done so far:
ForgeGradle has been rewritten to support modern gradle versions, with better tools
to be expandable and used for more than just setting up a Minecraft/Forge
dependency project. It's also much cleaner and organized this time around
@brandon3055
brandon3055 / Stoneblock Client side event dump
Last active October 24, 2018 01:55
This is a dump of most client side event handlers. Statically registered events are not listed. A lot of these events are registered both client and server side.
Dumping listeners for bus: EVENT_BUS
Handlers for event: class appeng.api.events.LocatableEventAnnounce
NORMAL appeng.core.features.registries.LocatableRegistry updateLocatable(appeng.api.events.LocatableEventAnnounce)
Handlers for event: class betterquesting.api.events.DatabaseEvent$Update
NORMAL betterquesting.handlers.EventHandler onDataUpdated(betterquesting.api.events.DatabaseEvent$Update)
Handlers for event: class betterwithmods.api.FeatureEnabledEvent
NORMAL squeek.appleskin.helpers.BetterWithModsHelper bwmFeatureEnabled(betterwithmods.api.FeatureEnabledEvent)
@brandon3055
brandon3055 / Stoneblock Server side event dump
Last active October 24, 2018 01:55
This is a dump of most server side event handlers. Statically registered events are not listed.
Dumping listeners for bus: EVENT_BUS
Handlers for event: class appeng.api.events.LocatableEventAnnounce
NORMAL appeng.core.features.registries.LocatableRegistry updateLocatable(appeng.api.events.LocatableEventAnnounce)
Handlers for event: class betterwithmods.api.FeatureEnabledEvent
NORMAL squeek.appleskin.helpers.BetterWithModsHelper bwmFeatureEnabled(betterwithmods.api.FeatureEnabledEvent)
Handlers for event: class com.enderio.core.common.event.ConfigFileChangedEvent
NORMAL com.enderio.core.common.config.AbstractConfigHandler onConfigFileChanged(com.enderio.core.common.event.ConfigFileChangedEvent)
NORMAL com.enderio.core.common.config.ConfigProcessor onConfigFileChanged(com.enderio.core.common.event.ConfigFileChangedEvent)
@Desani
Desani / ScanMedia.md
Last active April 10, 2024 23:44
3.6 - Corrected issues with determining terminal size in specific use cases. Added file encoding thanks to recommendation by LordKenmou. Fixed update script checker.

This script utilizes ffmpeg, the same tool Plex uses, to decode the video stream and captures the output for any errors during playback and sends the playback errors to a log file. So essentially it plays the video in the background faster than regular speed. It then checks the error output log file to see if there is anything inside. If ffmpeg was able to cleanly play the file, it counts as a passed file. If there is any error output, an error could be anything from a container issue, a missed frame issue, media corruption or more, it counts the file as failed. So if there would be an issue with playback and a video freezing, it would be caught by this method of checking for errors. Because of the nature of the error log, any errors that show up, even simple ones, will all count as a fail and the output is captured so you can view the error log. Some simple errors are easy to fix so I have included an auto-repair feature which attempts to re-encode the file which is able to correct some issues that would cau

import UIKit
class ViewController: UIViewController, UITableViewDelegate, UITableViewDataSource {
@IBOutlet weak var tableView: UITableView!
override func viewDidLoad() {
super.viewDidLoad()
NSLayoutConstraint.activate([
tableView.topAnchor.constraint(equalTo: view.topAnchor),
@Maddosaurus
Maddosaurus / readme.md
Last active February 11, 2023 14:51
Dual Boot Arch & Windows 10 - Both fully encrypted on the same disk

Fully encrypting a multiboot-installation with TrueCrypt/VeraCrypt is unfortunately not possible ATM.
Also, chainloading an ISO in GRUB is not working, so it's kind of complicated to get FDE (Full Disk Encryption) working in a multiboot single drive configuration.

1 - Do a Windows 7/8/10/x basic (unencrypted) install

Not much to say here. Basic install with all your desired settings. But wait with wireless, passwords, setup & stuff.
Just let it use 50%(?) of your available space and let it create its recovery volume.

2 - Install Arch Linux with dm-crypt

TL;DR: 100MB /boot, 50% I followed the articles from the german Arch wiki here and here (first one is available in english, too).

@Choonster
Choonster / ModelLoadingProcess.md
Last active January 15, 2021 11:20
A description of the model loading process in Minecraft Forge 1.9-1.12.1

In this document, I use strings in the format "foo:bar" to represent ResourceLocations with domain foo and path bar. I also use [square brackets] for placeholders.

The Model Loading Process

Blocks

On startup and whenever the resources are reloaded (in ModelLoader#setupModelRegistry), Minecraft iterates through every registered Block (in ModelLoader#loadBlocks) and asks its custom IStateMapper (or DefaultStateMapper if none has been registered) to create a mapping between every valid IBlockState of the Block and the ModelResourceLocation for that state (with the domain and path pointing to a blockstates file and the variant to a variant within that file). It then attempts to load these models.

DefaultStateMapper looks for the blockstates file with the Block's registry name (i.e. assets/[modid]/blockstates/[name].json) and serialises each property and value of the IBlockState to create the variant name that the model is loaded from (e.g. "enabled=true,type=foobar"

@lolzballs
lolzballs / HelloWorld.java
Created March 22, 2015 00:21
Hello World Enterprise Edition
import java.io.FileDescriptor;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.io.PrintStream;
public class HelloWorld{
private static HelloWorld instance;
public static void main(String[] args){
instantiateHelloWorldMainClassAndRun();