This is somewhat of a follow-up to the Nintendo Alarmo blog post from last year. This time the blog post is about the security of the STM32H730 microcontroller series itself, which is also used by the Alarmo. The STM32H730 contains an Arm Cortex-M7 core and 128 Kbytes of internal flash memory. In this blog post we'll take a look at a vulnerability that allows arbitrary code execution in the secure…
While everyone was waiting on news for the successor of the Nintendo Switch, Nintendo released the Alarmo. A small plastic alarm clock that can wake you up with sounds from your favorite Nintendo games. While I was hesitant to buy one at first, I eventually decided to get one and look deeper into how it works. Just an Alarm Clock? The Alarmo has a small 2.8-inch LCD at the front, a back and…
It's annual Wii U exploit time! 😄 Image of the Wii U connection test screen on the GamePad. After reverse engineering parts of the Wii Us' NET stack for another project I was working on, I realized it's using a modified version of NicheStack . NicheStack is a TCP/IP stack developed by InterNiche Technologies and is designed for use in embedded systems. INFRA:HALT If you end up searching for…
With the end of Google's Stadia platform on January 18, 2023, Google published a website allowing people to "Switch the Stadia Controller to Bluetooth mode". This seems pretty cool, but there are two points listed under "Important things to know" which I didn't like: Switching is permanent Once you switch your controller to Bluetooth mode, you can’t change it back to use Wi-Fi on Stadia. You can…
In this write-up we're going to take a look at exploiting the Wii U's USB Host Stack. Over the past few months I spent a lot of time reverse engineering USB related things on the Wii U. Overview The Wii U contains an ARM chip running an embedded operating system called IOSU . IOSU consists of several modules which contain device drivers and other components not handled on the main PPC CPU. The…
BluuBomb allows running an IOSU kernel binary by sending data from an emulated Wii Remote. Overview The Wii U's operating system consists of CafeOS, which runs on the PowerPC, and the IOSU, which itself runs on an ARM chip called the Starbuck. While the Wii U has several exploits and entrypoints on the PPC side, the IOSU only has a few exploits and no direct entrypoints. To get IOSU code execution…