Possible new Wii exploit

It's... been a while.

Anyways, while checking out why was it that Firefox was updated a full version number again in such short notice, one thing led to another, and I was led something I hadn't remembered in a very long while: the acid3 test.

According to it's entry in wikipedia, the acid3 test supposedly crashes the console. Unfortunately, this was not something I could try out since I'm not currently anywhere near my Wii, but a quick google search revealed me this:

[www.youtube.com]

and this

[www.youtube.com]


The latter is longer, yet a bit more precise and clearer than the first. Still advised to watch both (skip to around 5:00 in the latter), since they both display similar behaviour, yet act different in both instances.

As you can see, the acid3 test crashes Opera, and inherently, the Wii. I have no idea why it crashes. Maybe precisely because it's forced to display something on screen for which it was not designed to display. I think that it might be helpful somehow, and I thought I'd let you know (if you didn't know already).

While I'm aware that a couple of new exploits have been released in the last couple of months, I thought that at least one other wouldn't hurt (this, implying that Nintendo will ever bother to update the Wii, what with it's new console in the horizon).

I don't think there is likely to be an Opera based exploit. Nintendo probably locked down the browser a lot to ensure there is very little possibility of exploiting it to a useful degree.

Neither of those videos show a crash, they just show the browser becoming unresponsive (possibly because it's run out of memory or some other fatal error).

i think the internet channel is ruled out as an avenue for exploits because it stores/parses/runs/whatever the webpages from mem2. and it has configured mem2 to be non executable. there is already the old opera exploit with a whole bunch of opening html tags and no closing tags that works to crash the browser. however, even when you get it to execute your own code, you code happened to be in that area of memory that it refused to execute, so it just crashes.

on a different note, the internet channel loads it save file into mem1. and its save file is a vff file. there are lots of assumptions in their vff code, and it is easy to write a save file that crashes the internet channel. but i never managed to get it to do anything except allocate a bunch of memory and then crash while accessing a null pointer.


now, i never tried to combine these 2 methods. i would guess that it is entirely possible. since you can use the save file to get your code into memory that is executable, and then use the html-tag exploit to get the channel to branch to your code in mem1.



Edited 1 time(s). Last edit at 11/11/2011 02:34AM by giantpune.