ASLR scripts/overlays confirmed on hardware!
Posted by: RETIRE
Date: 2018-03-13 17:19:08
Here's the video evidence:
https://www.youtube.com/watch?v=d740tdPTTDM&feature=youtu.be
Also a long video showing off how to do this on hardware / explaining this a bit more in depth
https://youtu.be/z5taufgobuA
I said Map 168 but it was Map ID 163.
For anyone who has not read the HoO document, out of bounds scripts (oob scripts for short) are scripts and overlays loaded
via RETIRE, when there aren't at least 4 scripts in runtime in the current map id.
For nearly a year, it was unknown as to how to recreate it, even on an emulator, however, while testing a different glitch I accidentally stumbled
upon it.
ASLR
When you start up your console, Address Space Layout Randomization kicks into action.
It does what the name implies, it randomises address space for memory.
Because of this, it's supposed to be harder to use action replay codes, and other hacking tools.
From the looks of it, there are 64 different randomisations that you could get on startup.
As you might have guessed by now, the section of memory used by RETIRE if there are less than 4 scripts, will be randomised.
This means that there are 64 different results/map id you could potentially get from using RETIRE. Before we go further, let's show some examples.
[img]https://i.imgur.com/PjZyw3T.png[/img] [img]https://i.imgur.com/5kB1331.png[/img] [img]https://i.imgur.com/48RnYqS.png[/img]
Odd continuous surfing script: https://www.youtube.com/watch?v=9HR-yCyEuLo
Changing player name: https://www.youtube.com/watch?v=hp2TKubjBC0&t=18s
Changing map width/coordinates/void: https://www.youtube.com/watch?v=2LkBXYXW_Xk,
Chosing new starters: https://www.youtube.com/watch?v=CzuMAdM_kPA
These are just some examples, and I'll show more later in the thread.
As you can see, the results can be quite spectacular.
As far as I've noticed, these scripts only activate if the map id has some kind of script in it's runtime.
If it does not, it doesn't do anything. This might mean that RETIRE reads this as the data needed.
But, remember when I said that there are only 64 randomisations?
While this is in fact true, it doesn't mean we can't get more results/map.
In the void, there's a specific set of map's that are used in the battle tower.
These Battle tower map's move bytes by about 8000. This also influences the results heavily, and actually gives you 2x64, or 128 results/map!
We have been actively looking for ways to get some kind of ACE with this.
To end off, I'll add some more fun scripts!
[img]https://i.imgur.com/T05CGu9.png[/img] [img]https://i.imgur.com/HYAdWtK.png[/img] [img]https://i.imgur.com/vKxm0Tl.png[/img] [img]https://i.imgur.com/qqZjpcK.png[/img] [img]https://i.imgur.com/mRuSPPd.png[/img] [img]https://i.imgur.com/lqYLooN.png[/img]