- The Best Games Stranded on 3DS and Wii U, and How Nintendo Can Bring Them Back for Switch IGN
- Animal Crossing: New Leaf completionists race against time to help each other finish their towns before Nintendo turns off 3DS and Wii U servers in 3 days Gamesradar
- Nintendo 3DS fans say goodbye to the beloved handheld Polygon
- Pretendo saves the day after Wii U and 3DS server shut down — here’s how to keep your Nintendo games online Laptop Mag
- Just before Nintendo shut down the 3DS and Wii U servers, fans rallied together and gathered 23000 data dumps to preserve DLC that was nearly lost forever Gamesradar
Tag Archives: 3DS
Just before Nintendo shut down the 3DS and Wii U servers, fans rallied together and gathered 23000 data dumps to preserve DLC that was nearly lost forever – Gamesradar
- Just before Nintendo shut down the 3DS and Wii U servers, fans rallied together and gathered 23000 data dumps to preserve DLC that was nearly lost forever Gamesradar
- Animal Crossing: New Leaf completionists race against time to help each other finish their towns before Nintendo turns off 3DS and Wii U servers in 3 days Yahoo! Voices
- Pretendo saves the day after Wii U and 3DS server shut down — here’s how to keep your Nintendo games online Laptop Mag
- The bootleg Nintendo Network replacement no longer requires jailbreaking Engadget
- Nintendo Shuts Down Online Services for Wii U and 3DS, but Fan Project Pretendo Is Keeping Them Alive IGN
3D’s MIDI moment: Pixar, Adobe, Apple, Autodesk, and NVIDIA rally around OpenUSD – CDM Create Digital Music – Create Digital Music
- 3D’s MIDI moment: Pixar, Adobe, Apple, Autodesk, and NVIDIA rally around OpenUSD – CDM Create Digital Music Create Digital Music
- Apple plays nice with others for an OpenUSD metaverse Computerworld
- Enter a New Dimension: Groundbreaking Alliance Breaths Life into 3D and Augmented Reality Tech. Softonic EN
- Pixar, Adobe, Apple, Autodesk & NVIDIA Form OpenUSD Alliance to Drive Open Standards for 3D Content Animation Magazine
- Adobe, Apple, Autodesk, Nvidia, and Pixar come together to promote and develop OpenUSD 3D standard The Indian Express
- View Full Coverage on Google News
ENLBufferPwn: Critical vulnerability disclosed in 3DS, Wii U, and Switch games
Nintendo hacker PabloMK7 has released ENLBufferPwn, an exploit including proof of concept code, which demonstrates a critical vulnerability in multiple Nintendo first party games. Demo videos of the exploit show that it is possible to take full control of a target’s console, simply by having them join a multiplayer game.
Impacted games include Mario Kart 7, Mario Kart 8, Splatoon 1, 2, 3, Nintendo Switch Sports, and other Nintendo first party titles. The hacker explains that the vulnerability can be used as part of an exploit chain to run custom code on the consoles. However Nintendo have patched the vulnerability in most games already, following disclosure through their bounty program late last year.
What is ENLBufferPwn for Nintendo Switch, Wii U, and 3DS?
ENLBufferPwn is a vulnerability in the common network code of several first party Nintendo games since the Nintendo 3DS that allows an attacker to execute code remotely in the victim’s console by just having an online game with them (remote code execution). It was dicovered by multiple people independently during 2021 and reported to Nintendo during 2021 and 2022. Since the initial report, Nintendo has patched the vulnerability in many vulnerable games. The information in this repository has been safely disclosed after getting permission from Nintendo.
The vulnerability has scored a 9.8/10 (Critical) in the CVSS 3.1 calculator.
Here is a list of games that are known to have had the vulnerability at some point (all the Switch and 3DS games listed have received updates that patch the vulnerability, so they are no longer affected):
-
- Mario Kart 7 (fixed in v1.2)
- Mario Kart 8 (still not fixed)
- Mario Kart 8 Deluxe (fixed in v2.1.0)
- Animal Crossing: New Horizons (fixed in v2.0.6)
- ARMS (fixed in v5.4.1)
- Splatoon (still not fixed)
- Splatoon 2 (fixed in v5.5.1)
- Splatoon 3 (fixed in late 2022, exact version unknown)
- Super Mario Maker 2 (fixed in v3.0.2)
- Nintendo Switch Sports (fixed in late 2022, exact version unknown)
- Probably more…
PabloMK7 adds:
Combined with other OS vulnerabilities, full remote console takeover can be achieved. This has been demonstrated in the case of Mario Kart 7, where a payload is sent to launch SafeB9SInstaller. However, it is theoretically possible to do other malicious activities, such as stealing account/credit card information or taking unauthorized audio/video recordings using the console built-in mic/cameras.
The hacker provided proof of concept videos to showcase the vulnerability, in Mario Kart 7 and Mario Kart 8
Technical Details of ENLBufferPwn
From the exploit’s readme:
The ENLBufferPwn vulnerability exploits a buffer overflow in the C++ class NetworkBuffer
present in the network library enl
(Net
in Mario Kart 7) used by many first party Nintendo games. This class contains two methods Add
and Set
which fill a network buffer with data coming from other players. However, none of those methods check that the input data actually fits in the network buffer. Since the input data is controllable, a buffer overflow can be triggered on a remote console by just having an online game session with the attacker. If done properly, the victim user may not even notice a vulnerability was triggered in their console. The consequences of this buffer overflow vary on the game, from simple inoffensive modifications to the game’s memory (like repeatedly opening and closing the home menu on the 3DS) to more severe actions like taking full control of the console
Can I hack my Nintendo Switch with ENLBufferPwn?
Setting the 3DS and Wii U aside for a minute, I do not think this exploit can easily be leveraged to hack the Nintendo Switch:
- First of all, it would require to be chained with other vulnerabilities to get privilege escalation, and to my knowledge there are no publicly known kernel exploits in the latest firmware (some were allegedly patched recently, though)
- But ore importantly, the fact that this requires to join online games probably means Nintendo has multiple ways to prevent this, patching the games being the obvious, but not the only one. In other words, by the time the exploit was publicly disclosed, it was already dead. Unlike your typical “offline” exploit were people who stayed on a lower firmware could hope for a Jailbreak, online access (to Nintendo’s servers) usually means having the latest firmware and the latest patch for your specific game installed, meaning a patched vulnerability.
In other words, although the vulnerability is critical, and could impact other games, I do not see personally how this could be used for a “beneficial” exploit on the Nintendo Switch. The best (and only) way to hack your Switch as 2022 comes to an end, remains modchips for newer revisions of the hardware.
As far as the 3DS and the Wii U are concerned, those can be hacked fairly easily, so the benefits of the hack are limited in that context, from an end user perspective.
Nonetheless, it’s a pretty remarkable achievement to come up with an exploit that can target multiple console generations at once!
Download ENLBufferPwn
You can download the ENLBufferPwn code for Mario Kart 7 and Mario Kart 8 on the project’s github here.
source: PabloMK7
ENLBufferPwn exploit found in Switch, 3DS, and Wii U games
A severe vulnerability known as ENLBufferPwn has been found in various Switch, 3DS, and Wii U games. PabloMK7, Rambo6Glaz, Fishguy6564 were credited for the discovery. The vulnerability, first uncovered in 2021, was already reported to Nintendo.
The exploit is especially significant since a victim’s device can be easily taken over. This can be done merely by having an online game session with an attacker. Given the 9.8/10 (Critical) score it received in the CVSS 3.1 calculator, that goes to show how serious it is.
When paired with other OS exploits, the attacker could achieve full takeover of the system. They could also steal sensitive information or take audio / video recordings.
Remember the version 1.2 update for Mario Kart 7 that just recently came out? Many were surprised that the game received a new patch after so many years. As it turns out, Nintendo was looking to fix the ENLBufferPwn exploit.
As you can see, Nintendo has started to address the situation. Outside of Mario Kart 7, the exploit was fixed in Mario Kart 8 Deluxe version 2.1.0, Animal Crossing: New Horizons version 2.0.6, ARMS version 5.4.1, Splatoon 2 version 5.5.1, and Super Mario Maker 2 version 3.0.2. It was also apparently taken care of in Splatoon 3 and Nintendo Switch Sports a little while back. However, Wii U titles that are impacted – such as Mario Kart 8 and the original Splatoon – have not been patched and it’s unclear if any updates are in the works. It’s also thought that there could be other games out there still impacted by the exploit.
For those that want to get into even more of the details behind the ENLBufferPwn exploit, you can visit the vulnerability report page here. We’d also suggest checking out the Twitter thread here.
Related
Mario Kart 7 Gets Its First Update In Over A Decade, Here’s What’s Included
In surprise news, the excellent 3DS title Mario Kart 7 has today been updated for the second time ever. Yes, despite being released in 2011, Nintendo has randomly issued a new patch for the game bumping it up to Version 1.2.
According to the official patch notes, several issues have been addressed to improve the overall experience. This follows a previous update (Version 1.1) in May 2012. Here’s the full patch note history for this game, featuring updates a decade apart:
Ver. 1.2 (Released December 13, 2022)
General
Several issues have been addressed to improve the gameplay experience.
Ver. 1.1 (Released May 15, 2012)
- An update has been made available to eliminate shortcut exploits in the Wuhu Loop, Maka Wuhu, and Bowser Castle 1 tracks when they are played in the Online Multiplayer Mode.
- The update is required to play the game’s Online Multiplayer Modes. However, the tracks in Single-Player and Local Multiplayer Modes will not be affected by this update. Players can continue to play in these modes without installing the update.
In typical fashion, Nintendo doesn’t actually reveal what’s going on behind the scenes with this update, but it could easily have something to do with the online services or 3DS eShop closure – with the shutdown taking place on 27th March 2023. Dataminer OatmealDome has suggested this patch may fix certain security exploits:
In somewhat related news, Nintendo last week updated Mario Kart 8 Deluxe with the Wave 3 DLC. It adds another two cups and eight more courses to the game. You can learn more about it in our recent Nintendo Life coverage.
3DS System Update 11.16.0-49 Is Now Live, Here Are The Full Patch Notes
Following the 3DS system update late last month, Nintendo has now issued another one. This bumps the system up to Version 11.16.0-49. Here are the full patch notes, courtesy of Nintendo’s support website:
Ver. 11.16.0-49U (September 12th, 2022)
“Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience.”
Dataminer OatmealDome has shed some light on this latest system update (via @snbeast6). Apparently, it’s been issued because there was a “missing digit” in the Nintendo support phone number.
“Version 11.16.0-49 was released, a minor revision to the previous firmware. The sole change is to fix a typo (missing digit in the Nintendo support phone number) in text added in the last update. Homebrew is unaffected and it is safe to update.”
The previous update (Version 11.16.0-48) was also a stability update but included some updates to the 3DS eShop, web browser, and a few other areas.
Have you downloaded this latest update yet? Notice anything else? Comment down below.
3DS System Update 11.16.0-48 Is Now Live, Here Are The Full Patch Notes
Another stability update has been delivered
Well, just like the Wii U – the Nintendo 3DS has also received a system firmware update today. This bumps the unit up to 11.16.0-48. It’s once again another “stability” update. There have also been some other minor adjustments.
Like the Wii U update, this also happens to be the first patch for the 3DS in 2022. Here are the official patch notes, courtesy of Nintendo’s support page:
Ver. 11.16.0-48U (August 29th, 2022)
- Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience.
[3DS Firmware Update]
Firmware 11.16.0-48 was released for all 3DS models. This may be related to the upcoming shut down of adding funds in the eShop.
Updated:
– eShop
– Web Browser
– friends system module
– NATIVE_FIRMDetails are currently scarce. Awaiting more information. https://t.co/jXm3h3kruM
— OatmealDome (@OatmealDome) August 30, 2022
Once again, this lines up with the latest phase of the 3DS eShop shutdown, which removes the use of prepaid cards.
Have you downloaded this update yet? Notice anything else? Leave a comment below.
[source en-americas-support.nintendo.com]
Nintendo Prepares For 3DS & Wii U eShop Closure With Scheduled Maintenance
This week is pretty significant in the world of Nintendo – with the Japanese company previously announcing it would “no longer be possible to use a Nintendo eShop Card to add funds to an account on Nintendo eShop for Wii U or Nintendo 3DS”.
This will take effect “as of” 29th August 2022, and it seems Nintendo has now taken the next step towards this. The ‘NinStatusBot’ Twitter account reveals maintenance has now officially been scheduled for early next week around the same time:
It appears that Nintendo will remove the ability to add funds on the Wii U and 3DS eShops during this maintenance window.— NinStatusBot (@NinStatusBot) August 22, 2022
Consider this a reminder then to add eShop card funds to the 3DS and Wii U eShops while you still can. Updates for both of these eShop storefronts will be entirely discontinued on 27th March 2023. After this, purchases will no longer be available, but you’ll still be able to download your existing library.
Even after 27/03/2023 and for the foreseeable future, it will still be possible to redownload games and DLC, receive software updates and enjoy online play on Wii U consoles and Nintendo 3DS systems.— Nintendo UK (@NintendoUK) July 19, 2022
Super Smash Bros. Ultimate director Masahiro Sakurai recently reminded fans about these same closure dates, mentioning how this would be the “last chance” for everyone to get any games they really want, that may not be ported to other platforms in the future.
There are still some workarounds when it comes to adding funds, which you can read more about in our extensive guide:
How are you feeling about the eShop closures? Have you got everything you want at this point? Will you be making any last-minute purchases with your funds? Leave a comment down below.
Random: Masahiro Sakurai Reminds Nintendo Fans About 3DS & Wii U eShop Closure Dates
As you probably know by now, Nintendo is discontinuing the 3DS and Wii U eShop as of 28th March 2023. And later this month on 29th August, you’ll no longer be able to add eShop card funds (aka points) to accounts.
This is happening worldwide, and as a result – Nintendo fans around the globe are grabbing certain digital titles before the deadline. Even the Super Smash Bros. director Masahiro Sakurai is making the most of these digital shops while he still can.
Here’s a rough translation of his most recent social media post (via Google translate) – essentially reminding fellow 3DS and Wii U users of the closure:
“In a little over two weeks, you won’t be able to add points to 3DS and Wii U…I’m patrolling the e-shop thinking it’s my last chance. Because of the touch panel, there are probably many things that won’t be ported to other models.”
あと2週間と少しで、3DSとWii Uにポイント追加ができなくなるのですよね…
最後の機会だと思ってeショップを巡回中です。
タッチパネルのため、他機種に移植されないものも多いだろうしなあ。https://t.co/xIXtooDGWA— 桜井 政博 / Masahiro Sakurai (@Sora_Sakurai) August 13, 2022
Unfortunately, he didn’t specify if he made any purchases, but as he noted – a lot of the games using these systems’ touch screens, might not necessarily get ported to other platforms in the future. We can’t imagine he is thrilled about older Super Smash Bros. DLC being retired, either.
The 3DS and Wii U eShops aren’t the only things coming to an end – with Sakurai announcing earlier this month that he was almost out of Super Smash Bros. Ultimate screenshots.
You can learn more about the upcoming eShop closures in some of our previous posts. It’s worth noting the sales of Fire Emblem Fates will end on 28th February 2023 and its DLC is available until 27th March 2023.
Sales of the game Fire Emblem Fates will end one month earlier, on 28/02/2023. DLC for Fire Emblem Fates, including story paths accessible after the completion of Chapter 6, will still be available until 27/03/2023.
More info: https://t.co/0SBEIjk0Bc
— Nintendo UK (@NintendoUK) July 19, 2022
Learn more about Nintendo’s 3DS & Wii U eShop closure:
Are you making the most of your time with these eShops, like Sakurai is? Any specific games you’ll be picking up before it’s too late? How do you feel about the whole closure at this point? Leave your thoughts down below.