Jailbreaking the 3DS through 7 years of hardening

$int SecurityBlob::parse(u8* buffer, int length) { int result = -1; if ( security_blob_len >= 0x58 ) { int o...$

$int SecurityBlob::parse(u8* buffer, int length) { ... for(int i = 0; i < 6; i++) { offset += this->unpack_l...$

$ldr:ro race condition ... u32 segment_table_offset = *(u32*)&cro_buf[0xC8]; if ( segment_table_offset ) { ...$

$Slab heap allocation code KLinkedListNode* alloc_kobj(KLinkedListNode* freelist_head) { KLinkedListNode* ret; do ...$

$alloc_kobj uses 0xFFF0701C: v11 = alloc_kobj(freelist_1); if ( v11 ) { ... }else{ throw_error(0xC860...$

$svcWaitSynchronizationN svcWaitSynchronizationN: ... for ( int i = 0; i < num_kobjects; i++ ) { KObject* obj = kob...$

$TWL_FIRM’s “weird” memcpy void write_ndsram_section(u32 ndsram_dst, u16* src, int len) { u16* ctr_pa_dst = convert_nds...$