Summary of REMOTE CODE EXECUTION ON THE N64
Security researcher CTurt exploited a Nintendo 64 game, Morita Shogi 64, which includes a built-in telephone modem in its cartridge. By analyzing the game's code with a GameShark and a decompiler, CTurt discovered an overflow vulnerability in the modem functionality. This "shogihax" exploit enables remote code execution, allowing for arbitrary code to be streamed and executed on the console. This hack stands out because it leverages a readily accessible cartridge without needing rarer hardware like the N64DD modem.
Parts used in the Shogihax Project:
- Nintendo 64 console
- Morita Shogi 64 game cartridge (with built-in modem)
- GameShark cheat device
- Decompiler software
Some like to garden in their spare time, while others prefer to smoke cigars or fold complicated origami figurines. Security researcher [grifter] [CTurt] seems to enjoy cracking consoles instead, and had a go at exploiting the Nintendo 64 over an obscure modem interface.
The 1990s were a wild time, where games shipped in cartridges. This format opened up crazy possibilities to add additional hardware to the cartridge itself. Perhaps most famously, Nintendo packed in the SuperFX chip to enable 3D graphics on the Super Nintendo. Later on, the N64 game Morita Shogi 64 shipped with an entire telephone modem in the cartridge itself. The resulting exploit is therefore dubbed “shogihax”.
Armed with a dodgy GameShark and a decompiler, [CTurt] set to work. Through careful parsing of the code, they were able to find a suitable overflow bug in the game when using the modem. Unlike more pedestrian savegame hacks, this not only allowed for the execution of arbitrary code but also the modem interface means that it’s possible to continually stream more data to the console on an ad-hoc basis.
It’s a great hack that takes advantage of a relatively accessible cartridge, rather than relying on more obscure hardware such as the N64DD modem or other rarities. We’ve seen other N64 homebrew hacks before, too. Video after the break.
Thanks to [grifter] for the tip!
Source: REMOTE CODE EXECUTION ON THE N64
