>>40993082hexkyz does some work, but he's more of a reverse engineering/bootloader guy than a system module reimplementation guy.
TuxSH/fincs are also both team members, but TuxSH is busy IRL and fincs is focused on libnx and only does code review/design help. I'm the only meaningfully active dev, and I can only throw ~4-6 hours a night at it these days.
It's gonna be ignored for the next week or two for swish tool dev/datamining, too...
>>40993104Any modern system is broken into via the web browser initially.
For the switch:
March 3, 2017 (release day): hacked the web browser using pegasus exploit
~April-May 2017: had good web browser exploitation tools (pegaswitch) that let us start exploring how the web browser interacts with the rest of the system.
~June 2017: Found the "smhax" bug, which granted full service access and allowed us to begin poking at privileged APIs
~July 2017: Figured out how to use the above to grant ourselves access to the services that read code, got full filesystem permissions + dumped the code of all the OS modules
~August-October 2017: GPU hax implemented, granted us a bunch of stuff.
~August 2017: andeor uses voltage glitching on a Jetson TX1 devkit to dump the bootrom, we begin auditing it.
~November 2017: 1.0.0 web browser hax via puyo puyo tetris found, combined with GPUhax hthh and I used this to pwn the kernel for the first time.
https://gist.github.com/SciresM/425aa51f34f2dec68c97848e45dd17d9~December 2017: Motezazer and I theorize the jamais vu exploit, it works and we pwn trustzone.
~December 2017: warmboot bootrom bug found and used to dump all the switch's keydata, full privilege code achieved found for the first time.
~January 2018: USB recovery mode bug found.
The rest is basically public history.
>>40993127Yeah, I understand LGPE's code pretty well.
I'm hoping so but not optimistic.
>>40993133Planning on giving it my genuine best effort.
We'll see what the task entails :)
