I recently decided to do some keyboard hacking for fun, so I started with
one of the cheapest Logitech wireless keyboard models available: the K360.
This model is a little old and the main chip inside it, as well as the
Logitech Unifying wireless protocol it uses, have been well
covered before. See Marc Newlin’s MouseJack presentation,
Travis Goodspeed’s nRF24 sniffing work, and the KeyKeriki research mentioned in each.
I’m doing this more as an exercise rather than novel research, and I didn’t
know what I’d find going in.
That said, I thought this was a neat little example of extracting bare metal
firmware from on-chip flash.
A couple of months ago I took a crack at the Maze challenges in the CSCG 2020 CTF
and thought a few of the challenges were really interesting, so I wanted to share how
I solved them.
I started this project because I wanted to be able to use save file modifications
I was testing in the Dolphin emulator on real GameCube hardware. One, because
some of the weirder features of the Animal Crossing NES emulator and exploit payloads
might behave differently in an emulator, and two, because it’s more fun to see
things working on a real console.
While looking for ways to activate the developer menus left over in Animal Crossing,
including the NES emulator game selection menu, I found an interesting feature that exists
in the original game that was always active, but never used by Nintendo.
In addition to the NES/Famicom games that can be obtained in-game, it was possible to
load new NES games from the memory card.
I was also able to find a way to exploit this ROM loader to patch custom code and data into
the game, allowing for code execution via the memory card.
Last summer I began reverse engineering Animal Crossing for the GameCube to explore
the possibility of creating mods for the game. I also wanted to document the process
to create tutorials for people interested in ROM hacking and reverse engineering.
In this post I explore the developer debugging features that are still left in
the game, and how I discovered a cheat combo that can be used to unlock them.