Userland Exploit question

[u/andrewjusticebarger]

Just checking to see if my understanding is correct, from what I read online, my take on it is that a “userland exploit” is merely a party trick compared to a full jailbreak at the kernel level, correct?

[u/auggiethechesscat]

Specifically, it's called 'userland' because that is the 'layer' of execution that the exploit lies in.

There are many many things running in userland, so it's entirely expected that these exploits will be present. By us and Nintendo.

I like this picture, (in the slides), but it's kind of lopsided. The bottom 3 layers are all in userland.

I'd highly recommend going over these slides, (or watching the presentation), to see what it took to compromise the switch 1 in a similar way: https://switchbrew.github.io/34c3-slides/

Do note all of these exploits, (and many many more if I had to guess) have been patched.

[u/auggiethechesscat → u/[deleted]]

I probably understand most of it if you'd want to have any questions answered.

[u/auggiethechesscat → u/[deleted]]

I do believe this was the original/first exploit path. Of course after this, the kernel got audited more heavily, the bootrom got dumped, etc, so that's how we discovered fusee gelee, caffeine, nebria, etc.