Conversation

* N64 games such as Paper Mario have bugs that allow running arbitrary code in-game
* N64 emulators such as Mupen/Bizhawk have bugs that allow for malicious game code to hack your PC

The amusing consequence: A TAS that, when played back, bluescreens your computer.
https://tasvideos.org/8982S
https://youtu.be/u3KmW-02wsU

3
12
0

@Rairii here's an interesting ACE exploit in bizhawk v2.9.1 that's probably worth reversing - this one directly leads to an arbitrarily-invoked ERROR_ACCESS_DENIED bugcheck

1
0
0

@MrCheeze seems TASVideos rejected the entry, would REALLY love an in-depth writeup on both the injected Paper Mario code and the Mupen bug

1
0
0

@sterophonick @MrCheeze "reason: emulation" thonk

1
0
0

@minirop @sterophonick Technically true, the very goal of the run is an emulation error

Also as per https://tasvideos.org/Forum/Topics/25297?CurrentPage=1&Highlight=528969#528969 , it is genuinely running arbitrary code on the host PC

0
1
0

@winload_exe @Rairii That's what I wanted to ask - how was the emulator able to trigger a bugcheck?

1
0
0

@exec @winload_exe NtRaiseHardError, which allows an admin to bugcheck the system

1
0
0

@Rairii

So uh, obvious follow-up question: why the hell is an N64 emulator running with admin privileges?

@winload_exe @exec

0
0
1

@Rairii

How is UAC not a security boundary? I thought the whole point of it was to be a security boundary.

@winload_exe @exec

0
0
0
@MrCheeze on a much more benin fashion, i once made a sleep routine for gameboy that would disable vblank interrupts but rely on keypad interrupts to wake up. it worked perfectly on real hardware, but in emulators it would crash half of the emulators and sometimes even the host os as shittily programmed emulators rely on the vblank to happen to assert events
0
0
1