Dreamcast Ex Inferis - RCE on the Sega Dreamcast PlanetWeb Browser

The speaker, a vulnerability researcher, set out to run code on a Sega Dreamcast through its PlanetWeb browser, a program from the 2000 to 2001 era. The browser depends on a backend service that no longer exists, so whoever controls that domain's DNS answers can direct the console to their own server. The hardware is tightly constrained: an SH4 RISC processor, about 16 MB of RAM shared with video memory and the browser, an old Java runtime with no security manager, no code signing, and plain HTTP. The research started by mapping the attack surface, which included a subscription framework, Java-to-native commands, image parsers, a mail client, and memory card access.

Six unique vulnerabilities turned up, three of them of research interest. A malicious server could offer a package that the browser subscribed to and ran automatically. A stack overflow in the mail client's MIME name handling gave control of execution, but only within roughly 64 KB of space. A native command with an unbounded copy at a fixed address supplied room to stage a much larger payload. Chained over a man-in-the-middle setup, the exploit loads DOOM onto the console, taking about five minutes in an emulator and 10 to 15 minutes on real hardware. The emulator's modem model had to be modified to behave more like the real one, and memory layout had to avoid the browser and its frame buffer.

The main takeaway is that on older targets most of the effort went into memory layout and working around constraints rather than the bug itself. A confirmed bug is not automatically exploitable, and older systems make a useful training ground. Next steps include faster iteration on real hardware and looking for bugs in Phantasy Star Online.