Legend of Zelda: Use-After-Free
Allan Cecil details how a Use-After-Free flaw in Ocarina of Time allowed TASBot to execute arbitrary code on an unmodified Nintendo 64 to raise $228K for charity.
Summary
Hacking the Nintendo 64 via Controller Inputs
Tool-Assisted Speedruns (TAS) push vintage console hardware to its physical limits, leveraging frame-perfect controller inputs to trigger esoteric memory corruption vulnerabilities.
Exploiting a Use-After-Free in Ocarina of Time
Allan Cecil explains how a subtle Use-After-Free vulnerability in The Legend of Zelda: Ocarina of Time’s actor management system permits hijacking game execution flow.
Multi-Stage Bootstrapping via TASBot
Using the custom hardware robot TASBot, precise button sequences streamed arbitrary MIPS assembly code into console RAM, bootstrapping a full arbitrary code execution engine on an unmodified retail N64.
Charity Showcase and Cultural Impact
The live exploit demonstration at Summer Games Done Quick (SGDQ) 2022 generated over $228,000 for charity, demonstrating the positive community impact of exploit engineering.
Related talks
Source Zero Con·31 min
Analyzes hardware Hacking 101 and evaluates key implications for security practitioners.
Source Zero Con·31 min
Analyzes source Zero Con: Security of the Internet of Things (IoT) and evaluates key implications for security practitioners.
Main Stage·42 min
Allan Cecil
Allan Cecil details TASBot, an automated tool utilizing millisecond-accurate controller input to trigger arbitrary code execution on legacy gaming consoles.