Recently I got running unsigned code through an exploit on an device. Now I would like to discover the framebuffer address so I could write to the screen and output data.

The only way I can imagine to do this is doing a for/while loop and write to every memory address until the screen gets drawed. When I say address I mean pyshicall address.

Is it the good way or are there any other methods to do this? At the moment I'm completely blind since I cannot output anything.


  • What device is it? What information do you have about it? – michalsrb Aug 21 '16 at 15:12
  • @michalsrb the thing is that I just want to learn how to find framebuffers (and other stuff) addresses so the device doesn't mind. (It's actually a nintendo3ds and addresses are documented but I want to learn to find them by myself) – Pedro Javier Fernández Aug 22 '16 at 11:42

If you see what is on the display or if you can even make the device show picture of your choice, you can guess the data that represent the pixels in the framebuffer. You just need to know the pixel format or try all the typical formats (RGB, BGR, RGBx, BGRx ...). Then you just scan the whole memory for the data you expect to find in framebuffer. Reading is much less destructive than writing and you don't need to observe if the display changed between writes.

Example: Let's say you know that at the moment of execution there is line of pixels containing black, black, white, black and white pixels in this order. Make your exploit scan memory for 000000 000000 FFFFFF 000000 FFFFFF. If you find a match, you may have found an address inside framebuffer and you can try to write to it to output on display. Obviously the longer the pattern is, the lower chance of false positives.

  • Yes, the exploit can access the framebuffer memory (other people has achieved it). The problem is that I don't know the framebuffer address so I cannot write to it; At the moment, the problem is that I'm completely blind, since I can't output to the screen yet I can't read memory and show it in the screen for example. – Pedro Javier Fernández Aug 21 '16 at 10:22
  • 1
    So is there anything preventing you in using the method I described? I will make edit to add an example to make it clearer. – michalsrb Aug 21 '16 at 10:56
  • Even if I scan the whole memory, I wouldn't be able to save the dump anywhere, since I can't output to the framebuffer nor I can write to the filesystem yet. There's nothing in the display (well the screen gets freezed when triggering the exploit) and I can't draw any picture. EDIT: I've just seen your edit.. hmm.. as I said the screen gets stuck with some pixels of grey/cream color.. so I could try and search for that pattern maybe – Pedro Javier Fernández Aug 21 '16 at 11:01
  • 1
    First you would need to find the exact RGB values used in the symbol. Make screenshot if possible, dig it out of the system image, find it on internet... Depends what your device actually is. Then pick a line of the image and put the RGB values of the pixels next to each other: RGBRGBRGB... And make your exploit search memory for that array of bytes. If it fails, try again with BGRBGRBGR... Or other pixel formats. – michalsrb Aug 21 '16 at 15:12
  • 1
    Thank you for accepting the answer. For the buttons you could trace the lines from them to a chip and check its documentation, or make a tool that dumps state of all registers and compare between pressed and released states, or disassemble the firmware and read from there. Reading disassembled firmware is an option for finding the framebuffer address too. In general reverse engineering differs lot case from case - that's the fun of it. :-) – michalsrb Aug 22 '16 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.