vault backup: 2026-03-14 19:36:32

Dictionary/ShofEL2 - Fusée Gelée Exploit.md

@@ -0,0 +1,26 @@
+**ShofEL2** (and its sister exploit **Fusée Gelée**) is an unpatchable hardware vulnerability found in the NVIDIA Tegra X1's USB Recovery Mode (RCM). Because the flaw exists in the **Read-Only Memory (Boot ROM)** of the SoC, it cannot be fixed via software or firmware updates by Nintendo or NVIDIA.
+
+The exploit allows for **Unsigned Code Execution** at the highest privilege level (EL3) before the operating system even begins to load.
+
+- - -
+
+
+## How It Works (The Vulnerability)
+
+The exploit leverages a **heap overflow** in the Tegra X1’s USB RCM stack.
+
+1. **RCM Mode:** The Tegra X1 enters a recovery mode designed to receive factory images via USB.
+    
+2. **Control Request:** The attacker sends a massive `USB Control Request` (Get Status) with an invalid length field.
+    
+3. **Buffer Overflow:** The Boot ROM fails to properly validate the length of the data being requested. It copies more data than the internal buffer can hold, overflowing into the **execution stack**.
+    
+4. **Arbitrary Execution:** By carefully crafting the overflow (a technique known as "smashing the stack"), the attacker overwrites the return address to point to their own payload loaded in the SoC's Internal RAM (IRAM).
+    
+
+> [!IMPORTANT] Since the Boot ROM is "burned" into the silicon at the factory, the only way to "patch" this was for NVIDIA to release a new hardware revision (the "Mariko" / T210B01 chip found in V2 and OLED Switches).
+
+---
+
+> [!warning]
+> The Above explanations is AI Generated, Learn more at : https://github.com/erdzan12/switch-fusee