The Nintendo 3DS's built-in emulator is usually locked down to only run official ROMs from Nintendo's online store. A new exploit released this week, however, opens the platform to load and run any existing Game Boy or Game Boy Color ROM, taking full advantage of the 3DS.
The exploit relies on an overflow error in the memory of the current version of the 3DS browser. When loaded at a specific timing, the overflow error can be used to replace a legitimately purchased Game Boy game in memory with another ROM loaded from the SD card or stored at a web address, as long as both ROMs are the same size. Game Boy Advanced games are not currently supported, and users can save their game progress using the Virtual Console save function.
While the exploit appears to work with any 3DS firmware up to and including the latest version (9.4), it doesn't appear to work with the web browser that will be included with the new 3DS, which will be released in the US next month. This suggests that Nintendo to patch this memory issue in a future 3DS firmware and web browser release.
This is the second security issue for the 3DS that has been discovered in recent months. In November, hackers exploited a buffer overflow in the game Cubic Ninja to allow the system to run unsigned homebrew code.
