I wrote a blog post about the security of the STM32H730 microcontroller used in the Nintendo Alarmo. There's a vulnerability that allows dumping the protected secure bootloader of the STM32H730.
You can read more about it here: garyodernichts.blogspot.com/2025/11/priv...

now with sound!!!!!

I had to change the audio amplifier's config to make it run at 32KHz (instead of the standard 48KHz). heh

here's a framebuffer graphics demo (this has no practical purpose and I can't prove I'm not just like, playing a youtube video or something)

I spoke too soon heh...
Nintendo released a new Alarmo update a few hours ago. The new update contains a new 2ndloader where the signature is properly checked in USB mode. If you want to modify your Alarmo without soldering, stay on v2.0.0!

Nintendo is still shipping Alarmos without signature checks in the 2ndloader. I assumed they might do something for the wide retail release, but it looks like they don't really care (for now).

Wii U fun facts:
While reverse engineering the Wii U's USB Host Stack (UHS) I noticed several fun quirks in their descriptor code.
One of them was even exploitable (UDPIH), but there are some others that I have never mentioned before. This thread contains some of the minor ones I still remember.

After my last post, it was pretty clear what everyone wanted to see on the Alarmo. So, here it is - Doom running on the Nintendo Alarmo!

It's possible to run custom code on the Nintendo Alarmo via USB - without opening it up!
More details in the blog post here: garyodernichts.blogspot.com/2024/10/look...
#nintendo #hacking

Here's a simplified overview of what I figured out about the Nintendo Alarmo boot process so far.

I kind of forgot about Bluesky and now I have over 50 followers out of nowhere. I guess I should start posting some more things over here!

Ever wanted to exploit DNS response parsing on the Wii U? I have just released DNSpresso!
You can find the technical write-up here: garyodernichts.blogspot.com/2023/10/expl...

wii u