iQueBrew - User contributions [en]

Main Page

2020-01-28T06:50:15Z

Normmatt: Reverted edits by Toilet (talk) to last revision by Normmatt

IQue Player System Flaws

2020-01-28T06:46:05Z

Normmatt: Reverted edits by Toilet (talk) to last revision by Jhynjhiruu

{{DISPLAYTITLE:iQue Player System Flaws}}
==Hardware==
{| class="wikitable" border="1"
! Summary
! Description
! Timeframe this was discovered
! Discovered by
|-
| Virage2 is writable
| SK has code to write to Virage2; this actually works and writes there.
Virage2 was assumed "OTP" before, it contains SK hash, bootrom patches, BBID and key material.

Successfully overwriting the correct virage2 areas allows for persistent boot-time secure mode code execution.

WARNING: overwriting SK hash with garbage, not fixing checksum, etc, WILL hard brick your console!
| May 4, 2018
| [[User:Normmatt|Normmatt]]
|-
|}

==Secure Kernel==
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Timeframe this was discovered
! Discovered by
|-
| psychic paper: Secure Kernel could incorrectly consider a self-signed certificate chain as valid
| The function for verifying certificate chains at <tt>0x9FC028BC</tt> is passed an array of pointers to certificates.
For the first 5 elements, it checks to see if the certificate was issued by <tt>Root</tt>, if so it checks if the certificate was signed by the hardcoded <tt>Root</tt> public key (and returns immediately with the result).

If the certificate wasn't signed by <tt>Root</tt>, it checks if the certificate was signed by the public key of the next certificate in the array.

If all 5 certificates verified correctly, the function will return success.
| Assuming this function can be called with an attacker-controlled array of certificates (this is possible, thanks to other (below) issues), self-signing of certificates (and thus, arbitrary code execution, with full non-Secure Mode privileges)
(This is not the case for Secure Applications, the code in SK for verifying those sets up a hardcoded array on the stack for the certificate verification function)
| April 2018
| [[User:Riley|Riley]]
|-
| skLaunchSetup and skRecryptBegin leave CMD in memory if its signature does not verify
| The function called by skLaunchSetup (and skRecryptBegin) at <tt>0x9FC00BAC</tt> verifies ticket and CMD, and decrypts the titlekey.
After verifying the ticket signature, it copies the CMD to another place in memory, derives the titlekey encryption key, decrypts the titlekey with the titlekek, then verifies the CMD signature.

If the CMD signature does not verify successfully, the function just returns an error, leaving the unsigned CMD in place.

Most of the code that uses a CMD in SK uses the CMD in that place in memory that this function copies the CMD to, and trusts that whatever data is there has been verified already.

The entire CMD is covered by the ticket signature anyway, so this isn't that useful really, besides potentially making psychic paper easier to exploit.
| With existing code execution with access to skLaunchSetup or skRecryptBegin and some other SKC that uses SK's internal CMD copy (only non-test SAs have this level of access), and the ability to sign a ticket but not a CMD:
Allowing the use of an unsigned CMD by SK, potentially leading to privilege escalation (by specifying arbitrary allowed hardware access/allowed SKCs).
| April 26, 2018
| [[User:Riley|Riley]]
|-
| skLaunch does not check content hash if recrypt flag is set in CMD
| skLaunch calculates the SHA1 hash of the content and compares it to the value in the CMD, returning an error if the hash doesn't match. This entire block of code is jumped over if the recrypt flag is set in the CMD.
| With plaintext of an application with the recrypt flag set in its CMD, arbitrary code execution (via, for example, implementation of the attack described in pocorgtfo17)
Also: Injection of games; see [[iQueCrypt]].
| Early 2018?
| Everyone
|-
| skVerifyHash signature pointer not validated
| skVerifyHash takes in a u8 pointer to a signature to verify, but does not actually validate this pointer is valid before treating the memory it points to as an RSA/ECC signature.
| Causing the Secure Kernel to data abort -- possibly usable as an infoleak, depending on the provided cert chain
| April 29, 2018
| [[User:SciresM|SciresM]]
|-
| SK's ECDH implementation does no validation of the other party's public key
| When deriving the titlekek using ECDH, SK does no validation whatsoever of the public key, which comes from the ticket. Because ECDH is just multiplication, passing in an all-zero public key would lead to an all-zero titlekek being used.
| With the ability to sign a ticket and CMD (for example, psychic paper): causing SK to use a constant titlekek; no need to know a console's ECC keypair.
| April 29, 2018
| [[User:Riley|Riley]]
|-
| skRecryptData insufficient checks
| skRecryptData allows for NULL to be passed in as a pointer, for supporting some alternate mode controlled by a u32 in SK .data.
However, if this u32 is 0 (which is the default), no further checks are done and recrypt operations are done starting from NULL with provided length (in 0x400 chunks).

Also, if skRecryptBegin wasn't called, the recrypt operation is done by decrypting using the current hardware AES engine state, then re-encrypting with a completely zero internal state (which is invalid, so nothing will be done).

If skRecryptBegin was called, the re-encryption will succeed as the internal state would have been set, and re-encrypted data would be written to the same area that the original data was read from. (To get to the SK code area with this, though, requires overwriting all of DRAM)
| Possible infoleak into the PI buffer. (without recrypt state set)
Possible secure mode code execution. (with recrypt state set)
| April 30, 2018
| [[User:Riley|Riley]]
|-
| SK's CRL checking function will not check a ticket CRL at all if the ticket CRL version in the ticket (as s32) is < 0
| The function in SK that checks provided CRLs at <tt>0x9FC02CB4</tt> checks the provided ticket CRL version first (which comes from the ticket.) If it's less than 0 as s32, it will not be checked at all, that call will be jumped over.

The first CRL in the list is the ticket CRL; thus this could provide a favourable situation for exploiting psychic paper.

Additionally, the required elements to craft a CRL such that SA believes it to be valid with the public key in the correct place for psychic paper do not overlap.

Furthermore, libultra function osBbSaGamePrelaunch (which calls skLaunchSetup/skRecryptBegin/etc), which is called by SA when launching a game, stores the CRL structure for those two SKCs directly after the ticket bundle structure in .data. This, plus other flaws (below) lead directly to the successful exploitation of psychic paper.
| Exploitation of psychic paper
| April 30, 2018
| [[User:Riley|Riley]]
|-
| eSKape: bad SKC table bounds check
| SK's Secure Kernel Call handler bounds check uses a signed comparison when checking the SKC number that's being called to make sure it is within the bounds of the table, leading to the ability to have SK take the SKC function pointer from non-secure RAM, and thus, arbitrary code execution in secure mode.
| Secure mode code execution.
| May 1, 2018
| [[User:Stuckpixel|Stuckpixel]] and [[User:Riley|Riley]] (complementary)
|}

==System Applications==
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Exploitable System Applications
! Timeframe this was discovered
! Discovered by
|-
| libultra _osBbSaVerifyTickets gets an entire ticket bundle then just uses skVerifyHash with the ticket cert-chain ptr
| _osBbVerifyTickets is called by osBbSaMetaGetTickets if argument 2 is not 0. (osBbSaMetaGetTickets, in turn, is called by a function in SA that appears to get the data for the game menu?)
This function calls osBbSaBundleTicket, which gets a "ticket bundle" (struct containing ticket + ticket+CMD cert chain + CRL pointers, pointer to which is used as an argument for skLaunchSetup and skRecryptBegin), then proceeds to call skVerifyHash passing a pointer to the ticket cert-chain pointer array from that structure.

Given that the CMD cert chain pointer array is directly after the ticket cert-chain pointer array in that structure, this gives a favourable situation for exploitation of psychic paper.
| Exploitation of psychic paper and self-signing tickets such that non-test SAs believe them to be valid.
| All non-test SAs?
| April 30, 2018
| [[User:Riley|Riley]]
|-
| libultra osBbSaCertCreateChain only uses the endmost certificate's issuer
| osBbSaCertCreateChain parses cert.sys to create a cert chain array for SK (first element points to the object's signer, second element points to its signer, etc.).
This function only uses the issuer of the endmost certificate (object's signer), to get a list of certificate names to obtain.

The rest of the certificates only have their name compared against the one currently being searched for. There are no checks that the chain being created ends in Root. This gives a favourable situation for exploitation of psychic paper.
| Exploitation of psychic paper
| All non-test SAs?
| April 30, 2018
| [[User:Riley|Riley]]
|-
| EMS monitor SA's signature verification code is flawed
| The EMS monitor SA, when loading its payload from NAND, verifies its CMD signature using similar code to what SK does.
However, SK's code, being in SK, calls SK-internal functions for the verification, whereas the SA has to use skVerifyHash.

skVerifyHash imposes less constraints on verification due to it having to support everything; most notably, no checks are done as to what type of certificate was used for signing, and ECC signatures (at the end of a cert chain) are allowed.

Additionally, usage of skVerifyHash requires that a list of CRL pointers is passed to it; these pointers are placed directly after the certificate chain pointers in memory, which potentially gives a favourable situation for exploitation of psychic paper.
| More signers/signatures are allowed that perhaps would have been intended; possibly, exploitation of psychic paper.
| All EMS monitor SAs?
| August 8, 2018
| [[User:Riley|Riley]]
|}

Main Page/Navigation

2020-01-28T06:46:03Z

Normmatt: Reverted edits by Toilet (talk) to last revision by Riley

{{Main page box|Navigation|:Navigation}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="33%" | '''General''' 
! width="33%" | '''Homebrew''' 
! width="33%" | '''Hardware/Software''' 
|- valign="top" style="background: #F5FAFF;"
|
*[[Glossary]]
*[[Games]]
*[[:Category:PC utilities|PC Utilities]]
|
*[[IQue Player System Flaws|System flaws]]
|
*[[:Category:Hardware|Hardware]]
*[[IQue Player|Player Overview]] ([[IO|IO registers]])
*[[IQue Card|Memory Card]]
*[[:Category:File_formats|File Formats]]
*[[SKC|Secure Kernel calls]]
|}
</div>
{{box-footer-empty}}

Talk:Main Page

2020-01-28T06:46:02Z

Normmatt: Reverted edits by Toilet (talk) to last revision by Jhynjhiruu

Ooh look, we have talk pages. I guess I can talk with you guys during lessons now, hehe.

Super Mario 64

2018-03-27T08:13:06Z

Normmatt:

{{infobox
|title= Super Mario 64
|titleCN= 神游马力欧
|ISBN=
|GameID=11011
|image=[[File:Poster_11011.jpg]]
|developer=Nintendo
|publisher=Nintendo
|released=November 17, 2003
|genre=Action
|modes=Single player
|GameVer=[http://cds.idc.ique.com:16963/cds/download?content_id=1101104 1101104]
|ManualVer=[http://cds.idc.ique.com:16963/cds/download?content_id=1101902 1101902], [http://cds.idc.ique.com:16963/cds/download?content_id=1101906 1101906]
}}

Super Mario 64 (Chinese name: 神游马力欧, literally "iQue Mario") was released on the iQue Player on Nov 17, 2003.

It was one of the console's launch titles, and a demo version of the game was included with every iQue Player console.

Template:Infobox

2018-03-27T05:36:25Z

Normmatt: Created page with "{|class="infobox" cellpadding=2 cellspacing=2 width=265 style="float:right;padding:4px;margin:0 0 1em 1em;font-size:11px;background-color:#FFF5EE;border:1px solid #f98686" |al..."

{|class="infobox" cellpadding=2 cellspacing=2 width=265 style="float:right;padding:4px;margin:0 0 1em 1em;font-size:11px;background-color:#FFF5EE;border:1px solid #f98686"
|align=center colspan=2 bgcolor=#FAAAAA style=font-size:13px{{!}}'''''{{{title|{{PAGENAME}}}}}'''''
|-
|align=center colspan=2|{{{image|}}}
|-bgcolor=#FFE4E1 style=vertical-align:top align=left
|'''Developer(s)'''
|{{{developer|}}}
|-style=vertical-align:top align=left
|'''Publisher(s)'''
|{{{publisher|}}}
|-bgcolor=#FFE4E1 style=vertical-align:top align=left
|'''Platform(s)'''
|{{{platforms|}}}
|-style=vertical-align:top align=left
|'''Release date'''
|{{{released|}}}
|-bgcolor=#FFE4E1 style=vertical-align:top align=left
|'''{{color-link|Genre|#000}}'''
|{{{genre|}}}
|-style=vertical-align:top align=left
|'''Rating(s)'''
|{{{ratings|}}}
|-bgcolor=#FFE4E1 style=vertical-align:top align=left
|'''Mode(s)'''
|{{{modes|}}}
|-style=vertical-align:top align=left
|'''Media'''
|{{{media|}}}
|-bgcolor=#FFE4E1 style=vertical-align:top align=left
|'''Input'''
|{{{input|}}}
|}<noinclude>{{br}}
==Usage==
{|border=1 style=border-collapse:collapse;width:70%;float:right;margin-left:1em; cellpadding=3
!colspan=2|Syntax
|-
||title=
|Title of the game (only necessary when the name of the article has text other than the title alone, such as "Title (game)")
|-
||image=
|Box art of the game (North American box takes precedence to be consistent with [[MarioWiki:Naming|the naming policy]])
|-
||developer=
|Developer of the game
|-
||publisher=
|Publisher of the game (based on which console/handheld this game is for)
|-
||platforms=
|What consoles/handhelds can play the game
|-
||released=
|Release dates in all countries for all platforms, in order from earliest to latest (use {{tem|released}})
|-
||genre=
|What genre the game is in (see [[Genre]] for a full list of genres)
|-
||ratings=
|Official ratings of the game (use {{tem|ratings}})
|-
||modes=
|How many players can play the game simultaneously, and whether or not the game supports online play
|-
||media=
|The medium used by the system the game is on, whether a cartridge, optical disc, or digital download (use {{tem|media}})
|-
||input=
|What controllers the title supports (use {{tem|input}})
|}
<pre>
{{infobox
|title=
|image=
|developer=
|publisher=
|platforms=
|released=
|genre=
|ratings=
|modes=
|media=
|input=
}}
</pre>
[[Category:Infobox templates|{{PAGENAME}}]]</noinclude>

Template:Br

2018-03-27T05:36:11Z

Normmatt: Created page with "<div style="clear:{{{1|both}}}"></div><noinclude> Used to give space to sections if they have a spacing issue. Usage below: *<code><nowiki>{{br}}</nowiki></code> gives space..."

<div style="clear:{{{1|both}}}"></div><noinclude>
Used to give space to sections if they have a spacing issue. Usage below:

*<code><nowiki>{{br}}</nowiki></code> gives space to a section
*<code><nowiki>{{br|right}}</nowiki></code> gives space to right side of a section
*<code><nowiki>{{br|left}}</nowiki></code> gives space to left side of a section (ideal when headers clash with infoboxes)

[[Category:Formatting templates]]
</noinclude>

Template:Color-link

2018-03-27T05:35:43Z

Normmatt: Created page with "<span class="color-link"><span style="color:{{{2}}}; a:hover:{{{2}}};">{{{1}}}</span></span><noinclude> {{color-link|Main Page|#C00}}. Though you shouldn't falsel..."

<span class="color-link">[[{{{1}}}|<span style="color:{{{2}}}; a:hover:{{{2}}};">{{{1}}}</span>]]</span><noinclude>

{{color-link|Main Page|#C00}}. Though you shouldn't falsely use the template as just shown, its implication is shown: change the link color of a link from the default blue. You can use a color name or a hexadecimal, but be sure to add a <tt>#</tt> before the six alphanumeric sequence (or three if there's three pairs, such as C00, used in the example).

Actual code: <tt><nowiki>[[{{{1}}}|<span style="color:{{{2}}};">{{{1}}}</span>]]</nowiki></tt>

Also see {{tem|color-link-piped}}.
[[Category:Internal link templates|{{PAGENAME}}]]</noinclude>

Template:Tem

2018-03-27T05:35:24Z

Normmatt: Created page with "{{{{{1}}}{{#if:{{{2|}}}||{{{2}}}}}{{#if:{{{3|}}}||{{{3}}}}}{{#if:{{{4|}}}||{{{4}}}}}{{#if:{{{5|}}}||{{{5}}}}}}}<noinclude>Categ..."

{{[[Template:{{{1}}}|{{{1}}}]]{{#if:{{{2|}}}||{{{2}}}}}{{#if:{{{3|}}}||{{{3}}}}}{{#if:{{{4|}}}||{{{4}}}}}{{#if:{{{5|}}}||{{{5}}}}}}}<noinclude>[[Category:Internal link templates|{{PAGENAME}}]]</noinclude>

Template:Box-footer-empty

2018-03-24T06:11:58Z

Normmatt: Created page with "<includeonly><div style="clear:both;"></div></div></includeonly>"

Main Page/Navigation

2018-03-24T06:11:03Z

Normmatt:

{{Main page box|Navigation|:Navigation}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="33%" | '''General''' 
! width="33%" | '''Homebrew''' 
! width="33%" | '''Hardware/Software''' 
|- valign="top" style="background: #F5FAFF;"
|
*[[Glossary]]
*[[Games]]
*[[:Category:PC utilities|PC Utilities]]
|
*[[Homebrew Exploits]]
*[[Homebrew Applications]]
*[[Homebrew Libraries and Tools]]
*[[System Flaws]]
|
*[[Hardware|Overview]] ([[IO|IO registers]])
*[[Memory Cards]]
*[[:Category:File_formats|File Formats]]
|}
</div>
{{box-footer-empty}}

Template:Box-header

2018-03-24T05:57:51Z

Normmatt:

<div style="clear: both; position: relative; border: {{{border-type|solid}}} {{{titleborder|{{{border|#ababab}}}}}}; border-width: {{{border-top|{{{border-width|1}}}}}}px {{{border-width|1}}}px 0; background: {{{titlebackground|#bcbcbc}}}; color: {{{titleforeground|#000}}}; padding: .1em;text-align: {{{title-align|center}}};margin-bottom: 0px;">{{#if: {{{EDITLINK|}}} ||
<span class="plainlinks" style="position: absolute;top: 1px;right: 1px;margin-bottom:.1em;font-size:{{{font-size|80%}}}; color: {{{titleforeground|#000}}}">{{
#if: {{{noedit|}}} || [{{fullurl:{{{editpage|/}}}|action=edit{{#if: {{{section|}}} |&section={{{section}}}}}}} <span style="color: {{{titleforeground|#000}}}">edit</span>] }}{{#if: {{{viewpage|}}} |'''·''' [[:{{{viewpage}}}|<font color="{{{titleforeground|black}}}">view</font>]] }}{{{top|}}} 
</span>}}{{#if: {{{SPAN|}}} |<span style="font-size:{{{title-font-size|100%}}}; font-weight:bold; margin: 0; padding:0; padding-bottom:.1em; color:{{{titleforeground|#000}}};{{{extra|}}}">{{{title}}}</span>|<h2 style="font-size:{{{title-font-size|100%}}}; font-weight:bold; border: none; margin: 0; padding:0; padding-bottom:.1em; color:{{{titleforeground|#000}}};{{{extra|}}}">{{{title}}}</h2>}}
</div>
<div style="display:block; border: {{{border-width|1}}}px solid {{{border|#ababab}}}; border-top-width: {{{border-top|1}}}px; vertical-align: top;background: {{{background|#fefeef}}};opacity: {{{background-opacity|1}}}; color: {{{foreground|#000}}}; text-align: {{{text-align|left}}}; margin: 0 0 10px; padding: {{{padding|1em}}};padding-top: {{{padding-top|.3em;}}}"><noinclude>
{{box-footer}}

{{Documentation}}
</noinclude>

Template:Box-header

2018-03-24T03:43:54Z

Normmatt:

{{Box-header{{{watch|}}} | title={{{1}}}
|editpage={{{2}}}
|border=#A3B1BF 
|titleforeground=black 
|titlebackground=#CEE0F2 
|background=#F5FAFF 
|foreground=black 
}}<noinclude>{{Box-footer}}</noinclude>

Main Page/Navigation

2018-03-24T03:30:29Z

Normmatt:

<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="33%" | '''General''' 
! width="33%" | '''Homebrew''' 
! width="33%" | '''Hardware/Software''' 
|- valign="top" style="background: #F5FAFF;"
|
*[[Glossary]]
*[[Games]]
*[[:Category:PC utilities|PC Utilities]]
|
*[[Homebrew Exploits]]
*[[Homebrew Applications]]
*[[Homebrew Libraries and Tools]]
*[[System Flaws]]
|
*[[Hardware|Overview]] ([[IO|IO registers]])
*[[Memory Cards]]
*[[:Category:File_formats|File Formats]]
|}
</div>

Main Page

2018-03-24T03:30:14Z

Normmatt: Replaced content with "{{:Main Page/Header}} {{:Main Page/Navigation}}"

Template:Documentation

2018-03-24T03:29:20Z

Normmatt: Created page with "<div class="template-documentation"><!-- These are the literal class definitions in common.css: /* For template documentation */ .template-documentation { clear: both;..."

<div class="template-documentation">{{#ifeq:{{{heading|μ}}}|
|
|<div style="padding-bottom:3px; border-bottom: 1px solid #aaa; margin-bottom:1ex">{{#ifeq:{{{content|μ}}}|μ
|<span class="editsection plainlinks" id="doc_editlinks">{{#ifexist: {{{1|{{Documentation/docname}}}}}
|[[{{fullurl:{{{1|{{Documentation/docname}}}}}|action=edit}} edit]]
|[[{{fullurl:{{{1|{{Documentation/docname }}}}}|action=edit&preload=Template:Documentation/preload}} create]]
}}</span>
}} <span style="{{#if:{{{heading-style|}}}|{{{heading-style}}}|{{#ifeq:{{NAMESPACE}}|{{ns:template}}|font-weight: bold; font-size: 125%|font-size: 150%}}}}">{{#if:{{{heading|}}}|{{{heading}}}|{{#ifeq:{{NAMESPACE}}|{{ns:template}}|[[Image:Template-info.svg|50px]] Template documentation|Documentation}}}}</span></div>
}}<div id="template_doc_page_transcluded" class="dablink plainlinks">{{#ifexist: {{{1|{{Documentation/docname}}}}}
|This documentation is transcluded from [[{{{1|{{Documentation/docname}}}}}]]. <small style="font-style: normal">([{{fullurl:{{{1|{{Documentation/docname}}}}}|action=edit}} edit] | [{{fullurl:{{{1|{{Documentation/docname}}}}}|action=history}} history])</small><br />
}}{{#switch: {{SUBPAGENAME}}
|sandbox|testcases=
|#default=
{{#switch: {{SUBJECTSPACE}}
|{{ns:template}}
|{{ns:user}}=
{{#ifexist: {{FULLPAGENAME}}/sandbox
|This template has a [[/sandbox|sandbox]] <small style="font-style: normal">([{{fullurl:{{ #rel2abs: /sandbox }}|action=edit}} edit])</small> {{#ifexist: {{FULLPAGENAME}}/testcases
|and [[/testcases|testcases]] <small style="font-style: normal">([{{fullurl:{{ #rel2abs: /testcases }}|action=edit}} edit])</small>}} for editors to experiment.
|{{#ifexist: {{FULLPAGENAME}}/testcases
|This template has [[/testcases|testcases]] <small style="font-style: normal">([{{fullurl:{{ #rel2abs: /testcases }}|action=edit}} edit])</small> for editors to experiment.}}
}}}}}}
</div>
{{#if:{{{content|}}}|{{{content}}}|{{#ifexist:{{{1|{{Documentation/docname}}}}} | {{ {{{1|{{Documentation/docname}}}}} }} }}}}
</div>

Template:Documentation/docname

2018-03-24T03:29:05Z

Normmatt: Created page with "{{#switch: {{SUBPAGENAME}} |sandbox|testcases={{ #rel2abs: ../doc }} |#default={{SUBJECTPAGENAME}}/doc }}<noinclude> {{PAGENAME}} </noi..."

{{#switch: {{SUBPAGENAME}}
|sandbox|testcases={{ #rel2abs: ../doc }}
|#default={{SUBJECTPAGENAME}}/doc
}}<noinclude>
[[Category:Template documentation|{{PAGENAME}}]]
</noinclude>

Template:Box-header

2018-03-24T03:28:27Z

Normmatt: Created page with "<div style="clear: both; position: relative; border: {{{border-type|solid}}} {{{titleborder|{{{border|#ababab}}}}}}; border-..."

Template:Box-footer

2018-03-24T03:28:10Z

Normmatt: Created page with "<includeonly><div class="noprint" style="text-align:right; margin:0.3em 0.2em 0.2em 0.3em; padding:0.3em 0.2em 0em 0.3em;"><b>{{{1|}}}</b></div><div style="clear:both;"></div>..."

Template:Main page box

2018-03-24T03:27:32Z

Normmatt: Created page with "{{Box-header{{{watch|}}} | title={{{1}}} |editpage={{{2}}} |border=#A3B1BF  |titleforeground=blac..."

{{Box-header{{{watch|}}} | title={{{1}}}
|editpage={{{2}}}
|border=#A3B1BF 
|titleforeground=black 
|titlebackground=#CEE0F2 
|background=#F5FAFF 
|foreground=black}} 
<noinclude>{{Box-footer}}</noinclude>

Main Page/Navigation

2018-03-24T03:26:37Z

Normmatt: Created page with "{{Main page box|Navigation|Main Page/Navigation}} <div style="margin: -.3em -1em -1em -1em;"> {| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" sty..."

{{Main page box|Navigation|Main Page/Navigation}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="33%" | '''General''' 
! width="33%" | '''Homebrew''' 
! width="33%" | '''Hardware/Software''' 
|- valign="top" style="background: #F5FAFF;"
|
*[[Glossary]]
*[[Games]]
*[[:Category:PC utilities|PC Utilities]]
|
*[[Homebrew Exploits]]
*[[Homebrew Applications]]
*[[Homebrew Libraries and Tools]]
*[[System Flaws]]
|
*[[Hardware|Overview]] ([[IO|IO registers]])
*[[Memory Cards]]
*[[:Category:File_formats|File Formats]]
|}
</div>

Main Page/Header

2018-03-24T03:20:57Z

Normmatt: Created page with "<div style="background-color:#e7eef6; border: 1px solid #ccc; color:#000; margin-top: 15px; margin-bottom: 10px; padding: 8px; text-align:center;"> <div style="font-size: 162%..."

<div style="background-color:#e7eef6; border: 1px solid #ccc; color:#000; margin-top: 15px; margin-bottom: 10px; padding: 8px; text-align:center;">
<div style="font-size: 162%; border: none; margin: 0; padding:.1em;">Welcome to [[iQueBrew:About|iQueBrew]],</div>
<div style="font-size: 95%">a wiki dedicated to homebrew on the Nintendo Ique Player.</div>
<div style="font-size:85%;">We have [[Special:Statistics|{{NUMBEROFARTICLES}}]] articles.</div>
</div>