The Most Valuable Shovelware

Cubic Ninja, developed by AQ Interactive and released in 2011, is a 3DS game about guiding a cube shaped Ninja through a trap filled maze using nothing but the 3DS' built-in gyroscope. The game recieved a lukewarm critical response and is widely considered to be a pretty shoddy piece of shovelware, meant to get in on the ground floor of Nintendo's newest console at the time.

oops

This game is universally deemed to be a very middle-of-the-road/mid/meh/nothing-special release that was mostly forgotten about shortly after launch, especially as more substantial games began releasing for the system. So with all of that in mind, why did this game's prices absolutely skyrocket in November of 2014, over 3 years after release?

Like a lot of console exclusive shovelware, Cubic Ninja was very eager to take advantage of the new, unique features of the hardware, such as the 3DS' fast QR code scanning ability.

If you don't how QR codes work, they're basically a way for a computer to encode data into an easily printable and scannable image, which can then be decoded by other computers. It's essentially a way to share computer data on a non-digital format, similar to barcodes. The 3DS mostly utilized this technology to make it easier to players to share custom content amongst eachother easier, such as Miis. Cubic Ninja decided to use this as a way to encode and share creations made in the game's level editor.

Now, class, what do we do when we give users the ability to input some kind of custom data? We add a check to make sure that it doesn't try to load more data than it's capable of.

AQ Interactive didn't do this.

A carefully crafted QR code with too much data than Cubic Ninja is able to handle (and an extra bit of special code) creates a buffer overflow, allowing arbitrary code execution in the game. While I'm not nearly smart enough to understand the full scope of the technical aspects, using this glitch along with some vulnerabilities in the way that the GPU and web browser access memory allows the full execution of unsigned code.

Consoles nowadays are made to only execute code that's signed with a special digital "signature" from the console's publisher, preventing just anybody from running programs

The veteran DS homebrewer who discovered this vulnerability, Smealum, dubbed his hack "Ninjhax". Since this was one of the first entrypoints discovered for the console, its announcement made the Cubic Ninja go from the Walmart bargain bin to one of the most expensive games to get your hands on, often being sold for hundreds of dollars by scalpers.

Thankfully, there are far easier exploits written for the 3DS nowadays that make use of stock software, no longer requiring you to sell your firstborn child for some mediocre game.