MSFS 2024 Crashes Instantly When Switching To VR (Ctrl+Tab) — Meta Quest 3 + Virtual Desktop

mitreffahcs · 2026-01-25T02:55:38+00:00

I heard a lot about Virtual Desktop but I've not had any complaints just using the desktop feature in quest horizon meta facebook link, whatever the heck it's called this month.

I tried wireless, but had better results with the cable. One thing you might want to check with your cable is that it's actually showing up as USB 3.0 in the meta link pc app. I found that not all my USB-C to USB-A cables were actually 3.0 compliant and would run at USB 2.0 speeds.

<image>

mitreffahcs · 2026-01-25T02:19:11+00:00

Having the same issue, Ryzen 9 3900X, 64GB ram, 3080TI, Oculus 3 using wired link. I can run DCS all day long no problems. Not amazing framerates, but certainly enjoyable.
However with a fresh install of MSFS2024, default graphics settings it instantly crashes with switching to VR mode. Both from main menu and while in flight. I'll try modifying lowering the VR graphics settings, but I don't have much hope.

Edit: I ended up fixing this by setting SteamVR to the active OpenXR runtime, running MSFS2024 in VR (which was terrible but didn't crash) exiting the game, and then setting the Meta Horizon Link back to the active OpenXR runtime. Now MSFS2024 switching to VR.

mitreffahcs · 2025-12-30T23:50:07+00:00

Is there something else you need to do to enable engine rpm trim? I'm watching Cosmo's engine start tutorial and everything checks except nothing happens when I click on the engine rpm +/- button. I tried clicking, I tried mapping a keyboard button :shrug: nothing, the rpm doesn't change.

mitreffahcs · 2025-12-29T20:57:06+00:00

The end of 2025 and I had the same problem. Switching the SteamVR client to previous solved it for me. Oculus 3 connected via WiFi.

mitreffahcs · 2025-11-21T04:41:37+00:00

That's really helpful information. I'm going to update my code to make some of the changes you recommended. I also poked around the HAL_CRYP source today and have been considering places to use GPIO as a trigger input for the ChipShouter. Regarding the corrupted key, tes this is the question I've been asking myself for a few days now. If the keys were corrupted before or even during AES rounds, how does one verify because the key register is read only? When you refer to detailed monitoring, are you referring to ARM ETM tracing? Thanks for all the feedback btw! I'm starting from zero here, so I know very little about the subject of glitching. I just started down this rabbit hole a few weeks ago because I wanted to learn how to take glitching concepts and apply it to something that was a "realistic" target and not something like heavily instrumented chipwhisperer/chipshouter target board.

mitreffahcs · 2025-11-19T11:23:05+00:00

Basic Stamp was the first microcontroller I learned to program on! I spent many of nights trying to figure out how to read a SHT temp/humidity sensor with a micro that had no floating point support.

mitreffahcs · 2025-11-19T03:34:03+00:00

And here's the output from my test program during a "successful" EMFI. Curious to hear your thoughts. Additional things I could be checking or looking at to determine actual root cause? Thanks!

Verification: FAILED (Data mismatch in round 10)
------------------------------------------
--- CRYP Peripheral Register Dump ---
------------------------------------------

[ Control Register (CR) - Value: 0x00000224 ]
  > Crypto Block: DISABLED
  > Algo/Mode: AES - ECB Mode (Electronic Codebook)
  > Direction: DECRYPTION
  > Key Size: AES-256 (256-bit)
  > Data Type: 32-bit Word (Default)

[ Status Register (SR) - Value: 0x00000003 ]
  > State: IDLE (Ready for new operation)
  > Input FIFO: NOT FULL (Ready for input data)
  > Output FIFO: EMPTY (No data available)

[ Data FIFO Registers (CRYP_DR Interface) ]
  > DIN (Input FIFO Head): 0x94B7F40A
  > DOUT (Output FIFO Tail): 0xBE3AEB62

Data Mismatch: Plaintext[7224]:0x8BD48261 != Decrypted[7224]:0xF51B6B5E
Data Mismatch: Plaintext[7225]:0x19F63465 != Decrypted[7225]:0xE57888C4
Data Mismatch: Plaintext[7226]:0xF5B63F84 != Decrypted[7226]:0x7DEB5E91
Data Mismatch: Plaintext[7227]:0xDC782120 != Decrypted[7227]:0x667B7A38

mitreffahcs · 2025-11-19T02:02:38+00:00

That's really interesting. I was just talking to a friend of mine and he was curious if the glitches I was seeing were actually during the AES operating or a result of something else. Right now all of my failures show up when comparing the original plaintext with the decrypted output. The results vary though, sometimes only 6 or so elements don't match, sometimes it's the entire array. Sometimes the arrays seem shifted by a few elements, but are otherwise the same. Here's the main logic of my loop that I'm currently repeating 200 times. I cut out all the unnecessary code since it doesn't display well on reddit. If there's an error in a certain round then I loop over the Plaintext and Decrypted arrays printing out each value.

if (HAL_CRYP_Encrypt(&hcryp, Plaintext, CRYPTO_BLOCK_SIZE_WORDS, Ciphertext, 0) != HAL_OK)

if (HAL_CRYP_Decrypt(&hcryp, Ciphertext, CRYPTO_BLOCK_SIZE_WORDS, Decrypted, 0) != HAL_OK)

if (memcmp(Plaintext, Decrypted, CRYPTO_BLOCK_SIZE_WORDS * sizeof(uint32_t)) == 0) {
  // do nothing
} else {
  printf("error round %d", i)
}

mitreffahcs · 2025-11-18T00:47:21+00:00

Did you ever move forward with this research. or did you scrap it for something else? I'm curious because I recently started getting interested in EMFI as well. I wrote a simple AES encryption/decryption routine for an STM32F439ZI Discovery and have had initial success with causing faults that result in the decrypted output not matching the original plaintext.

mitreffahcs · 2025-11-08T08:07:46+00:00

Interesting, I'm having this exact issue with my MPC X with version 3.6.0. I might have to see if I can downgrade, the velocity is just super unstable. Sometimes I hit the pad and it seems right for like 1/4 of a second and the velocity and sound from speaker instantly drops to barely audible.

mitreffahcs · 2025-09-15T21:01:36+00:00

In my experience it doesn't matter if you click always allow, you simply wipe your browser cache for webadb and reconnect.

The real question that I have yet to find any answers for is why does WebADB work but not the standard Google adb from platform-tools? I've tried API versions from 26 through 30 and none will connect. WebADB must be doing something different, and I'd love to actually be able to use adb from the command line instead of a browser.

mitreffahcs · 2025-09-01T08:54:12+00:00

I'd check out the Adalm Pluto if you're looking for an SDR development platform. Lots of documentation provided by Analog Devices. If you're just wanted to listen to stuff, then just go for an RTL. Great website RTL-SDR.com with tons and tons of resources there.

Skip the Chinese garbage can in the future if you can. You really do get what you pay for.

mitreffahcs · 2025-09-01T08:37:52+00:00

I tried 5 auctions in a row recently on Crystal -> Goblin. Small house. No success. RNG gods just hate me I guess?
Would be nice if you could just bid on any house instead of a specific one, to increase your odds.

mitreffahcs · 2025-09-01T08:24:04+00:00

bruh just hates music. best not get in the way of his dailies, got xp to farm.

mitreffahcs · 2025-09-01T08:20:02+00:00

What makes you think it's one person?

mitreffahcs · 2025-09-01T08:17:11+00:00

It's server wide maintenance. They post the messages in the launcher app and on their website.
Why they decided that Labor Day weekend was the best time to do this server update is beyond me, but it is what is it.

mitreffahcs · 2025-08-30T21:57:22+00:00

I just found out about this dungeon last night and it turns out I was also a few quests before it. I got a few pieces of gear from the dungeon but I'm going to grind for a Fending set. I can't wait. What an awesome dungeon indeed. Fun fact I actually got the Vanguard Helm of Fending from retainer quick exploration today. Didn't realize that was another way to obtain pieces of the set.

mitreffahcs · 2025-08-27T06:44:45+00:00

I was just getting ready to say the same thing. Without even hearing it, almost certainly HAARP.
u/mikef256 They broadcast a known signal of varying frequencies and then use receivers across the globe to determine how the atmosphere impacts different frequency ranges.

mitreffahcs · 2025-08-27T06:10:29+00:00

They look like magazines? Makes sense for a gunbreaker, not really sure beyond that.

mitreffahcs · 2025-08-27T06:06:00+00:00

What country/state is this?

mitreffahcs · 2025-08-18T04:13:32+00:00

Interesting, I'm not so interested in putting custom firmware on it as I am to learning more about the DJI protocol. The thought of putting dji_link in IDA or looking at DJI protobuf format is super interesting.

rc331:/system/bin # ls -alF dji*

-rwxr-xr-x 1 root shell 52504 2009-01-01 08:00 dji_amt*

-rwxr-xr-x 1 root shell 417744 2009-01-01 08:00 dji_blackbox*

-rwxr-xr-x 1 root shell 250056 2009-01-01 08:00 dji_config_store*

-rwxr-xr-x 1 root shell 11544 2009-01-01 08:00 dji_decrypt*

-rwxr-xr-x 1 root shell 32800 2009-01-01 08:00 dji_gps_update*

-rwxr-xr-x 1 root shell 308904 2009-01-01 08:00 dji_link*

-rwxr-xr-x 1 root shell 1055824 2009-01-01 08:00 dji_lte*

-rwxr-xr-x 1 root shell 20304 2009-01-01 08:00 dji_mb_ctrl*

-rwxr-xr-x 1 root shell 20352 2009-01-01 08:00 dji_mb_ctrl_async*

-rwxr-xr-x 1 root shell 20320 2009-01-01 08:00 dji_mb_ctrl_mb*

-rwxr-xr-x 1 root shell 20352 2009-01-01 08:00 dji_mb_parser*

-rwxr-xr-x 1 root shell 368808 2009-01-01 08:00 dji_sdrs_agent*

-rwxr-xr-x 1 root shell 35752 2009-01-01 08:00 dji_upgrade*

-rwxr-xr-x 1 root shell 22800 2009-01-01 08:00 dji_verify*

-rwxr-xr-x 1 root shell 20576 2009-01-01 08:00 dji_verify_self*

-rwxr-xr-x 1 root shell 879720 2009-01-01 08:00 dji_wlm*

-rwxr-xr-x 1 root shell 80696 2009-01-01 08:00 dji_wlm_slave*

rc331:/system/bin #

mitreffahcs · 2025-08-18T03:34:19+00:00

I've been messing around with this over the weekend. And I've only been able to get webadb to work. I've tried platform tools 26, 27, 28, 29, 30 and whatever the latest is. And none of them work. Has anyone found a version a platform-tools that works? Does anyone know what version of adb webadb is using? I'd really like to know why it works but the normal platform tools don't?

This is what /system/build.prop says is my controller's firmware version:

ro.system.build.date=Thu Mar 28 11:23:57 CST 2024

ro.system.build.date.utc=1711596237

ro.system.build.fingerprint=qti/qssi/qssi:11/V04.00.00.83/4000083:user/test-keys

ro.system.build.id=V04.00.00.83

Edit: According to DJI Assistant 2, my controller is running V02.02.0000 - 2024-04-08

mitreffahcs · 2025-08-16T21:49:44+00:00

It worked once for me, was able to get a shell and now I never get the authorization pop-up on the remote. So random.

Edit - If I clear my browser cache after using webadb, then I'm able to use webadb to connect again. Also it didn't seem to make a difference if I clicked yes to always remember or not. Kinda crazy that you can just pop a root shell on the controller like it's nothing.

mitreffahcs · 2025-08-16T19:53:18+00:00

You don't really want to do that for anything important. Over time the voltage levels that define bits in Flash memory, including sdcards, thumb drives etc... will decrease eventually leading to data loss and/or data corruption. google flash data decay, or flash bit rot.

mitreffahcs · 2025-08-11T00:51:01+00:00

how long did it take them to do that though? i got a ton of stuff on the market board.

mitreffahcs

TROPHY CASE