Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
| Latest revision | Your text | ||
| Line 2: | Line 2: | ||
= PS Game Savedata = | = PS Game Savedata = | ||
These flaws are relatively easy to find and exploit. There is a write-up on finding these flaws [https://championleake.github.io/blog//PS1-StackSmashing/ here]. | |||
{| class="wikitable" border="1" | {| class="wikitable" border="1" | ||
| Line 14: | Line 16: | ||
| Brunswick Circuit Pro Bowling | | Brunswick Circuit Pro Bowling | ||
| Stack Buffer Overflow via unchecked Custom Bowler Name length | | Stack Buffer Overflow via unchecked Custom Bowler Name length | ||
| Brunswick Circuit Pro Bowling offers players to create their own bowlers in terms of physical appearances and names. The bowlers' name is limited up to 15 characters long. When the player wants to create name, it | | Brunswick Circuit Pro Bowling offers players to create their own bowlers in terms of physical appearances and names. The bowlers' name is limited up to 15 characters long. When the player wants to create name, it's copied to the stack, however the string length is not checked. With a very large string, one can overwrite the stack and take control of the return address '''($ra register)''' to eventually jump to unsigned code in the savegame. | ||
| 1.0 | | 1.0 | ||
| January 20th, 2019 | | January 20th, 2019 | ||
| Line 91: | Line 93: | ||
|Sports Superbike | |Sports Superbike | ||
| | | | ||
| | | | ||
|N/A | |N/A | ||
|2014 | |2014 | ||
| Line 105: | Line 107: | ||
| Tekken 2 | | Tekken 2 | ||
| | | | ||
| | | | ||
| N/A | | N/A | ||
| 2014 | | 2014 | ||
| Line 119: | Line 121: | ||
| Tony Hawk's Pro Skater 2 | | Tony Hawk's Pro Skater 2 | ||
| Stack Buffer Overflow via unchecked Custom Skater name | | Stack Buffer Overflow via unchecked Custom Skater name | ||
| The player has the chance to create their own skater (physical appearance, skateboard, names, etc.). The skater name is copied to the stack, however the string length is not checked. With a large skater name, one can overwrite the stack and control the return address '''($ra register)''' to eventually jump to unsigned code in the savegame. One can trigger this overflow by selecting "Career Mode" and then selecting the "Create a new career" option. | | The player has the chance to create their own skater(physical appearance, skateboard, names, etc.). The skater name is copied to the stack, however the string length is not checked. With a large skater name, one can overwrite the stack and control the return address '''($ra register)''' to eventually jump to unsigned code in the savegame. One can trigger this overflow by selecting "Career Mode" and then selecting the "Create a new career" option. | ||
| 1.0 | | 1.0 | ||
| January 22nd, 2019 | | January 22nd, 2019 | ||
| Line 152: | Line 154: | ||
| qwikrazor87 and Acid_snake | | qwikrazor87 and Acid_snake | ||
|} | |} | ||
= System/Hardware = | = System/Hardware = | ||
| Line 164: | Line 162: | ||
|- | |- | ||
! Summary | ! Summary | ||
! | ! Vuln/Flaw | ||
! Documentation | ! Documentation | ||
! Revisions | ! Revisions | ||
! | ! Timeframe this vuln was discovered | ||
! | ! Vuln discovered by | ||
|- | |- | ||
| N/A | | N/A | ||
| Line 180: | Line 178: | ||
= Not Exploitable PS Game Savedata = | = Not Exploitable PS Game Savedata = | ||
These are games that developers have fuzzed | These are games that developers have fuzzed/researched trying to find bugs. Any useless crashes or games that do not crash at all go here. This is to inform researchers which games have already been studied. | ||
* Family Feud -- Using a large string for the family name does not seem to crash the game. In conclusion, the family name is not exploitable. (Researched by [[User:ChampionLeake|ChampionLeake]]) | * Family Feud -- Using a large string for the family name does not seem to crash the game. In conclusion, the family name is not exploitable. (Researched by [[User:ChampionLeake|ChampionLeake]]) | ||