Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 159: | Line 159: | ||
|Carol Vorderman's Sudoku | |Carol Vorderman's Sudoku | ||
|Stack Buffer Overflow via unchecked string length | |Stack Buffer Overflow via unchecked string length | ||
|The | |The savefile stores plaintext profile & highscore names. There are no checks regarding the size-length of the profile & highscore names. Once can use a very large string to overwrite and gain control of the stack and jump to unsigned code. | ||
This vulnerability | This vulnerability was ported over to the PSP version of the game. See [https://github.com/ChampionLeake/SudokuSTACK here] | ||
|N/A | |N/A | ||
|December 2021 | |December 2021 | ||
|ChampionLeake | |ChampionLeake | ||
|- | |- | ||
|Star Wars Racer Revenge | |Star Wars Racer Revenge | ||
|Stack-Smash via unchecked "Record Name" length | |Stack-Smash via unchecked "Record Name" length | ||
|The game allows players | |The game allows players record their names when breaking lap records on a course. However, the size of the name is not checked. Using a very large name can overwrite addresses on the stack and gain control of the $ra, which can be used to jump to unsigned code. | ||
|N/A | |N/A | ||
|August 2023 | |August 2023 | ||
Line 198: | Line 198: | ||
===== Bug Description ===== | ===== Bug Description ===== | ||
Okage Shadow King has a typical stack buffer overflow if you extend the player or town name in a savedata. | Okage Shadow King has a typical stack buffer overflow if you extend the player or town name in a savedata. | ||
===== Exploit Implementation ===== | ===== Exploit Implementation ===== | ||
Line 206: | Line 205: | ||
===== Save data format ===== | ===== Save data format ===== | ||
* The save data has no digest | * The save data has no digest. Strings can be modified and extended without making any crash. | ||
* The records pages data are stored as follows: for each record, signed int (4 bytes) for the time/most KO's | * The records pages data are stored as follows: for each record, signed int (4 bytes) for the time/most KO's, followed by ?22?-byte string. | ||
===== Bug description ===== | ===== Bug description ===== | ||
* max player name length allowed when breaking a record: 10 characters | |||
* | * max name length displayed in the record page: 21 characters | ||
* | |||
* buffer size: expected to be 256 bytes from tests (nothing happens when length is 256 characters followed by a zero byte) | * buffer size: expected to be 256 bytes from tests (nothing happens when length is 256 characters followed by a zero byte) | ||
* | * overflow size: >=257 -> freeze or crash during real time edit | ||
* 256:256+16 -> overwrites s0 register | |||
* | |||
===== Official cheat codes ===== | ===== Official cheat codes ===== | ||
* It might be useful to unlock more tracks in order to have more possibilities to trigger the buffer overflow in the records menu. | * It might be useful to unlock more tracks in order to have more possibilities to trigger the buffer overflow in the records menu. | ||
* To enable cheat codes, it is often forgotten in guides that you have to make a new record, then type "NO TIME" as | * To enable cheat codes, it is often forgotten in guides that you have to make a new record, then type "NO TIME" as name. This must be done once as it is stored in save data. Then at the main menu, hold R1, R2, L1, L2 while you press the cheat combos. The cheats remain in save data but some can be disabled at wish. | ||
** No Player Damage Cheat ON/OFF: uuddlrlrscsc ON/OFF -> up, up, down, down, left, right, left, right, square, circle, square, circle | * By looking at the debug strings of the binary files, one can deduce the following cheat codes: | ||
** | ** CONFIRMED No Player Damage Cheat ON/OFF: uuddlrlrscsc ON/OFF -> up, up, down, down, left, right, left, right, square, circle, square, circle | ||
** Hard Mode Cheat ON/OFF: simply triangle, not too late. | ** NOT CONFIRMED No Player Overheat Cheat ON/OFF: balrefsc -> ?ba?, left, right, ?ef?, square, circle. | ||
** One Hit Kills Cheat ON/OFF: ssssxctsxxxxctsxcccctsxcttttsxct | ** CONFIRMED Hard Mode Cheat ON/OFF: simply triangle, not too late. | ||
** All Tracks Unlocked!: rlrlcscs -> right, left, right, left, circle, square, circle, square. | ** CONFIRMED One Hit Kills Cheat ON/OFF: ssssxctsxxxxctsxcccctsxcttttsxct | ||
** All Podracers Unlocked!: uldtsxurdtcxuldtcxurdtsx -> up, left, down, triangle, square, x, up, right, ... | ** CONFIRMED All Tracks Unlocked!: rlrlcscs -> main combo then right, left, right, left, circle, square, circle, square. | ||
** All Podracers' Stats Maxed Out!: uuxxddttllccrrss -> up, up, x, x, down, down, triangle, triangle, left, left, circle, circle, right, right, square, square. | ** CONFIRMED All Podracers Unlocked!: uldtsxurdtcxuldtcxurdtsx -> up, left, down, triangle, square, x, up, right, ... | ||
** All Art Galleries Unlocked!: main combo then rslcdxut -> right, square, left, circle, down, x, up, triangle. | ** CONFIRMED All Podracers' Stats Maxed Out!: uuxxddttllccrrss -> up, up, x, x, down, down, triangle, triangle, left, left, circle, circle, right, right, square, square. | ||
* When using a save data that was | ** CONFIRMED All Art Galleries Unlocked!: main combo then rslcdxut -> right, square, left, circle, down, x, up, triangle. | ||
* When using a save data that was hand-modified to unlock every characters and circuits, a bug can occur in the record page: only one of the page can be accessed. Pressing left or right makes sound but remains on this page. | |||
==== GTA III ==== | ==== GTA III ==== | ||
Line 256: | Line 246: | ||
https://gamefaqs.gamespot.com/boards/915821-playstation-2/79857492?page=3 | https://gamefaqs.gamespot.com/boards/915821-playstation-2/79857492?page=3 | ||
==== Viewtiful Joe 2 demo on the NTSC U/C region 2004 Holiday Demo Disc ==== | ==== Viewtiful Joe 2 demo on the NTSC U/C region 2004 Holiday Demo Disc ==== | ||
Line 267: | Line 254: | ||
=== Possible vulnerable games === | === Possible vulnerable games === | ||
==== World War Zero Iron Storm ==== | ==== World War Zero Iron Storm ==== | ||
Line 301: | Line 270: | ||
==== All FIFA games ==== | ==== All FIFA games ==== | ||
FIFA06, FIFA08, FIFA Street 2 are vulnerable on Nintendo DS. See [https://github.com/CTurt/Dara|DARA by CTurt]. | Possibly vulnerable FIFA06, FIFA08, FIFA Street 2 are vulnerable on Nintendo DS. See [https://github.com/CTurt/Dara|DARA by CTurt]. | ||
==== List of other games ==== | ==== List of other games ==== | ||
See [https://github.com/libretro/LRPS2/blob/main/resources/GameIndex.yaml a list of almost all PS2 games]. Some may be vulnerable. | See [https://github.com/libretro/LRPS2/blob/main/resources/GameIndex.yaml a list of almost all PS2 games]. Some may be vulnerable. |