Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 159: Line 159:
|Carol Vorderman's Sudoku
|Carol Vorderman's Sudoku
|Stack Buffer Overflow via unchecked string length
|Stack Buffer Overflow via unchecked string length
|The save data file stores plaintext profile and high-score names. One can use a large string to overwrite the stack and jump to unsigned code.
|The savefile stores plaintext profile & highscore names. There are no checks regarding the size-length of the profile & highscore names. Once can use a very large string to overwrite and gain control of the stack and jump to unsigned code.
This vulnerability is also present in the PSP version of the game. See the [https://github.com/ChampionLeake/SudokuSTACK PSP exploit].
This vulnerability was ported over to the PSP version of the game. See [https://github.com/ChampionLeake/SudokuSTACK here]
|N/A
|N/A
|December 2021 (2011-01-06 for PSP)
|December 2021
|ChampionLeake for PS2, Jeerum for PSP
|ChampionLeake
|-
|-
|Star Wars Racer Revenge
|Star Wars Racer Revenge
|Stack-Smash via unchecked "Record Name" length
|Stack-Smash via unchecked "Record Name" length
|The game allows players to record their names when breaking lap records on a course. However when displaying the Hall of Fame, the size of the names are not checked. Using a very large name can overwrite addresses on the stack and gain control of $ra, which can be used to jump to unsigned code.
|The game allows players record their names when breaking lap records on a course. However, the size of the name is not checked. Using a very large name can overwrite addresses on the stack and gain control of the $ra, which can be used to jump to unsigned code.
|N/A
|N/A
|August 2023
|August 2023
Line 198: Line 198:
===== Bug Description =====
===== Bug Description =====
Okage Shadow King has a typical stack buffer overflow if you extend the player or town name in a savedata.
Okage Shadow King has a typical stack buffer overflow if you extend the player or town name in a savedata.
* The save data has a CRC digest.


===== Exploit Implementation =====
===== Exploit Implementation =====
Line 206: Line 205:


===== Save data format =====
===== Save data format =====
* The save data has no digest nor any kind of security.
* The save data has no digest. Strings can be modified and extended without making any crash.
* The records pages data are stored as follows: for each record, signed int (4 bytes) for the time/most KO's count, followed by 21-byte string for the player's name, which must be null-terminated as it is copied using strcpy.
* The records pages data are stored as follows: for each record, signed int (4 bytes) for the time/most KO's, followed by ?22?-byte string.


===== Bug description =====
===== Bug description =====
Star Wars Racer Revenge has a typical stack buffer overflow if you extend a player name in a savedata.
* To trigger the exploit, in the main menu, go to Options then Hall of Fame. The Hall of Fame will trigger the exploit as it copies from save data the best players' names without checking length.
* To trigger the exploit, in the main menu, go to Options then Hall of Fame. The Hall of Fame will trigger the exploit when you go to the page where the player name was extended in save data to more than 256 characters as the code copies from save data the best players' names without checking length.
* max player name length allowed when breaking a record: 10 characters as the keyboard gets disabled
* Player name max length allowed when breaking a record: 10 characters as the keyboard gets disabled
** Player name is registered in save data the first time that you make a new record but it seems not used at all.
** Player name is registered in save data the first time that you make a new record but it seems not used at all.
* Player name max length displayed in the record page: 21 characters as it is done a sort of "memcpy(src, dst, 21)" in a 22-byte null buffer.
* max name length displayed in the record page: 21 characters as it is done a sort of "memcpy(src, dst, 21)" in a 22-byte buffer
** 9 player names are displayed on each Hall of Fame page, stored temporarily in memory respectively at addresses: 0xF98B20, 0xFADB60, 0xFB29D0, 0xFB4E00, 0xFB7210, 0xFB9640, 0xFBBA50, 0xFBDE80, 0xCCE320
** 9 player names are displayed on each Hall of Fame page, stored temporarily in memory respectively at addresses: 0xF98B20, 0xFADB60, 0xFB29D0, 0xFB4E00, 0xFB7210, 0xFB9640, 0xFBBA50, 0xFBDE80, 0xCCE320
* buffer size: expected to be 256 bytes from tests (nothing happens when length is 256 characters followed by a zero byte)
* buffer size: expected to be 256 bytes from tests (nothing happens when length is 256 characters followed by a zero byte)
* latest valid $ra where pcsx2 debugger can go to quickly, then need to go by small step: 0x140D2C
* overflow size: >=257 -> freeze or crash during real time edit
* latest valid $ra: 0x1E4048
* 256:256+16 -> overwrites s0 register
* latest valid $pc: 0x1E4050 (jl ra) -> crash when executed so put breakpoint at 0x1E4050
* savedata string address: 0x61b76c in pcsx2
* current savedata payload: 256 non-null bytes then 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 00 00 00 00 00 00
* $ra -> 5857565554535251 (bottom), 0000000000005A59 (top)
* $s0 -> 4847005A59585756 (bottom), 504F4E4D4C4B4A49 (top)
* It is guessed that at least 0xB7B bytes of the savedata can be overwritten with a MIPS shellcode without breaking the main menu.
* savedata string address: 0x61b76c in pcsx2 but maybe depends on PS2 BIOS


===== Official cheat codes =====
===== Official cheat codes =====
* It might be useful to unlock more tracks in order to have more possibilities to trigger the buffer overflow in the records menu.
* It might be useful to unlock more tracks in order to have more possibilities to trigger the buffer overflow in the records menu.
* To enable cheat codes, it is often forgotten in guides that you have to make a new record, then type "NO TIME" as player name. This has to be done only once as it is stored in save data. Then at the main menu, hold R1, R2, L1 and L2 while you press successively the following cheat combos. The cheats remain in save data but some can be disabled at wish. The following cheat codes were found by looking at the debug strings of the binary files:
* To enable cheat codes, it is often forgotten in guides that you have to make a new record, then type "NO TIME" as player name. This has to be done only once as it is stored in save data. Then at the main menu, hold R1, R2, L1 and L2 while you press succesively the following cheat combos. The cheats remain in save data but some can be disabled at wish. The following cheat codes were found by looking at the debug strings of the binary files:
** No Player Damage Cheat ON/OFF: uuddlrlrscsc ON/OFF -> up, up, down, down, left, right, left, right, square, circle, square, circle
** No Player Damage Cheat ON/OFF: uuddlrlrscsc ON/OFF -> up, up, down, down, left, right, left, right, square, circle, square, circle
** (NOT CONFIRMED) No Player Overheat Cheat ON/OFF: balrefsc -> ?ba?, left, right, ?ef?, square, circle.
** (NOT CONFIRMED) No Player Overheat Cheat ON/OFF: balrefsc -> ?ba?, left, right, ?ef?, square, circle.
Line 256: Line 249:


https://gamefaqs.gamespot.com/boards/915821-playstation-2/79857492?page=3
https://gamefaqs.gamespot.com/boards/915821-playstation-2/79857492?page=3
https://gamefaqs.gamespot.com/ps2/927089-soulcalibur-iii/faqs/40424
https://gamefaqs.gamespot.com/boards/927089-soulcalibur-iii/24774951
https://www.reddit.com/r/SoulCalibur/comments/uqiff7/is_the_soulcalibur_iii_save_corruption_glitch/


==== Viewtiful Joe 2 demo on the NTSC U/C region 2004 Holiday Demo Disc ====
==== Viewtiful Joe 2 demo on the NTSC U/C region 2004 Holiday Demo Disc ====
Line 267: Line 257:


=== Possible vulnerable games ===
=== Possible vulnerable games ===
==== Jak X: Combat Racing ====
There is a bug with the autosave feature that corrupts save data on memory card. It was fixed in the Platinum version of the game.
https://gamefaqs.gamespot.com/boards/927166-jak-x-combat-racing/41999721
There is a bug, at least in PCSX2, where when starting the game for the first time and creating a new profile, the game freezes on the memory card saving screen. The save data is however well written and on next tries the game can be played as the save is correctly loaded.
https://github.com/PCSX2/pcsx2/issues/6935
Profile name is limited to 12 characters by keyboard. The game displays up to ?32? characters and the profile name can be extended by editing saveX-Y-0000000Z.bin in the PSU savedata file. Extending profile name does not create any buffer overflow. The strings in the center of the saveX-Y-0000000Z.bin file cannot be edited for an unknown reason, else the game loops infinitely on the save data loading screen.
==== Metal Gear Solid 3: Subsistence ====
There is bug with the PCSX2 emulator and MGS3: Subsistence that causes save files to become corrupt. While the exact cause of this issue is unknown, anyone using the PCSX2 emulaor with the saves below should wait a few seconds after accessing the memory to save the game and use the US BIOS. This seems to greatly reduce the likelihood of the bug corrupting the file. Also, do not save MGS3 on a memory card file that has a lot of other saves, because the bug corrupts the entire memory card.
https://retromaggedon.com/index.php/metal-gear-solid-3-subsistence-save-files-ps2/


==== World War Zero Iron Storm ====
==== World War Zero Iron Storm ====
Line 301: Line 273:
==== All FIFA games ====
==== All FIFA games ====


FIFA06, FIFA08, FIFA Street 2 are vulnerable on Nintendo DS. See [https://github.com/CTurt/Dara|DARA by CTurt].
Possibly vulnerable FIFA06, FIFA08, FIFA Street 2 are vulnerable on Nintendo DS. See [https://github.com/CTurt/Dara|DARA by CTurt].
 
Moreover, a lot of Electronics Arts games are vulnerable on PSP.
 
==== Psychonauts ====
 
Psychonauts is maybe vulnerable to string overflow although it seems very secure as for now by using fixed-length copy functions:
* Profile name is not vulnerable. It is limited to 8 characters by keyboard and to 10 characters in display.
* Level name is not vulnerable: the game displays a maximum of 127 characters as the level name is memcpied to a 128-byte null-terminated buffer.
* Profile* file must be exactly 64-byte long.
* SavedGame* file must be exactly 245760-byte long.
 
* The only important information stored in the Profile* file is the profile name as the remaining data can be overwritten.
* SavedGame* file format is "\n"-separated with also bars (|) separators. On each line is a setting. Each setting is made of between 1 and three parts separated by bars. Table|<name>|<value>. The name part is mandatory.
* There is a digest check on psu-embedded files as the game says that the "profile is damaged" when the savedata is edited without precaution. Using pypsu by McCaulay, one can extract files contained in the psu, but there are even more digests as any SavedGame* file is detected as "Damaged Save Game" after editing it too much. The SavedGame* files start with a 16-byte MD5 hash of the following data.
 
==== Lego games ====
 
LEGO Star Wars II: The Original Trilogy and LEGO Indiana Jones: The Original Adventures use a custom checksum:
* Offset: FileSize - 4
* Calc. Start: 0
* Calc. Length: FileSize - 4
 
<source lang="csharp">
private int CalculateChecksum(byte[] data) {
    using (var xIO = new MasterIO(data, Endian.Big)) {
        int count = (data.Length / 4) - 1;
        int sum = 0x5C0999;
        for (int i = 0; i < count; ++i)
            sum += xIO.Reader.ReadInt32();
        return sum;
    }
}
</source>
 
LEGO Star Wars may use the same checksum or no checksum at all. LEGO Batman: The Videogame may use the same checksum or the newer checksum:
* Offset: 12
* Calc. Start: 16
* Calc. Length: Filesize - 16
<source lang="csharp">
private int CalculateChecksum(byte[] data, int offset, int size) {
    int sum = -1;
    for (int i = 0; i < size; ++i) {
        sum *= 0x1000193;
        sum ^= data[offset++];
    }
    return ~sum;
}
</source>


==== List of other games ====
==== List of other games ====


See [https://github.com/libretro/LRPS2/blob/main/resources/GameIndex.yaml a list of almost all PS2 games]. Some may be vulnerable.
See [https://github.com/libretro/LRPS2/blob/main/resources/GameIndex.yaml a list of almost all PS2 games]. Some may be vulnerable.
Please note that all contributions to PS2 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS2 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/ps2/Vulnerabilities"