Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 267: Line 267:


=== Possible vulnerable games ===
=== Possible vulnerable games ===
==== Jak X: Combat Racing ====
There is a bug with the autosave feature that corrupts save data on memory card. It was fixed in the Platinum version of the game.
https://gamefaqs.gamespot.com/boards/927166-jak-x-combat-racing/41999721
There is a bug, at least in PCSX2, where when starting the game for the first time and creating a new profile, the game freezes on the memory card saving screen. The save data is however well written and on next tries the game can be played as the save is correctly loaded.
https://github.com/PCSX2/pcsx2/issues/6935
Profile name is limited to 12 characters by keyboard. The game displays up to ?32? characters and the profile name can be extended by editing saveX-Y-0000000Z.bin in the PSU savedata file. Extending profile name does not create any buffer overflow. The strings in the center of the saveX-Y-0000000Z.bin file cannot be edited for an unknown reason, else the game loops infinitely on the save data loading screen.


==== Metal Gear Solid 3: Subsistence ====
==== Metal Gear Solid 3: Subsistence ====
Line 301: Line 289:
==== All FIFA games ====
==== All FIFA games ====


FIFA06, FIFA08, FIFA Street 2 are vulnerable on Nintendo DS. See [https://github.com/CTurt/Dara|DARA by CTurt].
Possibly vulnerable FIFA06, FIFA08, FIFA Street 2 are vulnerable on Nintendo DS. See [https://github.com/CTurt/Dara|DARA by CTurt].
 
Moreover, a lot of Electronics Arts games are vulnerable on PSP.
 
==== Psychonauts ====
 
Psychonauts is maybe vulnerable to string overflow although it seems very secure as for now by using fixed-length copy functions:
* Profile name is not vulnerable. It is limited to 8 characters by keyboard and to 10 characters in display.
* Level name is not vulnerable: the game displays a maximum of 127 characters as the level name is memcpied to a 128-byte null-terminated buffer.
* Profile* file must be exactly 64-byte long.
* SavedGame* file must be exactly 245760-byte long.
 
* The only important information stored in the Profile* file is the profile name as the remaining data can be overwritten.
* SavedGame* file format is "\n"-separated with also bars (|) separators. On each line is a setting. Each setting is made of between 1 and three parts separated by bars. Table|<name>|<value>. The name part is mandatory.
* There is a digest check on psu-embedded files as the game says that the "profile is damaged" when the savedata is edited without precaution. Using pypsu by McCaulay, one can extract files contained in the psu, but there are even more digests as any SavedGame* file is detected as "Damaged Save Game" after editing it too much. The SavedGame* files start with a 16-byte MD5 hash of the following data.
 
==== Lego games ====
 
LEGO Star Wars II: The Original Trilogy and LEGO Indiana Jones: The Original Adventures use a custom checksum:
* Offset: FileSize - 4
* Calc. Start: 0
* Calc. Length: FileSize - 4
 
<source lang="csharp">
private int CalculateChecksum(byte[] data) {
    using (var xIO = new MasterIO(data, Endian.Big)) {
        int count = (data.Length / 4) - 1;
        int sum = 0x5C0999;
        for (int i = 0; i < count; ++i)
            sum += xIO.Reader.ReadInt32();
        return sum;
    }
}
</source>
 
LEGO Star Wars may use the same checksum or no checksum at all. LEGO Batman: The Videogame may use the same checksum or the newer checksum:
* Offset: 12
* Calc. Start: 16
* Calc. Length: Filesize - 16
<source lang="csharp">
private int CalculateChecksum(byte[] data, int offset, int size) {
    int sum = -1;
    for (int i = 0; i < size; ++i) {
        sum *= 0x1000193;
        sum ^= data[offset++];
    }
    return ~sum;
}
</source>


==== List of other games ====
==== List of other games ====


See [https://github.com/libretro/LRPS2/blob/main/resources/GameIndex.yaml a list of almost all PS2 games]. Some may be vulnerable.
See [https://github.com/libretro/LRPS2/blob/main/resources/GameIndex.yaml a list of almost all PS2 games]. Some may be vulnerable.
Please note that all contributions to PS2 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS2 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/ps2/Vulnerabilities"