Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 220: | Line 220: | ||
* latest valid $ra: 0x1E4048 | * latest valid $ra: 0x1E4048 | ||
* latest valid $pc: 0x1E4050 (jl ra) -> crash when executed so put breakpoint at 0x1E4050 | * latest valid $pc: 0x1E4050 (jl ra) -> crash when executed so put breakpoint at 0x1E4050 | ||
* current savedata payload: 256 non-null bytes then 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 00 00 00 00 00 00 | |||
* $ra -> 5857565554535251 (bottom), 0000000000005A59 (top) | |||
* current savedata payload | * $s0 -> 4847005A59585756 (bottom), 504F4E4D4C4B4A49 (top) | ||
* $ra | |||
* $s0 | |||
* It is guessed that at least 0xB7B bytes of the savedata can be overwritten with a MIPS shellcode without breaking the main menu. | * It is guessed that at least 0xB7B bytes of the savedata can be overwritten with a MIPS shellcode without breaking the main menu. | ||
* savedata string address: 0x61b76c in pcsx2 but maybe depends on PS2 BIOS | * savedata string address: 0x61b76c in pcsx2 but maybe depends on PS2 BIOS | ||
Line 248: | Line 245: | ||
The game does a copy from the memory card into a fixed-size buffer with size supplied by the savedata. | The game does a copy from the memory card into a fixed-size buffer with size supplied by the savedata. | ||
==== Dark Cloud | ==== Dark Cloud ==== | ||
* [https://www.youtube.com/results?search_query=%22dark+cloud%22+item+glitch+menu+before%3A2008-01-01 | * [https://www.youtube.com/results?search_query=%22dark+cloud%22+item+glitch+menu+before%3A2008-01-01 video of bug triggering] | ||
Moving the cursor and pressing X on the same frame in the items menu allows us to pick up an item from out-of-bounds memory, which results in | Moving the cursor and pressing X on the same frame in the items menu allows us to pick up an item from out-of-bounds memory, which results in exploitable behaviour. | ||
==== Soul Calibur III ==== | ==== Soul Calibur III ==== |