Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 224: Line 224:
===== Save data format =====
===== Save data format =====
* The save data has no digest nor any kind of security.
* The save data has no digest nor any kind of security.
* The records pages data are stored as follows: each track has its own page. Each page contains three categories of records: best total time, best lap time and best KO's count. For each category of record, the three best records are stored as three signed int (4 bytes) for the time/most KO's count, followed by three 21-byte string for the player's name, which must be null-terminated as they are each copied using an unsafe strcpy function.
* The records pages data are stored as follows: for each record, signed int (4 bytes) for the time/most KO's count, followed by 21-byte string for the player's name, which must be null-terminated as it is copied using strcpy.
 
<source lang="C">
typedef struct track_record_struct { // size is 0xEA bytes
  int best_total_time[3];
  char best_total_time_player[3][22];
  int best_lap_time[3];
  char best_lap_time_player[3][22];
  int best_kos_count[3];
  char best_kos_count_player[3][22];
} track_record_struct;
 
typedef struct player_data_struct { // size is 0xD64 bytes
  track_record_struct track_record[13]; // 0xBE2 bytes, default value is fake records by NPC
  uint8_t unk_0xBE2[0x96]; // probably unused
  char player_name[0x2C]; // player name displayed with a 10 chars-limited keyboard when making a new track record, default value is "PLAYER 1"
  uint8_t flags[0xC0]; // probably cheat codes enable status
} player_data_struct;
 
typedef struct BESLES_50366 { // size is 0xF508 bytes
  uint32_t magic; // must be 7
  uint32_t unk_4; // ex: 0x1712
  uint8_t game_data[0xE79C]; // contains strings (maybe filenames) about "songs", at BESLES_50366+0x4A is a bitflag
  player_data_struct player_data; // contains Hall of Fame records, player name and probably cheats status, loaded to 0x61b760 in pcsx2 but may depend on PS2 BIOS
} BESLES_50366;
 
/*
"BESLES-50366.psu" content:
- 62728  BESLES-50366    -> see BESLES_50366 structure
- 964    icon.sys        -> standard PS2 savedata information
- 119000 NORMAL.ICO      -> standard PS2 savedata icon
*/
</source>


===== Bug description =====
===== Bug description =====
Line 276: Line 244:
* $s0 read from $sp -> 4847005A59585756 (bottom), 504F4E4D4C4B4A49 (top)
* $s0 read from $sp -> 4847005A59585756 (bottom), 504F4E4D4C4B4A49 (top)
* It is guessed that at least 0xB7B bytes of the savedata can be overwritten with a MIPS shellcode without breaking the main menu.
* It is guessed that at least 0xB7B bytes of the savedata can be overwritten with a MIPS shellcode without breaking the main menu.
* savedata string address: 0x61b76c in pcsx2 but may depend on PS2 BIOS:
* savedata string address: 0x61b76c in pcsx2 but maybe depends on PS2 BIOS
<source lang="C">
PTR_DAT_00383100 = 0x4339a0;
MAIN_CTX_OFF = 0x2dc;
CTX_PLAYER_DATA_ADDR_OFF = 0x102f0;
main_ctx = *(PTR_DAT_00383100 + MAIN_CTX_OFF) = *(0x4339a0 + 0x2dc) = *0x433c7c; // =(pcsx2)= 0x60b470;
player_data_address = main_ctx + CTX_PLAYER_DATA_ADDR_OFF; // =(pcsx2)= 0x60b470 + 0x102f0 = 0x61B760;
player_data_address = *0x00433C7C + 0x102f0; // in summary
</source>


===== Official cheat codes =====
===== Official cheat codes =====
Please note that all contributions to PS2 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS2 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/ps2/Vulnerabilities"