Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 49: Line 49:
FreeMCBoot allows homebrew programs to be launched without a trigger disc required unlike PS2 Independence.
FreeMCBoot allows homebrew programs to be launched without a trigger disc required unlike PS2 Independence.


This also allows one the use of homebrew on unmodded systems without a functional disc drive. However, installation of the exploit to each individual memory card requires either an already exploited/modded system in order to launch the installer, or boot image that can load an app that loads ELF files (network adapter and hard drive also required). Copying from one memory card to another will not work.
This also allows use of homebrew on unmodded systems without a functional disc drive. However, installation of the exploit to each individual memory card requires either an already exploited/modded system in order to launch the installer, or boot image that can load an app that loads ELF files (network adapter and hard drive also required). Copying from one memory card to another will not work.


It does not work on the very newest PS2s (SCPH-9000x model with BIOS 2.30 and up) but will work on all models prior to that.
It does not work on the very newest PS2s (SCPH-9000x model with BIOS 2.30 and up) but will work on all models prior to that.
Line 89: Line 89:
==== FreeDVDBoot ====
==== FreeDVDBoot ====


An exploit released in 2020 by CTurt, which exploits the DVD Video Player and allows the execution of code (wLaunchElf in the pre-built ISOs). It supports all PS2 slim consoles, including the ones that do not support FreeMCBoot.
An exploit released in 2020 by CTurt, which exploits the DVD Video Player and allows the execution of code (wLaunchElf in the pre-built ISOs). Currently supports all slim consoles, including the ones that don't support FMCB.


==== ESR Vulnerability ====
==== ESR Vulnerability ====


Vulnerability to bypass PS2 disc reader anticopy protection system. Implemented by ffgriever in 2008.
Vulnerability to bypass PS2 disc reader anticopy protection system.


Allows to run burnt CD/DVD of PS2 games on a PS2 without any modchip. It is needed to have FreeMCBoot/FreeHDBoot, Fortuna or SwapMagic in order to launch ESR homebrew.
Allows to run burnt PS2 CD/DVD on a PS2 without modchip. It is needed to have FreeMCBoot/FreeHDBoot, Fortuna or SwapMagic in order to launch ESR.


ESR does not itself yield code-execution, but once you have the ability to load code, you can access content on burned (Video-)DVDs, which have DVD-Video-content. This vulnerability is used in different apps like ESR or Simple Media System and in varying 'formats' like ESR-Discs or simple Video-DVDs with extra-content.
It does not yield code-execution, but once you have the ability to load code, you can access content on burned (Video-)DVDs, which have DVD-Video-content. This vulnerability is used in different apps like ESR or SMS and in varying 'formats' like ESR-Discs or simple Video-DVDs with extra-content.


To use ESR vulnerabilities, two operations are necessary:
===Playstation 2 Linux RTE===
* the burnt CD/DVD inserted in the PS2 must contain ESR-patched content. To patch that content, one can use ESR Disc patcher/unpatcher program by ffgriever.
* the PS2 must execute the ESR homebrew.


Analysis:
====Linux====
* [https://web.archive.org/web/20140704003121/http://psx-scene.com/forums/f164/esr-file-do-i-use-120905/#post1116390 Explanation by ffgriever (2014-01-02)]
* [https://www.ps2-home.com/forum/viewtopic.php?f=10&t=6957 Explanation by Jay-Jay (2016-01-03)]


Implementations:
Todo
* [https://www.ps2-home.com/forum/viewtopic.php?f=10&t=15 ESR homebrew r10f by ffgriever]
* [https://gitlab.com/ffgriever/esr/ ESR homebrew r10f source code by ffgriever]
* [https://www.ps2-home.com/forum/viewtopic.php?f=27&t=9725 ESR Disc patcher/unpatcher by bootsector]
* [https://www.ps2-home.com/forum/download/file.php?id=15475 ESR Disc patcher command line edition v0.2 source code by bootsector]
* [https://www.ps2-home.com/forum/download/file.php?id=15466 ESR Disc patcher/unpatcher JAVA edition v0.2.4 by bootsector]
* [https://www.ps2-home.com/forum/download/file.php?id=15464 ESR Disc patcher/unpatcher GUI for Windows v0.24a by bootsector]
* [https://github.com/jerrys123111/ESRDiscPatcher ESR Disc patcher/unpatcher GUI for Windows source code by bootsector]
* [https://www.ps2-home.com/forum/viewtopic.php?f=10&t=3361 ESRPatcher Pro for Windows Release 07-16-2009 source code by insanity5000]


=== Playstation 2 Linux RTE ===
=Games=


==== Linux ====
==Demo games==


To document
===PS2 Yabasic Exploit===
 
= Games =
 
== Demo games ==
 
=== PS2 Yabasic Exploit ===


Released on 12-10-2019 by CTurt.
Released on 12-10-2019 by CTurt.
Line 135: Line 117:
[https://github.com/CTurt/PS2-Yabasic-Exploit Exploit code by CTurt]
[https://github.com/CTurt/PS2-Yabasic-Exploit Exploit code by CTurt]


== Network games ==
==Network games==
 
It is possible to exploit Network-capable games, to inject codes!!!


It is possible to exploit network-capable games, to inject codes. This is perfect for Slim PS2 and people which can not move files to the MC.
This is perfect for Slim PS2 and people which can not move files to the MC!


TnA scarcely mentioned that method since January 2019, like it can be seen in the comments of @Haldrie's video about the time-swap. TnA got the basic idea from some discoveries someone else mentioned.
TnA scarcely mentioned that method since January 2019, like it can be seen in the comments of @Haldrie's video about the time-swap! TnA got the basic idea from some discoveries someone else mentioned.


The problem is to either inject it elsewhere, or find a way to run it.
The problem is to either inject it elsewhere, or find a way to run it!


== PS1 Savedata exploits ==
==PS1 Savedata exploits==


The existing FreePSXBoot exploit chain for PS1 does not work on the PS2 (mainly inside mcman), due to the fact that the internal structure is different.
The existing FreePSXBoot exploit chain does not work on the PS2 (mainly inside mcman), due to the fact that the internal structure is different.


In mcman, there is no bounds check on linked_block member access relative to arrays on stack: https://github.com/ps2dev/ps2sdk/blob/d976e57349645cb940a9e0f9ec0207c16472ca2c/iop/memorycard/mcman/src/main.c#L3041-L3072
In mcman, there is no bounds check on linked_block member access relative to arrays on stack: https://github.com/ps2dev/ps2sdk/blob/d976e57349645cb940a9e0f9ec0207c16472ca2c/iop/memorycard/mcman/src/main.c#L3041-L3072
Line 157: Line 141:
See [https://psdevwiki.com/ps1/index.php?title=Vulnerabilities PS1 Dev Wiki Vulnerabilities].
See [https://psdevwiki.com/ps1/index.php?title=Vulnerabilities PS1 Dev Wiki Vulnerabilities].


=== BOOT.ELF (Fat PS2 consoles only) ===
===BOOT.ELF (Fat consoles only)===
 
[https://sksapps.haldrie.com/bootleg/tutorials/fmcb/armax2.php Official sp193 guide (backup)]
[https://sksapps.haldrie.com/bootleg/tutorials/fmcb/armax2.php Official sp193 guide (backup)]


Line 170: Line 153:
!Vulnerability
!Vulnerability
!Description
!Description
!Patched
!Revisions
!Date of discovery
!Date of discovery
!Discovered/exploited by
!Discovered by
|-
|-
|Carol Vorderman's Sudoku
|Carol Vorderman's Sudoku
|Stack Buffer Overflow via unchecked string length
|Stack Buffer Overflow via unchecked string length
|The save data file stores plaintext profile and high-score names. One can use a large string to overwrite the stack and jump to unsigned code.
|The savefile stores plaintext profile & highscore names. There are no checks regarding the size-length of the profile & highscore names. Once can use a very large string to overwrite and gain control of the stack and jump to unsigned code.
This vulnerability is also present in the PSP version of the game. See the [https://github.com/ChampionLeake/SudokuSTACK PSP exploit].
This vulnerability was ported over to the PSP version of the game. See [https://github.com/ChampionLeake/SudokuSTACK here]
|No
|N/A
|December 2021 (2011-01-06 for PSP)
|December 2021
|ChampionLeake for PS2, Jeerum for PSP
|ChampionLeake
|-
|Star Wars Racer Revenge
|Stack-Smash via unchecked "Record Name" length
|The game allows players record their names when breaking lap records on a course. However, the size of the name is not checked. Using a very large name can overwrite addresses on the stack and gain control of the $ra, which can be used to jump to unsigned code.
|N/A
|August 2023
|ChampionLeake
|-
|-
|OKAGE: Shadow King
|OKAGE: Shadow King
|Stack Buffer Overflow via unchecked "Player/Town" name length
|Stack Buffer Oveflow via unchecked "Player/Town" name length
|Successfully exploit through mast1c0re for the PS4/PS5.
|Successfully exploit through mast1c0re for the PS4/PS5.
CTurt's Writeup: [https://cturt.github.io/mast1c0re.html Here]
CTurt's Writeup: [https://cturt.github.io/mast1c0re.html Here]
McCaulay's Writeup: [https://mccaulay.co.uk/mast1c0re-introduction-exploiting-the-ps4-and-ps5-through-a-gamesave/?t=1 Here]
McCaulay's Writeup: [https://mccaulay.co.uk/mast1c0re-introduction-exploiting-the-ps4-and-ps5-through-a-gamesave/?t=1 Here]
|No
|N/A
|September 14th, 2022
|September 14th, 2022
|CTurt & McCaulay
|CTurt & McCaulay
|-
|Star Wars Racer Revenge
|Stack-Smash via unchecked "Record Name" length
|The game allows players to record their names when breaking lap records on a course. However when displaying the Hall of Fame, the size of the names are not checked. Using a very large name can overwrite addresses on the stack and gain control of $ra, which can be used to jump to unsigned code.
|No
|August 2023
|ChampionLeake
|-
|GTA III and GTA Vice City Stories
|Stack Buffer Overflow via unchecked savedata size
|The game does a copy from the memory card into a fixed-size buffer with size supplied by the save data file.
[https://github.com/halpz/re3/blob/9a7fa478578beaba947ea867c15a25e411d641d8/src/save/MemoryCard.cpp#L358 Bug in GTA III]
[https://github.com/halpz/re3/blob/37e9ec0d19cbd3cd25823089380fcdae558bee0b/src/save/MemoryCard.cpp#L363 Bug in GTA VCS]
[https://cturt.github.io/mast1c0re.html CTurt's writeup]
|Maybe in PSP version of GTA VCS and in GTA LCS PSP
|June 27th, 2020
|re3 decompilation project then CTurt
|-
|Jak X: Combat Racing (PAL and NTSC, PAL has more symbols)
|Custom code injection via patch.bin file
|By injecting a file named patch.bin in the savedata folder, this file gets loaded and executed by the game.
|Maybe in Greatest Hits/Platinum release
|September 26th, 2024
|CelesteBlue
|}
|}


=== Confirmed vulnerable games ===
=== Confirmed vulnerable games ===
==== Carol Vorderman's Sudoku ====
TODO


==== OKAGE: Shadow King ====
==== OKAGE: Shadow King ====
Line 236: Line 198:
===== Bug Description =====
===== Bug Description =====
Okage Shadow King has a typical stack buffer overflow if you extend the player or town name in a savedata.
Okage Shadow King has a typical stack buffer overflow if you extend the player or town name in a savedata.
* The save data has a CRC digest.


===== Exploit Implementation =====
===== Exploit Implementation =====
Line 244: Line 205:


===== Save data format =====
===== Save data format =====
* The save data has no digest nor any kind of security.
* The save data has no digest. Strings can be modified and extended without making any crash.
* The records pages data are stored as follows: each track has its own page. Each page contains three categories of records: best total time, best lap time and best KO's count. For each category of record, the three best records are stored as three signed int (4 bytes) for the time/most KO's count, followed by three 21-byte string for the player's name, which must be null-terminated as they are each copied using an unsafe strcpy function.
* The records pages data are stored as follows: for each record, signed int (4 bytes) for the time/most KO's, followed by ?22?-byte string.
 
<source lang="C">
typedef struct track_record_struct { // size is 0xEA bytes
  int best_total_time[3];
  char best_total_time_player[3][22];
  int best_lap_time[3];
  char best_lap_time_player[3][22];
  int best_kos_count[3];
  char best_kos_count_player[3][22];
} track_record_struct;
 
typedef struct player_data_struct { // size is 0xD64 bytes
  track_record_struct track_record[13]; // 0xBE2 bytes, default value is fake records by NPC
  uint8_t unk_0xBE2[0x96]; // probably unused
  char player_name[0x2C]; // player name displayed with a 10 chars-limited keyboard when making a new track record, default value is "PLAYER 1"
  uint8_t flags[0xC0]; // probably cheat codes enable status
} player_data_struct;
 
typedef struct BESLES_50366 { // size is 0xF508 bytes
  uint32_t magic; // must be 7
  uint32_t unk_4; // ex: 0x1712
  uint8_t game_data[0xE79C]; // contains strings (maybe filenames) about "songs", at BESLES_50366+0x4A is a bitflag
  player_data_struct player_data; // contains Hall of Fame records, player name and probably cheats status, loaded to 0x61b760 in pcsx2 but may depend on PS2 BIOS
} BESLES_50366;
 
/*
"BESLES-50366.psu" content:
- 62728  BESLES-50366    -> see BESLES_50366 structure
- 964    icon.sys        -> standard PS2 savedata information
- 119000 NORMAL.ICO      -> standard PS2 savedata icon
*/
</source>


===== Bug description =====
===== Bug description =====
Star Wars Racer Revenge has a typical stack buffer overflow if you extend a player name in a savedata.
* To trigger the exploit, in the main menu, go to Options then Hall of Fame. The Hall of Fame will trigger the exploit when you go to the page where the player name was extended in save data to more than 256 characters as the code copies from save data the best players' names without checking length.
* To trigger the exploit, in the main menu, go to Options then Hall of Fame. The Hall of Fame will trigger the exploit when you go to the page where the player name was extended in save data to more than 256 characters as the code copies from save data the best players' names without checking length.
* Player name max length allowed when breaking a record: 10 characters as the keyboard gets disabled
* Player name max length allowed when breaking a record: 10 characters as the keyboard gets disabled
** Player name is registered in save data the first time that you make a new record but it seems not used at all.
** Player name is registered in save data the first time that you make a new record but it seems not used at all.
* Player name max length displayed in the record page: 21 characters as it is done a sort of "memcpy(src, dst, 21)" in a 22-byte null buffer.
* Player name max length displayed in the record page: 21 characters as it is done a sort of "memcpy(src, dst, 21)" in a 22-byte buffer
** 9 player names are displayed on each Hall of Fame page, stored temporarily in memory respectively at addresses: 0xF98B20, 0xFADB60, 0xFB29D0, 0xFB4E00, 0xFB7210, 0xFB9640, 0xFBBA50, 0xFBDE80, 0xCCE320
** 9 player names are displayed on each Hall of Fame page, stored temporarily in memory respectively at addresses: 0xF98B20, 0xFADB60, 0xFB29D0, 0xFB4E00, 0xFB7210, 0xFB9640, 0xFBBA50, 0xFBDE80, 0xCCE320
* buffer size: expected to be 256 bytes from tests (nothing happens when length is 256 characters followed by a zero byte)
* buffer size: expected to be 256 bytes from tests (nothing happens when length is 256 characters followed by a zero byte)
Line 290: Line 218:
* latest valid $ra: 0x1E4048
* latest valid $ra: 0x1E4048
* latest valid $pc: 0x1E4050 (jl ra) -> crash when executed so put breakpoint at 0x1E4050
* latest valid $pc: 0x1E4050 (jl ra) -> crash when executed so put breakpoint at 0x1E4050
* $s0 to restore: ?0000000000FF1280? (to dump with valid savedata and bkpt at 1E4048)
* current savedata payload: 256 non-null bytes then 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 00 00 00 00 00 00
* $r0 to restore: ? (to dump with valid savedata and bkpt at 1E4048)
* $ra -> 5857565554535251 (bottom), 0000000000005A59 (top)
* current savedata payload in PSU file: at offset 0xefb0 256 characters then <code>41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 00 00 00 00 00 00</code>
* $s0 -> 4847005A59585756 (bottom), 504F4E4D4C4B4A49 (top)
* $sp: 01F7F790
* savedata string address: 0x61b76c in pcsx2 but maybe depends on PS2 BIOS
* $ra read from $sp+0x10 -> 5857565554535251 (bottom), 0000000000005A59 (top)
* $s0 read from $sp -> 4847005A59585756 (bottom), 504F4E4D4C4B4A49 (top)
* It is guessed that at least 0xB7B bytes of the savedata can be overwritten with a MIPS shellcode without breaking the main menu.
* savedata string address: 0x61b76c in pcsx2 but may depend on PS2 BIOS:
<source lang="C">
PTR_DAT_00383100 = 0x4339a0;
MAIN_CTX_OFF = 0x2dc;
CTX_PLAYER_DATA_ADDR_OFF = 0x102f0;
main_ctx = *(PTR_DAT_00383100 + MAIN_CTX_OFF) = *(0x4339a0 + 0x2dc) = *0x433c7c; // =(pcsx2)= 0x60b470;
player_data_address = main_ctx + CTX_PLAYER_DATA_ADDR_OFF; // =(pcsx2)= 0x60b470 + 0x102f0 = 0x61B760;
player_data_address = *0x00433C7C + 0x102f0; // in summary
</source>


===== Official cheat codes =====
===== Official cheat codes =====
* It might be useful to unlock more tracks in order to have more possibilities to trigger the buffer overflow in the records menu.
* It might be useful to unlock more tracks in order to have more possibilities to trigger the buffer overflow in the records menu.
* To enable cheat codes, it is often forgotten in guides that you have to make a new record, then type "NO TIME" as player name. This has to be done only once as it is stored in save data. Then at the main menu, hold R1, R2, L1 and L2 while you press successively the following cheat combos. The cheats remain in save data but some can be disabled at wish. The following cheat codes were found by looking at the debug strings of the binary files:
* To enable cheat codes, it is often forgotten in guides that you have to make a new record, then type "NO TIME" as player name. This has to be done only once as it is stored in save data. Then at the main menu, hold R1, R2, L1 and L2 while you press succesively the following cheat combos. The cheats remain in save data but some can be disabled at wish. The following cheat codes were found by looking at the debug strings of the binary files:
** No Player Damage Cheat ON/OFF: uuddlrlrscsc ON/OFF -> up, up, down, down, left, right, left, right, square, circle, square, circle
** No Player Damage Cheat ON/OFF: uuddlrlrscsc ON/OFF -> up, up, down, down, left, right, left, right, square, circle, square, circle
** (NOT CONFIRMED) No Player Overheat Cheat ON/OFF: balrefsc -> ?ba?, left, right, ?ef?, square, circle.
** (NOT CONFIRMED) No Player Overheat Cheat ON/OFF: balrefsc -> ?ba?, left, right, ?ef?, square, circle.
Line 320: Line 236:
* When using a save data that was badly hand-modified to unlock every characters and circuits, a bug can occur in the record page: only one of the pages can be accessed. Pressing left or right to change track page makes sound but remains on this page.
* When using a save data that was badly hand-modified to unlock every characters and circuits, a bug can occur in the record page: only one of the pages can be accessed. Pressing left or right to change track page makes sound but remains on this page.


==== GTA III and GTA Vice City Stories ====
==== GTA III ====


* [https://github.com/halpz/re3/blob/9a7fa478578beaba947ea867c15a25e411d641d8/src/save/MemoryCard.cpp#L358 vulnerability]
* [https://github.com/halpz/re3/blob/9a7fa478578beaba947ea867c15a25e411d641d8/src/save/MemoryCard.cpp#L358 vulnerability]
Line 326: Line 242:
The game does a copy from the memory card into a fixed-size buffer with size supplied by the savedata.
The game does a copy from the memory card into a fixed-size buffer with size supplied by the savedata.


==== Jak X: Combat Racing ====
==== Dark Cloud ====
 
See also [https://jakanddaxter.fandom.com/wiki/Bugs Jak and Daxter games bugs on jakanddaxter.fandom.com].


===== Custom code injection via patch.bin file =====
* [https://www.youtube.com/results?search_query=%22dark+cloud%22+item+glitch+menu+before%3A2008-01-01 video of bug triggering]


The game savedata contains a file named patch.bin whose aim is to be loaded at address 0x00C00000 then executed. There is no protection except a CRC32 checksum (with 0xEDB88320 polynomial) and a sort of obfuscated (yet to be understood) format for the patch data. CelesteBlue's hypothesis are:
Moving the cursor and pressing X on the same frame in the items menu allows us to pick up an item from out-of-bounds memory, which results in exploitable behaviour.
* some simple but undocumented obfuscation (xor, byte swap, etc.)
* some compression (LZO/miniLZO as in DGO/CGO files, ...)
* some encryption (des/des_ede/desx/rc2/rc5/rc5_64/rc6/gencrypt algorithm with cbc/ecb/cbc_interleaved/cfb/cfb_pipelined/ofb/ofb_pipelined mode and nopad/pad/stream choice of padding)
* some [[DNAS]] check by connecting to SCE remote servers
 
The patch.bin file must contain a little-endian header of 16 bytes followed by patch data of arbitrary size.
 
<source lang="C">
typedef struct jakx_patch_bin_hdr { // size is 0x10 bytes
  uint32_t magic;
  uint32_t digest; // crc32 of data
  uint32_t unk; // maybe unused
  uint32_t size; // equals patch.bin size minus header size
} jakx_patch_bin_hdr;
 
typedef struct jakx_patch_bin { // size is (0x10 + size) bytes
  jakx_patch_bin_hdr header;
  char data[size];
} jakx_patch_bin;
</source>
 
===== Corruption after game autosaving =====
 
There is a bug with the autosave feature in Jak X that corrupts save data on memory card. It was fixed in the Platinum / Greatest Hits versions of the game.
 
https://gamefaqs.gamespot.com/boards/927166-jak-x-combat-racing/41999721
 
===== Infinite loop after game saving =====
 
There is a bug, at least in PCSX2, where when starting the game for the first time and creating a new profile, the game freezes on the memory card saving screen after saving data. The save data is however well written and on next tries the game can be played as the save is correctly loaded.
 
The same bug can be triggered by going to the Profile settings and selecting "Save game". After saving, the game freezes as it enters an infinite loop (in R59000 at $pc address 0x81FC0 on PAL and NTSC Greatest Hits and in R3000 at $pc address 0xBE9C). CelesteBlue's hypothesis is that during the game initialization, the game open files from the memory card (for example patch.bin at address 0x00100884 on PAL), but closes the fd only if some condition are met, which by default are not as the patch.bin file is invalid.
 
https://github.com/PCSX2/pcsx2/issues/6935
 
The NTSX Greatest Hits version of Jak X does not fix this problem.
 
===== Strings overflow =====
 
Profile name is limited to 12 characters by keyboard. The game displays up to ?32? characters and the profile name can be extended by editing saveX-Y-0000000Z.bin in the PSU savedata file. Extending profile name does not create any buffer overflow. The strings in the center of the saveX-Y-0000000Z.bin file cannot be edited for an unknown reason, else the game loops infinitely on the save data loading screen.
 
==== Dark Cloud 1 and 2 ====
 
* [https://www.youtube.com/results?search_query=%22dark+cloud%22+item+glitch+menu+before%3A2008-01-01 videos of bug triggering]
* [https://www.youtube.com/watch?v=Pezh533eSZk video of freeze in Dark Cloud 1]
* [https://www.youtube.com/watch?v=FTUgv1H18q8 money/stats glitch in Dark Cloud 1]
* [https://www.youtube.com/watch?v=lKtntYfHzZ8 full demonstration video of glitch in Dark Cloud 1]
* [https://www.youtube.com/watch?v=1qS6XWKSWpI complete video explaining how integer overflow works and how to enable debug menu in Dark Cloud 2]
* [https://www.youtube.com/watch?v=5d1EIMc4c3k Fastest way to enable debug menu in Dark Cloud 2 NTSC on PS5]
* [https://www.youtube.com/watch?v=VbKljNM6v-0 Slow way to enable debug menu in Dark Cloud 2 NTSC]
* [https://www.youtube.com/watch?v=Jz97TTW4IhI debug menu showcase in Dark Cloud 2]
 
Moving the cursor and pressing X on the same frame in the items menu allows us to pick up an item from out-of-bounds memory, which results in an exploitable behaviour. This integer overflow leads to infinite money, statistics, duplicate items, enable debug menu (in Dark Cloud 2), or to game freeze according to the context. However, even in case of game freeze, from an exploitation point of view, this integer overflow may not be controllable enough to specify a specific address to jump to.
 
The overflow bug can be removed by simply changing one byte in the game's binary file.
 
The debug menu in Dark Cloud 2 might be vulnerable to $ra overwrite. The debug menu features are detailed [https://tcrf.net/Dark_Cloud_2/Debug_Menu#Main_Debug_Menu here].
 
Dark Cloud 2 uses a scripting engine described [https://tcrf.net/User:Kojin/Dark_Cloud_2_Technical_Information#Scripting_Engine here].
 
=== Possible vulnerable games ===


==== Soul Calibur III ====
==== Soul Calibur III ====
Line 400: Line 253:


https://gamefaqs.gamespot.com/boards/915821-playstation-2/79857492?page=3
https://gamefaqs.gamespot.com/boards/915821-playstation-2/79857492?page=3
https://gamefaqs.gamespot.com/ps2/927089-soulcalibur-iii/faqs/40424
https://gamefaqs.gamespot.com/boards/927089-soulcalibur-iii/24774951
https://www.reddit.com/r/SoulCalibur/comments/uqiff7/is_the_soulcalibur_iii_save_corruption_glitch/


==== Viewtiful Joe 2 demo on the NTSC U/C region 2004 Holiday Demo Disc ====
==== Viewtiful Joe 2 demo on the NTSC U/C region 2004 Holiday Demo Disc ====
Line 410: Line 260:
https://gamefaqs.gamespot.com/boards/915821-playstation-2/79857492?page=3
https://gamefaqs.gamespot.com/boards/915821-playstation-2/79857492?page=3


==== Metal Gear Solid 3: Subsistence ====
=== Possible vulnerable games ===
 
There is bug with the PCSX2 emulator and MGS3: Subsistence that causes save files to become corrupt. While the exact cause of this issue is unknown, anyone using the PCSX2 emulaor with the saves below should wait a few seconds after accessing the memory to save the game and use the US BIOS. This seems to greatly reduce the likelihood of the bug corrupting the file. Also, do not save MGS3 on a memory card file that has a lot of other saves, because the bug corrupts the entire memory card.
 
https://retromaggedon.com/index.php/metal-gear-solid-3-subsistence-save-files-ps2/


==== World War Zero Iron Storm ====
==== World War Zero Iron Storm ====
Line 431: Line 277:
==== All FIFA games ====
==== All FIFA games ====


FIFA06, FIFA08, FIFA Street 2 are vulnerable on Nintendo DS. See [https://github.com/CTurt/Dara DARA by CTurt].
Possibly vulnerable FIFA06, FIFA08, FIFA Street 2 are vulnerable on Nintendo DS. See [https://github.com/CTurt/Dara|DARA by CTurt].
 
Moreover, a lot of Electronics Arts games are vulnerable on PSP.
 
==== Psychonauts ====
 
Psychonauts is maybe vulnerable to string overflow although it seems very secure as for now by using fixed-length copy functions:
* Profile name is not vulnerable. It is limited to 8 characters by keyboard and to 10 characters in display.
* Level name is not vulnerable: the game displays a maximum of 127 characters as the level name is memcpied to a 128-byte null-terminated buffer.
* Profile* file must be exactly 64-byte long.
* SavedGame* file must be exactly 245760-byte long.
 
* The only important information stored in the Profile* file is the profile name as the remaining data can be overwritten.
* SavedGame* file format is "\n"-separated with also bars (|) separators. On each line is a setting. Each setting is made of between 1 and three parts separated by bars. Table|<name>|<value>. The name part is mandatory.
* There is a digest check on psu-embedded files as the game says that the "profile is damaged" when the savedata is edited without precaution. Using pypsu by McCaulay, one can extract files contained in the psu, but there are even more digests as any SavedGame* file is detected as "Damaged Save Game" after editing it too much. The SavedGame* files start with a 16-byte MD5 hash of the following data.
 
==== Lego games ====
 
LEGO Star Wars II: The Original Trilogy and LEGO Indiana Jones: The Original Adventures use a custom checksum:
* Offset: FileSize - 4
* Calc. Start: 0
* Calc. Length: FileSize - 4
 
<source lang="csharp">
private int CalculateChecksum(byte[] data) {
    using (var xIO = new MasterIO(data, Endian.Big)) {
        int count = (data.Length / 4) - 1;
        int sum = 0x5C0999;
        for (int i = 0; i < count; ++i)
            sum += xIO.Reader.ReadInt32();
        return sum;
    }
}
</source>
 
LEGO Star Wars may use the same checksum or no checksum at all. LEGO Batman: The Videogame may use the same checksum or the newer checksum:
* Offset: 12
* Calc. Start: 16
* Calc. Length: Filesize - 16
<source lang="csharp">
private int CalculateChecksum(byte[] data, int offset, int size) {
    int sum = -1;
    for (int i = 0; i < size; ++i) {
        sum *= 0x1000193;
        sum ^= data[offset++];
    }
    return ~sum;
}
</source>


==== List of other games ====
==== List of other games ====


See [https://github.com/libretro/LRPS2/blob/main/resources/GameIndex.yaml a list of almost all PS2 games]. Some may be vulnerable.
See [https://github.com/libretro/LRPS2/blob/main/resources/GameIndex.yaml a list of almost all PS2 games]. Some may be vulnerable.
Please note that all contributions to PS2 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS2 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/ps2/Vulnerabilities"