Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 327: Line 327:


==== Jak X: Combat Racing ====
==== Jak X: Combat Racing ====
See also [https://jakanddaxter.fandom.com/wiki/Bugs Jak and Daxter games bugs on jakanddaxter.fandom.com].


===== Custom code injection via patch.bin file =====
===== Custom code injection via patch.bin file =====


The game savedata contains a file named patch.bin whose aim is to be loaded at address 0x00C00000 then executed. There is no protection except a CRC32 checksum (with 0xEDB88320 polynomial) and a sort of obfuscated (yet to be understood) format for the patch data. CelesteBlue's hypothesis are:
The game savedata contains a file named patch.bin whose aim is to be loaded at address 0x00C00000 then executed. There is no protection except a CRC32 checksum (with 0xEDB88320 polynomial) and a sort of obfuscated (yet to be understood) format for the patch data.
* some simple but undocumented obfuscation (xor, byte swap, etc.)
* some compression (LZO/miniLZO as in DGO/CGO files, ...)
* some encryption (des/des_ede/desx/rc2/rc5/rc5_64/rc6/gencrypt algorithm with cbc/ecb/cbc_interleaved/cfb/cfb_pipelined/ofb/ofb_pipelined mode and nopad/pad/stream choice of padding)
* some [[DNAS]] check by connecting to SCE remote servers


The patch.bin file must contain a little-endian header of 16 bytes followed by patch data of arbitrary size.
The patch.bin file must contain a little-endian header of 16 bytes followed by patch data of arbitrary size.
Line 354: Line 348:
</source>
</source>


===== Corruption after game autosaving =====
===== Infinite loop or corruption after game saving =====


There is a bug with the autosave feature in Jak X that corrupts save data on memory card. It was fixed in the Platinum / Greatest Hits versions of the game.
There is a bug with the autosave feature that corrupts save data on memory card. It was fixed in the Platinum (Greatest Hits) version of the game.


https://gamefaqs.gamespot.com/boards/927166-jak-x-combat-racing/41999721
https://gamefaqs.gamespot.com/boards/927166-jak-x-combat-racing/41999721


===== Infinite loop after game saving =====
There is a bug, at least in PCSX2, where when starting the game for the first time and creating a new profile, the game freezes on the memory card saving screen after saving data. The save data is however well written and on next tries the game can be played as the save is correctly loaded. The same bug can be triggered by going to the Profile settings and selecting "Save game". After saving, the game freezes as it enters an infinite loop (at $pc address 0x81FC0 on PAL). CelesteBlue's hypothesis on the cause is that during the game initialization, the game open files from the memory card (for example patch.bin at address 0x00100884 on PAL), but closes the fd only if some condition are met, which by default are not as the patch.bin file is invalid.
 
There is a bug, at least in PCSX2, where when starting the game for the first time and creating a new profile, the game freezes on the memory card saving screen after saving data. The save data is however well written and on next tries the game can be played as the save is correctly loaded.
 
The same bug can be triggered by going to the Profile settings and selecting "Save game". After saving, the game freezes as it enters an infinite loop (in R59000 at $pc address 0x81FC0 on PAL and NTSC Greatest Hits and in R3000 at $pc address 0xBE9C). CelesteBlue's hypothesis is that during the game initialization, the game open files from the memory card (for example patch.bin at address 0x00100884 on PAL), but closes the fd only if some condition are met, which by default are not as the patch.bin file is invalid.


https://github.com/PCSX2/pcsx2/issues/6935
https://github.com/PCSX2/pcsx2/issues/6935
The NTSX Greatest Hits version of Jak X does not fix this problem.


===== Strings overflow =====
===== Strings overflow =====
Line 431: Line 419:
==== All FIFA games ====
==== All FIFA games ====


FIFA06, FIFA08, FIFA Street 2 are vulnerable on Nintendo DS. See [https://github.com/CTurt/Dara DARA by CTurt].
FIFA06, FIFA08, FIFA Street 2 are vulnerable on Nintendo DS. See [https://github.com/CTurt/Dara|DARA by CTurt].


Moreover, a lot of Electronics Arts games are vulnerable on PSP.
Moreover, a lot of Electronics Arts games are vulnerable on PSP.
Please note that all contributions to PS2 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS2 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)