Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 89: Line 89:
=== Before PS Vita era ===
=== Before PS Vita era ===


==== Grand Theft Auto: Liberty City Stories UMD (and the Goofy exploit): PSP 2.00-3.03. Patched 3.30 ====
==== Grand Theft Auto: Liberty City Stories UMD (Goofy exploit): PSP 2.00-3.03. Patched 3.30 ====


Discovered by Edison Carter, Fanjita and n00bz in 2006.
Discovered by Edison Carter.


There is a stack buffer overflow in the savedata processing of GTA LCS. In essence, the savedata mostly consists of a large structure, with an element indicating the total size. GTA LCS allocates a statically-sized buffer for this to be read into, on the stack - presumably using sizeof(savestruct) or similar. But it copies the number of bytes given by the .size element from the savedata into the stack buffer. By editing the .size element in the saved data, we can therefore force a buffer overflow. The .size element is at offset 0004 in the DATA.BIN file, in the savedata folder. Note that the DATA.BIN is encrypted, so you need to use something like the savedata sample from the pspsdk in order to modify it.
The GTA LCS exploit is a classic stack buffer overflow, in the savedata processing. In essence, the savedata mostly consists of a large structure, with an element indicating the total size. GTA LCS allocates a statically-sized buffer for this to be read into, on the stack - presumably using sizeof(savestruct) or similar. But it copies the number of bytes given by the .size element from the savedata into the stack buffer. By editing the .size element in the saved data, we can therefore force a buffer overflow. The .size element is at offset 0004 in the DATA.BIN file, in the savedata folder. Note that the DATA.BIN is encrypted, so you need to use something like the savedata sample from the pspsdk in order to modify it.


Sony quickly patched this vulnerability with a firmware update, and released a "new" version of the game that required to install the patched System Software. People wanting to hack their PSP had to be careful not to buy an updated version of the UMD. This is the only time in the PSP history that an exploited game got a UMD update.
The Exploit was patched in a second batch of UMD prints.


Germany version:
Germany version:
Line 113: Line 113:


Another indication is the copyright date: if it is 2005 then it is unpatched, else it is 2006 and is patched.
Another indication is the copyright date: if it is 2005 then it is unpatched, else it is 2006 and is patched.
This vulnerability got reused a second time by Noobz on 2007-01-25, in what was called the Goofy exploit, as it was discovered that Sony had incorrectly patched the vulnerability.
https://web.archive.org/web/20081212045551/http://www.noobz.eu/joomla/news/sony-goofed-again-hello-world-on-all-v2.0-3.03-firmwares.html


==== Lumines (Illuminati exploit): PSP <= 3.50. Patched 3.51 ====
==== Lumines (Illuminati exploit): PSP <= 3.50. Patched 3.51 ====


On 2007-06-23, Noobz, with the help of Archaemic, found an exploit in the game Lumines. Called illuminati, the exploit was apparently found by pure luck, when Archaemic was trying to feed random data to the game.
==== Gripshift by Matiaz: PSP <= 5.02?-5.03?. Patched 5.05 ====
 
https://web.archive.org/web/20080115210003/http://www.noobz.eu/joomla/news/beware-of-the-illuminati.html
 
==== Gripshift by MaTiaZ: PSP <= 5.02?-5.03?. Patched 5.05 ====
 
* released by MaTiaZ on 2009-01-01.
 
There is a buffer overflow vulnerability in the player’s name, by editing the game’s save data.
 
https://web.archive.org/web/20090121190410/https://lan.st/showthread.php?t=1867
 
==== Medal Of Honor Heroes by kgsws: PSP <=?5.51? ====
 
* first version (requires connection between 2 PSPs) of the exploit for Medal of Honor Heroes (ULUS-10141) released by kgsws on 2009-07-06
* second version (does not require online) of the exploit for Medal of Honor Heroes (ULUS-10141) released by kgsws on 2009-07-09
* Medal Of Honor Heroes 2 is maybe affected too.
 
https://www.youtube.com/watch?v=VqTjvtfCnXc
 
https://wololo.net/2009/07/10/medal-of-honor-heroes-the-coolest-exploit-ever/
 
https://www.brewology.com/downloads/download.php?id=9900
 
https://www.dcemu.co.uk/vbulletin/threads/223571-New-Exploit-MOHH-(Medal-of-Honor-Heroes)-THIS-VERSION-DOESN-T-WORK
 
https://www.dcemu.co.uk/vbulletin/threads/224663-Medal-of-Honor-Heroes-(MOHH)-second-exploit
 
https://forums.exophase.com/threads/new-psp-homebrew-medal-of-honor-heroes-exploit-v2.17461/


==== Patapon 2 demo (USA) by Malloxis: PSP <= ?6.20? ====
==== Patapon 2 demo (USA) by Malloxis: PSP <= ?6.20? ====


https://wololo.net/talk/viewtopic.php?f=3&t=51
https://wololo.net/talk/viewtopic.php?f=3&t=51
https://wololo.net/2010/03/29/way-to-keep-a-secret-malloxis/


==== Everybody's Golf and variants: PSP <=?6.31? ====
==== Everybody's Golf and variants: PSP <=?6.31? ====
Line 192: Line 158:
* [https://github.com/ChampionLeake/SudokuSTACK implementation by ChampionLeake (2019-04-22)]
* [https://github.com/ChampionLeake/SudokuSTACK implementation by ChampionLeake (2019-04-22)]
* The PS2 version of this game is also vulnerable.
* The PS2 version of this game is also vulnerable.
==== Medal Of Honor Heroes by kgsws: PSP <=?5.51? ====
* first version (requires connection between 2 PSPs) of the exploit for Medal of Honor Heroes (ULUS-10141) released by kgsws on 2009-07-06
* second version (does not require online) of the exploit for Medal of Honor Heroes (ULUS-10141) released by kgsws on 2009-07-09
* Medal Of Honor Heroes 2 is maybe affected too.
https://www.youtube.com/watch?v=VqTjvtfCnXc
https://wololo.net/2009/07/10/medal-of-honor-heroes-the-coolest-exploit-ever/
https://www.brewology.com/downloads/download.php?id=9900
https://www.dcemu.co.uk/vbulletin/threads/223571-New-Exploit-MOHH-(Medal-of-Honor-Heroes)-THIS-VERSION-DOESN-T-WORK
https://www.dcemu.co.uk/vbulletin/threads/224663-Medal-of-Honor-Heroes-(MOHH)-second-exploit
https://forums.exophase.com/threads/new-psp-homebrew-medal-of-honor-heroes-exploit-v2.17461/


=== During PS Vita era ===
=== During PS Vita era ===
Please note that all contributions to PSP Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PSP Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)