Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 20: | Line 20: | ||
== PSP Game Savedata == | == PSP Game Savedata == | ||
=== Before PS Vita era === | === Before PS Vita era === | ||
==== Grand Theft Auto: Liberty City Stories UMD ( | ==== Grand Theft Auto: Liberty City Stories UMD (Goofy exploit): PSP 2.00-3.03. Patched 3.30 ==== | ||
Discovered by Edison Carter | Discovered by Edison Carter. | ||
The GTA LCS exploit is a classic stack buffer overflow, in the savedata processing. In essence, the savedata mostly consists of a large structure, with an element indicating the total size. GTA LCS allocates a statically-sized buffer for this to be read into, on the stack - presumably using sizeof(savestruct) or similar. But it copies the number of bytes given by the .size element from the savedata into the stack buffer. By editing the .size element in the saved data, we can therefore force a buffer overflow. The .size element is at offset 0004 in the DATA.BIN file, in the savedata folder. Note that the DATA.BIN is encrypted, so you need to use something like the savedata sample from the pspsdk in order to modify it. | |||
The Exploit was patched in a second batch of UMD prints. | |||
Germany version: | Germany version: | ||
Line 113: | Line 47: | ||
Another indication is the copyright date: if it is 2005 then it is unpatched, else it is 2006 and is patched. | Another indication is the copyright date: if it is 2005 then it is unpatched, else it is 2006 and is patched. | ||
==== Lumines (Illuminati exploit): PSP <= 3.50. Patched 3.51 ==== | ==== Lumines (Illuminati exploit): PSP <= 3.50. Patched 3.51 ==== | ||
==== Gripshift by Matiaz: PSP <= 5.02?-5.03?. Patched 5.05 ==== | |||
==== Patapon 2 demo (USA) by Malloxis: PSP <= ?6.20? ==== | |||
==== | |||
==== Medal Of Honor Heroes, or Heroes 2, or both by kgsws: PSP <=? ==== | |||
2009-07-10 | |||
https://wololo.net/2009/07/10/medal-of-honor-heroes-the-coolest-exploit-ever/ | https://wololo.net/2009/07/10/medal-of-honor-heroes-the-coolest-exploit-ever/ | ||
https://www.brewology.com/downloads/download.php?id=9900 | https://www.brewology.com/downloads/download.php?id=9900 | ||
https://www.dcemu.co.uk/vbulletin/threads/224663-Medal-of-Honor-Heroes-(MOHH)-second-exploit | https://www.dcemu.co.uk/vbulletin/threads/224663-Medal-of-Honor-Heroes-(MOHH)-second-exploit | ||
=== During PS Vita era === | === During PS Vita era === | ||
Line 294: | Line 165: | ||
==== "Jikkyou Powerful Pro Yakyu 2012 Ketteiban" (Japanese: 実況パワフルプロ野球 2012決定版) (ULJM06206) by 173210: <= 2.61 ==== | ==== "Jikkyou Powerful Pro Yakyu 2012 Ketteiban" (Japanese: 実況パワフルプロ野球 2012決定版) (ULJM06206) by 173210: <= 2.61 ==== | ||
==== Pipe Madness by Frostegater: <= 2.61. Patched 3.00 ==== | ==== Pipe Madness by Frostegater: <= 2.61. Patched 3.00 ==== | ||
Line 357: | Line 224: | ||
==== Gladiator Begins Demo (NPEH90050, NPUH90077, NPJH90084) by qwikrazor87: <= 3.18 ==== | ==== Gladiator Begins Demo (NPEH90050, NPUH90077, NPJH90084) by qwikrazor87: <= 3.18 ==== | ||
Discovered | Discovered around 2014-09-12 by qwikrazor87. | ||
https://wololo.net/talk/viewtopic.php?t=39771 | https://wololo.net/talk/viewtopic.php?t=39771 | ||
Line 375: | Line 238: | ||
https://bitbucket.org/Acid_Snake/ark-2/src/master/exploit/usploit/wid_od_2_eu/ | https://bitbucket.org/Acid_Snake/ark-2/src/master/exploit/usploit/wid_od_2_eu/ | ||
==== Patapon: <= 3.18 ==== | ==== Patapon 1: <= 3.18 ==== | ||
==== Talkman Travel: Tokyo: <= 3.18 ==== | ==== Talkman Travel: Tokyo: <= 3.18 ==== | ||
Line 386: | Line 249: | ||
==== Patapon 2 non-demo (UCES01177): <= 3.36 ==== | ==== Patapon 2 non-demo (UCES01177): <= 3.36 ==== | ||
https://wololo.net/2019/08/13/hacking-consoles-a-learning-journey-part-4/ | https://wololo.net/2019/08/13/hacking-consoles-a-learning-journey-part-4/ | ||
Line 408: | Line 269: | ||
==== Ape Escape: On the Loose: <= 3.50. Patched 3.51 ==== | ==== Ape Escape: On the Loose: <= 3.50. Patched 3.51 ==== | ||
==== "Toukiden: Kiwami (DEMO)" (討鬼伝 極 体験版) by 173210: <= 3.51 ==== | ==== "Toukiden: Kiwami (DEMO)" (討鬼伝 極 体験版) by 173210: <= 3.51 ==== | ||
Line 424: | Line 281: | ||
https://github.com/173210/psp_exploits/ | https://github.com/173210/psp_exploits/ | ||
=== After PS Vita era === | === After PS Vita era === | ||
Line 437: | Line 287: | ||
https://github.com/ChampionLeake/scrabblehax | https://github.com/ChampionLeake/scrabblehax | ||
==== Carol Vorderman's Sudoku by ChampionLeake: probably not patched, 2019-04-22 ==== | |||
https://github.com/ChampionLeake/SudokuSTACK | |||
=== Remarks === | === Remarks === | ||
Line 543: | Line 397: | ||
== Unclassified usermode vulnerabilities == | == Unclassified usermode vulnerabilities == | ||
=== PsOneLoader by TheFloW === | === PsOneLoader by TheFloW === | ||
Line 1,139: | Line 987: | ||
= General writeups = | = General writeups = | ||
https://wololo.net/2014/01/18/10-days-of-hacking-day-4-the-psp-part-1/ | https://wololo.net/2014/01/18/10-days-of-hacking-day-4-the-psp-part-1/ |