Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 20: Line 20:


== PSP Game Savedata ==
== PSP Game Savedata ==
=== Savedata protections ===
Most PSP games have a common encryption system whose encryption key is per-game. The encrypted savedata is often named DATA.BIN. The per-game key can be dumped using a plugin on an actual PSP: SGKeyDumper by qwikrazor87. The savedata can be decrypted on PC using [https://github.com/38-vita-38/psp-save psp-save by 38-vita-38] or [https://github.com/cielavenir/psp-savedata-endecrypter psp-savedata-endecrypter by popsdeco/cielavenir] or [https://github.com/BrianBTB/SED-PC SED-PC by BrianBTB] or on PSP using [https://github.com/bucanero/apollo-psp Apollo Save Tool (PSP) by bucanero] or SED (Savegame Encrypt/Decrypt).
Some PSP games have an additional encryption applied to their savedata. This system was already present in some PlayStation and PlayStation 2 games:
* Tekken 2 and 3 for PS1.
* Bandai Namco Entertainment used a previously unknown feature of PS2 memory cards (per sector encryption on flash raw sectors) to protect the quest data memory card on the System 246 version of Soul Calibur 2 Arcade game. One cannot move the save data from one memory card to another because the game uses the per card crypto seed.
See also [https://github.com/bucanero/save-decrypters/] and [https://community.wemod.com/t/philymasters-security-archive/3923]
Some games store digests in the savedata to ensure integrity.
==== Tekken 6 ====
The first 0x20 bytes of MAINDATA.SAV, GHOST.SAV and REPLAY.SAV of PS3 Tekken 6 are not encrypted and are a sort of header. They contain filesize and maybe digest. The remaining data in the files are encrypted with an unknown algorithm (maybe AES128 with a per-console key based on eid0).
MAINDATA.SAV of PSP Tekken 6 is fully encrypted without any header. The game calls [[Kirk]] command 5 to encrypt/decrypt savedata with a key derived from per-console [[Fuse ID]]. This file can be decrypted on PC with the command <code>psp-save -d KEY.BIN 5 MAINDATA.SAV MAINDATA_DEC.SAV</code> where KEY.BIN is the per-console key. This per-console key can be dumped using Apollo Save Tool (PSP) or derived from the console's [[Fuse ID]].
==== Gladiator Begins Demo ====
==== Gran Turismo ====
==== Invizimals ====
Invizimals PSP game stores a checksum in its savedata. It also maybe encrypts it (to check).
https://github.com/bucanero/save-decrypters/tree/master/invizimals-checksum-fixer
==== SOCOM U.S. Navy SEALs games ====
Custom savedata encryption may concern the following PSP games:
* SOCOM U.S. Navy SEALs: Fireteam Bravo
* SOCOM U.S. Navy SEALs: Fireteam Bravo 2
* SOCOM U.S. Navy SEALs: Fireteam Bravo 3
* SOCOM U.S. Navy SEALs: Tactical Strike
==== Patapon 3 ====
https://github.com/bucanero/save-decrypters/tree/master/patapon3-decrypter
==== Monster Hunter games ====
Monster Hunter PSP and Nintendo 3DS games use a custom encryption system and a custom SHA1 integrity hash. It concerns the following games and DLCs:
* Monster Hunter Freedom Unite (ULUS10391/ULES01213)
* Monster Hunter Portable 2nd G (ULJM05500)
* Monster Hunter Portable 3rd (ULJM05800)
* Quests - MH Freedom Unite (ULUS10391/ULES01213)
* Quests - MH Portable 2nd G (ULJM05500)
* Quests - MH Portable 3rd (ULJM05800)
https://github.com/bucanero/save-decrypters/tree/master/monsterhunter-decrypter


=== Blacklisted games ===
=== Blacklisted games ===
Line 361: Line 309:
It is fairly easy to get this exploit to work as it is a buffer overflow in the player's name.
It is fairly easy to get this exploit to work as it is a buffer overflow in the player's name.


The savedata in Gladiator Begins Demo only work on the PSP that created them.
The savedata in this demo only work on the PSP that created them. Lots of people were complaining about the impossibility to re-use their save games on recent games such as Tekken 6.


https://wololo.net/talk/viewtopic.php?t=39771
https://wololo.net/talk/viewtopic.php?t=39771
Please note that all contributions to PSP Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PSP Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/psp/Vulnerabilities"