Editing Vulnerabilities

== Exploits to sort ==

https://en.wikibooks.org/wiki/PSP/Homebrew_History

 

 

 

https://web.archive.org/web/20150902210716/http://www.zload.net/bilder/PSVita/VitaExploitChart.png

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

https://github.com/bucanero/save-decrypters/tree/master/invizimals-checksum-fixer

 

 

* SOCOM U.S. Navy SEALs: Fireteam Bravo 2

 

 

https://github.com/bucanero/save-decrypters/tree/master/patapon3-decrypter

 

 

* Quests - MH Freedom Unite (ULUS10391/ULES01213)

 

https://github.com/bucanero/save-decrypters/tree/master/monsterhunter-decrypter

 

 

 

 

 

 

==== Grand Theft Auto: Liberty City Stories UMD (and the Goofy exploit): PSP 2.00-3.03. Patched 3.30 ====

 

 

 

 

 

 

 

 

 

 

 

 

==== Lumines (Illuminati exploit): PSP <= 3.50. Patched 3.51 ====

 

 

 

==== Gripshift by MaTiaZ: PSP <= 5.02?-5.03?. Patched 5.05 ====

 

 

 

 

 

 

 

 

 

 

 

 

 

https://wololo.net/talk/viewtopic.php?f=3&t=51

 

https://wololo.net/2010/03/29/way-to-keep-a-secret-malloxis/

 

 

* https://wololo.net/talk/viewtopic.php?f=3&t=51

 

 

 

 

 

 

https://wololo.net/talk/viewtopic.php?f=3&t=51

==== Minna no sukkiri and variants by Jeerum: PSP <= ?6.35? ====

* Minna no sukkiri, Minna no sukkiri demo

* Discovered and exploited by Jeerum (2010-12-19). It had been found before Jeerum by at least Darxploit, Flyer, minomushi, some1. These people made the move of keeping this as secret as possible, and contacting mamosuke, j416, JJS, m0skit0, and wololo in order to discuss release plans.

 

https://wololo.net/talk/viewtopic.php?t=1032

 

 

==== Everybody's Tennis (UCES01420, UCUS98701, UCJS10101, UCAS40307) by wololo: <= 1.61 ====

 

 

 

 

==== Motorstorm: Arctic Edge (UCES01250, NPHG00023, NPJG00047, NPHG00023) by wololo: <= 1.61. Patched 1.65 ====

 

 

 

 

 

https://code.google.com/archive/p/valentine-hbl/source/default/source

 

 

 

==== Monster Hunter Freedom Unite (ULES01213, ULUS10391), Monster Hunter Freedom 2 (ULES00851), Monster Hunter Portable 2ndG (ULJM05500), Monster Hunter Portable 3rd (ULJM05800): <= 1.80. Patched 1.81 ====

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

https://bitbucket.org/Acid_Snake/ark-2/src/master/exploit/usploit/half_min_hero_eu/

https://bitbucket.org/Acid_Snake/ark-2/src/master/exploit/usploit/half_min_hero_us/

https://bitbucket.org/Acid_Snake/ark-2/src/master/exploit/usploit/half_min_hero_jp/

==== FieldRunners (NPEZ00098, NPUZ00014) by frostegater: <= 2.61. Patched 3.00 ====

https://bitbucket.org/Acid_Snake/ark-2/src/master/exploit/usploit/field_eu/

https://bitbucket.org/Acid_Snake/ark-2/src/master/exploit/usploit/field_us/

==== Urbanix (NPEZ00176, NPUZ00077, NPJH00082) second exploit by qwikrazor87: <= 3.00 ====

https://wololo.net/talk/viewtopic.php?f=56&t=36217

==== Cubixx: <= 3.00. Patched 3.01 ====

==== Ben 10 Alien Force: Vilgax Attacks: <= 3.01. Patched 3.10 ====

==== King Of Pool by qwikrazor87: <= 3.01. Patched 3.10 ====

This game was exploited 4 times and fixed 4 times.

==== Tiny Hawk (NPEZ00434) by qwikrazor87 ====

Not exploited.

==== 101-in-1 Megamix by xerpi: <= 3.01. Patched 3.10 ====

==== Fifa 2011, Fifa 2012: <= 3.01. Patched 3.10 ====

==== Persona 2: Innocent Sin, Persona 2: Tsumi: <= 3.01. Patched 3.10 ====

==== Arcade Air Hockey & Bowling (Europe, NPUZ00103), Arcade Pool & Snooker (Europe, USA), World of Pool (ULES00821), Pool Hall Pro (NPUH10091) second exploit by qwikrazor87: <= 3.01. Patched 3.10 ====

==== "Jikkyou Powerful Pro Yakyu 2012 Ketteiban" (Japanese: 実況パワフルプロ野球 2012決定版): <= 3.12 ====

==== MyStylist: <= 3.15 ====

==== Skate Park City by freakler: <= 3.15. Patched 3.18 ====

Exploited by freakler in 2014, then patched since PS Vita System Software version 3.18.

==== Space Invaders Extreme: <= 3.18 ====

==== Z.H.P.: Unlosing Ranger VS Darkdeath Evilman (NPEH00099, ULUS10559, ULJS00262) by KanadeEngel and qwikrazor87: <= 3.18 ====

 

 

Discovered in 2010 by anonymous and around 2014-09-12 by qwikrazor87.

 

 

The savedata in Gladiator Begins Demo only work on the PSP that created them.

 

 

 

==== Vertigo (NPUH10092) by qwikrazor87: <= 3.18 ====

 

==== Widget's Odyssey 2 (NPEZ00149, NPUZ00055) by qwikrazor87: <= 3.18 ====

https://bitbucket.org/Acid_Snake/ark-2/src/master/exploit/usploit/wid_od_2_eu/

==== Patapon: <= 3.18 ====

 

 

https://code.google.com/archive/p/valentine-hbl/source/default/source

 

==== Arcade Darts: <= 3.36 ====

 

 

https://code.google.com/archive/p/valentine-hbl/source/default/source

 

 

==== Numblast: <= 3.36 ====

 

 

 

 

 

This game is unfortunately fairly old, which makes it not so useful for things such as Half Byte Loader. Basically, Half Byte Loader needs a game that imports as many libraries as possible, especially recent ones, to have a better compatibility with homebrews.

==== "Toukiden: Kiwami (DEMO)" (討鬼伝 極 体験版) by 173210: <= 3.51 ====

https://code.google.com/archive/p/valentine-hbl/source/default/source

==== God of War - Ghost of Sparta by sockse and qwikrazor87: <= ?3.52? ====

Exploited by sockse and qwikrazor87 in 2014.

 

 

 

 

 

 

 

 

==== World of Pool, Pool Hall Pro: <= 3.52 ====

 

==== Scrabble by sockse and ChampionLeake: probably not patched, 2018-05-17 ====

 

Discovered by sockse (see [https://web.archive.org/web/20230429162635/https://wololo.net/talk/viewtopic.php?t=39756 writeup by sockse (2014-09-16)]) then patched on PSP but exploited in a different way later by ChampionLeake.

https://github.com/ChampionLeake/scrabblehax

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

=== Old System PRX allowed: PSP any version ===

=== Fixed syscall numbers: PSP <= ?6.50? ===

On PSP System Software version below 6.60, you could guess the syscall number for any kernel export, allowing you to call any syscall without having the resolved stub readily available.

Fixed on PSP System Software version 6.60 or just before. On PSP System Software version 6.60, SCE developers randomized syscall numbers so you could not guess them anymore.

=== qwikTrick (or Perfect Syscalls) by qwikrazor87: PSP/PS Vita any version ===

 

On PSP System Software version 6.60, SCE developers randomized syscall numbers so you could not guess them anymore. Therefore hackers became restricted to the functions imported by the application they exploited. This led to limited kernel function access (less chances of triggering a kernel bug) and it also drastically reduced V/HBL compatibility.

 

 

 

https://github.com/PSP-Archive/ARK-4/blob/add6c946b4bab17ed7488114ccda3357ea42e0f2/common/utils/imports.c#L91

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

== sceNetMCopyback kernel arbitrary read by qwikrazor87 and AcidSnake (ARK-4): PSP <= 6.61 ==

 

PSP implementation of sceNetMCopyback does not check the pointers passed in. As there is no DACR in PSP nor PSPemu, kernel pointers can be passed. As it does a signed 32-bit comparison, returning different values for a0 <= a1 and a0 > a1, this function can be used to bruteforce the value at a kernel address. This vulnerability lets you compare the value at any place in kernel memory with whatever value you pass to it. There are 32 bits of data so you iterate 32 times. On each iteration, you determine the value of the current bit (0 or 1) by doing one comparison.

 

 

== sceHttpStorageOpen kexploit, 0xFFFFFFFFailSploit, write 0xFFFFFFFF to anywhere by some1 and liquidzigong (ME, Chronoswitch): PSP 6.20-6.61 ==

 

 

 

== sceUtilityPowerRegisterCallback kexploit by TN and davee with sceKernelUtilsMd5BlockInit kexploit to keep the data dynamic (TN-HEN, Chronoswitch): PSP 6.20-6.35 ==

 

 

== sceNetMFree race condition (named ifhandle 5.70) kexploit by davee: PSP 5.00-5.70, patched on PSP 6.20 ==

 

 

https://wololo.net/talk/viewtopic.php?p=147732#p147732

 

== GEN/M33 contested Wlan kexploit: PSP <= 5.50 ==

 

 

 

 

https://github.com/DaveeFTW/ChickHEN/blob/main/Launcher/main.c

This exploit clobbers 16 bytes of kernel memory, so it is needed to read kernel memory before exploiting and restore the other 12 after.

This kernel exploit requires some modules that are not loaded by the Gripshift game. This is why WhickHEN works with the libtiff XMB bug, but was never ported to the Gripshift exploit.

== Registry error store: PSP <= ?2.80? ==

According to davee, this registry vulnerability is pretty cool. There is an error condition that writes 0xFFFFFFFF to a user controlled address. Exploitation path is modifying the 0xBC000000 memory permission to allow usermode read/write to kernel.

https://wololo.net/talk/viewtopic.php?p=147642#p147642

== Registry write access from usermode: PSP <= 2.60 ==

Since the registry is placed on flash1, it can be accessed by usermode.

== sceKernelLoadExec buffer overflow by hitchhikr / Neural: PSP 2.01-2.60 ==

There is a subroutine in loadexec.prx that takes a path as an argument. It looks for the character ":" in that path, and calculates the length of the drive name from that (e.g. "ms0:"). It then copies the drive name onto the stack with strncpy.

The exploit is located in a subroutine in the loadexec.prx file. It is at address 0x88064C94 (game mode) in System Software version 2.60. The purpose of this procedure (used in other functions like "sceKernelLoadExec") is to check that the drive part of a filename is valid and legit. It allocates 48 bytes of stack and the return address to the calling function is stored at the end of it (from 44th to 47th bytes). It starts by checking the first char of the string to see if it is an empty drive name, if it is not the routine extracts the part of the filename that contain the drive name and copies it into the allocated stack. It only stops when it encounters a ':' char. Since it does not check any string length during the copy, if the drive name supplied by user is big enough, then it will overwrite the rest of the stack based values, like the return address for example. Hence why a drive name of 48 chars (+ an extra ':' char to let the loop ends) containing an address to an arbitrary position in memory (pointing to a function of ours for example) located from the 44th to 47th chars in the filename will allow us to run any code we want in the context of the executing routine (kernel mode) as when it ends, it reloads the return address from the stack and directly jumps to it.

In later System Software versions, loadexec checks if the drive name is longer than 0x1F bytes. If it is, it returns an error. Look at sub_21E0 in 6.60 loadexec_01g.prx.

https://forums.ps2dev.org/viewtopic.php?t=6091

https://www.hitchhikr.net/Exploit_2.6.zip

https://github.com/mathieulh/3.90-M33/blob/master/experiments/iplreboot/experiments/experiments/kernel/GTA%20stub/loader.c

https://github.com/mathieulh/3.90-M33/blob/master/experiments/iplreboot/experiments/experiments/kernel/dump_reboot_v2.6/copy.c

 

== reused index.dat key: PSP 2.00, 2.01 ==

 

== swaptrick/kxploit: PSP <= 1.50 ==

 

 

= iplloader =

Vulnerable: iplloader (all PSP bootrom versions, 0.7.0 and newer PSP DevKit Kbooti versions, PS Vita's PSP emulator bootrom)

The iplloader bootrom (present within Tachyon's IC package) as well as iplloader versions 0.7.0 and onward feature a NMI/Interrupt handler backdoor (most likely used internally for debugging purposes) in its loader part at the very first instructions of the bootrom.

If value at address 0xBC100000 is not equal to 0 and coprocessor register $9 is set, iplloader will jump to the address set in the register very early in the code (by the 8th instruction). Else (if value at address 0xBC100000 is equal to 0), coprocessor register $9 will be reset back to 0.

This backdoor may allow an attacker performing a hardware based attack to set those values and gain iplloader time code execution.

iplloader will not control the location at which it will load/copy the block. It will happily attempt to perform a memcpy (at a rate of 1 DWORD per cycle) to whatever load address is specified in the IPL header, assuming that the header passes the checks (Kirk cmd 1, Kirk cmd 1 ECDSA, Kirk cmd 0x6C SHA1 (on Tachyon 0x00600000 and later), ...). This allows to write a payload at arbitrary locations.

Fixed: iplloader 2.6.0

iplloader will jump to any location specified in the last IPL block's entrypoint. This allows arbitrary execution. This was used in conjunction with the Kirk time-attack to craft a block and gain execution from at address 0xBFD00100 in the Pandora hack, and thus allowed to craft a "valid" block in a more timely fashion.

iplloader will not control the block size. This allows to craft a small, favorable for time-attack, IPL block.

 

== iplloader assumes a block with the checksum 0 is the first IPL block ==

This implementation fault has been exploited to create a memory hole in VRAM that could be filled with our own payload to gain execution and dump iplloader.

== iplloader do not perform the XOR step when running in Jig/Service mode ==

Introduced: iplloader 3.5.0

Applicable to: Code execution on 3.5.0 iplloader without previous knowledge of the XOR key.

Fixed: probably never as 3.5.0 is the last known iplloader revision for Development Tool

To allow service centers to use a unique Memory Stick for multiple PSP models during servicing, iplloader deliberately disables the XOR step, allowing a non XORed IPL to run from Memory Stick. This is done so that the IPL can run on all systems from 01g to 11g. This is also presumably done because XOR keys may differ in between Tachyon revisions.

== iplloader clears the XOR key after doing a cache sync during normal execution ==

Introduced: iplloader 3.5.0

Applicable to: Dumping the iplloader 3.5.0 XOR key from Jig mode execution when used in conjunction with the arbitrary load address vulnerability

Fixed: probably never as 3.5.0 is the last known iplloader revision for Development Tool

3.5.0 iplloader clears the XOR key after doing a cache sync during normal execution. This allows to retrieve the key from the uncached memory at address 0xA001088C.

While it may be possible that Tachyon 0x00600000 and later iplloader fix this issue, it is irrelevant because the code should remain accessible as part of the Tachyon bootrom at address 0xBFC00000)

Starting with Tachyon 0x00600000, iplloader XORs each IPL block hash as they are loaded, and then uses this final XOR to verify the signature.