Search found 10 matches

by ModernRonin
Thu May 12, 2005 6:25 am
Forum: PSP Development
Topic: First cut at PSP buffer overflow loader code.
Replies: 15
Views: 11126

you can have the greatest code in the world.. but where the hell are you going to point it.. in most cases.. getting a overflow to run your code requires more experience about the system than most software developers posess.. (myself included). And me too. I said that in my post. Right there after ...
by ModernRonin
Thu May 12, 2005 6:20 am
Forum: PSP Development
Topic: First cut at PSP buffer overflow loader code.
Replies: 15
Views: 11126

and tomorrow you might as well get a MIPS programming handbook and learn about delay slots and such funky stuff like not using hashes as jump addresses ... Yeah, I deserved that. Especially since I scolded someone for not putting a branch delay slot instruction in their code a couple days ago . As ...
by ModernRonin
Wed May 11, 2005 3:21 pm
Forum: PSP Development
Topic: First cut at PSP buffer overflow loader code.
Replies: 15
Views: 11126

First cut at PSP buffer overflow loader code.

We need three things to run code on the 1.5 PSPs via buffer overflows: 1) We need to find a buffer overflow, and 2) figure out how to exploit it. I think the best candidate so far is this thread. (I think. Anyone else know of anything that looks like an obvious buffer overrun?) Some resources on buf...
by ModernRonin
Mon May 09, 2005 2:19 pm
Forum: PSP Development
Topic: PSP [firmware] Dump [program]
Replies: 69
Views: 66654

Hey nem , when you get some time, do you mind looking for symbols in the following files and tell us if you find anything interesting: loadcore.prx loadexec.prx usbstorboot.prx I'm particularly interested in knowing if "usbstorboot" means there's some way we can boot the PSP off a USB stor...
by ModernRonin
Mon May 09, 2005 1:58 pm
Forum: PSP Development
Topic: How To Crash The PSP
Replies: 51
Views: 27923

buffer overflows are definitely what might open up a v1.5, especially combined with what we'll learn from analyzing the workings of a v1.0. The shellcode linked will definitely not work since it's most likely going to attempt call the Irix equivalent of exec() and run a new shell (hence, "shel...
by ModernRonin
Sun May 08, 2005 5:50 pm
Forum: General Discussion
Topic: (TOPIC ABOUT STUFF BETTER LEFT UNSAID)
Replies: 1
Views: 1704

(TOPIC ABOUT STUFF BETTER LEFT UNSAID)

(RAMBLING REMOVED)

I can't be the first to think of this. Someone must have tried it. What happened?
by ModernRonin
Sun May 08, 2005 5:26 pm
Forum: PSP Development
Topic: Program for parsing data in PARAM.SFO files
Replies: 29
Views: 24384

Short Info: Even though it was compiled on and for win98 the program runs flawless on a win2000 /SP4 box i tested.

Sweet! Thanks, Mel.
by ModernRonin
Sun May 08, 2005 5:19 pm
Forum: PSP Development
Topic: Program for parsing data in PARAM.SFO files
Replies: 29
Views: 24384

Hey thanks for the update on letting people know how they can compile it on win98! I'm kinda curious if my executable works under 2k or XP. Actually, I'm curious if it even works on someone else's 98 box. For all I know it may depend on some weirdo DLL that only I have. Do newer windows platforms u...
by ModernRonin
Sun May 08, 2005 4:59 pm
Forum: PSP Development
Topic: How To Crash The PSP
Replies: 51
Views: 27923

Branch delay slot, dude...

.globl main main: j main You should probably put a NOOP after "j main". Read up on the MIPS architecture - due to the way the CPU instruction pipeline works, the next instruction right after a jump is always executed even though it isn't supposed to be. This is because the CPU is ...
by ModernRonin
Sat May 07, 2005 5:55 pm
Forum: PSP Development
Topic: Program for parsing data in PARAM.SFO files
Replies: 29
Views: 24384

Port to Win98 done.

I added some typedefs to your code to make this compile under Visual C++ 6.0 on Win98. Three typedefs: // Some data type definitions for Intel Doze platforms, 2005/05/06, bwc typedef unsigned int u_int32_t; typedef unsigned short int u_int16_t ; typedef unsigned char u_int8_t; And I had to cast some...