psp-dev have released their exploit for ver. 1.5

Fluff · Post by **Fluff** » Fri Jun 17, 2005 11:36 am

you'd have to be pretty digitally-reclusive not to visit general psp sites and not hear the kafuffle around this latest event. just my $0.02

Chrighton · Post by **Chrighton** » Fri Jun 17, 2005 11:46 am

MarfPSP wrote:I often find reading through duplicated posts on other forums that you can get tidbits of other information from them.

That's because it's statistically bound to happen when people arbitrarily pick from a number of threads with essentially the same topic. People don't know which one is more appropriate so they'll just pick one. It is haphazard and silly. It's far better to have one thread on a topic, period. All the information you need you will find in one place - makes sense and I applaud the moderators for doing just that.

F9zDark · Post by **F9zDark** » Wed Jun 22, 2005 4:04 pm

I tried this on my 1.51 PSP and it doesn't work :(.

I am gonna try it with a simpler homebrew app and see what happens.(I tried it with the Doom-PSP game). See what happens.

Thanhda · Post by **Thanhda** » Wed Jun 22, 2005 5:12 pm

to F9zDark:

it wont work. even a simple program like hello world. if i where you i would wait for a dead pixel or something to go wrong with it, and exchange it for another psp with 1.5. thats if you got store waranty.

F9zDark · Post by **F9zDark** » Wed Jun 22, 2005 5:19 pm

I actually have quite a few dead pixels... I might do just that.

If they don't have an exchange available, the nearby store has a refurb PSP for I think 100 bucks. I can ask them to check the system information before I buy it, if its 1.5 I can buy away :)

**Added**

I just feel so stupid for updating... Its obvious that the security fix was meant to address this hack specifically.

Lain_OTN · Post by **Lain_OTN** » Wed Jun 22, 2005 8:08 pm

PSP-DEV released the only one MS exploit:
http://putoamo.addr.com/index2.html
http://web.icoiig.es/ubalda/index2.html

No PBP in PBP, only a % in the directory name!!!!!!

Municher · Post by **Municher** » Wed Jun 22, 2005 8:28 pm

It's a simple and elegant hack - and it works.

Can someone explain the logic behind all this?

Arjan · Post by **Arjan** » Wed Jun 22, 2005 8:57 pm

the logic behind it is that there's a bug in the path parsing somewhere.

I could've found this if I tried to experiment more with the paths too :P (I bet it'll work with other characters too)

MindWall · Post by **MindWall** » Wed Jun 22, 2005 8:59 pm

apperantly you don't need a canon to kill a musquito!... who knew?!

and it's (at first glance) the same exploit, but they used a second system hole with directory name recognition.

first one (directory) with the "%" gets executed the "loader" and authoring process passes on only the directory minus the unrecognized "%" for execution.

kudos to the youth =)

konfig · Post by **konfig** » Wed Jun 22, 2005 11:19 pm

Arjan wrote:the logic behind it is that there's a bug in the path parsing somewhere.

I could've found this if I tried to experiment more with the paths too :P (I bet it'll work with other characters too)

if it is a bug in path parsing, I can't imagine how sony made such an obvious and stupid error(Just can't imagine, maybe it really is a bug. If anyone know how such an error is likely to occur while writing code, please tell people here).

At my first thought, it looks like some kind of system back door(don't know what it is for and done nothing to test yet).

F9zDark · Post by **F9zDark** » Thu Jun 23, 2005 2:15 am

konfig wrote:
Arjan wrote:the logic behind it is that there's a bug in the path parsing somewhere.

I could've found this if I tried to experiment more with the paths too :P (I bet it'll work with other characters too)
if it is a bug in path parsing, I can't imagine how sony made such an obvious and stupid error(Just can't imagine, maybe it really is a bug. If anyone know how such an error is likely to occur while writing code, please tell people here).

At my first thought, it looks like some kind of system back door(don't know what it is for and done nothing to test yet).

Come on, Sony was the company that released the 1.0 PSPs that had absolutely no necessity for encryption/signature reading, thus allowing homebrew code without hinderance...

This would also explain the 1.52 update, unless this problem is addressed in the 1.51 update, I hope it isn't .

Arjan · Post by **Arjan** » Thu Jun 23, 2005 2:51 am

ah indeed, I didn't think of that before :) It was just my guess though, I could also say % is used to pass arguments to the app.. Pure speculation though..

After some toying around, I found out that the percent mark can be put anywhere in the application directory name (not in any other dir name, PSP\%GAME\APP won't work). You can also put multiple percent marks in the directory name, as long as they're not adjecent.

Danj · Post by **Danj** » Thu Jun 23, 2005 3:07 am

F9zDark wrote:
konfig wrote:
Arjan wrote:the logic behind it is that there's a bug in the path parsing somewhere.

I could've found this if I tried to experiment more with the paths too :P (I bet it'll work with other characters too)
if it is a bug in path parsing, I can't imagine how sony made such an obvious and stupid error(Just can't imagine, maybe it really is a bug. If anyone know how such an error is likely to occur while writing code, please tell people here).

At my first thought, it looks like some kind of system back door(don't know what it is for and done nothing to test yet).
Come on, Sony was the company that released the 1.0 PSPs that had absolutely no necessity for encryption/signature reading, thus allowing homebrew code without hinderance...

This would also explain the 1.52 update, unless this problem is addressed in the 1.51 update, I hope it isn't .

Well, I tried this version of the exploit on my 1.51 PSP, and it gave me an error "The game cannot be started (80020148)". Perhaps a different character than % might work on 1.51? Or do you think they'll have closed this hole entirely?

Nick Fury · Post by **Nick Fury** » Thu Jun 23, 2005 3:15 am

I'm thinking they didn't fix this error for 1.51

I'm at work currently but when I get home I'll be sure to play around with every special character I can. This has to work for 1.51.

taconinjas · Post by **taconinjas** » Thu Jun 23, 2005 3:26 am

killer-x is teh leet

Danj · Post by **Danj** » Thu Jun 23, 2005 3:34 am

Nick Fury wrote:I'm thinking they didn't fix this error for 1.51

I'm at work currently but when I get home I'll be sure to play around with every special character I can. This has to work for 1.51.

I'm curious as to why you're so sure about this? Granted, the existence of a "security fix" in 1.52 points to a hole in 1.51, but it doesn't seem likely that it'd be the same one...? Unless they thought they'd fixed it, but found that they hadn't and had to fix it again?

Nick Fury · Post by **Nick Fury** » Thu Jun 23, 2005 3:45 am

Danj wrote: I'm curious as to why you're so sure about this? Granted, the existence of a "security fix" in 1.52 points to a hole in 1.51, but it doesn't seem likely that it'd be the same one...? Unless they thought they'd fixed it, but found that they hadn't and had to fix it again?

Call it instinct. Either way I'm dreaming right now and won't know until I get home to test some things.

So while I'm at it... I would really like to see a firmware hack for this device. I think until that is done Sony is going to continuously release updates and force us to use them with all of their new games.

Anyway, I'll play with this when I get home... back to work.

cwbowron · Post by **cwbowron** » Thu Jun 23, 2005 3:59 am

Arjan wrote:ah indeed, I didn't think of that before :) It was just my guess though, I could also say % is used to pass arguments to the app.. Pure speculation though..

After some toying around, I found out that the percent mark can be put anywhere in the application directory name (not in any other dir name, PSP\%GAME\APP won't work). You can also put multiple percent marks in the directory name, as long as they're not adjecent.

It could be related to the formatting characters used by functions like sprintf and printf. It's a fairly easy mistake to make. if you say something like sprintf(outbuffer, inbuffer) when you really mean sprintf(outbuffer, "%s", inbuffer) you can run in to issues with %'s in the inbuffer being interpretated as a formatting directive.

That could also explain why %% would not work, because %% is the directive for for a single %.

MindWall · Post by **MindWall** » Thu Jun 23, 2005 4:20 am

since this is exact "exploit" as the previous that needed swapping memory sticks, this will most probably NOT work on ver 1.51 nor 1.52
to get this you will need modification of the loading construct.

Danj · Post by **Danj** » Thu Jun 23, 2005 7:04 am

I decided to try and test the theory that this is some sort of printf-format related bug, and also to see if I could find a method that would work on 1.51 firmware. To that end, I used the KXploit tool with the precompiled Hello World program to create the two directories. I decided to choose a printf format code which would most likely produce anomalous output, and consequently I picked %p which is apparently intended for pointers. I then renamed my HELLOPSP% folder to HELLOPS%p. Upon attempting to run the loader on the PSP, I get a different error number than before, this time it is 80010002. I then tried %n which according to the man page I found should output the number of characters written so far. I changed the names of my folders to HELLOPS%n and HELLOPS7 respectively. This caused rather more spectacular results; the PSP froze in the menu screen and then after a couple of seconds turned itself off. Fortunately the PSP seems to be okay once I turned it back on. I've also tried a few different characters other than % (such as # and ~) but they just seem to result in the 80010002 error.

jimparis · Post by **jimparis** » Thu Jun 23, 2005 7:50 am

Danj wrote: I then tried %n which according to the man page I found should output the number of characters written so far. I changed the names of my folders to HELLOPS%n and HELLOPS7 respectively. This caused rather more spectacular results; the PSP froze in the menu screen and then after a couple of seconds turned itself off.

Nice. That is almost certainly a classic format string bug. %n does not cause output; it stores a value to the address pointed to by the next argument, which would definitely explain the crash. Does this work on both 1.51 and 1.52? It's definitely a strong possibility for exploit, but it's made a bit more difficult because we can't see the output of the format string. (it would be nearly trivial if we could see what %p got written as...)

F9zDark · Post by **F9zDark** » Thu Jun 23, 2005 7:51 am

Got a 1.50 PSP today, tried the Kxploit and it works fine. One qualm I have with it is the fact that the PSP shows the corrupt data and since the exploit includes its own image in the EBOOT.PBP file it creates, its rather annoying trying to find which game is which.(not to mention the corrupt data appearing on there disorganizes everything.)

Other than that it works wonders.

LiquidIce · Post by **LiquidIce** » Thu Jun 23, 2005 7:55 am

It seems to order apps by the date they were transfered to the memory stick. Is there any way to modify this date so directories without the % get marked in the past to put them on the bottom of the list?

jimparis · Post by **jimparis** » Thu Jun 23, 2005 8:20 am

LiquidIce wrote:It seems to order apps by the date they were transfered to the memory stick. Is there any way to modify this date so directories without the % get marked in the past to put them on the bottom of the list?

Code: Select all

touch *; touch -d yesterday *%

n1ckn4m3 · Post by **n1ckn4m3** » Thu Jun 23, 2005 9:55 am

LiquidIce wrote:It seems to order apps by the date they were transfered to the memory stick. Is there any way to modify this date so directories without the % get marked in the past to put them on the bottom of the list?

As far as I know, a simple way to do this on a Windows box (if you don't have cygwin/touch/etc.) would be to simply rename the '%' directories, and then rename them back to their original name -- this would change the modified date to the current date, thus placing it at the top of the list.

Make sense?

I haven't tested this and could be talking out my ass, if so, please disregard.

EDIT: Didn't work and evidently my version of XP Pro is missing touch, so I found a Windows9x/NT/2K/XP version available here: http://www.codeproject.com/tools/touch_win.asp

cable16 · Post by **cable16** » Thu Jun 23, 2005 9:58 am

tried the renaming, didnt work. WIN xp pro has touch though.

cable16 · Post by **cable16** » Thu Jun 23, 2005 10:01 am

fyi: "touch -d yesterday *%" works like a charm

F9zDark · Post by **F9zDark** » Thu Jun 23, 2005 10:22 am

A little tidbit, since I ran into problems with Touch. Make sure the directories are not READ-ONLY. Mine were set to read only and gave a whole slew of memory write errors after executing touch.

Nick Fury · Post by **Nick Fury** » Thu Jun 23, 2005 11:55 am

To add on to Danj. If you tack on %c you get another error of the type 8001000D

Does sony have a listing of all of these errors somewhere by chance?

Post by **mrbrown** » Thu Jun 23, 2005 12:53 pm

For any error that's 8001xxxx the "xxxx" corresponds to an error code found in <errno.h>.

So 80010002 is ENOENT (No such file or directory), and 8001000D is EACCESS (Permission denied).