Web Browser in Wipeout Pure

[drewsnwbrdr01]

I wanted to check my email on the psp, which you can do on hotmail by the way... but my main email address uses frames which will not allow you to enter the site w/out a frames supported browser. To get around this, go on your computer, and view the source code for the page you want to view. Find the part where it says <Frames> You will want to find the source name of the main frame you want to view. Basically, where it shows <FRAMES>, inside that bracket you will also find the letters "SRC". it should look like this... <Frames src="...."> the information in the quotation marks will go after a slash after the end of the desired web address that requires frames. Finally, if you want to view the inbox of your online mail server, look for the frame source that has the word inbox in it. the only thing you cannot do is delete messages. good luck... it's easy.

[kry.sys]

I just wanted to state once again that this is NOT a hack.

Note that this is only possible becuase sony allows it.

again... not a hack.

once again... sony still owns joo!

break free and then we'll talk about using the word hack in the right context.

[Èl Nächó]

Dude, Only one person in this thread even called this a hack. And that was 10 days ago. And you've already tried to prove how smart you are in this thread already. It isn't working.

Save your holier then thou attitude. It's really getting old.

[Yracry]

Amen, i can appreciate that a lot of useless stuff is goin to get on here, but if you keep putting down anyone that even has an idea people aren't going to post as much, including possible first time users, yeh most of it is rubbish and yeh a lot of the words used are wrong/in wrong context, but if you keep putting people down like this then people with good ideas will be less likely to post. The more input we have, the more ideas we have, the more ideas the more likely we are going to have a breakthrough. So please, kry.sys and whoever else is obviously good at all this don't put down people who aren't ok?Your just ruining potential possibilities.

[kry.sys]

i didnt put anyone down.. you did just now. dont try to flame me im trying to help you out. and im not smart.

if i were smart i would have figured a way to express these truths without people throwing a fit.

i guess im just tired of reading 10 page hack articles to find this is all that is getting reported.


again... not putting anyone down.. try to understand my tones as being on the verge of cynical but mostly sarcastic.

[blackdroid]

This is getting overboard, the last posts have no valid information whatsoever, keep it up and it will get locked.

[staverton]

Apologies is someone has suggested this before, but as the browser seems to support some Javascript, can someone point their PSP at the link below? It's a Javascript browser sniffer and tries to determine all it can about your browser and display it back to you.

http://webreference.com/tools/browser/javascript.html

Once you've done it, paste the results.

[KaL]

Why don't you do it yourself, if it's Sooo interesting ?

[pdc]

Why don't you do it yourself, if it's Sooo interesting ?

Because he doesn't have a PSP online, of course.
KaL, the mods have just threatened to lock this thread because of arguments and you are not helping.


Interesting link, staverton.

I wonder how much info the PSP will actually return. I would also be curious to read what comes up.

[kry.sys]

Apologies is someone has suggested this before, but as the browser seems to support some Javascript, can someone point their PSP at the link below? It's a Javascript browser sniffer and tries to determine all it can about your browser and display it back to you.

http://webreference.com/tools/browser/javascript.html

Once you've done it, paste the results.

interesting...

ill post this output when i get home.. or someone else will

KaL, the mods have just threatened to lock this thread because of arguments and you are not helping.

that would be my fault...


on an off note is there any way we can change this topic to "web browser api"

[mrbrown]

on an off note is there any way we can change this topic to "web browser api"

Give me the post # that you want to split at. I think the majority of posts leading up to this should still be the Wipeout thread.

[LiquidIce]

Here is the data output by the PSP. I don't think this is very useful, but maybe someone else will

Code: Select all

Navigator Object Data
navigator.appCodeName: SECJ PSP BROWSER
navigator.appName: SCEJ PSP BROWSER
navigator.appVersion: 1.0
navigator.userAgent: SCEJ PSP BROWSER102PSPnAVIGATOR
navigator.platform: PSP
navigator.javaEnabled(): false

Version Number
major version number: 1
major/minor version number: 1

Browser Version
nav:false
nav2:false
nav3:false
nav4:false
nav4up:false
nav5:false
nav5up:false
nav6:false
nav6up:false
nav7:false
nav7up:false

ie:false
ie3:false
ie4:false
ie4up:false
ie5:false
ie5up:false
ie5_5:false
ie5_5up:false
ie6:false
ie6up:false

aol:false
aol3:false
aol4:false
aol5:false
aol6:false
aol7:false
aol8:false

opera:false
opera2:false
opera3:false
opera4:false
opera5:false
opera5up:false
opera6:false
opera6up:false
opera7:false
opera7up:false

safari:false

konqueror:false

Gecko based: false

mozilla (guessing): false

firebird: false

firefox: false

webtv:false

hotjava:false
hotjava3:false
hotjava3up:false

AOL TV(TVNavigator):false

JavaScript Version
js:0

OS
win:false
os2:false
mac:false
unix:false
sun:false
irix:false
hpux:false
aix:false
linux:false
sco:false
unixware:false
mpras:false
reliant:false
dec:false
sinix:false
bsd:false
freebsd:false
vms:false

Object Detection Tests
document.all: false
document.anchors: true
document.cookie: true
document.forms: true
document.getElementById: false*
document.getElementsByTagName: false
document.documentElement: false
document.images: true
document.layers: false - NS6 gives false here**
document.links: true

window.frames: true
window.length: 0

Method Detection Tests
window.RegExp: false
window.Option: false

Screen Properties
window.screen: true
screen.height: 272
screen.width: 480
screen.availHeight: 272
screen.availWidth: 480
screen.colorDepth: 32
fontSmoothingEnabled: undefined

Document Properties
document.URL: http://webreference.com/tools/browser/javascript.html

Flash Detection
Flash Player Present: can't tell

Now what? I wish it supported xmlhttprequest

[kry.sys]

Give me the post # that you want to split at. I think the majority of posts leading up to this should still be the Wipeout thread.

points up... about there.

LiquidIce,

did you hand type all that? or pull it out of tcpdump?

[roto]

I just wanted to state once again that this is NOT a hack.

Note that this is only possible becuase sony allows it.

again... not a hack.

once again... sony still owns joo!

break free and then we'll talk about using the word hack in the right context.

The only people that call this a "hack" are the ones that are not doing anything important. "Hack" is very much an overused/misused term lately.

Keep working on that post count; why else would you revive this thread with that kind of comment after 5 days of no new posts?

[LiquidIce]

lol, hand typed? I thought this was the developers board?

Is anyone else upset about how long it takes to actually get the browser running? Wipeout has so many init screens!!

[kry.sys]

I just wanted to state once again that this is NOT a hack.

Note that this is only possible becuase sony allows it.

again... not a hack.

once again... sony still owns joo!

break free and then we'll talk about using the word hack in the right context.

The only people that call this a "hack" are the ones that are not doing anything important. "Hack" is very much an overused/misused term lately.

Keep working on that post count; why else would you revive this thread with that kind of comment after 5 days of no new posts?

yea i wasted some time reading crappy articles and took it out on this thread.

..

liquid,
ok just making sure. :P

[Shine]

Some more info about the browser:

- JavaScript memory limit:
This script:

Code: Select all

var big="1";
for &#40;i = 0; i < 19; i++&#41; big = big + big;
alert&#40;big.length&#41;;

shows 524288. With 20 the page is reloaded all the time, without the message, so looks like there is a memory limit for JavaScript somewhere between 512 kb and 1 mb.
- stack overflow check:

Code: Select all

var recursive = 1;
function test() {
  recursive++;
  test();
}
test();
alert(recursive);

4094

You can write the document with JavaScript, the timer function works and if you change the text of a button in a form with document.button.value="x", the old length of the text is used, showing memory garbage after the x:

Code: Select all

<script>
var big="1";
for &#40;i = 0; i < 5; i++&#41; big = big + big;
document.write&#40;"<form name=form>"&#41;;
for &#40;i = 0; i < 20; i++&#41; &#123;
  document.write&#40;"<input type=button value=" + big + " name=button" + i + ">"&#41;;
&#125;
document.write&#40;"</form>"&#41;;
function timer&#40;&#41; &#123;
  for &#40;i = 0; i < 20; i++&#41; document.form&#91;"button" + i&#93;.value = "x";
  timerID = setTimeout&#40;"timer&#40;&#41;", 1000&#41;;
&#125;
timerID = setTimeout&#40;"timer&#40;&#41;", 1000&#41;;
</script>

You can transfer data from JavaScript back to some PHP script on your server. For example for scanning all attributes of the document object:

Code: Select all

<script>
var properties = "";
document.write&#40;"<form name=form method=post action=save.php>"&#41;;
for &#40;var property in document&#41;
  properties = properties + property + "=" + document&#91;property&#93; + ",";
document.write&#40;"<input name=data type=text value=\"" + properties + "\">"&#41;;
document.write&#40;"<input type=submit>"&#41;;
document.write&#40;"</form>"&#41;;
</script>

with this PHP script on server side:

Code: Select all

<?php
$data = $HTTP_POST_VARS&#91;'data'&#93;;
$f = fopen&#40;'data.txt', 'w'&#41;;
fputs&#40;$f, $data&#41;;
fclose&#40;$f&#41;;
?>

you'll get this output in data.txt (commas substituted by newlines):

Code: Select all

writeln=function writeln(){[native]}
write=function write(){[native]}
getSelection=function getSelection(){[native]}
width=480
vlinkColor=
URL=http://ingame.scea.com/wipeout/index.html?serviceId=wipeoutpure_ingamesupport_main&hostId=...&hostLanguage=en&pspId=...&skin=Default
title=
referrer=
links=
linkColor=
lastModified=Sat, 23 Apr 2005 19:07:27 GMT
images=
height=272
forms=
fgColor=
domain=ingame.scea.com
cookie=
bgColor=
anchors=
alinkColor=
handleEvent=function handleEvent(a){[native]}
location=http://ingame.scea.com/wipeout/index.html?serviceId=wipeoutpure_ingamesupport_main&hostId=...&hostLanguage=en&pspId=...&skin=Default

Looks like onFocus and onBlur works, too, so lets write the first homebrew game for PSP:

Code: Select all

<center><br><h1>First homebrew game for PSP by Shine</h1>
<form name=controller>
<input type=button value=left onFocus="left=true" onBlur="left=false">
<input type=button value=forward name=forward>
<input type=button value=right onFocus="right=true" onBlur="right=false">
Score&#58; <input type=text value=0 name=score size=4>
</form>
<script> 

// create playfield
document.write&#40;"<form name=playfield>"&#41;; 
var width = 7;
var height = 6;
for &#40;y = 0; y < height; y++&#41; &#123; 
  for &#40;x = 0; x < width; x++&#41; &#123; 
    field = x + y * width;
    document.write&#40;"<input type=button value=\" \" name=button" + field + ">"&#41;; 
  &#125;
  document.write&#40;"<br>"&#41;; 
&#125; 
document.write&#40;"</form>"&#41;; 

// init game variables
var left = false;
var right = false;
var direction = 0;
var xPos = 0;
var yPos = 0;
var xTarget = -1;
var yTarget = -1;
var score = 0;
document.controller.forward.focus&#40;&#41;;

// set a piece on the playfield
function setPiece&#40;x, y, c&#41; &#123;
  field = x + y * width;
  document.playfield&#91;"button" + field&#93;.value = c;
&#125;

// set target
function setTarget&#40;&#41; &#123;
  do &#123;
    xTarget = Math.floor&#40;Math.random&#40;&#41; * width&#41;;
    yTarget = Math.floor&#40;Math.random&#40;&#41; * height&#41;;
  &#125; while &#40;xTarget == xPos && yTarget == yPos&#41;;
  setPiece&#40;xTarget, yTarget, "+"&#41;;
&#125;

// update player position
function timer&#40;&#41; &#123; 
  if &#40;xTarget < 0&#41; setTarget&#40;&#41;;
  setPiece&#40;xPos, yPos, " "&#41;;
  if &#40;left&#41; direction--;
  if &#40;right&#41; direction++;
  if &#40;direction == 4&#41; direction = 0;
  if &#40;direction < 0&#41; direction = 3;
  switch &#40;direction&#41; &#123;
    case 0&#58; xPos++; break;
    case 1&#58; yPos++; break;
    case 2&#58; xPos--; break;
    case 3&#58; yPos--; break;
  &#125;
  if &#40;xPos < 0&#41; xPos = width - 1;
  if &#40;xPos == width&#41; xPos = 0;
  if &#40;yPos < 0&#41; yPos = height - 1;
  if &#40;yPos == height&#41; yPos = 0;
  if &#40;xPos == xTarget && yPos == yTarget&#41; &#123;
    setTarget&#40;&#41;;
    document.controller.score.value = ++score;
  &#125;
  setPiece&#40;xPos, yPos, "*"&#41;;
  timerID = setTimeout&#40;"timer&#40;&#41;", 700&#41;; 
&#125; 
timerID = setTimeout&#40;"timer&#40;&#41;", 700&#41;;
</script> 
</center>

This can be enhanced to a full snake-like game. A problem is with too many buttons: there is a limit where you can't change the texts any more. And for better graphics output perhaps someone should discover some DTHML or other features for smooth animations and things like this, but it is a start, now it's your turn :-)

I forgot a screenshot of the game for everyone without Wipeout Pure. You change the direction of the moving star by focusing on the left or right button and the score increments if you catch the plus.

[ooPo]

Hombrew, Hombre!

I can't say I'm excited by the game, but that's an interesting trick with the button text.

[Arjan]

documents.images is working, you can use that in games to create animations, moving things etc. (as seen in the PSPTetris)

When using images, it is recommended to set the height and width properties to prevent the browser from re-rendering the webpage (which is very slow on PSP).

Too bad the PSP doesn't crash when generating a stack overflow, I had hoped it could be used to inject your own code.

[Shine]

documents.images is working, you can use that in games to create animations, moving things etc. (as seen in the PSPTetris)

Nice game, but you can't use document.images for highres images, because it is too slow. See this Filltest (works only on the PSP browser), it's less than 400 pixels per second:

Code: Select all

<center>
Please wait while generating the bitmap...<br>
<script>
var width = 20;
var height = 20;
for &#40;y = 0; y < height; y++&#41; &#123;
  for &#40;x = 0; x < width; x++&#41; &#123;
    document.write&#40;"<img border=0 width=1 height=1 src=w.gif>"&#41;;
  &#125;
  document.write&#40;"<br>"&#41;;
&#125;
var count = 0;
var white = true;
function timer&#40;&#41; &#123; 
  clearTimeout&#40;timerID&#41;;
  white = !white;
  for &#40;y = 0; y < height; y++&#41; &#123;
    for &#40;x = 0; x < width; x++&#41; &#123;
      document.images&#91;x + y * width&#93;.src = white ? "w.gif" &#58; "b.gif";
    &#125;
  &#125;
  document.form.count.value = ++count;
  timerID = setTimeout&#40;"timer&#40;&#41;", 700&#41;; 
&#125; 

function start&#40;&#41; &#123;
  timerID = setTimeout&#40;"timer&#40;&#41;", 700&#41;;
&#125; 
</script> 
<form name=form>
<input type=button value=Start onclick="start&#40;&#41;;">
Count&#58; <input type=text value=0 name=count size=10>
</form>
</center>

And if you use a "width" and "height" of 50, not all image are updated and somtimes the PSP crashes (reboots, perhpas on watchdog timeout). The browser is very slow and full of bugs.

[qleyo]

the more I hear about wipeout the more i want to make a standalone browser cause i know its so possibel....but i'm not that smart?

it seems like its all to do with the parsing but how? theres not enough information on PSP development for a newbie, i've read up about the PBP files and the lot on here though...

Should I just lash out and get wipeout? for now?

[Shine]

I've tried to generate a large image filename to provocate a buffer overflow, that's the code:

Code: Select all

<center>
<a href="dummy1">dummy1</a><br>
<a href="dummy2">dummy2</a><br>
<script>
big=unescape&#40;"%u0000"&#41;;
for &#40;i = 0; i < 10; i++&#41; big = big + big; 
document.write&#40;big.length + "<br>"&#41;;
document.write&#40;"<img src=\"" + big + "\">"&#41;;
</script>
</center>

With this code the name of the image is 1024 chars, all binary 0 and it is displayed as the standard image for not found (with the question mark). Sometimes while reloading with the square button the green image is visible and stays forever, until you hit the square button again. If you change the loop to 18, it reloads multiple times, after some time only an empty page is visible, but you can still return to the game menu, but no options are selectable any more. This could be some memory problems. Looks like with i<17 and big=unescape("%u0001") you can't move in the links any more after one reload.

I don't know why parts of the system are hanging. The idea is to built a buffer with lots of NOPs, followed by some useful code (this can all be done with unescape) and then a buffer overflow changes some return address on the stack, jumping somewhere in the nop-area and then sliding to the useful code (the usual ugly hack, like others have done for InternetExplorer JavaScript exploits). Perhaps someone wants to do some more tests, with code from the hello-world example.

[Shine]

Reproducable crash (hardware reset) on reload button:

Code: Select all

<script> 
crash = "";
// 472&#58; normal
// 473&#58; no reload button &#40;square button&#41; possible any more
// 500&#58; press reload button for crash
for &#40;i = 0; i < 500; i++&#41; crash += "<b>";
document.write&#40;crash&#41;; 
</script> 

Looks like there is some internal buffer overflow for deep nested HTML-structures. Perhaps on first load there is a buffer overflow, which changes some other data and on reload it crashes, because of accessing these data.

[minddog]

I am unable to reproduce this crash w/ 500 count, it will just freeze the browser which is a known issue I've been able to reproduce with advanced xhtml/css usage. Can anyone else confirm this works?

Environment:
1.50 US PSP
US Wipeout Pure

[Shine]

I can reproduce it all the time, even if I switch the language setting or change the script (adding newlines, Unix/DOS newlines etc.). Perhaps you have another Wipeout Pure version? I've scanned my agent log and looks like there are three or four different PSP browser versions:

SCEJ PSP BROWSER 0102pspNavigator

SCEJ PSP BROWSER 0105 UCJS10007

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; SCEJ PSP BROWSER 0102pspNavigator)

SCEJ PSP BROWSER 0102pspNavigator (3E39B17616FA910FF86E5DBA2E952D287A04FAC5_ABCD)

I've setup a PHP script, which shows the browser type and contains the crash script. On reload it crashs my PSP:

http://www.frank-buss.de/tmp/crash.php

Edited: My WipeoutPure browser is "SCEJ PSP BROWSER 0102pspNavigator".

[EdZ]

After downloading the Gamma pack 1, I'm no longer able to get away from the wipeout pure page via the download screen (i.e. all the various DNS servers have no effect). The only other factor apart from the gamma pack that I can think of is a new Linksys router that's just been installed (in place of an old Orinoco one). Are there any router serrings or adjustments needed to get the web browser 'working' again, or will I have to remove the gamma pack for now?

[Pikoro]

anyone czeched to see if perhaps the gamma pack has a local html file with a redirector in it?

Just a thought.

Cheers

[Phydeaux]

i noticed this also, just create a new profile (in-game). No need to delete the gamma data.

[greycellgreen]

You can control Trillian on your desktop computer remotely with the Wipeout browser!

1. You need a paid version of Trillian (for 3rd party plug-in support).
2. Install this excellent plug-in: IM Everywhere
3. In webserver.ini (IM Everywhere's plug-in directory under Trillian), at the following line to the [User Agents] section without quotes:

"SCEJ PSP BROWSER=xhtml-mp-colour"

(Without the different template specified, it tries to open a new window with javascript for your contact list, which the browser can't do.)

4. If you don't have one already, you'll probably want a domain from either a static or dynamic DNS services like dyndns.org.

Obviously text-input is tedious on the PSP, but future browsers may improve upon that. At the very least, you can check your messages if there's any pressing need.

IM Everywhere by the way, works extremely well from any WAP phone or web browser. I find it's far superior to the IM providers' own WAP services, and their java clients. Plus it has the bonus of keeping my logs centralised on my desktop.

[greycellgreen]

I don't know if anyone even cares, but I've created an IM Everywhere template with a virtual keyboard for the PSP in it. I need to clean it up a bit, but I'll release it in a day or two.