New PSP exploit found in GripShift, works on PSP-3000

xist

ΚΑΤΑ ΤΟΝ ΔΑΙΜΟΝΑ ΕΑΥΤΟΥ
OP
Member
Joined
Jul 14, 2008
Messages
5,859
Trophies
0
XP
973
Country
New PSP exploit found in GripShift, works on PSP-3000

QUOTE said:
Now this is how you start a new year! New exploit, old game! Damn, it's so cool to actually see this beauty working - and on a PSP-3000 no less! The PSP scene was buzzing the other day when MaTiAz found an exploit (read: buffer overflow!) in the three year old game, GripShift.

We'll leave the technical bits for later. Now, we'll have this video from FreePlay do the talking:

http://uk.youtube.com/watch?v=HAoZWymTySw&...g/49/aid/127658

Holy... mother... of... pearl... o_0

Now then, the details: MaTiAz says that they've yet to find any further use for this, but it's still a new exploit. It could lead to further hacks, and for now, it's merely a proof of concept. Be that as it may, this is a great start, and a rather sweet find! Here's MaTiAz explaining the exploit:

GripShift has a buffer overflow vulnerability when loading savegames. The savegame contains the profile name which can be easily used to overwrite $ra. The savegame file is pretty big (25kB) so you have lots of space to put your code there. I wrote a simple blob of code to paint the framebuffer completely white (to just indicate that arbitrary code is running ). The return address is located at offset 0xA9 in the file. In this poc it points to 0x08E4CD50 (which is only a few bytes after the return address), and the code starts at 0xCC in the file.


It was tested on 4.01M33-2 with US version of GripShift (ULUS10040), and psplink.prx, usbhostfs.prx and deemerh.prx loaded (also without psplink and usbhostfs). The decrypted savegame (sorry, couldn't [be bothered to] get Shine's savegame tool working so it's in plaintext form) is in the SDDATA.BIN form which Hellcat's Savegame-Deemer produces (thanks to him, if the program didn't exist I wouldn't have bothered with this. ). Just copy the ULUS10040SAVE00 directory to /PSP/SAVEPLAIN/ and run the game. EDIT: yeah, don't forget to have Savegame-Deemer working, duh.

There are two versions of the exploit. The first which is the raw form from MaTiAz, the other one (v2), is a version encrypted by FreePlay. It's also been confirmed that it works all the way up to the recent CFW 5.02 GEN-A.

We're getting there, people! Just a bit more... Hope springs eternal, folks!

Thanks to Sbrillo1 for the tip!

Before everyone rushes out to buy a copy of Gripshift however FreePlay notes -

QUOTEWhile there's a European save included, this was mainly for testing purposes. There are significant differences between the two versions (not the least being that Ubisoft was involved in the European one).

At the moment, *this code only works with the USA version of the game.* I'm pretty sure the exploit is in the European one, too, but haven't dealt with that yet.


Sony will probably patch this in newer firmwares as was the case in the past but for now hope springs eternal!
 

Doomsday Forte

Well-Known Member
Member
Joined
Apr 22, 2007
Messages
1,271
Trophies
0
Website
Visit site
XP
153
Country
United States
Hot damn. And this is an old game so it's unlikely they'll release a "fixed" version of it too...

Funny how game exploits have affected the PSPs through and through (Lumines, GTAVCS, and now Gripshift). =P
 

need4speed

Well-Known Member
Member
Joined
Nov 4, 2006
Messages
130
Trophies
0
Website
Visit site
XP
177
Country
Now thats really Intresting Indeed as I got a psp 3000. If It does work for the EU version of the game then I will get this game and then hack my psp 3000
smile.gif
Thanks for the Information.
 

RupeeClock

Colors 3D Snivy!
Member
Joined
May 15, 2008
Messages
6,457
Trophies
0
Age
32
Website
Visit site
XP
2,393
Country
Doomsday Forte said:
Hot damn. And this is an old game so it's unlikely they'll release a "fixed" version of it too...

Funny how game exploits have affected the PSPs through and through (Lumines, GTAVCS, and now Gripshift). =P

The exploits of using the same internal memory for save files, eh?
smileipb2.png


Wasn't there an old, web browser exploit in Wipeout?
 

Doomsday Forte

Well-Known Member
Member
Joined
Apr 22, 2007
Messages
1,271
Trophies
0
Website
Visit site
XP
153
Country
United States
kobykaan said:
No point getting excited about this until someone manages to actually get the EXPLOIT to ACTUALLY install CFW!
Well, no, no need to bust out the champagne and all, but it's something right now. Unlike the Datel Blue Battery thing, at least this has something in terms of promise out there.

But yes, I will say it is too early to celebrate now. It's a foothold at the least.
 

leonheart_a

Well-Known Member
Member
Joined
Dec 10, 2006
Messages
374
Trophies
0
Location
London
XP
284
Country
RupeeClock said:
Doomsday Forte said:
Hot damn. And this is an old game so it's unlikely they'll release a "fixed" version of it too...

Funny how game exploits have affected the PSPs through and through (Lumines, GTAVCS, and now Gripshift). =P

The exploits of using the same internal memory for save files, eh?
smileipb2.png


Wasn't there an old, web browser exploit in Wipeout?

Yeah there was, one of the first browsers if i remember. The game Fired Up also had one to
 

WildWon

EXTERMINATE!
Former Staff
Joined
Apr 4, 2008
Messages
2,822
Trophies
0
Location
8-Bit Heaven
XP
393
Country
United States

sconethief

Well-Known Member
Member
Joined
Jul 10, 2008
Messages
153
Trophies
0
Location
USA
XP
128
Country
United States
full article of what kobykaan said
smile.gif

Sparta exploit update
Back at it… MaTiAz & FreePlay have released a “Hello World” demonstration, as well as the SDK used to build said homebrew demo, for the newly discovered GripShift vulnerability.

QUOTE said:
Now coined the Sparta exploit, here’s what you should know: for the moment, you cannot downgrade or install a custom firmware with this, you may only enjoy Sparta-compiled homebrew and hope Sparta later leads to kernel mode access.

And finally, another video for your viewing pleasure –

FAQ
---
Q: Will this allow downgrading?
A: No, because this is an usermode exploit and functions required to downgrade are only available in kernel mode.

Q: Why the name?
A: Because the original exploit was found by overwriting the player name with "this is spartaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".

Q: Can/Will Sony block this?
A: Yes.

Q: I wanna make homebrew using the exploit. How?
A: Get FreePlay's GS SDK: http://tinyurl.com/sparta-sdk. It has some constraints though, check the readme. The Hello World was written with it.
smile.gif
 
General chit-chat
Help Users
  • No one is chatting at the moment.
    susbaconhairman @ susbaconhairman: what