Gaming PsP 3000, exploit found

sconethief

Well-Known Member
OP
Member
Joined
Jul 10, 2008
Messages
153
Trophies
0
Location
USA
XP
128
Country
United States

youtube (since embedded aint working )
QUOTE said:
GripShift has a buffer overflow vulnerability when loading savegames. The savegame contains the profile name which can be easily used to overwrite $ra. The savegame file is pretty big (25kB) so you have lots of space to put your code there. I wrote a simple blob of code to paint the framebuffer completely white (to just indicate that arbitrary code is running). The return address is located at offset 0xA9 in the file. In this poc it points to 0×08E4CD50 (which is only a few bytes after the return address), and the code starts at 0xCC in the file.

It was tested on 4.01M33-2 with US version of GripShift (ULUS10040), and psplink.prx, usbhostfs.prx and deemerh.prx loaded (also without psplink and usbhostfs). The decrypted savegame (sorry, couldn’t [be bothered to] get Shine’s savegame tool working so it’s in plaintext form) is in the SDDATA.BIN form which Hellcat’s Savegame-Deemer produces (thanks to him, if the program didn’t exist I wouldn’t have bothered with this). Just copy the ULUS10040SAVE00 directory to /PSP/SAVEPLAIN/ and run the game. EDIT: yeah, don’t forget to have Savegame-Deemer working, duh.
The original article found here
 

Pizzaroo

douchebag
Member
Joined
Feb 2, 2008
Messages
1,161
Trophies
0
Age
31
Website
Visit site
XP
403
Country
United States
Already announced about 10 mins ago by someone else, sorry
frown.gif
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • SylverReZ @ SylverReZ:
    @ZeroT21, The Russians are after you lol.
  • K3Nv2 @ K3Nv2:
    Send me your ip I'll remotely fix it
  • ZeroT21 @ ZeroT21:
    @K3Nv2 my head needs fixing if I believe you
  • ZeroT21 @ ZeroT21:
    it's kinda fun watching it happen tho
  • K3Nv2 @ K3Nv2:
    It needs fixing for other things but your pc I can fix
  • ZeroT21 @ ZeroT21:
    over 300+ virus/trojians/worms after scanning, what did I do to deserve this attention lol
  • ZeroT21 @ ZeroT21:
    tho I find it funny when i receive other people's pc/laptops in this state
  • ZeroT21 @ ZeroT21:
    i wont be upgrading unless I cant run the games i want anymore
  • K3Nv2 @ K3Nv2:
    Spill water on it good excuse
  • ZeroT21 @ ZeroT21:
    @K3Nv2 that's like a valid option if someone else is paying for ya
  • K3Nv2 @ K3Nv2:
    Daddy's wallet
  • K3Nv2 @ K3Nv2:
    Ngl hogwarts legacy has good pooping music
  • OctoAori20 @ OctoAori20:
    That's uh-
  • OctoAori20 @ OctoAori20:
    That's certainly a Dairy Queen sign lmao
  • K3Nv2 @ K3Nv2:
    You should see his help wanted signs
  • OctoAori20 @ OctoAori20:
    Ugh, so many sweat-dipwads in Sploon 3 Anarchy mode tonight
  • OctoAori20 @ OctoAori20:
    I didn't know this was "Make Octo never finish Fresh Season 2024 Catalog in Splatoon 3" month, good god
  • Veho @ Veho:
    What's the point of "confirming" games you know will get released. Like Nintendo "confirming" a Zelda sequel. "We can't be sure Nintendo is working on a new Zelda game, or if a new Zelda game will ever be released, until they officially confirm it."
  • Veho @ Veho:
    "There is literally no way to know if they will ever release a new Zelda game, it's wild speculation until they officially confirm it."
  • K3Nv2 @ K3Nv2:
    Black ops was the lesser shitter line in cock a poopoo tbf just a way to let people know it hasn't died or going a different route I guess
  • K3Nv2 @ K3Nv2:
    $70 DLC per 6 months is what it turned into
    K3Nv2 @ K3Nv2: https://youtu.be/R28ZSY2Sc2A?si=H5Lb6PNkzMhAHO_P