Tweet
A member by the name of MaTiAz over at lan.st has found a new exploit in the three year old game, GripShift. Due to my lack of software knowledge I have no clue what the technical details mean, but here they are, quoted directly from MaTiAz himself:
GripShift has a buffer overflow vulnerability when loading savegames. The savegame contains the profile name which can be easily used to overwrite $ra.
The savegame file is pretty big (25kB) so you have lots of space to put your code there. I wrote a simple blob of code to paint the framebuffer completely white (to just indicate that arbitrary code is running ).
The return address is located at offset 0xA9 in the file. In this poc it points to 0×08E4CD50 (which is only a few bytes after the return address), and the code starts at 0xCC in the file.It was tested on 4.01M33-2 with US version of GripShift (ULUS10040), and psplink.prx, usbhostfs.prx and deemerh.prx loaded (also without psplink and usbhostfs). The decrypted savegame (sorry, couldn?t [be bothered to] get Shine?s savegame tool working so it?s in plaintext form) is in the SDDATA.BIN form which Hellcat?s Savegame-Deemer produces (thanks to him, if the program didn?t exist I wouldn?t have bothered with this. ). Just copy the ULUS10040SAVE00 directory to /PSP/SAVEPLAIN/ and run the game. EDIT: yeah, don?t forget to have Savegame-Deemer working, duh.
A link to the files to try this yourself is here:
http://koti.kapsi.fi/~matiaz/psp/gripshift_poc.zip
And here is the encrypted save file:
http://koti.kapsi.fi/~matiaz/psp/gri...c_built_v2.zip
(careful? it?s flashy and could cause seizures.)
As for proof? Here:
PSP-3000 proof of concept
Does this mean we?re going to have custom firmware soon on the PSP-3000? Let us hope so. This exploit definitely brings us one step closer to CFW, and who knows? Maybe within a month we?ll have reached our goal!
Thanks, Slim Hacker, for the tip.
..UPPDATERING MED TVÅ VIDEOS..
http://www.youtube.com/watch?v=HAoZWymTySw
http://www.youtube.com/watch?v=0KdIr...eature=related
GripShift has a buffer overflow vulnerability when loading savegames. The savegame contains the profile name which can be easily used to overwrite $ra.
The savegame file is pretty big (25kB) so you have lots of space to put your code there. I wrote a simple blob of code to paint the framebuffer completely white (to just indicate that arbitrary code is running ).
The return address is located at offset 0xA9 in the file. In this poc it points to 0×08E4CD50 (which is only a few bytes after the return address), and the code starts at 0xCC in the file.It was tested on 4.01M33-2 with US version of GripShift (ULUS10040), and psplink.prx, usbhostfs.prx and deemerh.prx loaded (also without psplink and usbhostfs). The decrypted savegame (sorry, couldn?t [be bothered to] get Shine?s savegame tool working so it?s in plaintext form) is in the SDDATA.BIN form which Hellcat?s Savegame-Deemer produces (thanks to him, if the program didn?t exist I wouldn?t have bothered with this. ). Just copy the ULUS10040SAVE00 directory to /PSP/SAVEPLAIN/ and run the game. EDIT: yeah, don?t forget to have Savegame-Deemer working, duh.
A link to the files to try this yourself is here:
http://koti.kapsi.fi/~matiaz/psp/gripshift_poc.zip
And here is the encrypted save file:
http://koti.kapsi.fi/~matiaz/psp/gri...c_built_v2.zip
(careful? it?s flashy and could cause seizures.)
As for proof? Here:
PSP-3000 proof of concept
Does this mean we?re going to have custom firmware soon on the PSP-3000? Let us hope so. This exploit definitely brings us one step closer to CFW, and who knows? Maybe within a month we?ll have reached our goal!
Thanks, Slim Hacker, for the tip.
..UPPDATERING MED TVÅ VIDEOS..
http://www.youtube.com/watch?v=HAoZWymTySw
http://www.youtube.com/watch?v=0KdIr...eature=related
*
Comment