One Step Closer To Homebrew On Psp V2.0 :d


V3X

Dance Pac-man. DANCE!!!!
Joined
Mar 10, 2004
Messages
739
Age
34
Location
sunbury, victoria, australia
Website
Visit site
got this from psp emu news:

http://psp-news.dcemu.co.uk said:
PSP V2.0 Exploit Found
Posted on Sat 24 Sep 2005, 2:03 AM

Theres a real exploit been found in V2.0 PSPs, the group who are behind it are unknown at this time and sites are claiming its there find when thats rubbish but anyway heres the full readme.txt:


First Homebrew Code on 2.00
-----------------------------

1. Set wallpaper to frame_buffer.png (without overflow.tif present
in the PHOTO directory, or it will crash).
2. Add overflow.tif to the PHOTO directory, and open into the photo
viewer. Custom code to paint the screen! Or to write a homebrew
app! Not to run illegal games.

How It Works?
---------------

1. The PNG contains a small amount of code in a known, fixed place
(the VRAM). If to look closely at the wallpaper, sees small
coloured pixels in the right down. The pixels are Allegrex
opcodes, with the highest byte all zero for the ALPHA. These
pixels do:

syscall 0x20C7 ; sceKernelDcacheWritebackInvalidateAll
slt a0, zero, sp ; put 1 into a0
sll a0, a0, 6 ; put 64 into a0
addiu a0, sp, a0 ; get screen painter address over SP
jr a0 ; jump to the screen painter
nop ; branch delay slot

2. The TIFF contains also some code and a buffer to trigger the
known BitsPerSample overflow in libtiff in the photo viewer.
The buffer makes a jump to the VRAM which has the PNG colours
by overwriting the safed ra (return address) on the stack.
The VRAM code uses SP and calculates the address of the buffer
then runs it. Then it jumps there. The screen is yellow as
the colour was 0x12345678 in Hex.

PSP Users:

We didn't do this so you could steal from Sony and game companies.
We believe in OSS. There are plenty of amazing programs that have
been written for the PSP. Use this as a gift and not as an excuse
to steal.

Sony:

If you wanted to find us i know you could. This release wasn't
intended as a way to run pirated software on the PSP. We believe
that everyone should be able to compile their own code and run it.
Nothing is kept secret forever and i'm sure you know this.
In the end, if it wasn't us. It would be some one else.
Fighting it would be like skating up a hill. You did create the
PSP and did an amazing job.

Toc2rta:
To the people of the Toc2rta development network. You're our phone
a friend. With out your friendship this would never of happened.
I hope this brings you as much happiness as it brings us.
Join us on irc.toc2rta.com.

Most importantly... Have fun!

http://psp-news.dcemu.co.uk/
 
Last edited by a moderator:
And of course the first things someone will do is use it to try and get disk images to run, then maybe some emulators.

The "to sony" part is going to be completely ignored. Nice to hear though, I still havent updateed but I'm bound to buy either Burnout or GTA eventually.
 
Alpha2 posted on Sep 24 2005 at 03:49 AM said:
I still havent updateed but I'm bound to buy either Burnout or GTA eventually.

and...? Still don't have to update.
 
Last edited by a moderator:
Really? Actually I already knew about the version changer but I assumed Burnout pushed you up higher, well atleast I know I dont need to anytimes soon, but I most definatly will end up changing when GTA comes out, that's almost certain to be 2.0
 
Fishbong posted on Sep 24 2005 at 03:27 PM said:
Its still depresSing to hear that SO MANY UNINFORMED guys know nothing about the version changer.


NOONE NEEDS TO UPDATE HIS PSP TO PLAY ANY GAME !!!11!!!!1

Just have a look at this <_< PSP Archive
What happens when a game actually uses the new developer functions /API calls ? whatever they are?
 
Last edited by a moderator:
Every firmware upgrade also adds more functions/API calls for developers to use. When a game uses those calls and the firmware version is spoofed, then the game should crash since it cant call those functions.

Note: I could be wrong about this so someone correct me now if I am...
 
yaustar posted on Sep 24 2005 at 11:41 PM said:
Every firmware upgrade also adds more functions/API calls for developers to use. When a game uses those calls and the firmware version is spoofed, then the game should crash since it cant call those functions.

Note: I could be wrong about this so someone correct me now if I am...
not all f/w updates do, but 1.5 did. but no matter since 1.5 has been cracked.
 
Last edited by a moderator:
I would presume, that's what Sony does with the FWs and just adds features like web brosing or a new codec to make it not seem like it's specifically to foil a hack. I feel like all the additions they make to the FWs every so often might eventually cause them to get bloated and ruin the performance of their commercial games, obviously I don't know this for certain but if feels like something that could happen.
 
yaustar posted on Sep 24 2005 at 10:41 PM said:
Every firmware upgrade also adds more functions/API calls for developers to use. When a game uses those calls and the firmware version is spoofed, then the game should crash since it cant call those functions.

Note: I could be wrong about this so someone correct me now if I am...

Yes, but at the momemt we are ok as 2.0 does not use any new API calls apparently. So we're safe with 2.0.
 
Last edited by a moderator:
so far their is -

Overflow buffer
Hello World
Pong *Demo*
Firmware dumper
 
Exploite in the Media Player now maybe -

<xylon5> Looks like a hole has been found in the media player now
* Tamil|css has joined #pspchat
<dan21> any new psp game releases?
<Ibby> lol
<xylon5> Now this is looking promising as it could mean kernal mode
<heXLuth0r> media player?
<heXLuth0r> link?
* NostroMo has joined #pspchat
<S_Tsung> does the button swap operate with kernel priviledge?
<xylon5> Its us who have found it. Guys, this is NOT confirmed as yet... still working on it so stay tuned we'll update soon
<barbapapaz> you have pong tiff please
<S_Tsung> i noticed their authors also made a demo of UMD dumping
<Tamil|css> but trail
* joenewbre has quit IRC (Quit: )
<Tamil|css> nor full version
<xylon5> Yeah its when u open a file to play
<ph0rkeh> http://dingdingdong.ytmnd.com/
<Wursbrot> xylon5: then you can enter kernel mode ? ^^
<skoogis> w00t? ernel mode?
<skoogis> kernel mode
<xylon5> Yes we are hoping its gonna allow us straight into the heart, it's looking good but please just wait till we know more
<skoogis> how long will we wait?
<Wursbrot> xylon5: i dont post shit and rumors ^^ i am calm onto that...
<Wursbrot> its interessting to know though.
<mr_dank> omg ph0rkeh wth is that
<Zillaaa> xylon5 whatever you guys are working on, good luck =)
* isidore has joined #pspchat
* teufel66 has joined #pspchat
<xylon5> I couldn't say, really dont know. A couple of us are working on it now
* ph0rkeh has quit IRC (Quit: Computers are not intelligent. They only think they are.)
* Ethan80 has quit IRC (Quit: Ethan80)
<Wursbrot> xylon5: can i pm u? interessted in principe
* Proc has joined #pspchat
<skoogis> are we talking about hours, days, weeks?
<heXLuth0r> open source!
<xylon5> This is why I am not saying stuff like HACK FOUND!!!!! Because we're just taking it slowly and easily
<skoogis> thats good!
* joeMJ has joined #pspchat
<Tamil|css> ^^
* Blume has joined #pspchat
<xylon5> Lets say a couple of days till we have more info... I'm going 4 now, but feel free to pm me later if u wanna know more

From http://www.pspmod.com/forums/showthread.php?t=1812
 
Back
Top