!!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
New exploit, old game! Damn, it's so cool to actually see this beauty working - and on a PSP-3000 no less! The PSP scene was buzzing the other day when MaTiAz found an exploit (read: buffer overflow!) in the three year old game, GripShift.
Now then, the details: MaTiAz says that they've yet to find any further use for this, but it's still a new exploit. It could lead to further hacks, and for now, it's merely a proof of concept. Be that as it may, this is a great start, and a rather sweet find! Here's MaTiAz explaining the exploit:
GripShift has a buffer overflow vulnerability when loading savegames. The savegame contains the profile name which can be easily used to overwrite $ra. The savegame file is pretty big (25kB) so you have lots of space to put your code there. I wrote a simple blob of code to paint the framebuffer completely white (to just indicate that arbitrary code is running ). The return address is located at offset 0xA9 in the file. In this poc it points to 0x08E4CD50 (which is only a few bytes after the return address), and the code starts at 0xCC in the file.
It was tested on 4.01M33-2 with US version of GripShift (ULUS10040), and psplink.prx, usbhostfs.prx and deemerh.prx loaded (also without psplink and usbhostfs). The decrypted savegame (sorry, couldn't [be bothered to] get Shine's savegame tool working so it's in plaintext form) is in the SDDATA.BIN form which Hellcat's Savegame-Deemer produces (thanks to him, if the program didn't exist I wouldn't have bothered with this. ). Just copy the ULUS10040SAVE00 directory to /PSP/SAVEPLAIN/ and run the game. EDIT: yeah, don't forget to have Savegame-Deemer working, duh.
There are two versions of the exploit. The first which is the raw form from MaTiAz, the other one (v2), is a version encrypted by FreePlay. It's also been confirmed that it works all the way up to the recent CFW 5.02 GEN-A.
if u look around im sure youll find somthing but ill update if i find a link but soon the 3000 will be fully hacked so i know what im buying im not sure if its good or bad
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
Lol Spammer But thats pretty cool cuz u can now hack and have a built in mic :D SWEET
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
its not spam WTF but its not hacked yet wait a week or 2 and it will b
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
omg i cant freaking wait to mess socom up some more with a built in mic
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
dont update your 3000 or this will not work becuase sony fix it with the new update
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
Can some please post the 5.02 GEN-A fw so i can put on my psp i have grip shift i need the GEN-A fw please ?
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
No CFW yet. Not even a HEN.
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
PSP-3k just blows man,unless your not a hacker then youd luv it.
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
sooner or later they are going to release the HEN-A files and ill be able to hack my psp.
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
This is fake lol...
I've seen it on youtube...
It just flashes the psp screen grey to white and goes on...
phail!!!
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
I Have One Its Alright, It Would Be awsome If It Gets Hacked.
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
i hacked it...but it was pathetic
Re: !!!!!!!!!!!!!!!!!!psp300 exploit!!!!!!!!!!!!!!!!!
Quote:
Originally Posted by
25snipes
This is fake lol...
I've seen it on youtube...
It just flashes the psp screen grey to white and goes on...
phail!!!
It's a buffer overflow....noob. Meaning there's an exploit on its way to "hack" the PSP.
"phail"
