PSP-Hacks.com

Join the Dashhacks Fan Club on FacebookFollow Dashhacks on TwitterDashhacks YouTube ChannelPSP-Hacks RSS Feed

Hack your Sony PSP

Forums | Tutorials | Custom Firmwares | PSP Themes | Search


 

KXploit Analyzed

greg | June 24, 2005

I was surfing PS2Dev.org’s forums and came across this post explaining how the KXploit gets around having to use a swap trick. He also has some theories about extending these vulnerablities to the v1.51 & 1.52 and shows that not everything was patched by Sony in their lastest updates.

It appears that the reason the single-card KXploit works on 1.5 is twofold:

1. Treating the filename as a format string causes the HELLO% folder name to be translated to HELLO when being passed to the bootstrap code
2. The 1.50 bootstrap executes a bare ELF if it’s been passed one

Of course, the bare ELF execution was fixed on 1.51 and 1.52, so it no longer works there, failing after boot with 80020148 (”file type unsupported”). But this would only work if the format string vulnerability were still there. Experimentation verifies this:

When danj tried using %p etc, the error changes to 80010002, which would be because HELLO%p changed to e.g. HELLO12345678, and 80010002 is ENOENT.

When Nick Fury tried %c, the error is 8001000D, which is EACCESS and could be caused by %c generating an invalid character in the filename.

When danj tried using %n, it crashes his PSP, because %n causes writes to memory. That’s the vulnerability.

I convinced a friend to upgrade 1.51 -> 1.52 and verified that this bug does still exist on 1.52. Writing an exploit is non-trivial, partially because we can’t see the result of the format string expansion, and partially because MIPS exploits could be annoying (need to flush dcache)… but it’s definitely got potential.

Share This With...
  • Facebook
  • Digg
  • Twitter
  • RSS
  • Slashdot
  • Technorati
  • del.icio.us
  • Reddit
  • Blogosphere News
  • HackerNews
  • StumbleUpon
  • Google Bookmarks
  • email
Comments (76)

Tagged:

RSS feed | Trackback URI

76 Comments »

Comment by raiderj
2005-06-24 14:20:34

Neat read! Sounds like there is hope for 1.51+

 
Comment by Bubba
2005-06-24 14:26:00

Well, now that you’ve told Sony what was broken, it’ll be that much harder to exploit in future firmware releases. Was your 5 minutes of ego gratification gained by posting this info worth screwing it up for the rest of us? Thanks, idiot.

 
Comment by pablo
2005-06-24 14:27:30

or not much..
sony patched up good this time, but there is always hope!

Is there a LIST OF ERROR codes?

 
Comment by Julien
2005-06-24 14:27:34

lol, ya you fucking dumbass.

 
Comment by Julien
2005-06-24 14:28:30

i was agreing with #2 by the way

 
Comment by F9zDark
2005-06-24 14:31:22

Being that the website is focused on developing for the PS2 and PSP, I’d say the information is well worth it. It gives developers and the end-users ideas of how or where the next exploit will take place. Not that person’s fault that you updated…

Don’t you think the smart move now would be to not update to any future firmware releases?

 
Comment by DISCYER
2005-06-24 14:37:20

this is very good news

 
Comment by pablo
2005-06-24 14:40:10

#6
I agree..

– imagine if other developers trying to do same thing over and over.. atleast this will give them a headstart.. don’t you think SONY will figure it out after exploit iss released???

also, how about a LIST of ERROR CODES? anyone.. hmmm.. :(

 
Comment by goodnews
2005-06-24 14:41:09

IN the first place someone that wants to be able to run homebrew buys the product at lunch. Everyone knows that every product at lunch will have an security issue. So, if you upgraded to 1.51 and 1.52 that means you bought the psp just for the games not for future expliots. I bought mine for homebrew thats way I bought it at lunch, so that sony would not patch its security holes later in the year.

 
Comment by MFDOOM
2005-06-24 14:41:19

you shouldnt post shit like this, sony will see it!

 
Comment by Administrator
2005-06-24 14:41:24

Bubba your ignorance truely amazes me. The hole point of this website is to openly discuss hacking the PSP. If it wasn’t for releasing these finds to the public for further investigation we wouldn’t be running homebrew on our PSP’s right now.

If we followed your false sense of logic no one but a very few amount of people would be using homebrew apps right now. Instead they would be in their basements holding on to this kick ass secret that Sony doesn’t know about.

 
Comment by musters
2005-06-24 14:42:08

Agreeing with #6.
Do you think that if you are able to obtain a work-around for 1.51+ that Sony will be unable to see our code, that they will be unable to decompile our librarys? They are the architects. I’m sure they have someone who sits at a desk all day and analyzes our exploits.

This battle will rage on, and regardless of whether we post our findings, or just release work-arounds, Sony will still be able to provide updates.

I am in favour of providing as much information to the Dev community as possible, so we can be on the ball and ready to handle anything Sony throws at us.

 
Comment by Administrator
2005-06-24 14:53:02

Sony has their firmware source code sitting infront of them. They know what’s up regardless of what we post. Remember, 1.51 was out before the 1.50 exploit was even released.

 
Comment by ISOHaven
2005-06-24 14:57:13

Amen! Sony will find out sooner or later no matter what.

Sony = Tricky Bitches!

:)

 
Comment by Bingo83
2005-06-24 15:06:23

Surely Sony would see homebrew as a massive selling point – how many people have you shown emulators etc to and they think its amazing. Look at how many people bought a GP32 for the same thing.

No code is secure and there will always be exploits found – it just might take longer than you or I would hope.

Whats the bet that come September time – there will be a chip released to bypass the bios.

 
Comment by MFDOOM
2005-06-24 15:09:57

PSP-DEV WILL GET AROUND ANYTHING!

 
Comment by DrKickflip13
2005-06-24 15:14:44

WOW theres is hope for PSP 1.51!
I got about every error code possible messing with this last night.

 
Comment by Administrator
2005-06-24 15:14:54

Sony does not see homebrew as a massive selling point because they dont make money on the hardware. They dont want people buying them up just to play old games on them.

They make their money from the games and free alternative games probably doesn’t sit too well with them.

 
Comment by RAIDER - X
2005-06-24 15:17:00

Seriously! You should put a post sayiong something like:

“NEW PSP HOMBREW EXPLOIT FOR FIRMWARE vX.XX!!
Email to recieve info and download.”

That way it is private and safe from sony getting their hands on it and patching it up in the next version.

 
Comment by RAIDER - X
2005-06-24 15:20:43

To add to my last comment, We should form an email community chain so that all members and frequent visitors of phc can be kept up to date with all the exploits and sony cant get our emails so its a good idea

 
Comment by HaredX
2005-06-24 15:25:24

LOL I gurantee sony has someone on the inside that is subscribed to all 5 million psp dev and psp hacking websites in the world, why do you think that someone working for Sony wouldn’t gain access to your proposed mailing list

 
Comment by RAIDER - X
2005-06-24 15:43:49

Ummmmmm….. Well u got me there, but its still safer than just posting here.

 
Comment by Daveid
2005-06-24 15:50:26

And wouldn’t it be rather easy for someone from Sony to subscribe to the mailing list LOL?

 
Comment by Administrator
2005-06-24 16:03:25

Raider X you’re just not getting it. Keeping it a secret from Sony is paranoid nonsense. Only by having a transparent open source dev community can we really hope to take them on.

It’s really simple if you want to use homebrew it needs to be public or you won’t get it. If it is kept secret then you will never get access to it and development of it will be alot harder.

Sony knows their own code and patched 1.50 before the exploit was ever released. They are the ones holding secrets not us.

 
Comment by Michael Chen
2005-06-24 16:06:21

Oh man, I wish I can run homebrew on my psp 1.51. I was stupid, updated, but I think there is hope.
Did anyone try this:
e.g. NES —->>>NES.1
NES —->>>NES.2

I try it, the homebrew started, but my psp froze when I try to select the games. can anybody help!!!!!!!!!!!!!! I think this is a big help too, can’t figer out what is wrong.

 
Comment by mvpo.geo
2005-06-24 16:08:27

Any one that thinks releasing this info is bad is an idiot. How do you think homebrew gets developed? Most of the times one person will find a small crack, another will take this and exploit it further finally more and more will look at it and fully develop it. As for a “secret E-mail community” that just makes it harder for people to get their info to everyone and it can cause for people to unsubscribe when useless info is sent through it. Finally what stops someone from sony making a Yahoo account and just using that to keep Sony informed? You guys should really think before you post.

 
Comment by mvpo.geo
2005-06-24 16:10:19

Micheal Chen, you mean the homebrew actually starts? Can you please further explain what you mean by renaming it NES.1? What are you renaming cause no one has gotten the homebrew to start that far on a 1.51. We have only gotten error messages…Please explain!

 
Comment by Olif
2005-06-24 16:10:23

Ah, yes, “Sony doesn’t know of this yet”. Gee, you guys are ego-driven, mentally-retarded. As soon as an exploit goes off, people are clearly aware of how it works and how to patch it. Posting this info here and anywhere else is HIGHLY valuable, it allows other parties to try their methods instead of keept close among one or two parties that may die with the info in their hands instead of spreading just because of the chance of “being the ones who cracked the stuff”. Good move: info must be spread.

 
Comment by Negroiso
2005-06-24 16:19:25

You guys are idots, honestly if an exploit is discovered as previously mentioned it just gets exploited more and more. The only way you will see a patch from it is from SONY. Although you the dumbass that bought the PSP and updated it will more than likely update your PSP again. Then you will turn around and complain why there isn’t an exploit for X.XX firmware cause you just updated. What you should do is use your F$#King head and realize not to update things just cause they are available.

POST INFORMATION!

Its the only way to get it out to the community and that my friend is the only way you will see stuff grow on the PSP or any other console/device. I am sorry you guys don’t fully understand what it means to share and grow. =\

The company that made the product will know the product, and will know its exploits. Thats why they have dev teams. When they release it I am sure the release is at a “ready to ship” status meaning we’ve worked on it long enough it will now play games with minimal or no problems. Later on they research exploits, security issues, and even place addons in the firmware. Be patient you sorry bastards!

 
Comment by mvpo.geo
2005-06-24 16:27:08

“”Oh man, I wish I can run homebrew on my psp 1.51. I was stupid, updated, but I think there is hope.
Did anyone try this:
e.g. NES —->>>NES.1
NES —->>>NES.2

I try it, the homebrew started, but my psp froze when I try to select the games. can anybody help!!!!!!!!!!!!!! I think this is a big help too, can’t figer out what is wrong.”"

MICHEAL CHEN AKA Number 25..

Can you please explain to me what you are renaming, even send me the files at mvpo.geo@yahoo.com. Like I said earlier you are the only person I have heard of that has gotten the homwbrew to start but freeze when you try to select a ROM. If this is true this is what seems to be a major breakthrough, I hope what you said is the truth.

 
Comment by HaredX
2005-06-24 16:55:24

lol he was obviously lying, i just did what he said and it definately did NOT run I got the same old 8002130 error

 
Comment by mvpo.geo
2005-06-24 17:01:23

Man, why even lie about something like that? Im not 100% sure what he changed the name on though….you are probably right and he is just an idiot that wanted to be part of the conversation further by posting that. I would like him to post here again though if he can and tell me what he renamed if this is true. Cause if it is Im 100% positive that some people with coding experience can figure out why the game is freezing from that point.

 
Comment by MadMatt
2005-06-24 17:20:26

This is a tad redundant, but of corse Sony knows what holes are in their own updates. Thats most likly why they released a 1.51 and 1.52 before the 1.5 was even hacked. As long as their are people tring there is hope that even if future games do need updates that their will be people to bypass of fix it. Ive come to my sinces that is enough kick-ass games come out for the PSP needing 1.5+ I will sadly upgrade. However there will always be hope of someone continuasly fighting Sony, and I cheer them on. (there would have to be a GOOD line of kick ass games to make me get rid of Megaman,mario,sonic, and Final Fantasy :p)

 
Comment by HaredX
2005-06-24 17:21:03

it doesnt make any sense, if he got the homebrew to run the games wouldnt freeze theres nothing from that point to stop it. he is lying

 
Comment by Sony
2005-06-24 17:24:45

Interesting…

 
Comment by mvpo.geo
2005-06-24 17:27:46

LOL at someone posting under Sony Lol

 
Comment by Julien
2005-06-24 17:37:20

lol, hey sony, if ur from sony, go fuck urself, lol

 
Comment by HaredX
2005-06-24 17:39:53

ok but think of it this way, sony released the 1.51 update before the exploit was released for 1.5, Sony has already released an update to 1.52 which means that there is a way around the update and it has to be pretty obvious to experienced coders if Sony has already found it and fixed it in 1.52

 
Comment by mvpo.geo
2005-06-24 17:51:48

Obviously its not so obvious cause us 1.51ers aren’t running any homebrew yet……

 
Comment by MFDOOM
2005-06-24 18:23:36

WHO CARES!!! THERE WILL ALWAYS BE AWAY AROUND IT!!!

 
Comment by fLuffer nutteRz
2005-06-24 18:24:31

i wouldnt doubt it if the v1.51 and so on need some type of system file in the memory stick to load to get past the code

the non % and % folders would probly still work , sony probly put in some type of file for the v1.51 that locks them when ran on the memory stick

if sony didnt want this to happen why did they allow games to be played off the memory stick.. when the hell are we getting them anyways.. how come they never said anything on how to do it and shit

good day

 
Comment by Skunk
2005-06-24 18:24:48

I laugh at how naive you seem to be. The firmware updates are not purely to patch security loopholes; they could be fixing/updating one or more of many aspects of the firmware. 1.52 may even be resolving a problem that was missed or even caused by the 1.51 update as often seen with Motherboard bios updates.

Skunk

 
Comment by RAIDER - X
2005-06-24 18:29:17

Ok maybe emailing is a gay way, it was just a fucking idea!!! Okaaaaayyy???? Anyway, sony is always gonna find out and we’re always gonna find a way around it sooner or later. If only we could program a homebrew that could allow u to freely change your firmware at will to different versions without adverse effects…

 
Comment by mvpo.geo
2005-06-24 18:31:27

Ok I have one better for everyone, they are releasing an RPG game that you create on your computer. You then transfer it to your memory stick and run it on the PSP. When this is released every version on Firmware should have a hack because they will have to let this game be played on every version of firmware…!!!!

 
Comment by HaredX
2005-06-24 18:42:48

lol that is a japenese project thats not even endorsed by sony, its more or less homebrew

 
Comment by mvpo.geo
2005-06-24 18:56:12

lol

 
Comment by kei wo
2005-06-24 19:03:56

#49

actualy you are very right the v1.52 allows you to play “UMD MUSIC” check out the sight.

http://www.us.playstation.com/PSP.aspx?id=softwareupdate

 
Comment by kei wo
2005-06-24 19:10:11

this is because the UMD was just excepted as a “standard format” by ECMA Int. so now there gona release music UMDs and any other type of media you can put on disc.

source Forbes.

http://www.forbes.com/afxnewslimited/
feeds/afx/2005/06/24/afx2109823.html

 
Comment by MadMatt
2005-06-24 19:11:34

I dont know… Im pretty happy with my 1.5 . I can live another day without playing music from my games… instead of accully playing them. :P

 
Comment by kei wo
2005-06-24 19:12:10

Skunk good obsevation man. =)

 
Comment by MadMatt
2005-06-24 19:13:45

Oh, i missunderstod, well I still like playing MP3s from my memory stick. Its alot cheaper than geting a UMD music disk (I pay for my music… 30% of the time :) )

 
Comment by kei wo
2005-06-24 19:16:02

i personaly think there is a sony secured loop-hole to allow homebrew, now that its UMDs are a standard.

in the near future UMD drives on every thing ,lol.

 
Comment by Sony
2005-06-24 19:22:36

That’s funny, you tell me, “go fuck yourself.”

If it weren’t for me, there wouldn’t BE a PSP, now would there.

If you idiots wanted to play shitty old NES and SNES games then you should have bought a Nintendo DS. The PSP WILL require firmware updates in newer games that WILL override illegal use of the PSP. If you crack it, we patch it.

Have a nice day.

Comment by Tekaz
2007-08-21 20:52:24

if it weren’t for you there’d be no PSP? so are you the one who thought up the whole idea?

 
 
Comment by fLuffer nutteRz
2005-06-24 19:26:26

well..

if you patch it , we crack it

 
Comment by fLuffer nutteRz
2005-06-24 19:28:31

oh and about the firmware updates on the umd disks..

sony better send out some strong signal waves to everybody with psp’s otherwize people wont be buying games cause they dont have internet to do so

loss of sales isnt what sony wants

 
Comment by kei wo
2005-06-24 19:35:21

you can get free upgrade for any wifi center

 
Comment by kei wo
2005-06-24 19:36:05

just go to network update on your psp

 
Comment by MadMatt
2005-06-24 19:44:38

my god sony, have you anything better to do than roleplay as a sony employee? correction: If it were not for US, the consumer, there would be no PSP. it goes both ways.

Comment by Tekaz
2007-08-21 20:55:17

and you’re a putz too… the PSP was developed and designed by sony in japan, so the US consumer had nothing to do with it initially. in fact, the first shipment of psp’s in japan sold out in 6 hours back in 2004. no such thing ever happened over here. you’re a goof

 
 
Comment by alex
2005-06-24 19:45:26

oh yeah.

 
Comment by Curious1
2005-06-24 20:00:45

I dont know what forum to really ask this, but does any1 know where i can find a list of UMD games that actually update ur PSP to anything higher than v1.5?

 
Comment by MadMatt
2005-06-24 20:03:49

so far… all we have thats confermed if coded arms requiering 1.5, no higher. there are no games anounced going to need higher than 1.5. also there are no other games known needing a 1.5 other than coded arms.

 
Comment by danish
2005-06-24 21:04:16

even if sony pacthes up the updates if somebody makes a 6gigs memory stick we could put the games on the psp just like ppl do with xboxes they mod them n get dvd r or somthin n put games in them

 
Comment by kei wo
2005-06-24 22:13:37

to #60 there is no such list because but you can always ask sony.

 
Comment by harry22
2005-06-25 04:24:54

Anyone here tried to run XMAME on 1.50,or has anyone already been playing it ???I cant get it to run…..

 
Comment by Sygon
2005-06-25 10:41:33

Ok, this is just a thought, they mentioned that %p causes the string to become (original string) + “12345678″, if there is a way to make it execute the %p more than once you could cause a memory buffer overflow and possibly null op to a different address using the %n to set an address number to goto (this would be horribly hard to accomplish if even possible)… its a long shot but it could be a plauseable solution…

 
Comment by psp-brother
2005-06-25 15:02:52

i am going to check this site at least 5 times a day, until homebrew is available for 1.51

i cant beleive how stupid i was downloading that, im thinking of returning it for a 1.50, do you think they still sell them?

 
Comment by Thanhda
2005-06-25 17:17:27

in dont understand playing MUSIC UMD? how about the demo disc. it seem to have music umd capabilities. weird o_O;

 
Comment by Sygon
2005-06-25 19:21:02

All the update did was change where the music showed up on a music UMD… instead of games it shows up in the music section now.

 
Comment by WiseMaster
2005-07-08 01:44:36

What I don’t understand is why Sony has to be so proprietary in the first place. All they want to do is prevent creativity. Why don’t they phuking take a look at some of the better gaming companies our there. For example ID Software has links to a FULL engine SDK and manual complete sith forums and support. Is Sony so phuking scared of losing profit that they are willing to hinder the creative of the entire world. There are only 3 incoming freshman computer science major at the college my friend is going to. That is absolutely pathetic. Bill Gates even admits there is a lack of developers out there, well its because of companies like Sony that do nothing but keep secrets. Its sad really, I am starting to regret spending all this money on the PSP and a few games just to realize that it will never get any better. We can try all to change it all we want, but Sony is the proprietary monsters with all the secrets not us. Good luck to everyone, and i hope someday Sony will realize their stupidity and create something that is meant to be changed.

 
Comment by GrayFOX
2005-07-18 01:24:22

If an of you guys find out about running emulators on 1.51,please let me know, i would really like to play RPG’s on my PSP.There aren’t any rpgs for the PSP at the moment.(which sux ass)anywho, my email is grayfox22@gmail.com
it will be greatly appreciated.
Thanks in advance.

 
Comment by Sony
2005-07-19 07:55:28

Since you want me to fuck my self why dont you? well any way 1.52 is out and we got a 1.53 on the way so, if u crack it, require you to patch it. We will Be releasing 2 patches a day so one way to say it play mutiplayer and get patched and scaned for Homebrews

 
Comment by anonymous
2005-07-31 05:56:43

it was stupid buying psp version 1.51.
I can’t use the emulators and play games…why???

 
Comment by Chaldean Hacker
2005-09-12 18:14:01

I updated my PSP from .5 but stopped at 99%. Everything saved I think, but my firmware dosen’t say 1.51. Is there any hope for me?

 
Comment by Chaldean Hacker
2005-09-12 18:16:12

Quick Diagram

1.5 + 99% of 1.51 = 1.5

 
<< Login :: Register >>
Name (required)
E-mail (required - never shown publicly)
URI
Your Comment (smaller size | larger size)


Affiliates



Video Games






PSP Hacks Archives