Also from the Dash Hacks Network: ps3-hacks.com xbox360-hacks.com nes-hacks.com iphone-hacks.com ipod-hacks.net dashhacks.com
2.0 Exploited
Alias420 | September 23, 2005
Update: This proof of concept has now been confirmed as a working exploit for the 2.0 firmware. Now we have to wait until some more useful code using this exploit is released :) Remember who had it first PSP-Hacks.com
We just received a very convincing email claiming to have hacked the 2.0 firmware. We do not currently have a 2.0 PSP accessible right now. So we would like our members to try it out and let us know how it goes. We’ve been hearing rants for a while about no 2.0 news so here is a chance to not just complain but actually help out and let us know if it works.
First Homebrew Code on 2.00
—————————–
1. Set wallpaper to frame_buffer.png (without overflow.tif present
in the PHOTO directory, or it will crash).
2. Add overflow.tif to the PHOTO directory, and open into the photo
viewer. Custom code to paint the screen! Or to write a homebrew
app! Not to run illegal games.
How It Works?
—————
1. The PNG contains a small amount of code in a known, fixed place
(the VRAM). If to look closely at the wallpaper, sees small
coloured pixels in the right down. The pixels are Allegrex
opcodes, with the highest byte all zero for the ALPHA. These
pixels do:
syscall 0×20C7 ; sceKernelDcacheWritebackInvalidateAll
slt a0, zero, sp ; put 1 into a0
sll a0, a0, 6 ; put 64 into a0
addiu a0, sp, a0 ; get screen painter address over SP
jr a0 ; jump to the screen painter
nop ; branch delay slot
2. The TIFF contains also some code and a buffer to trigger the
known BitsPerSample overflow in libtiff in the photo viewer.
The buffer makes a jump to the VRAM which has the PNG colours
by overwriting the safed ra (return address) on the stack.
The VRAM code uses SP and calculates the address of the buffer
then runs it. Then it jumps there. The screen is yellow as
the colour was 0×12345678 in Hex.
PSP Users:
We didn’t do this so you could steal from Sony and game companies.
We believe in OSS. There are plenty of amazing programs that have
been written for the PSP. Use this as a gift and not as an excuse
to steal.
Sony:
If you wanted to find us i know you could. This release wasn’t
intended as a way to run pirated software on the PSP. We believe
that everyone should be able to compile their own code and run it.
Nothing is kept secret forever and i’m sure you know this.
In the end, if it wasn’t us. It would be some one else.
Fighting it would be like skating up a hill. You did create the
PSP and did an amazing job.
Toc2rta:
To the people of the Toc2rta development network. You’re our phone
a friend. With out your friendship this would never of happened.
I hope this brings you as much happiness as it brings us.
Join us on irc.toc2rta.com.
Most importantly… Have fun!
Download required files or go to the download section
what???? crazy cool if this is for real
haha this is great news !!
is it really can use?
i am really looking forward to it!
doesnt work, try it
Isnt that because the codes to go into this?
Wow great news, well now we can run homebrew and get the encryptation code for 2.0, so say in about some days PSP can run homebrew software AGAIN.
YESSSSSSS
#4 did you try it?
I try it and it doesent fuck your psp… but … it turn off it… you turn on… the version still the same… someone have more info?
it says that the png file is cruppted what to do ?
Lol I don’t even understand what they’re saying. Anyway I think it’s a fake.
I’ll wait till all the homebrews and apps are converted for the 2.0 if it actually works. I’ll update after that.
this has been proven to function.i have tried it with various code and it works perfectly…im working on getting this to boot more code(like a PBP loader for example…)
#8 This isn’t a downgrader
why i cant use it?!?!
it hangs my psp
So, after you load this, and it does what it does…
how do i get a snes emulator to run? (if even possible)
Wow, well i cant wait till it really works. Until then im sticking with 1.5
you need to convert your SNES to this expliot method
this is amazing if it truly works and i really hope this works cause im upgrading if it does but not untill there is solid evidence it does
put frame_buffer.png into photo directory?
set it as wallpaper…then delete it and put the overflow.tif into it..an i rite?
This really works…somehow.
Executed something ochre before it crashed.
Can’t wait until somebody really does something useful with this.
it’s supposed to without code.the overrun TIFF can be edited in windows picture and fax viewer,text can be added along with many other features.
how will like a app snes9x work with this ??? is it hard from this ?
does this matter which type of 2.0 you need?? jap (1st one) or american one???
there needs to be a forum topic about this.
AND THERE NEEDS TO BE WORKING SNES 9X FOR IT!
i followed the steps i loaded the png. set it as wallpaper n then i loaded the overflow n my screen just turned brown
how hard will it be to make e,g snes9x, fastloader ? from this thing ???
Not hard I imagine. Patience is required. I’m sure a PBP launcher isn’t far off.
can sum1 explain what does this mean for 2.00 is it done cracked or not and how long b4 we see homebrew
It’s not done yet, guys.
This is proof of concept code.
Once we get a pbp loader, we’ll be golden.
this is more than lileky only an exploit for 2.00 jap as many ppl’s psp crashes.. also the CRC32 fro thr jap and the us fw are completely different… something was changed in 2.00 us.. it wasn’t delayed for a reason it prolly is that hole that was fixed….
Tested on my euro 2.00 , work as expected in the readme
I cant choose any Theme after this trick.
I only set images as wallpaper :(
how can i deactivate this?
haihz
so i cant do anything with it then?
@31 in the theme settings, there should be a ‘USE Wallpaper’ option, turn it off.
Gr8!! :)
Now all we have to do is wait that homebrew comes out in .tiff files xD
Indeed it works… but, if the creaters are listening, it has a little problem… if u have more than one photo in the photo library, it loads the miniatures and when it loads the .tiff it apply’s the code and uses the exploit. I am not sure if this can be fixed but indeed is a great discovery =)
Homebrew will be again =)
Nice job!
i upgraded it from winning eleven umd…
so i cant use it?
damn i hope someone jumps on this quick.. anyone have the jap2.0 update or a link to it??
quote:
@31 in the theme settings, there should be a ‘USE Wallpaper’ option, turn it off.
thx :P i did not see that.
Worked on my euro 2.0, cant wait for the loader now, well done guys!
You can view your images through the web browser just add the directory link into your html bookmarks file and walla you have best of both
is it that us2.00 cant use it?
Jesus, it certainly didn’t work properly for me.
I followed instructions, then when scrolling down the image list to find the overflow.tif to view the system goes berserk and the screen barfs lots of horrible shit.
Luckily the PSP does, in fact, still work.
how do i work this
#41 r u dumb thats wut its supposed to do provin that it works. read the instructions and other comments be4 u go embarassing urself
41 thats exactly what it is supposed to do, its a proof of concept only, they have managed to get the psp 2 version to run thier own code, first step, then hello world, i hope.
Tout simplement terrible. Merci beaucoup.
Fonctionne sur psp euro (fr) v2.0
when can we expect homebrew to start ? what is buffer overflow is it good way to running homebrew
WOW ! just testet this with my PSP 2.0 EU and it does just what the exploit is supposed to do. IT WORKS ! Now sombody should share some programming faq´s with us so we kann start understanding und using this exploit. A tool like kxploit would even be greater !! Thanks to the programmers. (this will be used for pirated stuff for shure :-( ) but I hope Homebrew comes first.
JUst today someone in my class said “it will probably be cracked in a week” and I was like “nah maybe a couple months” but it happened on the same day I opened my mouth. I think I’ll stick with my v 1.5 and when the VERY TALENTED people who release codes figure out how to use this xploit then I will switch to 2.0, enjoy the browser, and switch over all my apps. This is some of the best news I have heard in a long time. I am sure it will take a couple months to run the code and all that but Kudos to whom ever figured this out. Now EVERYONE CAN UPGRADE AND SHUT UP ABOUT A DOWN GRADER. PS WAB can lick DEEEEEEEEES NUUUUUUUUUTSS LOL!!!!!
#44, you can suck my cock it didn’t do what it was supposed to.
What happened to my PSP simply looked like memory corruption.
Does what it is supposed to on my White JAP PSP. I think we potentially have a winner here. All that latest flash emulation work by humma, I think we may be able to get some nice stuff working on the 2.0. I’m spending this weekend coding! woo woo!
41 you’ll have to wait until someone releases some code for it. Just be patient. Its nice to see another xploit come through. I am sure they will re-release all the nice apps using this later on.
Also make note you dumbasses, I said I encounter issues before I ever even get a chance to view the image.
You fucking morons just don’t get it.
It didn’t work on my system. It hung it, I had to hard-reset it. It didn’t display a mustard colour, it distorted the contents of the screen until they were unreadable then just locked up.
anyone have a link to the JULY JAPANESE 2.0??
A buffer overflow exploit takes advantage of a block of data in code that does not explicitly check whether the data that is written to it will fit. I’m not terribly knowledgeable about this but I believe certain machine instructions (like those described above) are inserted into the part that flows past the bounds of the buffer, overwriting whatever code was there before. Then, when the code reaches the point in memory where the overwritten code is, it executes whatever the exploiter wants. In this case, its bits written into a specific memory location in an image. Once the return address is overwritten, I think its just a matter of writing a loader that takes advantage of this exploit and hands off control to whatever game/app the user wants to run.
well us morons probably deleted the frame buffer.png after setting it as wallpaper, which u did not
If you choose slideshow before going in the foto folder it works and it doesnt crash
Maybe you don’t get it b/c you are one of the only ones bitching. Maybe you fucked up. Stop crying. If its fake then I am sure we will find out in a couple days but alot of people claim it works so STFU dick!
1. Set wallpaper to frame_buffer.png (without overflow.tif present
in the PHOTO directory, or it will crash).
2. Add overflow.tif to the PHOTO directory, and open into the photo
viewer. Custom code to paint the screen! Or to write a homebrew
app! Not to run illegal games.
Just where does it tell you to telete the *.png?
I didn’t say it was fake, yoshihiro you shallow dipshit.
I said it didn’t work like it should have on my PSP, it could easily be any number of the variables which do happen to be different on my system from anyone else here and what I was pointing out was simply that it may need investigation.
perhaps wab can steal this and make a downgrader?
Fantastic news, it won’t be long before someone hacks the MS/ISO loader code into the PNG, and just imagine, we only have to change the wallpaper to run a different game, and each PNG can contain the UMD box cover artwork. Sweet!
Alright, to all you nitwits who tried calling me a moron because it didn’t work how it was supposed on my PSP, take a glance at this.
http://img279.imageshack.us/img279/3379/nasty0jl.png
Keep in mind, it happens when I’m scrolling through the image menu, not when I try loading the overflow.tif. Also, I’ve tried it before and after deleting frame_buffer.png with no change.
This camera sucks so you can’t see many of the finer details, but you can see enough to know something’s not right.
to see how to work it download the video at http://www.psphacks.net/files/homebrew2.0.mp4
cool.
For all you people with your negitivity about this you can kiss my ass because this is the first step to the downgrader(if it works of course)!!
Hey Surtsey I got one for ya
http://www.whaaaaaaaaaa.com
62 i get the same on my euro so u r not the only one
PS Surtsey take a joke.
It doesnèt fuckin work my bling(psp) almost crashed fuck them
Why would you want a downgrader if you had access to the same functionality as 1.5 in terms of homebrew plus all of the added features (web browser, wallpaper, etc) of 2.0?
come on coder ……start coding homebrew…………….I been waiting for this for ages…
70 i was trying to make a joke?
#72: Hah, I must be in a crappy mood because I didn’t see the sarcasm at all, heh. I’m still on 1.5 but this is really great for everyone.
Does anyone have the EU Downloadlink for the Firmware 2.0, because i have smashed my demo disc into trash.
#66 For all you people with your negitivity about this you can kiss my ass because this is the first step to the downgrader(if it works of course)!!
Why I the fucking living hell do we want to downgrade our psp if this exploit works? If it works then that meas it works without downgrading.
hellllllllllllllooooooooooooooo
I tried this out my 2.0 and it works! kick ass!! Now we just need a TIF thta has an EBOOT encoded into it or something and then we have cracked 2.0!! MAN!! i almost shit my pants when i saw this!!
How does this work, sorry ima noob but I have a grasp of the idea…… Could somebody help explain this
HEy #75 just bring your PSP to a “hot spot” and use the Network update or if you have a router just use that . it a lot easier than download from the net.
#79 Hm, the file you can download from there are from the 19th of september. Hmm, is it the same on the DEMO DISC ?!? we dont know it !
he 64. i can’t play your video i only hear sound how do i play it??
#78 it’s a standard buffer overflow exploit, the corrupted tiff image causes the software on the psp to crash but before it crashes it causes the execution to jump to some extra code added to the frame_buffer file. Similar things like this have been done on the xbox and pc.
European 2.0 firmware is at download section in http://www.lans-vc.com (sorry, the site is great but it is portuguese)
YES, THE http://WWW.LANS-VC.COM IS THE PSP GREATEST SITE I EVER SEEN!!
the download section is HUGE!
to #84,
NO! THIS IS THE THE BEST PSP SITE EVER!!!!!!!!!!
LONG LIVE HOMEBREW!!!!!
right on!!! 87
Hmm i want to test this. Should i update my firmaware 1.0 to 2.0 just to test this????
Hell no #89
Yes
#89: What is it with you? If anything, update to 1.5…don’t update to 2.0 JUST to test it out. Are you really that desperate for attention? What a lamer to even think of doing that to a perfectly good 1.0