2.00 Exploit found

[cyesergio]

First post and thread ever and i seem te have the scoop!!!

From the front page:

Update: This proof of concept has now been confirmed as a working exploit for the 2.0 firmware. Now we have to wait until some more useful code using this exploit is released Remember who had it first PSP-Hacks.com

We just received a very convincing email claiming to have hacked the 2.0 firmware. We do not currently have a 2.0 PSP accessible right now. So we would like our members to try it out and let us know how it goes. We’ve been hearing rants for a while about no 2.0 news so here is a chance to not just complain but actually help out and let us know if it works.

Digg this story!

First Homebrew Code on 2.00

—————————–

1. Set wallpaper to frame_buffer.png (without overflow.tif present

in the PHOTO directory, or it will crash).

2. Add overflow.tif to the PHOTO directory, and open into the photo

viewer. Custom code to paint the screen! Or to write a homebrew

app! Not to run illegal games.

How It Works?

—————

1. The PNG contains a small amount of code in a known, fixed place

(the VRAM). If to look closely at the wallpaper, sees small

coloured pixels in the right down. The pixels are Allegrex

opcodes, with the highest byte all zero for the ALPHA. These

pixels do:

syscall 0×20C7 ; sceKernelDcacheWritebackInvalidateAll

slt a0, zero, sp ; put 1 into a0

sll a0, a0, 6 ; put 64 into a0

addiu a0, sp, a0 ; get screen painter address over SP

jr a0 ; jump to the screen painter

nop ; branch delay slot

2. The TIFF contains also some code and a buffer to trigger the

known BitsPerSample overflow in libtiff in the photo viewer.

The buffer makes a jump to the VRAM which has the PNG colours

by overwriting the safed ra (return address) on the stack.

The VRAM code uses SP and calculates the address of the buffer

then runs it. Then it jumps there. The screen is yellow as

the colour was 0×12345678 in Hex.

PSP Users:

We didn’t do this so you could steal from Sony and game companies.

We believe in OSS. There are plenty of amazing programs that have

been written for the PSP. Use this as a gift and not as an excuse

to steal.

Sony:

If you wanted to find us i know you could. This release wasn’t

intended as a way to run pirated software on the PSP. We believe

that everyone should be able to compile their own code and run it.

Nothing is kept secret forever and i’m sure you know this.

In the end, if it wasn’t us. It would be some one else.

Fighting it would be like skating up a hill. You did create the

PSP and did an amazing job.

Toc2rta:

To the people of the Toc2rta development network. You’re our phone

a friend. With out your friendship this would never of happened.

I hope this brings you as much happiness as it brings us.

Join us on irc.toc2rta.com.

Most importantly… Have fun!

[pinky_pii]

I followed instructions,but when i open the overflow.tiff in my PSP,it says file corrupted.I don't know what to do

[jibbz]

Originally Posted by pinky_pii

I followed instructions,but when i open the overflow.tiff in my PSP,it says file corrupted.I don't know what to do

Woooaaahhhhh ..... way to bump a Old thread ......

What are you trying to do Pinky ? ....
If you need your PSP downgrading don't use this

[igotapencil]

Originally Posted by pinky_pii

I followed instructions,but when i open the overflow.tiff in my PSP,it says file corrupted.I don't know what to do

You ruined it i hate you.

[WaffleKopter]

Umm this thread is from 2005 please don't bump 3 year old threads........ just look in the tutorial section next time....



[EDIT] you beat me to it xD

[Mac2468]

This is Olllllld schooool homebrew right here.

[Jsamp]

I lmao at old bump lulz

[Xitherun]

dude I remember when this was first discovered.

I had updated to the Japanese 2.00 update the day it came out, and then I found out about homebrew.

I was stoked as balls.

[Jsamp]

I had my 1st psp in Jan 06. This was the exploit I used. At first I used the eloader than ran all the user mode homebrew and after my fear subsided I used the 1.50 downgrader.

[Xitherun]

Originally Posted by Jsamp

At first I used the eloader than ran all the user mode homebrew and after my fear subsided I used the 1.50 downgrader.

lol, I downgraded mine the day the 2.00 downgrader came out.

I used the downgrader a few times a day, lol.

upgrading to 2.00 so I could play SW:Battlefront, then back to 1.50 for homebrew.