2.7+ Decrypted Dump Exploit Discuss

VB_Master

www.howardforums.com/showthread.php?p=6121181

check this out, it may help.
-= Double Post =-
VB_master

you have to get that serial cable working asap

we may have found exactly what we need to get nand flashing on the psp going. but i need you to complete your cable and get the remote program installed on your pc. we may have the commands now required to access the nand via the serial port.

Please look over the following sites for referance.

http://hitmen.c02.at/files/docs/psp/...8u0b_rev13.pdf

http://64.233.183.104/search?q=cache...n&ct=clnk&cd=1

http://hitmen.c02.at/files/yapspd/ps...p8.html#sec8.7 <---- A must read very important read everything. especially the section that covers the serial port. commands are listed in the pdf.

http://www.jess2.net/projects/PSP/psp_doc.pdf

the last site still needs to be looked at but all these sites contain exactly what we need to progess in our attempt at serial flashing.

lets move people....times a wastin!!!!!

Zitat:

---

Zitat von jedimasteryoda

VB_Master

www.howardforums.com/showthread.php?p=6121181

check this out, it may help.
-= Double Post =-
VB_master

you have to get that serial cable working asap

we may have found exactly what we need to get nand flashing on the psp going. but i need you to complete your cable and get the remote program installed on your pc. we may have the commands now required to access the nand via the serial port.

Please look over the following sites for referance.

http://hitmen.c02.at/files/docs/psp/...8u0b_rev13.pdf

http://64.233.183.104/search?q=cache...n&ct=clnk&cd=1

http://hitmen.c02.at/files/yapspd/ps...p8.html#sec8.7 <---- A must read very important read everything. especially the section that covers the serial port. commands are listed in the pdf.

http://www.jess2.net/projects/PSP/psp_doc.pdf

the last site still needs to be looked at but all these sites contain exactly what we need to progess in our attempt at serial flashing.

lets move people....times a wastin!!!!!

---

i dont understand any of this, you need a hardcore engineer and coder to find something here

i hope you guys can make it but I don't really understand that information:Jump:

the documentation reveals the codes that the chip responds to, if the psp remote program can accept different commands other that the known commands we could input the documented commands to see what results come out.

your don't really need to be an engineer to test the op codes, they're right there in the document.

we just need someone to set it up and test them.

who could do that?

anyone with a working serial cable.

the cable and the psp remote program would be required.

or the psplink program

i believe either one could be used to try and execute the commands.

then from there it's just a matter of figureing out which codes will give us access to the nand.

i hope this will work. we could then flash the psp through the serial port...

well that the idea, we needed to know everything there was to know about how the chip works, once we understand how to read from it and write to it then it's just a matter of writing a program to execute the right codes to flash any firmware we want.

we would get alot further if we had an engineer look over the specs, but just through testing alone we should get some kind of response.

vb, maybe I do want that cable now.

teamoverloard

did you go over the chip specs? i think with your help we can get this going. if vb_master can complete the cable soon we can get started on testing.

tell me what you think based on the spec info so far.

I havent yet taken a look, but I will do so shortly.

The serial cables arn't very hard to make, radio shack has all the parts.

But since just throwing code at the NAND is almost guarenteed to brick I don't want to try it.

The cable is useable, PS2Dev even has a walkthrough on making your own.

The programing is gonna be rough though.

we have to test the commands either way. someone with a mod chip would be the most likely to test this in case bricking happens

just a quick question, how hard is it to create a serial cable that runs from the PSP to the PC, i want to create one but i dont know how =(

If eventually this leads to something, someone should create a guide for how to make a serial cable :P


But i hope this all leads to something, good work guys.

Zitat:

---

Zitat von RoninRevolution

The serial cables arn't very hard to make, radio shack has all the parts.

But since just throwing code at the NAND is almost guarenteed to brick I don't want to try it.

The cable is useable, PS2Dev even has a walkthrough on making your own.

The programing is gonna be rough though.

---

give us a link to that ps2 dev walkthrough

Maybe there is an new exploit with Tiff. I don't know if these would work.

http://cve.mitre.org/cgi-bin/cvename...=CVE-2006-3459
http://www.saintcorporation.com/cgi-...fact_color=doc

Zitat:

---

CVE-2006-2024 Multiple vulnerabilities in libtiff before 3.8.1 allow context-dependent attackers to cause a denial of service via a TIFF image that triggers errors in (1) the TIFFFetchAnyArray function in (a) tif_dirread.c; (2) certain "codec cleanup methods" in (b) tif_lzw.c, (c) tif_pixarlog.c, and (d) tif_zip.c; (3) and improper restoration of setfield and getfield methods in cleanup functions within (e) tif_jpeg.c, tif_pixarlog.c, (f) tif_fax3.c, and tif_zip.c.

---

Zitat:

---

CVE-2006-2025 Integer overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a crafted TIFF image.

---

Zitat:

---

CVE-2006-2026 Double-free vulnerability in tif_jpeg.c in libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers errors related to "setfield/getfield methods in cleanup functions."

---

http://www.saintcorporation.com/cgi-...=cve_2006.html

http://forums.ps2dev.org/viewtopic.p...16fb66b23f8192

Has some pretty good info on how they got working serial cables, but I'm still not real sure sure if they can be used to access the NAND.

Anywho who, here is some walkthroughs on making your own serial cable:
http://www.thoralt.de/projects/SIO2USB/SIO2USB.html
http://nil.rpc1.org/psp/remote.html


Hopefully that helps.

I'm not gonna make my own until I see that one of you guys actually got it working how we hope it does.

Same here don't want to risk bricking

I will make one at my work soon. The devs there do an excellent job at these things.

Good luck, it's good to see all this progress on stuff like this.

EDIT: 1000th post! :D I wanted to make it in a big thread lol.

Does anyone know what version libtiff is compiled in fw 2.71?

lol, Jachra that is exactly what I have been asking!

All i have found is that it uses lippng 1.2.5 in the XMB and libpng 1.2.6 in the Browser, other than that no one seems to know, not even wiki >_<

Nobody has looked at it, havent heard of VB Master in a while, Happy 1000th post N: Cal:k!

Probably TO knows it

Can someone create tiffs with the info i posted on page 138? Then we might be able to test those options.

People stop the flaming in this thread, it has been a great thread and lets keep it like that.

Anyway I'm still waiting for a news on what VB Master was doing, I think he said he would even try the serial himself, because originaly he was going to give it to TO.

I think he fell off the face of the planet >_<

Anyone else willing to pick up in his place?

So far we know you can get some basic caommands into the psp through a working serial cable.

But we don't really know if you can acces the NAND chip through it, and even harder still is that you can only send about 12 bytes of info, which I don't think is enough to really do anything...

So I think this could be useless efforts.

Though if we figure out waht version of libmng the PSP uses it could be pretty handy, because it seems to be a pretty exploitable library.

Any other idea peoples?

You dont think anything could be done with 12 bytes?(wow thats awful small)
Maybe we should wait for a game that has a similar exploit as GTA LCS...

12 bytes could be enough to run an update eboot?

even if this serial cable does work, do you think VB is going to make 100s of them for everyone? Or is the one cable going to be circulated around the world so everyone has a chance...

a serial cable is not hard to make, so make it your self, there are tutorials out already

and making a psp serial cable is nothing new

Zitat:

---

Zitat von NickTheBlitz

12 bytes could be enough to run an update eboot?

---

its plently enough for a file pointer.

Zitat:

---

Zitat von Jachra

Can someone create tiffs with the info i posted on page 138? Then we might be able to test those options.

---

Skylark said that both he and Fanjita had explored the possibility. He said that it's "not all that easy", but "nevertheless it *might* be possible." Coming from the guy who did a major part of the coding for the original TIFF exploit, "not all that easy" means a lot.

So there is hope for the serial.

12 Bytes? That's..about half of one letter.

Zitat:

---

Zitat von MisterBeefy

12 Bytes? That's..about half of one letter.

---

No, it's like 12 letters. Type it in notepad and save it.

Not much to work with.....

^ Its gotta be enough for something useful, depending how things are laid out im sure that a file pointer or something could be implemented..

Surely :S

A byte is = to 8 bits or one ASCII character
so 12 bytes is 12 characters or 96 bits