PSP 2.50 Overflow Exploit

[iSpO_fAcTo]

We've gotten 3 confirmations from forum users that this indeed works properly as an overflow exploit just as stated by the creator. This of course does not ensure it is safe, but after 6 hours and no reports of bricking, I feel confident to take this off such a high alert status and place it into a legitimate exploit status. Kudos PSPlayer1001, I believe you might have found something useful here.

 

We’ve gotten about 20 emails from users claiming that a new TIF overflow has been created for PSP firmware version 2.50 by a guy named PSPlayer1001 from the "PSP3D hacking team". Basically, he claims it freezes up the PSP when run, just like the original overflow exploit for 2.00 did. A similar exploit was found in the 2.00 firmware, which was used to create the MPH 2.00 -> 1.50 downgrader.

 

We do not have a fv2.50 PSP here at QJ, and even if we did we’d be hesitant to try such a file without the creator stepping forward and giving us more information (email us!). We weren’t going to put this up, but we figured there would be people out there that would want to hear about it. If it’s true, then great. If not, then oh well, no loss.

 

We warn you though, that EBOOT files that brick (break) your PSP *do* exist, and we strongly caution all but the most knowledgeable users not to download and test this file. We are only posting it so that we can get validation and pass a verdict one way or another on this file. As soon as we can pass judgement, I will update this post (or delete it if it’s bogus). Get the EBOOT [here]. Please use the "Submit News" feature up top to report your findings.

 

Oh, and I forgot to mention there is a crappy low quality video, which can be seen [here].

 

http://pspupdates.qj.net/2005/11/possible-250-overflow-exploit-warning.html

http://psp3d.com/

[iSpO_fAcTo]

OK to end fear of the exploit, here are the inner workings:

 

Tradional PBP and SAVEGAME Layout

-ULUS100xxxx or EBOOT

--Param.SFO (tells how the psp handles the file: e.g. title - update ver. 2.51)

--icon0.PNG (icon)

--icon1.PMF (almost like a short movie clip <500kb

--pic1.PNG (background for pile that appears when you look at the file)

--SND0 (background sound-not in most saves or EBOOTs)

--Data file/data.psp (name vary depending on game saves...data.psp is the name when in eboots)

--Data.psar(only in eboots)

 

Well my Exploit contains...

 

--Param.SFO (tells how the psp handles the file: e.g. title - update ver. 2.51)

--icon0.PNG (icon-overflow.tif)

--icon1.PMF (blank PMF found in iso rip kits)

--pic1.PNG (background for file-framebuffer)

--SND0.AT3 ( small randow sound clip)

--Data file/data.psp (from v1.5)

--Data.psar(from v1.5)

and...

--Pic0.PNG (overflow.tif)

 

My Original Idea For The Exploit

 

1)the icon0 would be set to the overflow.tif

2)pic1 the framebuffer image

3)the 2 data files as 1.50s data files

4)SND0.AT3 a music file >20mb

5)ICON1 the blank pmf found in iso rip kits

6)Param file set to be read as updater version 2.51

7)pic0 overflow.tif resized to 272x480

 

Only one thing from my original blueprint wasn't used : the AT3 file is 5kb

How This Works

 

This works by overloading the psp audio with a glitch sound, and overloading the image handler with overflow.tif, thus in conjuction overriding the TIF patch.

 

Now that I am a member of this prestigious site, we have turned our attention to finding a way to add a downgrader in supplication to this exploit. Through various experimentation I have found a way to turn my 2.5 EBOOT exploit into a savegame file. The savegame version performs the same actions, but with it in a savegame the data.bin can be changed to arbitrary code so that when you boot a UMD and load a savegame it runs the data.bin file. Thats the latest.

 

Here is the SAVEDATA file we used:

http://psp3d.com/2.5SAVEDATAEXPLOIT.rar

[gherudos]

ax vre paidia mhn trwte to koutoxorto,eipame to tiff overflow to exei patcharei h $ony opote den uparxei periptwsh na paiksei exploit vasismeno se tiff overflow.Akoma o tupos to mono pou katafere na kanei htan na crasharei to psp tou kanontas ola ta parapanw vhmata.Auto den shmainei omws tipota.Perimenete omws liges hmeres kai tha deite exete mou empistosunh kati sas etoimazoume

[nfs11]

ax vre paidia mhn trwte to koutoxorto,eipame to tiff overflow to exei patcharei h $ony opote den uparxei periptwsh na paiksei exploit vasismeno se tiff overflow.Akoma o tupos to mono pou katafere na kanei htan na crasharei to psp tou kanontas ola ta parapanw vhmata.Auto den shmainei omws tipota.Perimenete omws liges hmeres kai tha deite exete mou empistosunh kati sas etoimazoume

 

Περιμένουμε μην ανησυχείς. Ελπίζω όμως να μην έχεις καμία σχέση με τον yoshiro

[gherudos]

sou moiazw gia ton yoshihiro?ton megalutero apatewna tou net?

[Bourdoulas]

Na soy po tin ali8eia to touto sou fernei kapos ston yoshihiro! Plaka kano etsi

[iSpO_fAcTo]

Confirmed Sony PSP 2.5 is Hacked! The Overflow is Working!

 

I just received an email from butterballer360 over at psp3d.com. It’s been confirmed! These folks have discovered a way around the TIFF overflow patch for the recent exploit discovered in firmware version 2.0. Similar to the initial exploit discovered in 2.0 this currently “freezes” the PSP when executed - allowing the possibility of arbitrary code to be ran.

 

Included with the EBOOT are two videos demonstrating the exploit. Head over to psp3d.com for more information with regard to this exploit.

 

Download 2.5 Overflow Exploit(http://www.psp-hacks.com/file/152)

 

http://www.psp-hacks.com/index.php?post=443

[gherudos]

lol

ap oti fainetai den me akoute katholou,eipame einai pseftiko den tha sunexisw na analuw auto to thema.TELOS!!!

[nfs11]

lol

ap oti fainetai den me akoute katholou' date='eipame einai pseftiko den tha sunexisw na analuw auto to thema.TELOS!!![/quote']

 

lol

 

και καλά θα κάνεις από τη στιγμή που δεν έχεις να μας πεις κάτι το συγκεκριμένο. Μέχρι τότε άσε άλλους να βρίσκουν αληθινό exploit του 2.5 και να προσπαθούν να φτιάξουν τρόπο να παίξουμε τα τελευταία παιχνίδια που θέλουν version 2.0

[gherudos]

nfs11 otan den ksereis kati kalo tha htan prin arxiseis na to diadideis na to epeksergazesai.O kathe gnwsths tou thematos kserei oti einai ena aplo glitch ki oxi tiff overflow kathws to keno asfaleias me to tiff overflow eixei hdh diorthwthei apo thn ekdosh 2.01 kai stis neoteres.Otan diavazete kati to opoio einai aplos ena rumour den to postareis gia na dwseis pseftikes elpides.Nai polles omades asxolountai me to xploit sthn fw 2.50 kai tha vrethei suntoma an ki exei vrethei hdh alla auto tha to akousete molis kataferoune na to xrhsimopoihsoume wste na dhmiourghsoume pali downgrader h otan tha kataferoume na to xrhsimopoihsoume gia na treksoume anupografo kwdika se kernel mode sth 2.50 mexri tote mhn trwte to koutoxorto kai frontiste na mathenete gia auto pou prokeitai na kanete copy paste apo ena allo site to opoio den einai aksiopisto.Telos!!!

[iSpO_fAcTo]

ola ta psp sites lene oti einai overflow,tora an esy ksereis oti lene lathos kai den einai overflow...ti na po!

[sotris99]

Το http://www.ps2nfo.com πάντως εχθές που διάβασα το είχε σαν πρώτο θέμα... Σήμερα το αφαίρεσε. Υπάρχει αυτό:

 

>Update: In related news, today a PSP SaveData Exploit for v2.50 Firmware has been released, however, it is only intended as a base for further developments and will NOT allow running unsigned code/homebrew on a PSP v2.50 in itself. At the present time, all it does is freeze your screen resulting in you having to restart the PSP- whether it's a true Exploit or simply another method to crash the PSP is yet to be determined.

[gherudos]

thn apanthsh sou thn phres apo ton sotris99

pistepste me an sunevaine kati tetoio tha to mathainate apo emena

[sotris99]

εγώ πάντως εμπιστεύομαι μόνο ότι λέει το ps2nfo... και αυτό γιατί ο admin είναι τσακάλι!!! super hacker

[gherudos]

poios einai tsakali kai super hacker????????

LOL o Z????O Z einai enas apo tous megaluterous apatewnes tou diadiktyou.Den ksereis kala ta pragmata kai gia ton polemo metaksu mas.Apla tha sou pw na mhn empistevesai autous kathws den einai aksiopistoi.