November 2009

Freeplay released his exploit for the game Mercury a few hours ago. The reason is that the vulnerability has been patched in firmware 6.20, making any further work on this exploit useless. Sony also immediately updated the game on the PSN store so that it now requires firmware 6.20.

Matieuhlh, member of the team prometheus (the team who created the Pandora Batteries), and a respected hacker on the PSP scene, revealed that Freeplay actually stole the code from a private SVN. To prove this, Mathieulh released the original sources of the exploit, as well as the sources for a kernel exploit that has been patched in firmware 6.00.

Further development of these exploits will most likely lead to custom firmwares and/or HEN for PSPs up to the firmware 6.00. This is of course interesting only for owners of Ta88v3 and of PSP3000. Owners of PSPGo can still pray for a future XMB exploit, and owners of older models of PSPs can use pandora batteries, independently of their firmware. As usual, if you like homebrews, don’t upgrade. And avoid buying a PSPGo

People interested in working on these vulnerabilities (user and kernel) can download them here

Source:MForMature

The recent video posted by Team Typhoon about their “we won’t release it” HEN for the PSP Go has been generating lots of crap for the last few days. I’m pissed. I could write this on some forum and add to the hundreds of comments that can be found on MForMature, QJ, or PSPGen.

But I’ve got a blog which allows me to write, complain and whine with other people actually reading what I write, and my post not getting lost in hundreds of others. I rock, ’cause I’m better than you

I’ve read all the comments on the MForumature thread. Yes, all of them. At the time I write this, there are 189 of them. What can I say, I love dramas…

At first I was disappointed that team Typhoon decided not to release their hack, but I believe they have their reasons. As a fellow developer I’ve encountered many times users who treated me like sh#t, forgetting that they were getting hundreds of hours of my work for free. These people, that we can call “ungrateful users” always want more, insult you instead of giving constructive feedback, and are usually the reason devs quit doing their stuff after a while. There are lots of them.

I was then surprised at the reaction of one of the members of Team Typhoon, who basically insulted everyone in the thread, which more or less ruined the point of the whole thing. When you want to prove to others that they are assholes, a rule of thumb is to not act like one yourself.

This is when I realized the reason I have been working on Wagic for more than 2 years now. Even if there are lots of “parasites” in the PSP “scene”, there are also lots of great people. In the two years I’ve been working on Wagic, I’ve had the opportunity to work with dozens of very talented people, from various horizons, not necessarily devs. People who give feedback, ideas, help any way they can…

Granted, I’m not a genius hacker, I only code homebrew, there’s way less pressure than for people who work on hacks. But still, my point is that for 100 dumb users, there’s 1 cool guy who’s gonna change your life. And I believe that it’s worth working for that one guy.

Another thing that happens frequently in that kind of drama thread is people stating that “it was better years before”. Actually it wasn’t. There’s always been such drama in the PSP scene. Here’s a quote that I like from the libtiff mailing list . This was posted when the first tiff hack for the PSP was revealed, back in 2005:

If only these people spent as much time on actual good documentation and specification of facts and exact vulnerability, as they do on fighting amongst themselves in SMS type language of wannabee hackers, we’d have a chance to know what is actually going on.

That was the Noobz era back then, and apparently from an external point of view the PSP scene was already full of crap. Yes, there was probably a time when hacking the PSP was more fun and less drama. That was probably when the only way to get one was to be a huge geek with access to japanese imports… in other words, when the PSP wasn’t a mainstream product… like…for the 3 first months after it was out. If you don’t want drama, go to the openpandora. Oh, and stop thinking all the “good devs are gone”. Yes, lots of good devs have moved on. But lots of good ones appeared recently too.

Why is there so much drama in the PSP scene? Well my theory is that the PSP is the most active console in terms of underground. I ran a few funny google searches…note that everyone can use google to backup their claims, so these results are probably worthless, but they’re still interesting:

“psp homebrew” gives me more than 2.3 million results in google. “DS Homebrew” has less than half of it (if you look for “PSP ISO” or “DS ISO” though, the number of results are roughly equivalent :12 and 13 million). I was recently discussing with Magixien, webmaster of PSPGen, one of the biggest “console underground” website out there, who told me that no other console is close to what the PSP scene is in terms of activity.

It is also funny to see that the first results for “DS Scene” and “Wii Scene” in google are sites that promote pirated games downloads. “PSP Scene” gives links to more serious sites that talk about PSP releases, hacks, and homebrews. I won’t give names, try it by yourself. Does it mean that piracy is the main goal for hackers on all consoles but the PSP? Well I doubt it, but it’s still a strange result…

What’s my point you ask? I don’t know, I forgot while I was typing… I guess, it’s: stop whining. If you want hacks for piracy, just go to hell, we don’t like you. If you think the PSP scene was better 3 years ago, nobody’s asking you to stay, you’re spoiling the party. If you think you’re better than others because you’re a hacker or one of their beta testers, just learn humility, it won’t hurt you.

If you disagree with me, I have the power to erase your comments, I’m almighty, muahahahaha… meh, ok, you can post…

I’ve said it numerous times, finding crashes is the first step to finding exploits on the PSP (and on other devices as well, by the way. It is just easier on the PSP since we already have lots of tools to help us).

Crashes are usually the result of luck (bad luck if you were playing a game and forgot to save),  but there are ways to “force” your luck. One of them is called Fuzzing. I recently found an MP3 crash (which happened to be non exploitable) through this technique, and I was actually very proud of this “revolutionary” method of finding crashes, until I was told that this was a known technique in software testing .

Wikipedia tells us:

Fuzz testing or fuzzing is a software testing technique that provides invalid, unexpected, or random data to the inputs of a program.

Well that’s pretty clear. The idea is to feed our program with random data and see if it crashes. In my case, the “program” was the PSP mp3 Player, and the random data was a series of broken mp3 files.

This is all very good, but the main issue is that you’d need to be extremely lucky in order to find a crash this way. Except… that the PSP mp3 player allows us to test thousands of files extremely quickly with the usage of playlists.

Here’s what I did for the mp3 file: I first created a very short mp3 file with Audacity. I use audacity because it’s open source, but any audio manipulation software will do. I then created thousands of copies of this file, with only one bit changed for each of those files. I of course didn’t do this by hand, I used a script. I went with ruby, but here again, any scripting language will do (perl, php, python…I’m sure you can do it in Linux shell, or even in C/C++ if you like pain). Here’s what my script looks like (fe4r my Ruby skillz):

What this script tells is the following: open the file “a.mp3″ (my “source” regular mp3 created with audacity), and for i in 0..200, change the byte at position i with a value j, j varying between 0 and 255. In other words, I’m trying all the possible values for each single byte in the file. This generates thousands of files. For each value of i, I’m creating a new directory, so each folder will have 255 files. Note that I’m only doing this with the 200 first bytes because my 1GB memory stick got filled with those files, but nothing prevents us to actually create more (although I’d need to check if the mp3 player allows to have more than 255 subfolders in the mp3 directory). What I ended up doing is “sessions of 200″. I first tested the 200 first bytes, then 201 to 400, etc…

Once this was done, I copied all the generated files (still in their respective folders, the psp mp3 player doesn’t allow more than 999 mp3 files per folder anyways) on my psp, and started playing everything.

This takes time, but not mine: I don’t need to be around when the psp plays the mp3 files. if, when I come back, the PSP is off, it means a crash occured. I can then remove half of the files and try again, until I find the “culprit” through dichotomy.

That’s pretty much all there is to know about this technique. It worked for mp3s, and it would work for video files, as well as image files (through the slideshow feature), although I’m not sure how these two applications deal with playlists (let me know the outcome if you try it!). The whole point of this technique is to be able to test a very large number of files in a short amount of time. Even by testing thousands of files (my mp3 was 2048btes long, so thats 2048×255 = half a million files), we only test a very small percentage of all the combinations that could be fed to the software (what if I start changing 2bytes instead of 1 in my file? What if I use a different audio file as my source ? A wma maybe ? etc…). Well it’s good because everyone can try different combinations, but of course don’t expect too much results if the player only allows you to play 10 files in a row or something like that.

There are of course lots of other techniques to look for exploits in a system, but this one has several good points (when it is applicable!): it doesn’t require to be too clever (al you need is a little script, no specific knowledge about MP3s was required for my crash, at least for the first steps), and it takes very little time (as long as the system is nice enough to allow you to feed it thousands of inputs very fast).

I’m actually surprised I found a bug in the mp3 library of the PSP through this technique…One would think Sony use that kind of testing method on their firmwares.

I hope this will give inspiration to both people trying to secure their software, and those trying to free the world from the evil forces of DRMs Have fun hacking!