April 2009

All eyes are now turned on the MForMature forums where Davee announced that 1) he is in possession of a new Kernel exploit, 2) he is working on a HEN, 3) he plans to confirm the release early next week.

I can’t believe how fast this is going, I’m so glad I was a part of all this (not the kernel exploit, but the whole crazyness of these days ), I’m going to bathe in champagne or something.

Ok, let’s stay calm, it’s not done yet, fingers crossed

Sources:

MForMAture
?????PSPblog

Update:
It could be that my interpretation is wrong, and that the release will not be made next week, but confirmed next week. Always be sure to confirm your information from several sources, do not 100% trust me

Note:
Please don’t post comments in Chinese on this blog, they will be automatically deleted by my spam filter, and I can’t read Chinese Try to post only English comments, thanks

thanks sable0119 for this great picture

My titles are so funny I can’t stop laughing :/

Ok, I haven’t tested it myself yet, but a trusted source confirmed that Matiaz’s tiff exploit for the slim works on all slim models, including ta88v03 and the psp3000.

Here the email I got a few hours ago from Noob81:

Yep… just tested it… code is running on my psp 3000! p2s2p showed us a way to get it working! Too hard to explain here… got to DAX forums! (oh yeah, you have to upgrade to 5.02 though.) there is a video there also.

here is the video: http://www.myvideo.de/watch/6280818/Psp_3000_tiff_expolit_works_UPDATE

And another one:

They keep coming:

Now, I wouldn’t trust that kind of claim without testing it myself first, but I definitely trust Noob81, and seeing everyone started confirming it over at DAX’s forum, this is real, and I’ll try to confirm it with my eyes on my own model tonight.

Now, it seems the exploit works way better on recent firmwares, namely 5.02 and 5.03 (actually, nobody’s managed to have it run on 4.xx). But unless you’re a developer, don’t stupidly upgrade until this whole thing is actually useful for you as a user!!! Especially, if you upgrade, take responsibility for it, and don’t blame other people for your own mistakes.

If/When it is useful to really upgrade, big PSP news sites will let you know, until then, this is still work in progress.

To continue with the good news, Davee confirmed on MForMature’s forums that he is working on a Kernel Exploit which will probably become the key to a HEN on new firmwares. Let’s stay calm, it’s not done yet, anything could happen, but so far, all of this is looking very promising

For those who didn’t get it, in simpler words: The PSP 3000 has been hacked, for real!

I get lots of questions by email about the Hello World released by Matiaz yesterday, so I’ll try to answer to these questions.

1. What?

What is this about?

Yesterday, Matiaz (known for the Gripshift exploit) released a proof of concept “Hello world” file for an exploit on all PSPs up to firmware 5.03 (and probably 5.05 too, actually…). This file is a tiff file. Putting it in your PHOTO folder, as well as the correct “h.bin” file in the root of your memory stick, then viewing the file will randomly (1 out of ~20 times) display a “hello world” message.

Woot, CFW on my PSP3000 then?

Not so fast. The current “Hello world” only works on Phat PSPs

What, only Phats? Then this sh#t is useless?

Again, not so fast. the “Hello World” only works on Phat PSPs right now, but the exploit exists on all PSPs. The difference lies in how Slim and light PSPs manage the RAM. It’s only a matter of time (a few days?) before the equivalent is done on PSP2000 and PSP3000 models

So, er…woot, I guess, CFW on my 3000?

Sorry, not so fast again. It’s been said several times that CFW on the new 3000 models is probably impossible to do.

So I guess I was right, it’s all useless?

No. This exploit is yet another User mode exploit. If used with a Kernel mode exploit, it could allow to run a HEN (Homebrew ENabler) on the new PSP models. A HEN would in theory allow to run homebrews, and probably ISOS as well. The good point about a HEN is that it stays in memory, and does not get wiped out if you put your PSP in sleep mode. So even if the exploit seems really random, if you managed to run it once, with a HEN you wouldn’t have to care about the exploit anymore, unless you hard-reboot your console (after a crash, for example…). After a hard reboot, you would have to run the exploit again.

So with a HEN, the randomness of this exploit doesn’t matter that much.

But for a HEN to come out, remember that we are waiting for a – yet to be found – Kernel exploit. Could it be the “bit of awesomness” mentioned in Matiaz’s readme ?

So what’s the difference with the Gripshift exploit then?

Well, not so much, they both offer the same thing (a user mode exploit), with the following differences:

• The Gripshift exploit requires an expensive game (tiif is free)
• The Gripshift exploit only works up to 5.02 (tiff works up to 5.05)
• The tiff eggsploit is very unstable (Gripshift works every time)

So the question is: do you have Gripshift? What firmware is your PSP?

Will Sony patch this?

Definitely. Wait for the next firmware update, it will come with a patch for this issue. Don’t upgrade if you want to play homebrews…

Oh, and keep looking for other exploits. It’s fun, and always useful. I sincerely believe this exploit wouldn’t exist if people hadn’t started this whole “let’s look for crashes” crazyness recently

Yeah, I know, my post about vulnerabilities was inspirational, aw, please stop flattering me, it makes me blush

2. Who, When?

Although Matiaz truly did 99% of the work here, I believe it is important to name the people who worked on this. Several guys were involved in this, and it’s a bit sad to mention only one of them, even if the people who worked in parallel didn’t necessarily go as far as Matiaz did.

The initial file was posted with a link in a youtube video,  and on my blog by a guy named malloxis. From where I stand, this initial file involved lots of luck

This then started a little buzz on DAX’s forums, but went unnoticed in other places. Noob81 and myself quickly understood that the file was interesting, and started working on it. At some point we realized that we weren’t skilled enough to go further, and needed help. This is the time when we contacted Freeplay, Matiaz and Archaemic, who all looked into this vulnerability and confirmed it was exploitable. From then we all worked in parallel (I personally got help with Slims from MaxMouseDll), and it seems Matiaz (apparently with the help of Davee from the lan.st forums) reached the finish line first

I hope I don’t sound too bitter here, because I’m not really, I’m actually completely excited! But I guess hacking is all about fame, so even when it’s a tiny contribution, it’s fair to name the people who helped.  Anyways in the end we all get something useful out of this, so it’s cool

(I probably didn’t mention everyone actually involved in this, only the ones I know about)

3.How?

I don’t have all the technical details yet, but here is some information:

Is this related to the libtiff vulnerability you talked about earlier this year?

No. It’s a completely different vulnerability. Actually, my tests seemed to show that this is not a vulnerability in the tiff library, but rather a very sony specific bug in the way they implemented the lib on the PSP (if you can test this to see if it crashes on a PS3 or an Ipod, I’d be happy to know by the way)

PSPLink DIY

Ok, so here is the initial file as modified by myself, to show the possibilities of hack offered by these files. Matiaz endend up not using this error but another one that prooved more efficient, but this is the starting point for everything.

You can of course play with the proof of concept released by Matiaz too. After all, it’s only hex-editing and playing with PSPLink