GripShift savegame exploit PoC

[rebman]

This is a great find, good work guys.

let me know if I can do anything to help.

[wololo]

May I ask how people usually find this kind of vulnerability in a game ? Luck ? Or is there a "way" to look for those ?

Edit: I hope the game's good, because I ordered it on ebay. I'm not going to wait until the prices skyrocket like they did for GTA

[MaTiAz]

Originally Posted by wololo

May I ask how people usually find this kind of vulnerability in a game ? Luck ? Or is there a "way" to look for those ?

Edit: I hope the game's good, because I ordered it on ebay. I'm not going to wait until the prices skyrocket like they did for GTA

I found this one through pure boredom. There is a way to look for buffer overflows, and the simplest on is just trying to put long strings in places where a static size buffer is expected. In this case, I overwrote the player name with "this is spartaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaa" and watched psplink show the exception where the return address is 0x61616161

[Hellcat]

I really should get PSPLink working....

In the meantime I'm trying to figure out how to make syscalls from the injected code, so that I could try to make something usefull for it
Like "how do I get the address of a function (let's say sceIoOpen, for example) to then call it by jumping to it's address"....

[jas0nuk]

An excellent find. Well done.

[ne0h]

Hellcat, look at dax's sctrlHENFindFunction, maybe is what you are searching...

[FreePlay]

It isn't. He's trying to figure out how to find and use functions without already having access to any of the SCE functions.

[Bubbletune]

Originally Posted by FreePlay

It isn't. He's trying to figure out how to find and use functions without already having access to any of the SCE functions.

Just jump in to the stubs of the game, that's what the 3.50 HEN does.
Obviously this is limited, which is why it needs to be exploited further to get access to all SCE functions.

[Torch]

Is it even possible to have a HEN core in newer firmware without a custom IPL?

[MaTiAz]

Originally Posted by Torch

Is it even possible to have a HEN core in newer firmware without a custom IPL?

Why not, if we have a kernel exploit? Pre-3.60M33 firmwares didn't have a custom IPL and they still had a HEN core.