Game save crash

[pspjoke]

if this looks exploitable i would like to speak to one of the pros via pm to further the development of the exploit and to learn more about exploits in general.




the overrun string was just a ton of A's

or 0x61 .. as you see i managed to overwrite ra so i think im on to something.


changed to 0xEE and it is for sure.

[Abigail]

Yes, this is exploitable.

[Getsuga_3000]

im not holding my breath until wololo, or someone approves of this, and send the files to him.

[coyotebean]

This is clearly a buffer overflow and the stack is overwritten which can most likely be exploited.

[SilverSpring]

Doesn't even look like a savegame. Just looks like a homebrew app.

Did you just write a simple homebrew to test a buffer overflow?

But, if it really is from a savegame feel free to PM and I'll confirm it and make an exploit from it.

[MaxMouseDLL]

That's one hell of a lot of variables you've broken into there, is it even possible to overwrite that many vars from a gamesave?

I look forward to hearing the outcome of this, but... in keeping with recent events, i won't hold my breath.

[coyotebean]

Originally Posted by MaxMouseDLL

That's one hell of a lot of variables you've broken into there, is it even possible to overwrite that many vars from a gamesave?

I look forward to hearing the outcome of this, but... in keeping with recent events, i won't hold my breath.

In the beginning of a function, it saves registers used in the function to the stack. When it is about to return to the calling routine, it restores registers from the stack. When the stack is overwritten, it restored the overwritten value (including the register $ra, the return address of the calling routine) from the stack.

[MaxMouseDLL]

Originally Posted by coyotebean

In the beginning of a function, it saves registers used in the function to the stack. When it is about to return to the calling routine, it restores registers from the stack. When the stack is overwritten, it restored the overwritten value (including the register $ra, the return address of the calling routine) from the stack.

I get that, but it seems to have affected a whole bunch of registers (Yes i call them variables because i code PHP all day everyday.. force of habit when dealing with dollar signs).

Anyway, i hope it's legit and look forward to hearing about it (Even though it obviously doesn't apply to me)

[pspjoke]

judging from peoples responses, sounds like i hit gold..

awesome. ok silver, pming you now. well... in a bit actually.. im shivering to death right now and just want some fing coffee...

[FrEdDy]

this looks like GripShift exploit ^^ I think....I hope you tested it on 6.20 too and on psp go maybe....