New PSP exploit found in GripShift, works on PSP-3000

[Ostinato]

Now this is how you start a new year! New exploit, old game! Damn, it's so cool to actually see this beauty working - and on a PSP-3000 no less! The PSP scene was buzzing the other day when MaTiAz found an exploit (read: buffer overflow!) in the three year old game, GripShift.

We'll leave the technical bits for later. Now, we'll have this video from FreePlay do the talking:

YouTube - PSP Hack: GripShift exploit POC demonstration version 2 - Homebrew code running on the PSP 3000

Holy... mother... of... pearl... o_0

Now then, the details: MaTiAz says that they've yet to find any further use for this, but it's still a new exploit. It could lead to further hacks, and for now, it's merely a proof of concept. Be that as it may, this is a great start, and a rather sweet find! Here's MaTiAz explaining the exploit:

GripShift has a buffer overflow vulnerability when loading savegames. The savegame contains the profile name which can be easily used to overwrite $ra. The savegame file is pretty big (25kB) so you have lots of space to put your code there. I wrote a simple blob of code to paint the framebuffer completely white (to just indicate that arbitrary code is running ). The return address is located at offset 0xA9 in the file. In this poc it points to 0x08E4CD50 (which is only a few bytes after the return address), and the code starts at 0xCC in the file.


It was tested on 4.01M33-2 with US version of GripShift (ULUS10040), and psplink.prx, usbhostfs.prx and deemerh.prx loaded (also without psplink and usbhostfs). The decrypted savegame (sorry, couldn't [be bothered to] get Shine's savegame tool working so it's in plaintext form) is in the SDDATA.BIN form which Hellcat's Savegame-Deemer produces (thanks to him, if the program didn't exist I wouldn't have bothered with this. ). Just copy the ULUS10040SAVE00 directory to /PSP/SAVEPLAIN/ and run the game. EDIT: yeah, don't forget to have Savegame-Deemer working, duh.

There are two versions of the exploit. The first which is the raw form from MaTiAz, the other one (v2), is a version encrypted by FreePlay. It's also been confirmed that it works all the way up to the recent CFW 5.02 GEN-A.

We're getting there, people! Just a bit more... Hope springs eternal, folks!

Thanks to Sbrillo1 for the tip!

So any ebay entrepreneurs out there...get buying all the copies of Gripshift you can before they skyrocket in value. Oh and for reference FreePlay also adds...

While there's a European save included, this was mainly for testing purposes. There are significant differences between the two versions (not the least being that Ubisoft was involved in the European one).

At the moment, *this code only works with the USA version of the game.* I'm pretty sure the exploit is in the European one, too, but haven't dealt with that yet.

[huntsman]

Wow this is fantastic news, after news that datels lite blue tool doesnt work people were saying this may never be hackable well done to whoever found this. Cant wait for a hack

[psp[26]]

This is a good news indeed. The sooner the better :)

[Ostinato]

Venom...when you read this, and given your propensity to scour videogame shops....given the exploit is thus far only working in the US release of GripShift you might want to venture out and pick up a few copies of the game if you can get them cheaply. Prices and bidding on ebay for it have gone a bit nuts in the last 24 hours...so you can either make a bit of cash whilst the madness is still around or stand prepared to help out your European buddies from this forum.

However bear in mind that this may not amount to anything at all....perhaps the most sensible option would be to bung them all on the bay and keep one or two just in case. That way hopefully you'd be in profit and still have a couple of copies of the game that might, and i stress might, unlock the PSP 3000.

[Venom]

Thanks for the tip Ostinato. I'll hit the stores and check for a few copies.I think GripShift is going pretty cheap at EBgames. If I can find a few copies, I'll definitely look after you guys first before posting on ebay.Not really worried about profit. I'll keep you posted.

[CEK]

hmmm, we just happen to have this game in stock at work, pre owned of course, but that doesn't matter, they do say the data needed is on the european version so it might be worth it to have on hand in case this does amount to a hack, wouldn't mind getting a new PSP anyway.

[Ostinato]

As everyone predicted even though this may lead to nothing...

Prices of the game are sky-rocketing up to 125$ on ebay. 3 days ago the game was 7$ on ebay and 15$ on Amazon. Now it's 50$ on Amazon. Looks even worse than what happened for GTA (here in Japan GTA-LCS was sold for 20 000 yen on auction sites - that's around 200$) , and there's not even a guarantee that this will lead to CFW.

[rogerio020]

does this mean you can hack with this? cause im not really into the hackin, more in games

if you could sell some games for a lot of money send me some eh?