forums.ps2dev.org Forum Index forums.ps2dev.org
Homebrew PS2, PSP & PS3 Development Discussions
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Kernel mode under firmware 2.6 * The proof of concept *
Goto page 1, 2  Next
 
Post new topic   Reply to topic    forums.ps2dev.org Forum Index -> PSP Development
View previous topic :: View next topic  
Author Message
hitchhikr



Joined: 04 Feb 2006
Posts: 83

PostPosted: Wed Jun 28, 2006 5:03 am    Post subject: Kernel mode under firmware 2.6 * The proof of concept * Reply with quote

http://perso.orange.fr/franck.charlet/Exploit_2.6.zip

There you have it boys.
Back to top
View user's profile Send private message
Zettablade



Joined: 05 May 2006
Posts: 71

PostPosted: Wed Jun 28, 2006 5:05 am    Post subject: Reply with quote

eh? What is it? Is it safe?
Back to top
View user's profile Send private message
harleyg



Joined: 05 Oct 2005
Posts: 123

PostPosted: Wed Jun 28, 2006 5:08 am    Post subject: Reply with quote

Yes, it is. :)
Back to top
View user's profile Send private message
jas0nuk



Joined: 27 Apr 2006
Posts: 137

PostPosted: Wed Jun 28, 2006 5:38 am    Post subject: Reply with quote

This works?
Back to top
View user's profile Send private message
moonlight



Joined: 26 Oct 2005
Posts: 567

PostPosted: Wed Jun 28, 2006 5:48 am    Post subject: Reply with quote

Awesome.

Kernel mode on 2.6. The keys will be with us soon :)

Congratulations.
Back to top
View user's profile Send private message
Dragonuk



Joined: 16 May 2006
Posts: 6

PostPosted: Wed Jun 28, 2006 5:58 am    Post subject: Reply with quote

amazing, is it full kernal mode
Back to top
View user's profile Send private message
zshadow



Joined: 26 Dec 2005
Posts: 42

PostPosted: Wed Jun 28, 2006 6:02 am    Post subject: Reply with quote

moonlight wrote:
Awesome.

Kernel mode on 2.6. The keys will be with us soon :)

Congratulations.


indeed :)

nice work hitchhikr
Back to top
View user's profile Send private message
hitchhikr



Joined: 04 Feb 2006
Posts: 83

PostPosted: Wed Jun 28, 2006 6:05 am    Post subject: Reply with quote

For those who're wondering: the only thing this program does is to dump the kernel memory on the memory stick, thing that is impossible to do in user mode. It *does* need GTA to run on 2.6, of course.
Back to top
View user's profile Send private message
Dragonuk



Joined: 16 May 2006
Posts: 6

PostPosted: Wed Jun 28, 2006 6:08 am    Post subject: Reply with quote

hitchhikr -

Is it full kernal mode? Does it mean we can access read/write flash? And we can run apps with full kernal mode?
Back to top
View user's profile Send private message
hitchhikr



Joined: 04 Feb 2006
Posts: 83

PostPosted: Wed Jun 28, 2006 6:09 am    Post subject: Reply with quote

There's read & write access to kernel space, take a wild guess ;D
Back to top
View user's profile Send private message
_00_



Joined: 22 May 2005
Posts: 8

PostPosted: Wed Jun 28, 2006 6:10 am    Post subject: bug in sceKernelLoadExec? Reply with quote

hitchhikr:
is this ':' at the end of filename crucial for this to work? Something like 48 bytes buffer for device(drive) name?
Back to top
View user's profile Send private message
hitchhikr



Joined: 04 Feb 2006
Posts: 83

PostPosted: Wed Jun 28, 2006 6:13 am    Post subject: Re: bug in sceKernelLoadExec? Reply with quote

_00_ wrote:
hitchhikr:
is this ':' at the end of filename crucial for this to work? Something like 48 bytes buffer for device(drive) name?


Yes it is, we need to break the loop at the right time.
Back to top
View user's profile Send private message
_00_



Joined: 22 May 2005
Posts: 8

PostPosted: Wed Jun 28, 2006 6:18 am    Post subject: Re: bug in sceKernelLoadExec? Reply with quote

hitchhikr wrote:
_00_ wrote:
hitchhikr:
is this ':' at the end of filename crucial for this to work? Something like 48 bytes buffer for device(drive) name?


Yes it is, we need to break the loop at the right time.


Congratulations! You are making history...
Back to top
View user's profile Send private message
Dragonuk



Joined: 16 May 2006
Posts: 6

PostPosted: Wed Jun 28, 2006 6:20 am    Post subject: Reply with quote

Yes well done m8! :)
Back to top
View user's profile Send private message
Muhu



Joined: 28 Jun 2006
Posts: 2

PostPosted: Wed Jun 28, 2006 6:23 am    Post subject: Reply with quote

This 2.60 user is starting to get his hopes up. Great job.
Back to top
View user's profile Send private message AIM Address
pspwill



Joined: 17 Nov 2005
Posts: 51

PostPosted: Wed Jun 28, 2006 6:25 am    Post subject: Reply with quote

the n00bs will love you for this. well done!
Back to top
View user's profile Send private message
FreePlay



Joined: 04 Jan 2006
Posts: 71
Location: Schenectady, New York, USA

PostPosted: Wed Jun 28, 2006 7:39 am    Post subject: Reply with quote

Excellent and encouraging work! Congrats on finding the hole. It seems so obvious, now, of course :)
Back to top
View user's profile Send private message
Brad89



Joined: 25 Jun 2006
Posts: 4

PostPosted: Wed Jun 28, 2006 7:48 am    Post subject: Reply with quote

Hmm..Can't wait until iRShell for 2.6! So, can anyone give a guestimate of how long it will take for coders to incorporate this into their work & such?ie:How long until certain programs(like iRshell) are released for 2.6?
Back to top
View user's profile Send private message
sg57



Joined: 14 Oct 2005
Posts: 154

PostPosted: Wed Jun 28, 2006 8:30 am    Post subject: Reply with quote

If you read over at PSPU, the founder and Fanjita are working on somewhat of an 'eLoader' for this new exploit/hole. So Im assuming the first release of it will allow full access and all those '1.5' only apps will now be 2.5-2.6 apps as well.

But I for one do not have GTA so I guess Ill stick with 1.5 til this is actually turned into something.
Back to top
View user's profile Send private message
Maxime



Joined: 28 Jun 2006
Posts: 1

PostPosted: Wed Jun 28, 2006 9:54 am    Post subject: Reply with quote

OMG this is awesome!
I Hope PSPUpdates isn't speculating about it...
You're gonna make thousand of people cry of hapiness lol.
1 question : are you french ? (perso.orange.fr)
Back to top
View user's profile Send private message
Raphael



Joined: 17 Jan 2006
Posts: 646
Location: Germany

PostPosted: Wed Jun 28, 2006 10:41 am    Post subject: Reply with quote

Great finding :) Keep up the good work

@Maxime: The kids over at PSPU are going crazy about this, already starting to yell for a loader without GTA, downgraders and isos... meh
Back to top
View user's profile Send private message Visit poster's website
lS[UMD/2kdlSU]



Joined: 26 Oct 2005
Posts: 8
Location: Shiga, Japan

PostPosted: Wed Jun 28, 2006 11:04 am    Post subject: Yes you did! But... Reply with quote

Great work!
But what I am worrying is... that we have full access to flash..

We can downgrade 2.60 to 1.50 (or 1.00) maybe,
but some harmful program will be created for 2.60 users.
# In Japan, the "trojan horse" hiding in programs, or illegal ISOs
# is threat for "normal users"....

I'm creating new PSP Antibrick and I'll add 2.60 method.
# PSP Antibrick is protection software from harmful programs.
# And new version uses "debug registers" :P
_________________
lS[UMD/2kdlSU] - now working as 67...
----------------------------------------------
site: jap | eng
jap blog: here
Back to top
View user's profile Send private message Send e-mail Visit poster's website MSN Messenger
laichung



Joined: 06 May 2005
Posts: 123

PostPosted: Wed Jun 28, 2006 11:04 am    Post subject: Re: Kernel mode under firmware 2.6 * The proof of concept * Reply with quote

Thx very much at all , what a great news~!
But could you pls explain what's the secret inside? thx ~
Back to top
View user's profile Send private message
dot_blank



Joined: 28 Sep 2005
Posts: 498
Location: Brasil

PostPosted: Wed Jun 28, 2006 11:20 am    Post subject: Reply with quote

just check out the source that is with the zip
the exploit is so simple ...its all there and as you
can see it require 48 byte length path and that
will create a buffer overflow quiet easily ...something
so small i do not think i or anyone really bent on finding
could have found but hitchhikr has very good eyes :)

this is truely an exploit and not speculation
_________________
10011011 00101010 11010111 10001001 10111010
Back to top
View user's profile Send private message
laichung



Joined: 06 May 2005
Posts: 123

PostPosted: Wed Jun 28, 2006 11:44 am    Post subject: Reply with quote

I just want to know more about how they found it or the theory behind~


dot_blank wrote:
just check out the source that is with the zip
the exploit is so simple ...
Back to top
View user's profile Send private message
groepaz



Joined: 01 Sep 2005
Posts: 305

PostPosted: Wed Jun 28, 2006 11:53 am    Post subject: Reply with quote

Quote:
I just want to know more about how they found it or the theory behind


2.5 memory dump disassembly, time, skill. thats the theory pretty much :=)
_________________
http://www.hitmen-console.org
http://hitmen.c02.at/files/yapspd/
Back to top
View user's profile Send private message Visit poster's website
UsefulIdiot



Joined: 17 Jan 2006
Posts: 13

PostPosted: Wed Jun 28, 2006 12:58 pm    Post subject: Reply with quote

bravo! i applaud thee!
Back to top
View user's profile Send private message
Viper8896



Joined: 26 Jan 2006
Posts: 110

PostPosted: Wed Jun 28, 2006 7:45 pm    Post subject: Reply with quote

owned!
Back to top
View user's profile Send private message
Barts_706



Joined: 24 Jan 2006
Posts: 38

PostPosted: Wed Jun 28, 2006 8:02 pm    Post subject: Trurely awesome! Reply with quote

Respect. This really is something. I have almost lost hope for kernel access on 2.00+ - and there it is. I have a feeling that there will be a surge of programs to follow, including some that we do not talk about in these forums... ;)

Congratulations. Hitchhikr's guide to the PSP.
Back to top
View user's profile Send private message Visit poster's website
Brunni



Joined: 08 Oct 2005
Posts: 186

PostPosted: Wed Jun 28, 2006 10:04 pm    Post subject: Reply with quote

Excellent work :)
Hmm... something I was wondering, how is kernel space protected on PSP, as there is no MMU?
_________________
Sorry for my bad english
Oldschool library for PSP - PC version released
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    forums.ps2dev.org Forum Index -> PSP Development All times are GMT + 10 Hours
Goto page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group