Kernel mode under firmware 2.6 * The proof of concept *

hitchhikr · Post by **hitchhikr** » Wed Jun 28, 2006 5:03 am

http://perso.orange.fr/franck.charlet/Exploit_2.6.zip

There you have it boys.

Zettablade · Post by **Zettablade** » Wed Jun 28, 2006 5:05 am

eh? What is it? Is it safe?

harleyg · Post by **harleyg** » Wed Jun 28, 2006 5:08 am

Yes, it is. :)

jas0nuk · Post by **jas0nuk** » Wed Jun 28, 2006 5:38 am

This works?

moonlight · Post by **moonlight** » Wed Jun 28, 2006 5:48 am

Awesome.

Kernel mode on 2.6. The keys will be with us soon :)

Congratulations.

Dragonuk · Post by **Dragonuk** » Wed Jun 28, 2006 5:58 am

amazing, is it full kernal mode

zshadow · Post by **zshadow** » Wed Jun 28, 2006 6:02 am

moonlight wrote:Awesome.

Kernel mode on 2.6. The keys will be with us soon :)

Congratulations.

indeed :)

nice work hitchhikr

hitchhikr · Post by **hitchhikr** » Wed Jun 28, 2006 6:05 am

For those who're wondering: the only thing this program does is to dump the kernel memory on the memory stick, thing that is impossible to do in user mode. It *does* need GTA to run on 2.6, of course.

Dragonuk · Post by **Dragonuk** » Wed Jun 28, 2006 6:08 am

hitchhikr -

Is it full kernal mode? Does it mean we can access read/write flash? And we can run apps with full kernal mode?

hitchhikr · Post by **hitchhikr** » Wed Jun 28, 2006 6:09 am

There's read & write access to kernel space, take a wild guess ;D

_00_ · Post by **_00_** » Wed Jun 28, 2006 6:10 am

hitchhikr:
is this ':' at the end of filename crucial for this to work? Something like 48 bytes buffer for device(drive) name?

hitchhikr · Post by **hitchhikr** » Wed Jun 28, 2006 6:13 am

_00_ wrote:hitchhikr:
is this ':' at the end of filename crucial for this to work? Something like 48 bytes buffer for device(drive) name?

Yes it is, we need to break the loop at the right time.

_00_ · Post by **_00_** » Wed Jun 28, 2006 6:18 am

hitchhikr wrote:
_00_ wrote:hitchhikr:
is this ':' at the end of filename crucial for this to work? Something like 48 bytes buffer for device(drive) name?
Yes it is, we need to break the loop at the right time.

Congratulations! You are making history...

Dragonuk · Post by **Dragonuk** » Wed Jun 28, 2006 6:20 am

Yes well done m8! :)

Muhu · Post by **Muhu** » Wed Jun 28, 2006 6:23 am

This 2.60 user is starting to get his hopes up. Great job.

pspwill · Post by **pspwill** » Wed Jun 28, 2006 6:25 am

the n00bs will love you for this. well done!

FreePlay · Post by **FreePlay** » Wed Jun 28, 2006 7:39 am

Excellent and encouraging work! Congrats on finding the hole. It seems so obvious, now, of course :)

Brad89 · Post by **Brad89** » Wed Jun 28, 2006 7:48 am

Hmm..Can't wait until iRShell for 2.6! So, can anyone give a guestimate of how long it will take for coders to incorporate this into their work & such?ie:How long until certain programs(like iRshell) are released for 2.6?

sg57 · Post by **sg57** » Wed Jun 28, 2006 8:30 am

If you read over at PSPU, the founder and Fanjita are working on somewhat of an 'eLoader' for this new exploit/hole. So Im assuming the first release of it will allow full access and all those '1.5' only apps will now be 2.5-2.6 apps as well.

But I for one do not have GTA so I guess Ill stick with 1.5 til this is actually turned into something.

Maxime · Post by **Maxime** » Wed Jun 28, 2006 9:54 am

OMG this is awesome!
I Hope PSPUpdates isn't speculating about it...
You're gonna make thousand of people cry of hapiness lol.
1 question : are you french ? (perso.orange.fr)

Raphael · Post by **Raphael** » Wed Jun 28, 2006 10:41 am

Great finding :) Keep up the good work

@Maxime: The kids over at PSPU are going crazy about this, already starting to yell for a loader without GTA, downgraders and isos... meh

lS[UMD/2kdlSU] · Post by **lS[UMD/2kdlSU]** » Wed Jun 28, 2006 11:04 am

Great work!
But what I am worrying is... that we have full access to flash..

We can downgrade 2.60 to 1.50 (or 1.00) maybe,
but some harmful program will be created for 2.60 users.
# In Japan, the "trojan horse" hiding in programs, or illegal ISOs
# is threat for "normal users"....

I'm creating new PSP Antibrick and I'll add 2.60 method.
# PSP Antibrick is protection software from harmful programs.
# And new version uses "debug registers" :P

laichung · Post by **laichung** » Wed Jun 28, 2006 11:04 am

Thx very much at all , what a great news~!
But could you pls explain what's the secret inside? thx ~

dot_blank · Post by **dot_blank** » Wed Jun 28, 2006 11:20 am

just check out the source that is with the zip
the exploit is so simple ...its all there and as you
can see it require 48 byte length path and that
will create a buffer overflow quiet easily ...something
so small i do not think i or anyone really bent on finding
could have found but hitchhikr has very good eyes :)

this is truely an exploit and not speculation

laichung · Post by **laichung** » Wed Jun 28, 2006 11:44 am

I just want to know more about how they found it or the theory behind~

dot_blank wrote:just check out the source that is with the zip
the exploit is so simple ...

groepaz · Post by **groepaz** » Wed Jun 28, 2006 11:53 am

I just want to know more about how they found it or the theory behind

2.5 memory dump disassembly, time, skill. thats the theory pretty much :=)

UsefulIdiot · Post by **UsefulIdiot** » Wed Jun 28, 2006 12:58 pm

bravo! i applaud thee!

Viper8896 · Post by **Viper8896** » Wed Jun 28, 2006 7:45 pm

owned!

Barts_706 · Post by **Barts_706** » Wed Jun 28, 2006 8:02 pm

Respect. This really is something. I have almost lost hope for kernel access on 2.00+ - and there it is. I have a feeling that there will be a surge of programs to follow, including some that we do not talk about in these forums... ;)

Congratulations. Hitchhikr's guide to the PSP.

Brunni · Post by **Brunni** » Wed Jun 28, 2006 10:04 pm

Excellent work :)
Hmm... something I was wondering, how is kernel space protected on PSP, as there is no MMU?

forums.ps2dev.org

Kernel mode under firmware 2.6 * The proof of concept *

Kernel mode under firmware 2.6 * The proof of concept *

bug in sceKernelLoadExec?

Re: bug in sceKernelLoadExec?

Re: bug in sceKernelLoadExec?

Yes you did! But...

Re: Kernel mode under firmware 2.6 * The proof of concept *

Trurely awesome!