maybe another tiff overflow in the 2.01+ firmwares - PSP3D.com - Sony PlayStation Portable News, Homebrew, Hacks, Reviews, Videos, Mods, Forums

6nikola9 · #1 (**permalink**) 05-01-2006, 08:39 AM

have a look at this site http://www.frsirt.com/english/advisories/2006/1563 this exploit was released only some day ago!!!!!!

EDIT: here you can download all the tiff exploit i found and tested!!

Files in the rar archive are files that freezes psp or shows an image, those are 3 files. There are other 2 files wich appears as corrupted data.
NULL deref in PredictorVSetField() freeze
NULL deref in Fax3VSetField() freeze
NULL deref via TIFFError() by TIFFFetchAnyArray() ? doesn't freeze (corrupted data)
buffer overflow via TIFFFetchData() and memcpy() ? doesn't freeze (corrupted data)
double free() in setByteArray()? shows an image but doesn't freeze

i've updated the archive putting other 2 files that psp doesn't read...now in the archive there are all files that i discovered and downloaded by the exploits site
__________________________________________________ _____

other 2 files tiff that freeze psp
links and files attached
http://www.security-protocols.com/sp-x29-advisory.php
http://www.security-protocols.com/sp-x30-advisory.php

__________________________________________________ __

Maybe now a really strange gif....
http://www.security-protocols.com/sp-x28-advisory.php
"Overview:
A heap overflow vulnerability exists when processing .gif files which causes the application to crash, and or may allow for an attacker to execute arbitrary code on the targted host.
Technical Details:
When decompressing a specially crafted .gif file, the CFAllocatorAllocate () function incorrectly parses the malformed data and causes the application to segmentation fault."

The gif in my psp system show as a looping preview loading...when i open the file psp tells me this "showing image impossible (00000001)"

BigMessFHS · #2 (**permalink**) 05-01-2006, 08:52 AM

Intresting, but dosent this still require you put a tiff image on your psp. We all know that its been patched up for 2.01+.

6nikola9 · #3 (**permalink**) 05-01-2006, 08:53 AM

i tried the overflow tiff and this shout down the psp.....it's very very very interesting guys....i'll post the link!!!

BigMessFHS · #4 (**permalink**) 05-01-2006, 08:54 AM

Quote:

Originally Posted by 6nikola9

i tried the overflow tiff and this shout down the psp.....it's very very very interesting guys....i'll post the link!!!

What fw do you have?

6nikola9 · #5 (**permalink**) 05-01-2006, 08:56 AM

i've japanese psp with 2.01 firmware installed on it

6nikola9 · #6 (**permalink**) 05-01-2006, 08:58 AM

http://bugzilla.remotesensing.org/show_bug.cgi?id=1102 here you can download tiff bugs

i'm not a faker, it's the true....download that files

Wow, blackbird I think your comment is a little to short to have made a new thread.......

6nikola9 · #7 (**permalink**) 05-01-2006, 09:04 AM

at this point i could not stay so secure

Homer · #8 (**permalink**) 05-01-2006, 09:06 AM

Quote:

Originally Posted by BigMessFHS

I never said you were a faker but, like I said before no downgrade for 2.01+ will come in the form of a .tiff overflow. Sony has dug the hole, buried the coffin, and racked the dirt over the .tiff bugs for 2.01+.

Not true, a downgrader won't come from the 2.0 tiff exploit. But, if we find another exploit it's possible.

bobsickal · #9 (**permalink**) 05-01-2006, 09:08 AM

I tried putting one of the Tiffs from the bugzilla link on the previous page into the photo folder and it does crash n shut down the PSP but it doesn't allow u to scroll down to the photo or view it it crashes as soon as u go into photo menu

6nikola9 · #10 (**permalink**) 05-01-2006, 09:11 AM

it crashes the psp as the 2.00 does..the image.tiff in 2.00 doesn't showed