Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 6: Line 6:


See [[Modchips]].
See [[Modchips]].
= Software =
= Operating System =
== PS2 Independence ==
Released on 15-08-2003 by Marcus R. Brown <[email protected]>.
Homebrew programs can be launched directly from a memory card on unmodified consoles by using certain software that takes advantage of a long known and used exploit, dealing with the boot part of the EE/IOP process (PS2 Independence exploit).
See [[PS2 Independence]].


== CD/DVD Swap tricks ==
== CD/DVD Swap tricks ==
Line 17: Line 29:
See [[Swap Magic]].
See [[Swap Magic]].


== Mechanics Controller ==
== FreeMCBoot ==
 
The [[MechaCon]] upon receiving power loads the ROM patches from it's EEPROM.
 
Patches can be updated over the PMAP interface in test mode.
 
The performed security checks on it is three checksums over the DES-ECB encrypted data.
 
One can bruteforce that encryption key and apply their own patches.
 
= Software =
 
== Operating System ==
 
=== PS2 Independence ===
 
Released on 15-08-2003 by Marcus R. Brown <[email protected]>.
 
Homebrew programs can be launched directly from a memory card on unmodified consoles by using certain software that takes advantage of a long known and used exploit, dealing with the boot part of the EE/IOP process (PS2 Independence exploit).
 
See [[PS2 Independence]].
 
=== FreeMCBoot ===


Released on 23-05-2008 by jimmikaelkael (with help from Neme). Maintained since 14-09-2011 by SP193.
Released on 23-05-2008 by jimmikaelkael (with help from Neme). Maintained since 14-09-2011 by SP193.


FreeMCBoot allows homebrew programs to be launched without a trigger disc required unlike PS2 Independence.
Free McBoot allows homebrew programs to be launched without a trigger disc required unlike PS2 Independence.


This also allows use of homebrew on unmodded systems without a functional disc drive. However, installation of the exploit to each individual memory card requires either an already exploited/modded system in order to launch the installer, or boot image that can load an app that loads ELF files (network adapter and hard drive also required). Copying from one memory card to another will not work.
This also allows use of homebrew on unmodded systems without a functional disc drive. However, installation of the exploit to each individual memory card requires either an already exploited/modded system in order to launch the installer, or boot image that can load an app that loads ELF files (network adapter and hard drive also required). Copying from one memory card to another will not work.
Line 51: Line 41:
See [[FreeMCBoot/FreeHDBoot]].
See [[FreeMCBoot/FreeHDBoot]].


=== FreeHDBoot ===
== FreeHDBoot ==


The newest versions of Free McBoot, version 1.90 and newer, also have the ability to install and boot from both Sony and non-Sony HDDs when using a "fat" PS2 and network adapter.[3] This support is called FreeHDBoot or FHDB. With a few minor issues, it is now possible to game entirely from the HDD, without needing to use the optical disc drive nor a physical memory card.
The newest versions of Free McBoot, version 1.90 and newer, also have the ability to install and boot from both Sony and non-Sony HDDs when using a "fat" PS2 and network adapter.[3] This support is called FreeHDBoot or FHDB. With a few minor issues, it is now possible to game entirely from the HDD, without needing to use the optical disc drive nor a physical memory card.


=== Fortuna ===
== Fortuna ==


Released on 12-02-2019 by krat0s.
Released on 12-02-2019 by krat0s.
Line 61: Line 51:
Fortuna is an homebrew launcher for all PS2 models.
Fortuna is an homebrew launcher for all PS2 models.


That means EVERY PS2 from 1.90 ROMVER 50k model up to the TV can be exploited by scrolling to an MC-Icon and "back out" of the menu.
That means EVERY PS2 including the TV can be exploited by scrolling to an MC-Icon and "back out" of the menu.


=== Opentuna ===
Fortuna supports all PS2 models, from the first to the very last. However, different files are needed depending on the console version (SLIM or FAT).
an open source version of fortuna. supports almost all PS2 models, from the SCPH-18000 to the very last. This exploit hasn't been ported to the 10k and 15k models, it proved to be quite challenging to do so, probably related to the fact that these models does not have compressed OSDSYS programs. Different files are needed depending on the console version.


=== Requirements ===
Requirements:
*A PS2 Memory Card
*A PS2 Memory Card
*A way to transfer files to the Memory Card (one time setup)
*A way to transfer files to the Memory Card (one time setup)
*Making sure the hacked icon is displayed first (OSDSYS icon order is based on date)


=== The exploit ===
Technical explanation on how it works will be provided later by krat0s.
Fortuna/Opentuna exploit a vulnerability on the RLE decompression routine used for memory card icon textures, allowing to copy raw executables to protected area on ram, and achieving execution when going back to main menu. Alex Párrado, creator of Opentuna, left a [https://www.psx-place.com/#tab_1710732308 technicall write-up on how it works]


TnA writes it is a bit similar to this bug:
TnA writes it is a bit similar to this bug:
Line 83: Line 70:
See [https://www.ps2-home.com/forum/viewtopic.php?f=107&t=8542].
See [https://www.ps2-home.com/forum/viewtopic.php?f=107&t=8542].


 
== ESR Vulnerability ==
=== Oddities ===
Fortuna/Opentuna exploit fails if the console is rendering some japanese characters, either from a save file or by setting the console to Japanese language.
 
During late test stages of Opentuna, it was found that if the hack is triggered from the Browser 2.0, the console stops recognizing the memory card untill you shit it down completely
 
When the OSDSYS parses the hacked icon, any save folder using built-in icons (eg: "your system configuration") will stop getting rendered, showing no icon 3d model, like the exploit icon
 
=== FreeDVDBoot ===
 
An exploit released in 2020 by CTurt, which exploits the DVD Video Player and allows the execution of code (wLaunchElf in the pre-built ISOs). Currently supports all slim consoles, including the ones that don't support FMCB.
 
=== ESR Vulnerability ===


Vulnerability to bypass PS2 disc reader anticopy protection system.
Vulnerability to bypass PS2 disc reader anticopy protection system.
Line 102: Line 77:


It does not yield code-execution, but once you have the ability to load code, you can access content on burned (Video-)DVDs, which have DVD-Video-content. This vulnerability is used in different apps like ESR or SMS and in varying 'formats' like ESR-Discs or simple Video-DVDs with extra-content.
It does not yield code-execution, but once you have the ability to load code, you can access content on burned (Video-)DVDs, which have DVD-Video-content. This vulnerability is used in different apps like ESR or SMS and in varying 'formats' like ESR-Discs or simple Video-DVDs with extra-content.
=== Linux ===
Todo


= Games =
= Games =
== Demo games ==
=== PS2 Yabasic Exploit ===
Released on 12-10-2019 by CTurt.
[http://cturt.github.io/ps2-yabasic.html Writeup by CTurt]
[https://github.com/CTurt/PS2-Yabasic-Exploit Exploit code by CTurt]


== Network games ==
== Network games ==
Line 131: Line 92:
== PS1 Savedata exploits ==
== PS1 Savedata exploits ==


Maybe not exploitable on PS2.
Maybe not exploitable. See PS1 Dec Wiki Vulnerabilities page.
 
See [https://psdevwiki.com/ps1/index.php?title=Vulnerabilities PS1 Dev Wiki Vulnerabilities].
 
=== BOOT.ELF (Fat consoles only) ===
[https://sksapps.haldrie.com/bootleg/tutorials/fmcb/armax2.php Official sp193 guide (backup)]
 
There exists a vulnerability using a PS1 game as a 'boot' disc to load a modified savedata which in turn runs arbitrary code. This method allows for installation of homebrew such as FMCB. In order to utilize this vulnerability you would need a gameshark or similar cheat device to transfer the modded save over from USB and you also need a PC tool to make the savedata modifications and a USB pen drive to use as a medium to transfer the save data from PC>USB>MC. Once you place the modified PS1 game savedata onto a PS2 memory card, just load your boot disc, and voila.


== PS2 Savedata exploits ==
== PS2 Savedata exploits ==
Please note that all contributions to PS2 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS2 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/ps2/Vulnerabilities"