Slashdot Mirror

← Back to Stories (view on slashdot.org)

HEN TIFF Exploit Cracks PSP-3000 Open For Homebrew

Posted by Soulskill on from the finding-a-way dept.

indrora writes "The PSP community was rocked this weekend by the Homebrew Enabler (HEN) from developers Davee and Bubbletune. One of their friends on the Team Typhoon development team posted a YouTube video showing proof of the TIFF Exploit running on Firmware 5.03, changing the firmware version and MAC address for a reboot. This comes after a picture of gpSP running on a PSP-3000 via the HEN exploit. From the QJ.net article: 'First [things] first: No, Davee hasn't finished the HEN yet. Which means it isn't out yet. What we do have today is some visual confirmation that the HEN can indeed run emulators, in this case the GBA emulator gpSP.' And from the more recent article showing the exploit demo video: 'Be patient, everyone. Davee's HEN Kernel exploit will eventually arrive, given time. "This is a demo of the 5.03 firmware running the tiff exploit and booting into a HEN environment on a PSP 2003 (3000 Support also) on 5.03 Official Firmware. This proves that the code survives a reboot and the system software and MAC address can be changed. This is something that only can be done with a kernel exploit. A video launching homebrew will be posted later."' Hopefully, we'll soon have PSP-3000s playing homebrew games and running PSP uCLinux."

55 of 77 comments (clear)

  1. Cool by Goldberg's+Pants · · Score: 4, Funny

    All 27 remaining PSP users must be thrilled with this!

    1. Re:Cool by Nick+Ives · · Score: 1, Insightful

      More like 50m.

      I was surprised when I saw that number a few months ago too but it's true, PSP has 1/3 the handheld market.

      That raises the question, why aren't there any killer games for the PSP? 50m is still bigger than all the next-gen (PSWii60) consoles combined.

      --
      Nick
    2. Re:Cool by Anonymous Coward · · Score: 1, Insightful

      Just wondering, is there even 27 games out for it?

      I thought the PSP was nicer hardware overall -- one nice big screen, instead of 2 small shitty screens with a HUGE seam between them like the DS.

      Then I looked at the game selection, and I bought the kids a pair of DS. It was also a lot cheaper (not only the console itself, but the memory cards too)

    3. Re:Cool by Goldberg's+Pants · · Score: 2, Insightful

      As I said a while back on here, I looked into getting a PSP and planned to hack it, with piracy being a part of it.

      I didn't see anything for the PSP worth pirating. And only one game worth buying. (Football Manager.)

      Of course lately the DS isn't much better IMO. I've largely stopped using mine.

    4. Re:Cool by vux984 · · Score: 3, Informative

      50m is still bigger than all the next-gen (PSWii60) consoles combined.

      Say what now? Wii has 50M pretty much all by itself.

    5. Re:Cool by Nick+Ives · · Score: 1

      OK, so combined sales of next-gen is almost 100m. Still, not too far out...

      --
      Nick
    6. Re:Cool by Anonymous Coward · · Score: 1, Insightful

      Well, the game lineup is still a trillion times better than the PSP. But if you know something better, please share...

    7. Re:Cool by MikeBabcock · · Score: 1

      This announcement is why there aren't more killer apps on the PSP. Where the piracy potential is high, game developers don't want to take the risk to make high budget games.

      For the record though, God of War was really good, as was Daxter. Personally I thought Patapon was the ultimate in hand-held fun but Puzzle Quest is pretty great too, especially since its easily suspendable when you need to put it down. Suspending Patapon on the other hand is almost always a bad idea (due to the timed input).

      --
      - Michael T. Babcock (Yes, I blog)
    8. Re:Cool by Mr2001 · · Score: 1

      This announcement is why there aren't more killer apps on the PSP. Where the piracy potential is high, game developers don't want to take the risk to make high budget games.

      I suppose that's why there are no high budget games for Xbox 360, Wii, PS2, or PC.

      --
      Visual IRC: Fast. Powerful. Free.
    9. Re:Cool by Nick+Ives · · Score: 1

      Where the piracy potential is high, game developers don't want to take the risk to make high budget games.

      Until this announcement (which hasn't been released yet) you had to use a special battery pack to mod your PSP and there was a chance of bricking it.

      Compared to DS, where you can buy R4DS + other brand flash carts from newsagents, at least in the cities here in the UK, and I'd say pirating games on PSP is an order of magnitude harder on PSP than DS. DS still sells boatloads of games though, even though its install base is only double that of PSP.

      --
      Nick
    10. Re:Cool by Grim+Beefer · · Score: 1

      The DS is FAR easier to pirate gam...ahem..."run homebrew" for. All you have to do is plug a card into Slot 1 loaded with software. Really, that's it. There is no battery swapping, tiff expoiting crap to deal with. Also, most DS games are relatively tiny, compared to a UMD. Yet the DS has a million awesome games.

      Because the PSP can do near PS2 quality games, there is a large onus to up the production value. Bigger budgets mean higher risk, and this is probably the real reason why the PSP is pretty barren.

    11. Re:Cool by Theoboley · · Score: 1

      i bought mine, hacked it, and recently found it in my dufflebag from the last trip i took... in NOVEMBER. playing PSP =/= priority apparently.

      --
      Stupidity only gets you so far, then you've gotta try
  2. Why.... by Darkness404 · · Score: 4, Interesting

    Why even include TIFF support in the PSP if you were trying to lock people out of homebrew? TIFF, by nature, will contain more exploitable code then other image formats (based on how the image is stored and other technical specs of the TIFF format), and is much lesser used compared to JPEG, PNG, GIF, and the dozens of other image formats we use on a daily basis. But the inclusion of TIFF seems puzzling, unless by default various Sony products save things as TIFF, there doesn't seem to be any need for it.

    --
    Taxation is legalized theft, no more, no less.
    1. Re:Why.... by Anonymous Coward · · Score: 3, Informative

      Digital cameras produce TIFFs.

    2. Re:Why.... by imsabbel · · Score: 1

      Did, you mean.
      Back when people still used flobby disks...

      --
      HI O WISE PRINCE. WHT TOOK U SO DAM LONG?
    3. Re:Why.... by Archaemic · · Score: 2, Informative

      Yes, I wonder the same thing about TIFF support on the PSP myself. It was touted as a new feature for the 2.0 firmware, but I don't really see the point, given how insecure it is in general and how rarely it is used. Furthermore, if it is used for a camera picture, it's pretty useless anyway, because the PSP will generally not show the picture if it's too large anyway, which is usually smaller than digital camera resolution. The original PSP model does only have 32MB of RAM, 8 of which is not available in usermode. A fair amount of this memory is unavailable to the decoder anyway, leaving only about 4MB of RAM for displaying a picture.

      I've had two battles with LibTIFF on the PSP, one resulting in a triumphant victory for me (although never released due to various reasons). The other was me actually trying to exploit a crash that lead to the exploit that MaTiAz found (which is the TIFF exploit (user mode) mentioned in this article). The kernel mode exploit used in conjunction with the user mode exploit was found by Davee, as mentioned. However, what was particularly great was how they patched the TIFF exploit for 5.03 in the following firmware: by disabling the section of LibTIFF that was being exploited. If one tries to view a TIFF that has additional channels (i.e. alpha channel, be it premultiplied or whatever), it says unsupported data. Brilliant work, Sony. The TIFF exploit didn't work in any other software because the other software properly supported the additional channels. It's still sort of a mystery how they failed this one so hard.

      Furthermore, there was an exploit in LibTIFF in earlier firmwares (and actually the current stable version of LibTIFF) that was patched by Apple, and then Sony (and most others) adopted the patch. However, the patch itself is broken, as I discovered when looking at it. Therefore, I now have a TIFF that will crash any modern LibTIFF application (unless it has a specific section of LibTIFF disabled, which some do, such as Photoshop CS3), including the PSP on its newest firmware. Works even on the newest firmware. All I can say for the patch is that it did seal the vector for shellcode, even if it didn't seal a vector for a DoS. I filed a patch with the LibTIFF people that sealed the hole entirely, but it's been ignored since January.

    4. Re:Why.... by AliasMarlowe · · Score: 2, Informative

      Did, you mean. Back when people still used flobby disks...

      Actually, some digital SLRs use variants of the TIFF format to store their "raw" files. They may muck about with the headers and you need to know the RGB response curves to make proper use of the data, but underneath, it's still a TIFF. The Pentax PEF format as produced by the istD family of DSLRs can be rendered by TIFF readers which ignore certain "irregularities" in the header, for instance.

      --
      Those who can make you believe absurdities can make you commit atrocities. - Voltaire
    5. Re:Why.... by Lord+Byron+II · · Score: 1

      TIFF, by nature, will contain more exploitable code then other image formats

      Care to elaborate? It seems to me that TIFF, being uncompressed, would require less lines of code to process than a compressed format like JPEG. Less code usually means less security holes. What's the case here?

    6. Re:Why.... by vux984 · · Score: 1

      Care to elaborate?

      TIFF at this point is basically a container. You can stick anything into a TIFF, including a JPG.

    7. Re:Why.... by Darkness404 · · Score: 1

      The TIFF file format is unusual in comparison to other image formats, in that it is composed of small descriptor blocks containing offsets into the file which point to the actual pixel image data (composed of bands of pixel rows). This means that incorrect offset values can cause programs to attempt to read erroneous portions of the file or attempt to read past the physical end of file. Like most other image file formats, improperly encoded packet or line lengths within the file can cause poorly written rendering programs to overflow their internal buffers. Properly-written image rendering programs generally avoid such pitfalls.

      Which basically means, buffer overflows are trivial to do with TIFF. Then there is the fact that libtiff has several exploits (as mentioned by a previous poster) that still exist in the most stable version of it.

      --
      Taxation is legalized theft, no more, no less.
    8. Re:Why.... by c_forq · · Score: 1

      Almost every point-and-shoot digital I've ever owned uses TIFF for the "raw" files, it is has the option of uncompressed files. Why I would want an uncompressed image from my 2-megapixel POS camera with a crappy lens, I have no idea. My Nikon SLR uses NEF, which is based on TIFF but breaks from the standard in the header and on image tags.

      --
      Computers allow humans to make mistakes at the fastest speeds known, with the possible exception of tequila and handguns
    9. Re:Why.... by MikeBabcock · · Score: 1

      Most digital cameras use TIFF as the file format for RAW files at least, but many also do so for their JPEG files (you can store JPEG in TIFF encapsulation).

      The ones that don't use TIFF seem to use TarGA.

      --
      - Michael T. Babcock (Yes, I blog)
    10. Re:Why.... by Anonymous Coward · · Score: 2, Funny

      Can we at least acknowledge that TIFF isn't an image format but a linked library format, and make the buffer overflows a feature and not a bug?

    11. Re:Why.... by fireman+sam · · Score: 3, Insightful

      "Why I would want an uncompressed image from my 2-megapixel POS camera with a crappy lens, I have no idea."

      Because it uses the super crappy jpeg compression code which will give even worse results. At least if you can capture in raw you can do post processing with you crappy computer without the jpeg artifacts.

      --
      it is only after a long journey that you know the strength of the horse.
    12. Re:Why.... by KZigurs · · Score: 1

      About 6-10 high-end models (generally medium format backs).

    13. Re:Why.... by c_forq · · Score: 1

      I don't feel the filesize justifies it though. With my SLR I always shoot in RAW, but I view my point and shoot, like most people view their camera phones, it is going to be a low quality image; so why care? And on "super crappy jpeg compression code", I don't think that is really an issue unless I am compressing it multiple times (infamous seagull example) or am using it for something serious (in which case I would/should be using my SLR).

      --
      Computers allow humans to make mistakes at the fastest speeds known, with the possible exception of tequila and handguns
  3. Just admit you're not making new homebrew games by Anonymous Coward · · Score: 5, Insightful

    Hopefully, we'll soon have PSP-3000s playing emulators and running the same goddamn games you've all been emulating since the first emulators came out for PCs.

    There. Fixed that for you.

    Unless someone can show me a decent amount of actual, fairly good, unique homebrew games, that is. You know, not the piece of shit "proof of concept that we can homebrew" game clones we see on every iteration of homebrew hacks, but the groundbreaking games that all the proponents of homebrew keep bragging about and assuring us will result from it?

    1. Re:Just admit you're not making new homebrew games by beleriand · · Score: 1

      http://www.zincland.com/powder/

      It may not be groundbreaking, but it's a good game.

      "Decent amount" it may be true that there are not many yet, but there are allready some good free versions of the quake-type game e.g., so we may see some good free games in the future.

    2. Re:Just admit you're not making new homebrew games by calmofthestorm · · Score: 1

      Well shiver me timbers, this landlubber has yet to discover the bay.

      --
      93rd rule of Slashdot: No matter how obvious my sarcasm is, my comment will be taken seriously by someone.
    3. Re:Just admit you're not making new homebrew games by KDR_11k · · Score: 1

      Dead parrots?

      --
      Justice is the sheep getting arrested while an impartial judge declares the vote void.
    4. Re:Just admit you're not making new homebrew games by Grim+Beefer · · Score: 1

      While I wholeheartedly agree with your point, not all homebrew sucks, at least not for the DS...

      Check out a program called Colors, which is a simple painting/sketching program which uses the touch interface. To my knowledge, the DS doesn't have this feature otherwise.

  4. Stupid Sony by Nom+du+Keyboard · · Score: 2, Interesting

    Why do you keep trying to lockout your homebrew users, who are some of your most talented fans? Why not end this stupid war and simply sell an open version that can run what people want to run on it?

    Same for Apple. You are trying to control too much. Leads me to cheer for an open Android platform with healthy competition from clone makers. The biggest jump in improvement of the Apple platform I ever saw was during the brief period that Apple allowed clone makers.

    Proprietary systems are never to the consumer's advantage.

    --
    "It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
    1. Re:Stupid Sony by Anonymous Coward · · Score: 1, Insightful

      Because 99.99% of this "homebrew" - pirated games. Sony did sell open for development(but not for piracy) PS1 and PS2, guess how many bought?

    2. Re:Stupid Sony by Moridineas · · Score: 1

      The biggest jump in improvement of the Apple platform I ever saw was during the brief period that Apple allowed clone makers.

      Really? Such as?

      I can't say I remember much of the clone period as I wasn't that into macs back then. Still have a SuperMac sitting around in a storage closet somewhere though... What changed?

    3. Re:Stupid Sony by argent · · Score: 1

      The biggest jump in improvement of the Apple platform was when Apple quit trying to write their own operating system and switched to UNIX. That was long after they stopped allowing clones to run that piece of crap Mac OS.

    4. Re:Stupid Sony by annerajb · · Score: 1

      They are just trying to limit the amount of piracy. i am sure that somebody on sony agrees the put homebrew and backup games on the psp thing. but it also opens the door for piracy i wish someday a console will let you do backups so only you can use. instead of having to rely on hacking the console for it. on a unrelated note my starcrafts disk are all dead beyond repair if i had a backup of them i would not have to go download them from piratebay. (keys are lost too fyi so no blizzard downloader)

    5. Re:Stupid Sony by Anonymous Coward · · Score: 2, Insightful

      "Proprietary systems are never to the consumer's advantage."

      Of course not. That's because it's not about you or what's good for you. One day we'll wake up and realize that the market, in it's current form, isn't based on "best product" for the "best price". It's about gaining enough market share to afford legislation to protect your business model from innovation and competition.

    6. Re:Stupid Sony by Nethead · · Score: 1

      Mac? No, he's talking about the Franklin Ace. Now get off my lawn, kid!

      --
      -- I have a private email server in my basement.
    7. Re:Stupid Sony by Microlith · · Score: 1

      Nitpick: They didn't switch to UNIX.

      They switched to NExT (xnu,) adopted a bit from FreeBSD, and added the BSD userland and their own proprietary front end. Then got it certified UNIX.

      No, the biggest jump in improvement for Apple was bringing Jobs back. The only thing it's bad for these days are the techies who think their minority opinion is what everyone really wants.

    8. Re:Stupid Sony by PiSkyHi · · Score: 1

      The so-called fans bought the damned device!

      That should be enough, but Sony's plan was to merely balance the books with the hardware - it was making the software turn you around and getting you to bend over, that was the smiles-round-the-board-room moment.

    9. Re:Stupid Sony by tepples · · Score: 1

      Because those so-called "fans" don't generate revenue.

      Then don't take a gnikcuf loss on your hardware. Try actually selling a low-cost PC that connects to a TV, or a Linux-based PDA with a D-pad, and charge a bit more than it costs to make and ship it. What a concept!

    10. Re:Stupid Sony by tepples · · Score: 1

      Because 99.99% of this "homebrew" - pirated games.

      Is Ubuntu a pirated copy of Solaris? No. Is GIMP a pirated copy of Paint Shop Pro? No. Is OpenOffice.org a pirated copy of Microsoft Office 2003? No. Are Lockjaw, Gnometris, and KSirtet pirated copies of Tetris? No.

      Sony did sell open for development(but not for piracy) PS1 and PS2, guess how many bought?

      The "Net Yaroze" PS1 and the PS2 with Linux were token efforts, discontinued in less than a year. Other than VAIO and PLAYSTATION 3, Sony hasn't kept a commitment to any computing platform without a lockout chip.

    11. Re:Stupid Sony by argent · · Score: 1

      Nitpick back. I'm so tired of people who either (a) don't understand what the revolution in computing that UNIX introduced was and what it meant, or (b) have skin in the game and want to queer the pitch for everyone else by playing games.

      NeXTstep was UNIX.
      FreeBSD is UNIX.
      Linux is UNIX, and was UNIX even before they got certification.
      OS X is UNIX.
      UNIX is as UNIX does.

      UNIX is and has been for over a quarter of a century - since the first independent implementations like Idris and Regulus, a FAMILY of operating systems, with a huge variety of underlying implementations, that share a common core API based around the revolutionary simplifications in API design that were developed at Bell Labs in the early '70s. They didn't just make a "simple Multics", they went far beyond that. There's been nothing like it since, and we're long overdue for another revolution of that level.

    12. Re:Stupid Sony by Jae686 · · Score: 1

      and they were hard to get and eXpenSive! And whats the point if its hard to share what you do with it ?

  5. Re:I don't get it. by KasperMeerts · · Score: 1

    That's the way it always works, the manufacturers catching up with the crackers. Don't worry, there will always be more exploits to discover.

    And sometimes, exploits are practically unfixable. All PSP-1000 and PSP-2000 models are crackable using a modified, so-called Pandora Battery.

    --
    As long as there are slaughterhouses, there will be battlefields.
  6. Re:5.03? by Archaemic · · Score: 1

    Yes, it came out in a hurry to patch the exploit used in this firmware. These exploits don't pop up all that often, you know. Although they do pop up often enough, as it turns out. So I expect to see another one come firmware 6.95.

  7. Re:Lesbian Strapon Porno HERE! No Torrents, all mp by Rev.+Brucie+J. · · Score: 1

    Pics or it isn't real.

  8. Re:5.03? by millennial · · Score: 1

    get to work, hacker boy! ;D
    (--FreePlay)

    --
    I am scientifically inaccurate.
  9. Novel idea by Goffee71 · · Score: 3, Insightful

    If all these homebrew guys are such loyal PSP fans and great coders, why don't they release their cracks with a block on running PSP ripped games, thereby protecting the success of the console they enjoy playing on?

    That'd be a decent thing to see (right up there with alien motherships, flying pigs and world peace)

    --
    If he's the Walrus then can I be a penguin please?
    1. Re:Novel idea by wbo · · Score: 2, Informative

      Actually Davee has stated it will be very difficult to run pirated games using this HEN.

  10. Then what is to the consumer's advantage? by tepples · · Score: 1

    Why not end this stupid war and simply sell an open version that can run what people want to run on it?

    Because then you can't squeeze the corporate publishers (you know, the ones with the money) for a gatekeeper's fee.

    The biggest jump in improvement of the Apple platform I ever saw was during the brief period that Apple allowed clone makers.

    Even bigger than 9 to X?

    Proprietary systems are never to the consumer's advantage.

    Then which computing platform that comes with a composite or S-Video output as a standard feature (like the PS2, PSP 3000, PS3, Wii, and Xbox 360) is to the consumer's advantage? And what handheld gaming system sold in North America is to the consumer's advantage?

  11. Pandora Nukem Forever by tepples · · Score: 1

    All PSP-1000 and PSP-2000 models are crackable using a modified, so-called Pandora Battery.

    But Pandora isn't even out yet. If it were, people wouldn't need PSP homebrew. Why did people start calling it a "Pandora battery" instead of a "service battery" or a "-1 battery" anyway?

  12. Re:Sony makes money with software... by LoverOfJoy · · Score: 1

    Much like Apple they do earn money using software and sell hardware as loss

    I have a hard time believing Apple sells hardware at a loss. Do you have anything to back that up? Are you talking about the iphone and its associated phone contracts as I don't think that'd really qualify for what you're saying?

  13. Re:Lesbian Strapon Porno HERE! No Torrents, all mp by Sj0 · · Score: 2, Funny

    Tribadism, not Tribulation, you moron.

    I dunno, it looks like the most difficult way possible to get off. Tribulation might be accurate.

    --
    It's been a long time.
  14. Re:Sony makes money with software... by tlhIngan · · Score: 1

    Much like Apple they do earn money using software and sell hardware as loss

    I have a hard time believing Apple sells hardware at a loss. Do you have anything to back that up? Are you talking about the iphone and its associated phone contracts as I don't think that'd really qualify for what you're saying?

    I don't think Apple even sells hardware at a loss at all. The iPhone is sold full price to carriers, who are allowed to subsidize it in their sales contracts with Apple. (After all, I'm sure the carriers don't get phones from Nokia for "free" with their free phones).

    Apple sells hardware for a profit, and leverages their software to sell hardware. Apple's margins are huge compared to the industry average. They also sell software, which also makes a profit. Apple sells "solutions" - hardware and software combinations, but independently, they also make money off each. Hence stuff like Boot Camp - if they can't sell you a solution, they'd still rather sell you something and make money rather than not sell you anything at all.