forums.ps2dev.org

[burrito]

I may have found an exploit for firmware 3.52 and maybe the psp slim when it comes out.

1. Download this
2. Put the mp3 on your psp's memory stick at MUSIC/STUFF/1.mp3
3. Open up the STUFF folder with the psp's xmb mp3 player, but don't play the mp3.
4. Get in a different mp3 (in a different folder), and the psp will crash. Maybe this 2nd mp3 could be coded to load a Hello World or downgrader.

I don't know much about exploits, so if you are familiar with them, please discuss what I found.

[Marco_N]

Burrito,

while this is interesting, if your goal is to downgrade to 1.50 why not just use the free "Pandora" service mode unbricker/downgrader/reflasher made by 'Prometheus Project'?

You can find it here
http://www.noobz.eu/joomla/news/pandoras-battery.html

[burrito]

I already know about the Pandora battery; I have one.
I just found this out when using my psp. And if this works, then the reason for it is to downgrade without needing a homebrew capable psp to flash the battery, and this method could possibly downgrade the slim psps.

[Chrighton]

There's talk that the Pandora battery method won't work on the PSP slim.

It may or may not be true, but I'm not hopeful that it will work.

In that event, we're back to (and should be) looking for exploits.

[Art]

Every single firmware bug you might stumble onto isn't an exploit.

[Viper8896]

[TyRaNiD]

Yah that mp3 file has been kicking around for abit, it does indeed cause a crash in the vsh but last time I looked at it the crash did not look exploitable. Might be though if you could work out exactly what it was doing as if I recall it did look to be a stack smashing exploit of a fashion.

[cloudhunter]

[flatmush]

It has been tested on a display psp that was on display at some event. I highly doubt they would add the vulnerability back in before release.

[zinga]

A corrupt ID3v2 tag - I've seen a few before, but haven't seen it do this behaviour yet.