forums.ps2dev.org

Heimdall · Joined: 10 Nov 2005 Posts: 259 Location: Netherlands

I've been playing with SHA algorithms and name generators for a couple of weeks and found some names that may match some function names on vsh:

ne0h · Joined: 21 Feb 2008 Posts: 386

Is possible, but I don't know very well how to reverse names and fuctions...
However good worl Heimdall!

jas0nuk · Joined: 27 Apr 2006 Posts: 137

Good stuff Heimdall. The chances are these are real, since the sceCcc prefix has worked with a few of them.
SilverSpring will be pleased ;)

Dariusc123456 · Joined: 12 Aug 2008 Posts: 394

On the pspsdk leak, they had some commands based on those commands. Libccc . For legal reasons, I cant post them. but you can google it.

Raphael · Joined: 17 Jan 2006 Posts: 646 Location: Germany

Unfortunately, sony changed the NIDs of paf.prx in later firmwares. So it's still not easily possible to use those functions unless they can be safely mapped with the NID resolver in the newer CFW's
_________________
<Don't push the river, it flows.>
http://wordpress.fx-world.org - my devblog
http://wiki.fx-world.org - VFPU documentation wiki
Alexander Berl

jean · Joined: 05 Jan 2008 Posts: 489

sha attack on NIDs? Didn't they leave the sha-derived nids? ...or you're still attacking an old dump??

Raphael · Joined: 17 Jan 2006 Posts: 646 Location: Germany

Heimdall · Joined: 10 Nov 2005 Posts: 259 Location: Netherlands

I'm not attacking, i've just tried to understand how the sdk works internally and since the gu libraries are just SHA hashes i tryed to make a simple app to brute force the unknown ones and found those functions on the paf.prx which i still have no clue what is it used for.

SilverSpring · Joined: 27 Feb 2007 Posts: 115

Unfortunately, those NID's have been known for a long time already: http://silverspring.lan.st/1.5x/vsh/module/paf.xml

And like Raphael mentioned, the paf NID's were changed in later fw.

Plus you wont find many more in paf by bruteforcing the hashes. Paf is a collection of many many different libs and most of them are C++, so the exports are C++ mangled names. I'm not sure how the SCE toolchain mangles them but I tried bruteforcing using the standard gcc name mangling format but couldnt get any hits.

It's unlikely any of the paf NID's will be cracked (same goes for all the other VSH modules) unless someone figures out the exact format the name mangling is in.

EDIT:

Actually you got a few sceCCC ones that weren't in the list.

Dariusc123456 · Joined: 12 Aug 2008 Posts: 394

What is your code that you use in it? Maybe it can still be use somehow.

SilverSpring · Joined: 27 Feb 2007 Posts: 115

My code? I've never used these functions before, I don't know their prototypes so I have no idea of their proper usage. I only cracked the NID's. Granted, I've never had to do character code conversion before and I doubt many other devs need to either.

What I do know is that for the Chinese/Japanese/Korean to Latin (and vice-versa) conversions they use lookup tables that are stored in the vsh/etc folder. There are multiple tables for each conversion type:

Dariusc123456 · Joined: 12 Aug 2008 Posts: 394

it depends on how its use that will make the dev to use it.

jean · Joined: 05 Jan 2008 Posts: 489

kralyk · Posted: Sat Aug 23, 2008 10:19 pm Post subject:

what do you guys use to sha attack the nids?
just a a-zA-Z brute force, or do you have some sort of dictionary?
_________________
...sorry for my english...

moonlight · Joined: 26 Oct 2005 Posts: 567

kralyk · Posted: Sat Aug 23, 2008 11:42 pm Post subject:

ok thanks for info.

Btw, Is the dictionary public? I dont ask for it in case its private/secret or something... just curious...
I'd like to try my luck with revealing some unknown ones...
_________________
...sorry for my english...

moonlight · Joined: 26 Oct 2005 Posts: 567

There is no secret in a dictionary :)

http://www.sendspace.com/file/41f76y

kralyk · Posted: Mon Aug 25, 2008 7:21 am Post subject:

thanks!
_________________
...sorry for my english...