forums.ps2dev.org Forum Index forums.ps2dev.org
Homebrew PS2, PSP & PS3 Development Discussions
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

libtiff exploit question

 
Post new topic   Reply to topic    forums.ps2dev.org Forum Index -> PSP Development
View previous topic :: View next topic  
Author Message
Dariusc123456



Joined: 12 Aug 2008
Posts: 394
PostPosted: Sun Jun 21, 2009 11:11 pm    Post subject: libtiff exploit question Reply with quote
In the tiff, I found after the "ms0:/h.bin" that says, "ScePafModule" or some sort. What use is it to have it in the tiff exploit? Does it have a purpose?
_________________
PSHN - Playstation Hacking Network
PSX/PS1 - HACK - Game Shark
PS2 - HACK - Swap
PSP - HACK - Pandora
PS3 - ?
Back to top
View user's profile Send private message AIM Address
m0skit0



Joined: 02 Jun 2009
Posts: 226
PostPosted: Mon Jun 22, 2009 8:03 pm    Post subject: Reply with quote
http://advancedpsp.freeforums.org/explaining-the-egg-of-the-chickhen-t40.html

You even have the source of the exploit available, why don't you check it out?
_________________
The Incredible Bill Gates wrote:
The obvious mathematical breakthrough would be development of an easy way to factor large prime numbers.
Back to top
View user's profile Send private message
Davee



Joined: 22 Jun 2009
Posts: 59
PostPosted: Tue Jun 23, 2009 2:02 am    Post subject: Reply with quote
"scePaf_Module". It's used in obsoleted module seeking code.
Back to top
View user's profile Send private message
Dariusc123456



Joined: 12 Aug 2008
Posts: 394
PostPosted: Tue Jun 23, 2009 10:19 am    Post subject: Reply with quote
Davee wrote:
"scePaf_Module". It's used in obsoleted module seeking code.


But how does it seek the module? I somwhat understand how the tiff loads the file, but that module?
_________________
PSHN - Playstation Hacking Network
PSX/PS1 - HACK - Game Shark
PS2 - HACK - Swap
PSP - HACK - Pandora
PS3 - ?
Back to top
View user's profile Send private message AIM Address
m0skit0



Joined: 02 Jun 2009
Posts: 226
PostPosted: Tue Jun 23, 2009 8:02 pm    Post subject: Reply with quote
Man, can't you read?

Code:
-- MODULE_NOT_FOUND --
# t0 = MODULE_NAME_POINTER
# t1 = STRING_POINTER
0000003c:   t0 <- v1 + s3
00000040:   t1 <- a0

-- COMPARE_CHARS --
# Compares two strings, pointed by t0 and t1
# Loads t2 with first/next character from MODULE_NAME_POINTER
# Loads t2 with first/next character from STRING_POINTER
# t0 = MODULE_NAME_POINTER
# t1 = STRING_POINTER
00000044:   t2 <- b(t0)
00000048:   t3 <- b(t1)
0000004c:   if t2 = t3 then pc <- pc + 0xc (SAME_CHARS)
# If characters are different, then it's not the module we're searching for
00000054:   pc <- pc + 0x1c
00000058:   v0 <- 1 (DECISION)

-- SAME_CHARS --
# If we character is NULL, then we've reached the end of the string
# so the strings are equal
# Go to DECISION
0000005c:   if t2 = 0 then pc <- pc + 14; v0 <- 0 (DECISION)
# If not, compare next character
00000064:   t0 <- t0 + 1
00000068:   pc <- pc - 0x24
0000006c:   t1 <- t1 + 1 (COMPARE_CHARS)

-- DECISION --
# If v0 = 0, we found the module
# If v0 = 1, we didn't found the module
# v1 = SCEPAF_MODULE_START
# s0 = EGG_START + 0x20
# s3 = OFFSET_MODULE_NAME
# If we found it, go to MODULE_FOUND with s3 = SCEPAF_MODULE_START
00000070:   if v0 = 0 then pc <- pc + 0x20; s3 <- v1 (MODULE_FOUND)
# If not, SCEPAF_MODULE_START++
00000078:   v1 <- v1 + 1
0000007c:   if v1 < s0 then t0 <- 1, else t0 <- 0
# If we reach the egg, go to MODULE_FOUND with s3 = 0
00000080:   if t0 = 0 then pc <- pc + 0x10; s3 <- 0 (MODULE_FOUND)
# If we haven't found the module, try again with v1 + 1
00000088:   pc <- pc - 0x4c (MODULE_NOT_FOUND)

_________________
The Incredible Bill Gates wrote:
The obvious mathematical breakthrough would be development of an easy way to factor large prime numbers.
Back to top
View user's profile Send private message
Dariusc123456



Joined: 12 Aug 2008
Posts: 394
PostPosted: Wed Jun 24, 2009 12:01 am    Post subject: Reply with quote
m0skit0 wrote:
Man, can't you read?

Code:
-- MODULE_NOT_FOUND --
# t0 = MODULE_NAME_POINTER
# t1 = STRING_POINTER
0000003c:   t0 <- v1 + s3
00000040:   t1 <- a0

-- COMPARE_CHARS --
# Compares two strings, pointed by t0 and t1
# Loads t2 with first/next character from MODULE_NAME_POINTER
# Loads t2 with first/next character from STRING_POINTER
# t0 = MODULE_NAME_POINTER
# t1 = STRING_POINTER
00000044:   t2 <- b(t0)
00000048:   t3 <- b(t1)
0000004c:   if t2 = t3 then pc <- pc + 0xc (SAME_CHARS)
# If characters are different, then it's not the module we're searching for
00000054:   pc <- pc + 0x1c
00000058:   v0 <- 1 (DECISION)

-- SAME_CHARS --
# If we character is NULL, then we've reached the end of the string
# so the strings are equal
# Go to DECISION
0000005c:   if t2 = 0 then pc <- pc + 14; v0 <- 0 (DECISION)
# If not, compare next character
00000064:   t0 <- t0 + 1
00000068:   pc <- pc - 0x24
0000006c:   t1 <- t1 + 1 (COMPARE_CHARS)

-- DECISION --
# If v0 = 0, we found the module
# If v0 = 1, we didn't found the module
# v1 = SCEPAF_MODULE_START
# s0 = EGG_START + 0x20
# s3 = OFFSET_MODULE_NAME
# If we found it, go to MODULE_FOUND with s3 = SCEPAF_MODULE_START
00000070:   if v0 = 0 then pc <- pc + 0x20; s3 <- v1 (MODULE_FOUND)
# If not, SCEPAF_MODULE_START++
00000078:   v1 <- v1 + 1
0000007c:   if v1 < s0 then t0 <- 1, else t0 <- 0
# If we reach the egg, go to MODULE_FOUND with s3 = 0
00000080:   if t0 = 0 then pc <- pc + 0x10; s3 <- 0 (MODULE_FOUND)
# If we haven't found the module, try again with v1 + 1
00000088:   pc <- pc - 0x4c (MODULE_NOT_FOUND)


What I mean is, is it necessary to have it in the tiff file. Yes I can read. I readed the whole thing.
_________________
PSHN - Playstation Hacking Network
PSX/PS1 - HACK - Game Shark
PS2 - HACK - Swap
PSP - HACK - Pandora
PS3 - ?
Back to top
View user's profile Send private message AIM Address
m0skit0



Joined: 02 Jun 2009
Posts: 226
PostPosted: Wed Jun 24, 2009 1:09 am    Post subject: Reply with quote
Quote:
What I mean is, is it necessary to have it in the tiff file

¿? How would you use sceIoOpen() and the like without it?
_________________
The Incredible Bill Gates wrote:
The obvious mathematical breakthrough would be development of an easy way to factor large prime numbers.
Back to top
View user's profile Send private message
Dariusc123456



Joined: 12 Aug 2008
Posts: 394
PostPosted: Wed Jun 24, 2009 1:28 am    Post subject: Reply with quote
m0skit0 wrote:
Quote:
What I mean is, is it necessary to have it in the tiff file

¿? How would you use sceIoOpen() and the like without it?


Let me clear it up, What I mean is that after "ms0:/h.bin", there's I see in text "scePaf_Module". Does it have a purpose to have the "scePaf_Module" text in there? Does that text loads onto the psp memory also?
_________________
PSHN - Playstation Hacking Network
PSX/PS1 - HACK - Game Shark
PS2 - HACK - Swap
PSP - HACK - Pandora
PS3 - ?
Back to top
View user's profile Send private message AIM Address
Davee



Joined: 22 Jun 2009
Posts: 59
PostPosted: Wed Jun 24, 2009 2:48 am    Post subject: Reply with quote
Dariusc123456 wrote:
m0skit0 wrote:
Quote:
What I mean is, is it necessary to have it in the tiff file

¿? How would you use sceIoOpen() and the like without it?


Let me clear it up, What I mean is that after "ms0:/h.bin", there's I see in text "scePaf_Module". Does it have a purpose to have the "scePaf_Module" text in there? Does that text loads onto the psp memory also?


1) Yes! You really need to read the replies. "scePaf_Module" is used to find the module text_addr.

2) OBVIOUSLY! I thought this was a proper development forum?
Back to top
View user's profile Send private message
Dariusc123456



Joined: 12 Aug 2008
Posts: 394
PostPosted: Wed Jun 24, 2009 3:07 am    Post subject: Reply with quote
Davee wrote:
Dariusc123456 wrote:
m0skit0 wrote:
Quote:
What I mean is, is it necessary to have it in the tiff file

¿? How would you use sceIoOpen() and the like without it?


Let me clear it up, What I mean is that after "ms0:/h.bin", there's I see in text "scePaf_Module". Does it have a purpose to have the "scePaf_Module" text in there? Does that text loads onto the psp memory also?


1) Yes! You really need to read the replies. "scePaf_Module" is used to find the module text_addr.

2) OBVIOUSLY! I thought this was a proper development forum?


This is a development forum with questions.

I dont see the point of having it in there, but its understandable though. Thanks for all the answers
_________________
PSHN - Playstation Hacking Network
PSX/PS1 - HACK - Game Shark
PS2 - HACK - Swap
PSP - HACK - Pandora
PS3 - ?
Back to top
View user's profile Send private message AIM Address
sauron_le_noir



Joined: 05 Jul 2008
Posts: 229
PostPosted: Wed Jun 24, 2009 3:39 am    Post subject: Reply with quote
I'm a beginner in mips assembler and i have 2 questions to ask (sorry if this is noobs question for you but as said before i'm a asbolute beginner in mips)
1>
00000018: 04110001 bgezal $zero,0x20
0000001c: 00000000 nop

00000020: 03e08021 addu $s0,$ra,$zero

the begezal is a branch a link , the $zero contain zero
so you branch at instruction 0x20 of the begin of the module ??? and you got in RA or R31 what is
the difference in some mips manual they talk about ra as return address register in other they talk
about R31.
In other assembler language that i have study you branch relative of the program counter here
you branch from begin of the program am i right ?

With the addu you add the Return adresse (the address where the module is loaded) with zero so you have a absolute address where the module has been loaded in the memory.

the nop is i presume for the no operation for the time slot instruction of the bgezal
2 > What kind of program do you use to disassemble raw mips assembler ?

And you have done a great work many thx to share your knowledge with the community.
Back to top
View user's profile Send private message Send e-mail MSN Messenger
J.F.



Joined: 22 Feb 2004
Posts: 2906
PostPosted: Wed Jun 24, 2009 7:45 am    Post subject: Reply with quote
Davee wrote:

OBVIOUSLY! I thought this was a proper development forum?


Sorry, but we sometimes get noobs with visions of greatness and no skills here asking all sorts of questions they aren't prepared to understand. We try to be nice, but sometimes we just have to tell them to shut up and go away until they understand the basics. Seriously, we get people here that don't even know about name mangling in C++! Can you believe they think they're developers when they don't even know the simplest aspects of the language they want to write their app in??

We try to shunt them over to psp-programming until they learn some C/C++/MIPS assembly.

http://www.psp-programming.com/forums/
Back to top
View user's profile Send private message AIM Address
psPea



Joined: 01 Sep 2007
Posts: 64
PostPosted: Wed Jun 24, 2009 10:23 am    Post subject: Reply with quote
J.F. wrote:
We try to shunt them over to psp-programming until they learn some C/C++/MIPS assembly.
And we don't appreciate it.
_________________
Click ME!
Back to top
View user's profile Send private message Yahoo Messenger MSN Messenger
Dariusc123456



Joined: 12 Aug 2008
Posts: 394
PostPosted: Wed Jun 24, 2009 10:27 am    Post subject: Reply with quote
We dont appreciate it when noobs spam this forum.
_________________
PSHN - Playstation Hacking Network
PSX/PS1 - HACK - Game Shark
PS2 - HACK - Swap
PSP - HACK - Pandora
PS3 - ?
Back to top
View user's profile Send private message AIM Address
kralyk



Joined: 06 Apr 2008
Posts: 114
Location: Czech Republic, central EU
PostPosted: Wed Jun 24, 2009 10:43 am    Post subject: Reply with quote
Don't you think you're a bit overconfident there, calling others noobs, lol.
Because I wouldn't dare to...

(Damn, is "overconfident" even a word in english? I wish I was better at foreign languages...)
_________________
...sorry for my english...
Back to top
View user's profile Send private message
Dariusc123456



Joined: 12 Aug 2008
Posts: 394
PostPosted: Wed Jun 24, 2009 11:05 am    Post subject: Reply with quote
But I never said who was a noob, lol. But I dont really care what they say. ill help out the best I can.

Now how did this thread get off topic? We dont need any more off-topic conversations. Maybe a mod can lock this thread if it happens to much.
_________________
PSHN - Playstation Hacking Network
PSX/PS1 - HACK - Game Shark
PS2 - HACK - Swap
PSP - HACK - Pandora
PS3 - ?
Back to top
View user's profile Send private message AIM Address
J.F.



Joined: 22 Feb 2004
Posts: 2906
PostPosted: Wed Jun 24, 2009 12:23 pm    Post subject: Reply with quote
Dariusc123456 wrote:
Now how did this thread get off topic? We dont need any more off-topic conversations. Maybe a mod can lock this thread if it happens to much.


It got off topic when someone pointed you to the source code and your response made it clear you don't understand MIPS assembly language as well as you should to be working on the target of the topic. ;)
Back to top
View user's profile Send private message AIM Address
slasher2661996



Joined: 22 Feb 2009
Posts: 91
Location: Melbourne Australia ZOMG
PostPosted: Wed Jun 24, 2009 1:27 pm    Post subject: Reply with quote
No need to start a fight...
Back to top
View user's profile Send private message
J.F.



Joined: 22 Feb 2004
Posts: 2906
PostPosted: Wed Jun 24, 2009 1:29 pm    Post subject: Reply with quote
slasher2661996 wrote:
No need to start a fight...


I put a ;) at the end, so I should be fine. A fight would be putting a :P at the end. ;)

:D
Back to top
View user's profile Send private message AIM Address
m0skit0



Joined: 02 Jun 2009
Posts: 226
PostPosted: Wed Jun 24, 2009 6:11 pm    Post subject: Reply with quote
I sincerely don't like people who call others noobs, neither those superiority showoffs. We all had to learn once ago, right? So let's help others with what we know and stop talking nonsenses.

Dariusc123456 wrote:
I dont see the point of having it in there

How come? And how would you find scePaf module then?

sauron_le_noir wrote:
so you branch at instruction 0x20 of the begin of the module ???

Yep

sauron_le_noir wrote:
In other assembler language that i have study you branch relative of the program counter here you branch from begin of the program am i right ?

Nope, there's no way the CPU got to know where the start is. This is relative branching, too. Look at a MIPS assembly instruction reference.

sauron_le_noir wrote:
With the addu you add the Return adresse (the address where the module is loaded) with zero so you have a absolute address where the module has been loaded in the memory.

Yeah, that's one technique for getting the absolute address where a shellcode is loaded. The addu is just to copy the address into another register.

sauron_le_noir wrote:
the nop is i presume for the no operation for the time slot instruction of the bgezal

Yes. The delay slot, properly MIPS speaking xD

sauron_le_noir wrote:
What kind of program do you use to disassemble raw mips assembler ?

I guess you mean "disassemble MIPS machine code". No use disassembling assembler right? ;) Google MIPS disassembler and you'll get a ton...

sauron_le_noir wrote:
many thx to share your knowledge with the community.

Not all people like to share. Some are very closed code... anyway, each one is reponsible for his/her behaviour.
_________________
The Incredible Bill Gates wrote:
The obvious mathematical breakthrough would be development of an easy way to factor large prime numbers.
Back to top
View user's profile Send private message
sauron_le_noir



Joined: 05 Jul 2008
Posts: 229
PostPosted: Thu Jun 25, 2009 7:39 am    Post subject: Reply with quote
Thx i have just installed yams on my linux box to learn basic mips assembler.
I have choosen yams because for programming him you need to cross compile gcc like the toolchain of psp. So i use the gnu as to assemble my program
And yes i'm a debutant in mips assembler programming.
Back to top
View user's profile Send private message Send e-mail MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    forums.ps2dev.org Forum Index -> PSP Development All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group