forums.ps2dev.org

[VeggieGames]

I was playing with the .SFO files and noticed that they do not do range checking on the offsets for the variable values. If you set the offset for the TITLE variable to a number beyond the end of the file it will display whatever is in memory at that address on the screen in the game browser (as a null-terminated string). If the memory access causes a fault the system will power off (no harm done).

I don't know how useful this will prove as it displays a maximum of 20 characters and there is no address consistency as the addresses you enter are offsets from wherever in memory the data happened to be loaded. It might be good for some memory sniffing though.

The specific place in EBOOT.PBP that you would change is the 4 bytes at position 0x98 (the original value is 0x00000018, change it to anything). To make the PBP file a more managable size for this purpose you can crop it at offset 0x3251 (where it says "~PSP"... don't need the executable because it won't be executed). Put the file on the PSP memory card in \PSP\GAME\UPDATE, then go to Game -> Memory Stick in the PSP menu and press X. Right there as the title you will see the memory contents... if there is no title that means the data at that address is zero.

[ooPo]

Hey, that's kinda nifty. Good find. :)

[charlie]

Hello. I'm fairly new to these boards, and to reverse engineering. Reading Hacking the Xbox and browsing these forums to learn. From what I have gathered, the firmware update is downloaded to MS, where it is decrypted and put into memory to be run when the actual flashing takes place, right? Then with this memory sniffing technique, couldn't one or maybe a lot of people collaborate together to piece together the program that updates the firmware while it is in RAM?

[TerryMathews]

If someone can make this hack read out the contents of the memory @ address 0, we might be able to start disassembling forward...

[Shine]

[XenuPSP]

[mrbrown]

[nanoscopic]

I fiddled around with this... and it is interesting but not really useful, because the PSP does not render much of the characters. Most characters aren't even show at all. (as stated by Darkfader in chat)(also a problem that should be obvious)

So, I figured I would try to map out what bytes ARE mapped to something. In the process of doing that I noticed something sort of interesting... there is in fact an 'escape' character. Well, there seem to be too. Both 0xE2 and 0xE3 both seem to be escape characters to map to ?unicode?. That is how the TM characters is created as well as the japanese letters.

What I don't understand is why the system only reads in 20 characters. Looking at the file, it is clear about 60 or so bytes or provided for each language...

I also realized you can make as many folders under the game folder as you want, named whatever, and they will all list in the psp. Anyways; that is my two bits for now.

[mc]

[nanoscopic]

Ok, so I didn't RTFM on UTF.... whatever.