forums.ps2dev.org

pdc · Posted: Sat Mar 26, 2005 10:05 am Post subject: Very odd PBP quirk

OK so it's not as useful as having cracked the encryption but...

I've been looking at the PBP file tonight, looking at the structure, manually extracting, adding files, etc.
(It's been a long time since I've been into anything technical so I'm enjoying this opportunity to get tinkering and learning again!)

I decided to try messing with the PNG within the PBP.
(This is the preview display picture for the update)
Trying things like removing the IEND tag and duplicating the IHDR tag.
One attempt had a very strange outcome....

The preview does not render the PNG. I must assume it can't.
However, the PSP does not give up;
Rather, it grabs JPEGs from /PSP/PHOTO/ and displays a jumble of those instead, in a strange collage with transparency dividing the squashed JPEGs!
Stranger still, this 'new' preview pic is different when highlighted/unhighlighted if there is more than 1 bootable item on the mem stick and if you have too many JPEGs, the pictures may 'spill' onto the next preview item!

Why the PNG is replaced by a bunch of JPEGs, I don't know...!
It's about the oddest thing I've seen yet though.

I thought it was strange enough to share with you :)

http://pdc.me.uk/psp/odd_pbp/
for the curious.

Also, this is anything but secure - whatever it is trying to do!

Guest · Posted: Sat Mar 26, 2005 12:50 pm Post subject:

I vote this being the coolest psp bug/quirk found so far. ;)

pdc · Posted: Sat Mar 26, 2005 6:52 pm Post subject:

Guest · Posted: Sat Mar 26, 2005 7:10 pm Post subject:

I am told I am good at theories. ;)

I think you said you removed some marker for the end of the image ? I wonder if the PSP uses such low level read routines that they do not pay any attention to any "end of file" marker, and keep on reading into the next contiguous area of data on the memory stick, which naturally could include other files ? Just one possibility, but very cool indeed.

Agntneo · Joined: 02 Mar 2005 Posts: 17

This is very interesting, why the hell would it suddenly start grabbing JPEG images from PSP/Photos?

Very interesting ,yes this is probably the biggest flaw we've found yet.
I think I will fool a bit around with this myself and see what outcome I get.

Thanks :)

Awhite · Joined: 23 Feb 2005 Posts: 55

Lol that the coolest bug :P

Hey try to remove some of the hex code inside of the PBP file, beause it's not needed if you want to play around only with the PNG file.For god's shake 13mbs are 13mbs :P

You can take a look at my Monkey island "loader" it's only 128kb :P
_________________
Ioannis KarAvas

pdc · Posted: Sat Mar 26, 2005 9:45 pm Post subject:

pdc · Posted: Sun Mar 27, 2005 3:51 am Post subject:

OK, I can confirm that the picture is not a mix from /PSP/PHOTO/
(let's face it, this seemed far too random)
but it is actually being read directly from the PSP's memory.

I imagine the update preview pic is reading from memory where the PNG decoder should have put the icon. Only the PNG decoder did not successfully decode.

The transparent parts must be non-image data in memory.

Also, after playing Ridge Racers, the preview pic reads RR game data.

Edit: Now if we could only get this as a text/data output, it would be quite something!!
Perhaps we need to wait for the PSP web-browser then maybe we can save this data? I can't think how else to retrieve the data at this time.

florinsasu · Joined: 15 Dec 2004 Posts: 47

pdc · Posted: Sun Mar 27, 2005 9:46 am Post subject:

florinsasu · Joined: 15 Dec 2004 Posts: 47

anyway, nice work pdc :)
i'm sure that are more bugz and eploits... ready to be discovered.
it's quite hard to protect perfectly such a device. with code written by various ppl and even with external library code.
and, those programmers from sony are not any genius, i can tell you that ;)

Shine · Joined: 03 Dec 2004 Posts: 728 Location: Germany

Fluff · Joined: 22 Apr 2005 Posts: 35

i was messing around with this idea, what i did was move the png header further down the file, and change the content of the png leading up to the new header location, to 00
and now the file has a very specific icon which sort of reminds me of the 1.5 update icon, possibly using a 'default' icon from the psp itself for pbp's that dont have a specific icon image?

anyway heres what it looked like

ChaosKnight · Joined: 14 Apr 2005 Posts: 142 Location: Florida, USA

I seem to remember someone else having a similar experiance on this board. If memory serves it has to do with the PSP not really validating the the offsets for files in the PBP. Therefore you can do all sorts of fun things like display text in memory or display other graphics which are residing in the graphic memory.

Fun trick though, I've never done it myself, so it's nice to see some screenshots.
_________________
w00t

pdc · Posted: Fri Apr 22, 2005 8:30 pm Post subject:

@Fluff - that 'default' image just means the PNG was detected to be invalid or missing.

@ChaosKnight, I suspect you are referring to http://forums.ps2dev.org/viewtopic.php?t=1326

Fluff · Joined: 22 Apr 2005 Posts: 35

th0mas · Joined: 24 Apr 2005 Posts: 43 Location: Canada

Hi. I'm new here.

Anyways.. just thought I'd share a brainstorm I had while reading this..

does the wipeout browser react the same to malformed PNGs as does the modified PBP file?

(ie, can we inference they're running the same PNG loading library?)
_________________
http://th0mas.xbox-scene.com

pdc · Posted: Sun Apr 24, 2005 4:43 am Post subject:

th0mas · Joined: 24 Apr 2005 Posts: 43 Location: Canada

ah, so someone forgot to check the PNG decompression call for success and assumed their buffer got filled. interesting.
_________________
http://th0mas.xbox-scene.com