PS2 OpenTuna - An open source version of "Fortuna", based on reverse engineering! v2.0.1

[blckbear_]

OpenTuna v1.0.2 uses 0x20C020C0 as return address, 0x20B020B0 is for v1.0.1 which is no longer used in sources just in documentation. So, stick to 0x20C020C0.



Nice, I've got that one too.



That's the tricky part, sorry I'm not automatize it. Anyway, if you want, send me icon.icn and I'll give some tips about how to tune it. Be sure payload-packed.elf properly works before trying to tune icon.

Great, I tested payload.elf and it works (never thought about trying that lol).

Now I'll make a new icon.icn and send it to you via PM (so I don't clutter the thread with non-working icons)

Edit: Uploads are not allowed in PMs, I'll upload here

 

[blckbear_]

Here's my icon, it was made with the launcher-keys option and the changes I made are that it loads wLE from /BOOT/BOOT.ELF and it loads OPL from /OPL/OPNPS2LD.ELF

 

[alexparrado]

Here's my icon, it was made with the launcher-keys option and the changes I made are that it loads wLE from /BOOT/BOOT.ELF and it loads OPL from /OPL/OPNPS2LD.ELF

There's something really bad with your icon because it doesn't even work in emulator. Did you adjust exploit Makefile with

KERNEL_NOPATCH = 1
NEWLIB_NANO = 1

and main.c in launcher-keys with

void _ps2sdk_libc_init() {}
void _ps2sdk_libc_deinit() {}

 

[blckbear_]

There's something really bad with your icon because it doesn't even work in emulator. Did you adjust exploit Makefile with

KERNEL_NOPATCH = 1
NEWLIB_NANO = 1

and main.c in launcher-keys with

void _ps2sdk_libc_init() {}
void _ps2sdk_libc_deinit() {}

Yes, I did.
Now what I'm trying is adding:
KERNEL_NOPATCH = 1
NEWLIB_NANO = 1

to the launcher-keys makefile, the icon.icn is now 30kb in size and the payload-packed.elf works fine. I'll try this and see if it works.

Edit: with this one I'm getting a black screen (I guess its progress )

 

[alexparrado]

KERNEL_NOPATCH = 1
NEWLIB_NANO = 1

to the launcher-keys makefile,

That will lead to linker errors. Just use void _ps2sdk_libc_init() {} void _ps2sdk_libc_deinit() {} in launcher-keys. Veriffy payload-stripped.elf in exploit folder has 0x20c020c0 as load address by using readelf -h command.

 

[alexparrado]

Yes, I did.
Now what I'm trying is adding:
KERNEL_NOPATCH = 1
NEWLIB_NANO = 1

to the launcher-keys makefile, the icon.icn is now 30kb in size and the payload-packed.elf works fine. I'll try this and see if it works.

Edit: with this one I'm getting a black screen (I guess its progress )

That's what I'm getting in emulator. Could you share source to make a quick revision?

 

[blckbear_]

That will lead to linker errors. Just use void _ps2sdk_libc_init() {} void _ps2sdk_libc_deinit() {} in launcher-keys. Veriffy payload-stripped.elf in exploit folder has 0x20c020c0 as load address by using readelf -h command.

payload-stripped.elf with the changes you suggested:

That's what I'm getting in emulator. Could you share source to make a quick revision?

After changing the icon.icn address to 0x20C020C0 the PS2 freezes when I open the Memory card, so I guess that's not gonna work. After removing those flags from the makfile and only using the dummy functions, the payload .bin is around 35kb.
Latest sources attached.

Edit: I'm using OpenTunaRLE to create the icon.icn file btw, and if I'm not mistaken it creates it with address 0x20B020B0 instead of 0X20C020C0, correct me if I'm wrong

 

[alexparrado]

After changing the icon.icn address to 0x20C020C0 the PS2 freezes when I opne the Memory card, so I guess that's not gonna work.

Actually a frozen console is not that bad, it's just matter of tuning those repetitions.

Latest sources attached.

I'll check.

 

[blckbear_]

Actually a frozen console is not that bad, it's just matter of tuning those repetitions.

Just to be clear, the frozen console happened when I compiled using
KERNEL_NOPATCH = 1
NEWLIB_NANO = 1

in the launcher-keys makefile, but if it may cause issues I'm not gonna compile that way.

I'll check.

Thanks!

 

[alexparrado]

@blckbear_ , please generate your icon by using this resource files for Opentuna-RLE. I completely forgot to update them for OpenTuna v1.0.2.

 

[alexparrado]

Just to be clear, the frozen console happened when I compiled using
KERNEL_NOPATCH = 1
NEWLIB_NANO = 1

in the launcher-keys makefile, but if it may cause issues I'm not gonna compile that way.


Thanks!

Code seems Ok, I compiled and it works in emulator. Just realized you are using wrong resource files in OpenTuna-RLE, so replace them with the ones in above post. Send me the icon if exploit properly boots in emulator we can start icon tuning stage.

 

[blckbear_]

Code seems Ok, I compiled and it works in emulator. Just realized you are using wrong resource files in OpenTuna-RLE, so replace them with the ones in above post. Send me the icon if exploit properly boots in emulator we can start icon tuning stage.

Ok, icon attached below.

I tried this icon in the console and the corrupted data icon is a blue cube, when going back MC icon disappears but then it returns to OSDSYS instead of launching the exploit.

 

[alexparrado]

Could you please use, the included ps2_packer.exe to create a smaller payload.bin. With that packer, payload.bin size can go down to 22.8 kb.

Edit: if payload.bin goes beyond certain size, I have to adjust opentuna-tail.bin, so please use ps2_packer.exe.

 

[blckbear_]

Ok, I'll use the included one, lemme try and I'll update here in a few minutes as I'll need to install wine

 

[blckbear_]

Icon made with the included ps2_packer.exe, still not working on console, icon is a blue cube and console just goeas back to OSDSYS instead of launching exploit.

 

[alexparrado]

Icon made with the included ps2_packer.exe, still not working on console, icon is a blue cube and console just goeas back to OSDSYS instead of launching exploit.

I'm sorry, my bad again, I definitely need to update OpenTuna-RLE as well. Please use this instead, so sorry.

 

[blckbear_]

Well, after compiling OpenTunaRLE and making the new icon, it now gets stuck when loading the MC in browser, I'll attach icon below.

 

[alexparrado]

Well, after compiling OpenTunaRLE and making the new icon, it now gets stuck when loading the MC in browser, I'll attach icon below.View attachment 34876

Ok, it works in emulator. This is the one to tune, taking into account it's freezing the console, you need to reduce return address repetitions, so replace values from offset 0x5c00 (no insert) 16 77 c0 20 with 00 00 00 00 . Let me know the result.

 

[blckbear_]

Replaced them with zeroes, same result, gets stuck when loading MC

 

[alexparrado]

Replaced them with zeroes, same result, gets stuck when loading MC

Ok, now halve word at offset 5BE9 from F0 7F to F8 3F.